update APIs 20260712

2 files changed, 17488 insertions, 25314 deletions

diff --git a/data/en_us/cloud-siem/2022-06-16/api-docs.php b/data/en_us/cloud-siem/2022-06-16/api-docs.php
index 3739556..d680c6a 100644
--- a/data/en_us/cloud-siem/2022-06-16/api-docs.php
+++ b/data/en_us/cloud-siem/2022-06-16/api-docs.php
@@ -1,855 +1,416 @@
 <?php return [
     'version' => '1.0',
-    'info' => [
-        'style' => 'RPC',
-        'product' => 'cloud-siem',
-        'version' => '2022-06-16',
-    ],
+    'info' => ['style' => 'RPC', 'product' => 'cloud-siem', 'version' => '2022-06-16'],
     'directories' => [
         [
-            'id' => 187571,
-            'title' => 'Multi-account Management',
+            'children' => ['ListRdUsers'],
             'type' => 'directory',
+            'title' => 'Multi-account management',
+        ],
+        [
             'children' => [
-                'ListRdUsers',
+                'ListAccountsByLog', 'DescribeUserBuyStatus', 'ListProjectLogStores', 'ModifyDataSource', 'ModifyDataSourceLog', 'ModifyBindAccount', 'ListImportedLogsByProd', 'ListDataSourceTypes', 'ListDataSourceLogs', 'ListBindDataSources', 'ListAllProds', 'EnableServiceForCloudSiem', 'EnableAccessForCloudSiem', 'DescribeServiceStatus', 'DescribeProdCount', 'DescribeImportedLogCount', 'DescribeDataSourceParameters', 'DescribeDataSourceInstance', 'DescribeAuth', 'DeleteBindAccount',
+                'BindAccount', 'AddUserSourceLogConfig', 'AddDataSourceLog', 'ListBindAccount', 'ListAccountAccessId', 'SubmitImportLogTasks',
             ],
+            'type' => 'directory',
+            'title' => 'Log access',
         ],
         [
-            'id' => 187473,
-            'title' => 'Log Management',
+            'children' => ['DescribeAlertsWithEntity', 'DescribeAlerts', 'DescribeAlertSource', 'DescribeAlertsCount'],
             'type' => 'directory',
-            'children' => [
-                'ListAccountsByLog',
-                'DescribeUserBuyStatus',
-                'ListProjectLogStores',
-                'ModifyDataSource',
-                'ModifyDataSourceLog',
-                'ModifyBindAccount',
-                'ListImportedLogsByProd',
-                'ListDataSourceTypes',
-                'ListDataSourceLogs',
-                'ListBindDataSources',
-                'ListAllProds',
-                'EnableServiceForCloudSiem',
-                'EnableAccessForCloudSiem',
-                'DescribeServiceStatus',
-                'DescribeProdCount',
-                'DescribeImportedLogCount',
-                'DescribeDataSourceParameters',
-                'DescribeDataSourceInstance',
-                'DescribeAuth',
-                'DeleteDataSourceLog',
-                'DeleteDataSource',
-                'DeleteBindAccount',
-                'BindAccount',
-                'AddUserSourceLogConfig',
-                'AddDataSourceLog',
-                'AddDataSource',
-                'ListBindAccount',
-                'ListAccountAccessId',
-                'SubmitImportLogTasks',
-            ],
+            'title' => 'Security alerts',
         ],
         [
-            'id' => 186523,
-            'title' => 'Alert Monitoring',
+            'children' => ['ListEntities', 'DescribeEntityInfo', 'PostEventDisposeAndWhiteruleList', 'DescribeWafScope', 'DescribeEventDispose', 'DescribeEventCountByThreatLevel', 'DescribeDisposeAndPlaybook', 'DescribeCloudSiemEvents', 'DescribeCloudSiemEventDetail', 'DescribeCloudSiemAssetsCounter', 'DescribeCloudSiemAssets', 'DescribeAlertsWithEvent', 'DescribeAlertSourceWithEvent'],
             'type' => 'directory',
-            'children' => [
-                'DescribeAlertsWithEntity',
-                'DescribeAlerts',
-                'DescribeAlertSource',
-                'DescribeAlertsCount',
-            ],
+            'title' => 'Event handling',
         ],
         [
-            'id' => 186560,
-            'title' => 'Event Response',
+            'children' => ['DescribeAlertType', 'DeleteCustomizeRule', 'DescribeAggregateFunction', 'DescribeCustomizeRuleCount', 'DescribeCustomizeRuleTest', 'DescribeCustomizeRuleTestHistogram', 'DescribeLogFields', 'DescribeLogSource', 'DescribeLogType', 'DescribeOperators', 'ListCloudSiemCustomizeRules', 'ListCloudSiemPredefinedRules', 'ListCustomizeRuleTestResult', 'PostCustomizeRule', 'PostCustomizeRuleTest', 'PostFinishCustomizeRuleTest', 'PostRuleStatusChange'],
             'type' => 'directory',
-            'children' => [
-                'ListEntities',
-                'DescribeEntityInfo',
-                'PostEventDisposeAndWhiteruleList',
-                'DescribeWafScope',
-                'DescribeEventDispose',
-                'DescribeEventCountByThreatLevel',
-                'DescribeDisposeAndPlaybook',
-                'DescribeCloudSiemEvents',
-                'DescribeCloudSiemEventDetail',
-                'DescribeCloudSiemAssetsCounter',
-                'DescribeCloudSiemAssets',
-                'DescribeAlertsWithEvent',
-                'DescribeAlertSourceWithEvent',
-            ],
+            'title' => 'Rule management',
         ],
         [
-            'id' => 186542,
-            'title' => 'Rule Management',
+            'children' => ['DescribeScopeUsers', 'DeleteAutomateResponseConfig', 'DescribeAutomateResponseConfigCounter', 'DescribeAutomateResponseConfigFeature', 'ListAutomateResponseConfigs', 'PostAutomateResponseConfig', 'UpdateAutomateResponseConfigStatus'],
             'type' => 'directory',
-            'children' => [
-                'DescribeAlertType',
-                'DeleteCustomizeRule',
-                'DescribeAggregateFunction',
-                'DescribeCustomizeRuleCount',
-                'DescribeCustomizeRuleTest',
-                'DescribeCustomizeRuleTestHistogram',
-                'DescribeLogFields',
-                'DescribeLogSource',
-                'DescribeLogType',
-                'DescribeOperators',
-                'ListCloudSiemCustomizeRules',
-                'ListCloudSiemPredefinedRules',
-                'ListCustomizeRuleTestResult',
-                'PostCustomizeRule',
-                'PostCustomizeRuleTest',
-                'PostFinishCustomizeRuleTest',
-                'PostRuleStatusChange',
-            ],
+            'title' => 'Response rules',
         ],
         [
-            'id' => 186597,
-            'title' => 'Response Rules Management',
+            'children' => ['ListDisposeStrategy', 'DescribeDisposeStrategyPlaybook'],
             'type' => 'directory',
-            'children' => [
-                'DescribeScopeUsers',
-                'DeleteAutomateResponseConfig',
-                'DescribeAutomateResponseConfigCounter',
-                'DescribeAutomateResponseConfigFeature',
-                'ListAutomateResponseConfigs',
-                'PostAutomateResponseConfig',
-                'UpdateAutomateResponseConfigStatus',
-            ],
+            'title' => 'Handling center',
         ],
         [
-            'id' => 186605,
-            'title' => 'Disposal Center',
+            'children' => ['RestoreCapacity', 'GetCapacity', 'SetStorage', 'DescribeStorage', 'GetStorage'],
             'type' => 'directory',
-            'children' => [
-                'ListDisposeStrategy',
-                'DescribeDisposeStrategyPlaybook',
-            ],
+            'title' => 'Storage management',
         ],
         [
-            'id' => 186147,
-            'title' => 'Storage Management',
+            'children' => ['ListDelivery', 'OpenDelivery', 'CloseDelivery'],
             'type' => 'directory',
-            'children' => [
-                'RestoreCapacity',
-                'GetCapacity',
-                'SetStorage',
-                'DescribeStorage',
-                'GetStorage',
-            ],
+            'title' => 'Delivery management',
         ],
         [
-            'id' => 186161,
-            'title' => 'Delivery Management',
+            'children' => ['UpdateWhiteRuleList', 'PostEventWhiteruleList', 'DescribeWhiteRuleList', 'DescribeAlertScene', 'DescribeAlertSceneByEvent', 'DeleteWhiteRuleList'],
             'type' => 'directory',
-            'children' => [
-                'ListDelivery',
-                'OpenDelivery',
-                'CloseDelivery',
-            ],
+            'title' => 'Alert whitelisting',
         ],
         [
-            'id' => 186608,
-            'title' => 'White Rule Management',
+            'children' => ['AddDataSource', 'DeleteDataSource', 'DeleteDataSourceLog', 'GetEntitiyStat'],
+            'title' => 'Others',
             'type' => 'directory',
-            'children' => [
-                'UpdateWhiteRuleList',
-                'PostEventWhiteruleList',
-                'DescribeWhiteRuleList',
-                'DescribeAlertScene',
-                'DescribeAlertSceneByEvent',
-                'DeleteWhiteRuleList',
-            ],
         ],
     ],
     'components' => [
         'schemas' => [],
     ],
     'apis' => [
-        'ListRdUsers' => [
-            'summary' => 'Queries a list of Alibaba Cloud accounts that are added to the threat analysis feature for centralized management. These accounts can be used to perform operations supported by the threat analysis feature, such as adding logs and handling events.',
-            'methods' => [
-                'get',
-                'post',
-            ],
-            'schemes' => [
-                'http',
-                'https',
-            ],
+        'AddDataSource' => [
+            'summary' => 'Adds a data source to an attached multicloud account.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'read',
+            'operationType' => 'write',
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'list',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-                'abilityTreeCode' => '154081',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
-            ],
+            'systemTags' => ['operationType' => 'create', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
-                    'name' => 'RegionId',
+                    'name' => 'AccountId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
-                ],
-            ],
-            'responses' => [
-                200 => [
-                    'schema' => [
-                        'title' => 'CloudSiemSuccessResponse<List<ListRdUsersResult>>',
-                        'description' => 'CloudSiemSuccessResponse\\<List>'."\n",
-                        'type' => 'object',
-                        'properties' => [
-                            'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'array',
-                                'items' => [
-                                    'description' => '',
-                                    'type' => 'object',
-                                    'properties' => [
-                                        'Joined' => [
-                                            'title' => '日志code。',
-                                            'description' => 'Indicates whether the account is added to the threat analysis feature for centralized management. Valid values:'."\n"
-                                                ."\n"
-                                                .'*   true'."\n"
-                                                .'*   false'."\n",
-                                            'type' => 'boolean',
-                                            'example' => 'true',
-                                        ],
-                                        'JoinedTime' => [
-                                            'description' => 'The time when the account was added to the threat analysis feature.'."\n",
-                                            'type' => 'string',
-                                            'example' => '2013-10-01 00:00:00',
-                                        ],
-                                        'DelegatedOrNot' => [
-                                            'title' => '是否被委派查看自己的资源',
-                                            'description' => 'Indicates whether the account can be used to view the logs and alerts within the account.'."\n",
-                                            'type' => 'boolean',
-                                            'example' => 'true',
-                                        ],
-                                        'MainUserId' => [
-                                            'title' => '购买威胁分析的云账号ID。',
-                                            'description' => 'The ID of the Alibaba Cloud account that is used to purchase the threat analysis feature.'."\n",
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '123XXXXXXXXX',
-                                        ],
-                                        'SubUserId' => [
-                                            'title' => '威胁分析云账号ID。',
-                                            'description' => 'The ID of the Alibaba Cloud account that is used to perform operations supported by the threat analysis feature.'."\n",
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '123XXXXXXXX',
-                                        ],
-                                        'SubUserName' => [
-                                            'title' => '威胁分析云账号名字。',
-                                            'description' => 'The username of the Alibaba Cloud account that can be used to perform operations supported by the threat analysis feature.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'sas_account_xxx',
-                                        ],
-                                    ],
-                                ],
-                            ],
-                            'RequestId' => [
-                                'title' => '请求消息ID。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****',
-                            ],
-                        ],
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account.', 'type' => 'string', 'required' => false, 'example' => '123xxxxxxxx'],
                 ],
-            ],
-            'errorCodes' => [
-                500 => [
-                    [
-                        'errorCode' => 'InternalError',
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                    ],
-                ],
-            ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"Joined\\": true,\\n      \\"JoinedTime\\": \\"2013-10-01 00:00:00\\",\\n      \\"DelegatedOrNot\\": true,\\n      \\"MainUserId\\": 0,\\n      \\"SubUserId\\": 0,\\n      \\"SubUserName\\": \\"sas_account_xxx\\"\\n    }\\n  ],\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
-            'title' => 'ListRdUsers',
-        ],
-        'ListAccountsByLog' => [
-            'summary' => 'Query accounts by log.',
-            'methods' => [
-                'get',
-                'post',
-            ],
-            'schemes' => [
-                'http',
-                'https',
-            ],
-            'security' => [
                 [
-                    'AK' => [],
+                    'name' => 'DataSourceType',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The type of the data source. Valid values:'."\n"
+                        ."\n"
+                        .'- obs: Huawei Cloud Object Storage Service (OBS).'."\n"
+                        ."\n"
+                        .'- wafApi: Tencent Cloud Web Application Firewall (WAF) download API.'."\n"
+                        ."\n"
+                        .'- ckafka: Tencent Cloud CKafka.', 'type' => 'string', 'required' => false, 'example' => 'obs'],
                 ],
-            ],
-            'operationType' => 'read',
-            'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'list',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-                'abilityTreeCode' => '196080',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
+                [
+                    'name' => 'DataSourceInstanceName',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The name of the data source.', 'type' => 'string', 'required' => false, 'example' => 'XX-Beijing-Kafka'],
                 ],
-            ],
-            'parameters' => [
                 [
-                    'name' => 'ProdCode',
+                    'name' => 'DataSourceInstanceRemark',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '产品的code。',
-                        'description' => 'The code of the service.'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'qcloud_waf',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The remarks on the data source.', 'type' => 'string', 'required' => false, 'example' => 'XX Cloud Firewall Shanghai instance'],
                 ],
                 [
-                    'name' => 'LogCodes',
+                    'name' => 'DataSourceInstanceParams',
                     'in' => 'formData',
-                    'style' => 'repeatList',
-                    'schema' => [
-                        'title' => '日志code列表，json数组格式。',
-                        'description' => 'The codes of logs. The value is a JSON array.'."\n",
-                        'type' => 'array',
-                        'items' => [
-                            'description' => 'The code of the log. The value is a JSON array.'."\n",
-                            'type' => 'string',
-                            'required' => false,
-                            'example' => '["cloud_siem_hcloud_waf_alert_log"]',
-                        ],
-                        'required' => true,
-                        'example' => '["cloud_siem_hcloud_waf_alert_log"]',
-                        'maxItems' => 100,
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The parameters for the data source. The value must be a JSON array.', 'type' => 'string', 'required' => false, 'example' => '[{"paraCode":"region_code","paraValue":"ap-guangzhou"}]'],
                 ],
                 [
                     'name' => 'CloudCode',
                     'in' => 'formData',
                     'schema' => [
-                        'title' => '多云的code。取值：'."\n"
-                            .' - hcloud：华为云。'."\n"
-                            .' - qcloud：腾讯云。 '."\n"
-                            .' - aliyun：阿里云。',
-                        'description' => 'The code that is used for multi-cloud environments.'."\n",
+                        'title' => '',
+                        'description' => 'The code for the multicloud service.',
                         'type' => 'string',
                         'required' => true,
+                        'enum' => ['qcloud', 'hcloud', 'aliyun'],
                         'example' => 'hcloud',
-                        'enum' => [
-                            'qcloud',
-                            'hcloud',
-                            'aliyun',
-                        ],
-                    ],
-                ],
-                [
-                    'name' => 'RoleType',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
-                ],
-                [
-                    'name' => 'RoleFor',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
                     ],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The data management center of the threat analysis feature. Specify this parameter based on the region where your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions inside China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region of the data management center for threat analysis. Select a region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: For assets in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: For assets in regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'CloudSiemSuccessResponse<List<ListAccountsByLogResult>>',
-                        'description' => 'CloudSiemSuccessResponse\\<List>'."\n",
+                        'title' => 'CloudSiemSuccessResponse<AddDataSourceResult>',
+                        'description' => 'CloudSiemSuccessResponse',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'array',
-                                'items' => [
-                                    'description' => '',
-                                    'type' => 'object',
-                                    'properties' => [
-                                        'SubUserId' => [
-                                            'title' => '威胁分析云账号ID。',
-                                            'description' => 'The ID of the Alibaba Cloud account for which the threat analysis feature is enabled.'."\n",
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '123XXXXXXXX',
-                                        ],
-                                        'MainUserId' => [
-                                            'title' => '购买威胁分析的云账号ID。',
-                                            'description' => 'The ID of the Alibaba Cloud account that is used to purchase the threat analysis feature.'."\n",
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '123XXXXXXXXX',
-                                        ],
-                                        'AccountId' => [
-                                            'title' => '云账号ID。',
-                                            'description' => 'The ID of the cloud account.'."\n",
-                                            'type' => 'string',
-                                            'example' => '123xxxxxxx',
-                                        ],
-                                        'AccountName' => [
-                                            'title' => '云账号名称。',
-                                            'description' => 'The name of the cloud account.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'sas_account_xxx',
-                                        ],
-                                        'Imported' => [
-                                            'title' => '该账号是否已经接入。取值：'."\n"
-                                                .' -1：已接入。'."\n"
-                                                .' -0：未接入。',
-                                            'description' => 'Indicates whether the account is added. Valid values: -1: yes -0: no'."\n",
-                                            'type' => 'integer',
-                                            'format' => 'int32',
-                                            'example' => '123xxxxxxx',
-                                        ],
-                                        'LogCode' => [
-                                            'title' => '日志code。',
-                                            'description' => 'The code of the log.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'cloud_siem_waf_xxxxx',
-                                        ],
-                                        'ProdCode' => [
-                                            'title' => '日志对应的产品code。',
-                                            'description' => 'The code of the service.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'qcloud_waf',
-                                        ],
-                                    ],
+                                'title' => '',
+                                'description' => 'The data returned.',
+                                'type' => 'object',
+                                'properties' => [
+                                    'Count' => ['title' => '', 'description' => 'The number of data sources that were added. A value of 1 indicates success. A value of 0 or less indicates failure.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'],
+                                    'DataSourceInstanceId' => ['title' => '', 'description' => 'The ID of the data source. The threat analysis feature generates the ID by calculating an MD5 hash of the parameter values.', 'type' => 'string', 'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea'],
                                 ],
+                                'example' => '',
                             ],
-                            'RequestId' => [
-                                'title' => '请求消息ID。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****',
-                            ],
+                            'RequestId' => ['title' => '', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorCode' => 'InternalError',
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                    ],
+                    ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"SubUserId\\": 0,\\n      \\"MainUserId\\": 0,\\n      \\"AccountId\\": \\"123xxxxxxx\\",\\n      \\"AccountName\\": \\"sas_account_xxx\\",\\n      \\"Imported\\": 0,\\n      \\"LogCode\\": \\"cloud_siem_waf_xxxxx\\",\\n      \\"ProdCode\\": \\"qcloud_waf\\"\\n    }\\n  ],\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
-            'title' => 'ListAccountsByLog',
-        ],
-        'DescribeUserBuyStatus' => [
-            'summary' => 'Checks whether the current Alibaba Cloud account or the management account of a resource directory is used to purchase the threat analysis feature.',
-            'methods' => [
-                'get',
-                'post',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"Count\\": 1,\\n    \\"DataSourceInstanceId\\": \\"220ba97c9d1fdb0b9c7e8c7ca328d7ea\\"\\n  },\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+            'title' => 'AddDataSource',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'AddDataSource'],
+                ],
             ],
-            'schemes' => [
-                'http',
-                'https',
+            'ramActions' => [
+                [
+                    'operationType' => 'create',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:AddDataSource',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'translator' => 'machine',
+        ],
+        'AddDataSourceLog' => [
+            'summary' => 'Adds a log for a data source.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'read',
+            'operationType' => 'write',
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'get',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-                'abilityTreeCode' => '157646',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
-            ],
+            'systemTags' => ['operationType' => 'create', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
-                    'name' => 'SubUserId',
+                    'name' => 'LogCode',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '阿里云账号',
-                        'description' => 'The ID of the Alibaba Cloud account.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '123XXXXXX',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The code of the log.', 'type' => 'string', 'required' => false, 'example' => 'cloud_siem_waf_xxxxx'],
                 ],
                 [
-                    'name' => 'RegionId',
+                    'name' => 'DataSourceInstanceId',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The ID of the data source. Threat Analysis calculates this ID as an MD5 hash value based on specific parameters. To obtain the data source ID, call the [ListDataSourceLogs](https://api.aliyun-inc.com/#/publishment/document/cloud-siem/863fdf54478f4cc5877e27c2a5fe9e44?tenantUuid=f382fccd88b94c5c8c864def6815b854\\&activeTabKey=api%7CListDataSourceLogs) operation.', 'type' => 'string', 'required' => true, 'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea'],
+                ],
+                [
+                    'name' => 'DataSourceInstanceLogs',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The details of the data source parameters. The value must be a JSON array.', 'type' => 'string', 'required' => true, 'example' => '[{"LogCode":"cloud_siem_qcloud_waf_alert_log","LogParas":"[{\\"ParaCode\\":\\"api_name\\",\\"ParaValue\\":\\"GetAttackDownloadRecords\\"}]"}]'],
+                ],
+                [
+                    'name' => 'AccountId',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account.', 'type' => 'string', 'required' => true, 'example' => '123xxxxxxx'],
+                ],
+                [
+                    'name' => 'CloudCode',
                     'in' => 'formData',
                     'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
+                        'title' => '',
+                        'description' => 'The code for the multicloud environment. Valid values:'."\n"
                             ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
+                            .'- qcloud: Tencent Cloud.'."\n"
+                            ."\n"
+                            .'- aliyun: Alibaba Cloud.'."\n"
+                            ."\n"
+                            .'- hcloud: Huawei Cloud.',
                         'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
+                        'required' => true,
+                        'enum' => ['qcloud', 'hcloud', 'aliyun'],
+                        'example' => 'hcloud',
                     ],
                 ],
+                [
+                    'name' => 'RegionId',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The region where the Data Management Center of Threat Analysis is deployed. Select the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Assets are in the Chinese mainland and Hong Kong (China).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
+                ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'CloudSiemSuccessResponse<UserBuyOrderStatusResult>',
-                        'description' => 'CloudSiemSuccessResponse'."\n",
+                        'title' => 'CloudSiemSuccessResponse<AddDataSourceLogResult>',
+                        'description' => 'CloudSiemSuccessResponse',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'description' => 'The data returned.'."\n",
+                                'title' => '',
+                                'description' => 'The data returned.',
                                 'type' => 'object',
                                 'properties' => [
-                                    'MasterUserId' => [
-                                        'title' => '资源目录Master账号ID。',
-                                        'description' => 'The ID of the management account of the resource directory.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int64',
-                                        'example' => '123XXXXXX',
-                                    ],
-                                    'MasterUserName' => [
-                                        'title' => '资源目录Master账号显示名称。',
-                                        'description' => 'The display name of the management account of the resource directory.'."\n",
-                                        'type' => 'string',
-                                        'example' => 'rd_master_xxx',
-                                    ],
-                                    'MainUserId' => [
-                                        'title' => '购买威胁分析的阿里云账号ID。',
-                                        'description' => 'The ID of the Alibaba Cloud account that is used to purchase the threat analysis feature.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int64',
-                                        'example' => '123XXXXXX',
-                                    ],
-                                    'MainUserName' => [
-                                        'title' => '购买威胁分析的阿里云账号名称。',
-                                        'description' => 'The username of the Alibaba Cloud account that is used to purchase the threat analysis feature.'."\n",
-                                        'type' => 'string',
-                                        'example' => 'sas_account_xxx',
-                                    ],
-                                    'SubUserId' => [
-                                        'title' => '当前登录阿里云账号ID。',
-                                        'description' => 'The ID of the logon Alibaba Cloud account.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int64',
-                                        'example' => '123XXXXXX',
-                                    ],
-                                    'SubUserName' => [
-                                        'title' => '当前登录阿里云账号名称。',
-                                        'description' => 'The username of the logon Alibaba Cloud account.'."\n",
-                                        'type' => 'string',
-                                        'example' => 'sas_account_xxx',
-                                    ],
-                                    'Capacity' => [
-                                        'title' => '购买威胁分析的SLS容量，单位GB。',
-                                        'description' => 'The log storage capacity that is purchased for the threat analysis feature. Unit: GB.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '1024',
-                                    ],
-                                    'SasInstanceId' => [
-                                        'title' => '云安全中心实例ID。',
-                                        'description' => 'The instance ID of Security Center.'."\n",
-                                        'type' => 'string',
-                                        'example' => 'sas-instance-xxxxx',
-                                    ],
-                                    'CanBuy' => [
-                                        'title' => '当前账号是否可以进行威胁分析订单操作。取值：'."\n"
-                                            .' - true：可以购买、升级、变配等。'."\n"
-                                            .' - false：不可以操作威胁分析订单。',
-                                        'description' => 'Indicates whether the logon Alibaba Cloud account can be used to place orders for the threat analysis feature, such as purchase, upgrade, and specifications change orders. Valid values:'."\n"
-                                            ."\n"
-                                            .'*   true'."\n"
-                                            .'*   false'."\n",
-                                        'type' => 'boolean',
-                                        'example' => 'true',
-                                    ],
-                                    'EndTime' => [
-                                        'title' => '威胁分析到期时间，毫秒级时间戳。',
-                                        'description' => 'The timestamp when the threat analysis feature expires. Unit: milliseconds.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int64',
-                                        'example' => '1669823999000',
-                                    ],
-                                    'DurationDays' => [
-                                        'title' => '距离威胁分析过期时间的天数。',
-                                        'description' => 'The number of days before the expiration time of the threat analysis feature.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int64',
-                                        'example' => '3',
-                                    ],
-                                    'RdOrder' => [
-                                        'title' => '是否是siem公测版订单。',
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '1',
-                                    ],
+                                    'Count' => ['title' => '', 'description' => 'The number of added logs. A value of 1 indicates success. A value of 0 or less indicates failure.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'],
+                                    'LogInstanceId' => ['title' => '', 'description' => 'The ID of the log. Threat Analysis calculates this ID as an MD5 hash value based on specific parameters.', 'type' => 'string', 'example' => 'ef33097c9d1fdb0b9c7e8c7ca320pkl1'],
                                 ],
-                                'title' => '请求返回值。',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求消息ID。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '81D8EC0C-0804-51AD-8C38-17ED0BC74892',
+                                'example' => '',
                             ],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorCode' => 'InternalError',
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                    ],
+                    ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"MasterUserId\\": 0,\\n    \\"MasterUserName\\": \\"rd_master_xxx\\",\\n    \\"MainUserId\\": 0,\\n    \\"MainUserName\\": \\"sas_account_xxx\\",\\n    \\"SubUserId\\": 0,\\n    \\"SubUserName\\": \\"sas_account_xxx\\",\\n    \\"Capacity\\": 1024,\\n    \\"SasInstanceId\\": \\"sas-instance-xxxxx\\",\\n    \\"CanBuy\\": true,\\n    \\"EndTime\\": 1669823999000,\\n    \\"DurationDays\\": 3,\\n    \\"RdOrder\\": 1\\n  },\\n  \\"RequestId\\": \\"81D8EC0C-0804-51AD-8C38-17ED0BC74892\\"\\n}","type":"json"}]',
-            'title' => 'DescribeUserBuyStatus',
-        ],
-        'ListProjectLogStores' => [
-            'summary' => 'Queries the dedicated Simple Log Service project and Logstore for a cloud service based on the patterns of the project and Logstore names.',
-            'methods' => [
-                'get',
-                'post',
+            'title' => 'AddDataSourceLog',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'AddDataSourceLog'],
+                ],
             ],
-            'schemes' => [
-                'http',
-                'https',
+            'ramActions' => [
+                [
+                    'operationType' => 'create',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:AddDataSourceLog',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"Count\\": 1,\\n    \\"LogInstanceId\\": \\"ef33097c9d1fdb0b9c7e8c7ca320pkl1\\"\\n  },\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+        ],
+        'AddUserSourceLogConfig' => [
+            'summary' => 'Adds a log collection task to import log data into Threat Analysis for alerting and event analysis.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'read',
+            'operationType' => 'write',
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'list',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-            ],
+            'systemTags' => ['operationType' => 'create', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
                     'name' => 'SourceProdCode',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '待查询的产品code。',
-                        'description' => 'The code of the cloud service.'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'sas',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The code of the product.', 'type' => 'string', 'required' => false, 'example' => 'sas'],
                 ],
                 [
                     'name' => 'SourceLogCode',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '待查询的日志code。',
-                        'description' => 'The log code.'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'cloud_siem_aegis_proc',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The code of the log.', 'type' => 'string', 'required' => false, 'example' => 'cloud_siem_aegis_proc'],
                 ],
                 [
                     'name' => 'SubUserId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '待查询云账号ID。',
-                        'description' => 'The ID of the Alibaba Cloud account.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => true,
-                        'example' => '123XXXXXXXX',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account for which you want to collect logs.', 'type' => 'integer', 'format' => 'int64', 'required' => true, 'example' => '123XXXXXX'],
+                ],
+                [
+                    'name' => 'SourceLogInfo',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The detailed information about the Simple Log Service (SLS) log to be collected. The value is a JSON string.', 'type' => 'string', 'required' => true, 'example' => '{"project":"wafnew-project-1335759343513432-cn-hangzhou","logStore":"wafnew-logstore","regionCode":"cn-hangzhou","prodCode":"waf"}'],
+                ],
+                [
+                    'name' => 'DisPlayLine',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The detailed information about the SLS log to be collected.', 'type' => 'string', 'required' => false, 'example' => 'cn-shanghai.siem-project.siem-logstore'],
+                ],
+                [
+                    'name' => 'Deleted',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'Specifies whether to add or delete the log collection task. Valid values:'."\n"
+                        ."\n"
+                        .'- -1: Deletes the task.'."\n"
+                        ."\n"
+                        .'- 0: Adds the task.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '0'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region where the Data Management center of Threat Analysis is located. Select a region based on the region where your assets reside. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or Hong Kong (China).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'CloudSiemSuccessResponse<List<ListProjectLogStoreResult>>',
-                        'description' => 'CloudSiemSuccessResponse\\<List>'."\n",
+                        'title' => 'CloudSiemSuccessResponse<UserSourceLogResult>',
+                        'description' => 'CloudSiemSuccessResponse',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'array',
-                                'items' => [
-                                    'description' => '',
-                                    'type' => 'object',
-                                    'properties' => [
-                                        'Project' => [
-                                            'title' => 'sls的project名字。',
-                                            'description' => 'The name of the Simple Log Service project.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'cloud-siem-project',
-                                        ],
-                                        'LogStore' => [
-                                            'title' => 'sls的logstore名字。',
-                                            'description' => 'The name of the Simple Log Service Logstore.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'cloud-siem-logstore',
-                                        ],
-                                        'EndPoint' => [
-                                            'title' => 'sls的project的endpoint。',
-                                            'description' => 'The endpoint of the Simple Log Service project.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'cn-hangzhou.log.aliyuncs.com',
-                                        ],
-                                        'RegionId' => [
-                                            'title' => 'sls的project所在的region。',
-                                            'description' => 'The ID of the region in which the Simple Log Service project resides.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'cn-hangzhou',
-                                        ],
-                                        'LocalName' => [
-                                            'title' => 'sls的project所在的region名字。',
-                                            'description' => 'The name of the region in which the Simple Log Service project resides.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'hangzhou',
-                                        ],
-                                        'MainUserId' => [
-                                            'title' => '购买威胁分析的阿里云账号ID。',
-                                            'description' => 'The ID of the Alibaba Cloud account that is used to purchase the threat analysis feature.'."\n",
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '123XXXXXXXXX',
-                                        ],
-                                        'SubUserId' => [
-                                            'title' => '威胁分析阿里云账号ID。',
-                                            'description' => 'The ID of the Alibaba Cloud account that can be used to perform operations supported by the threat analysis feature.'."\n",
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '123XXXXXXXX',
-                                        ],
-                                        'SubUserName' => [
-                                            'title' => '威胁分析阿里云账号名字。',
-                                            'description' => 'The username of the Alibaba Cloud account that can be used to perform operations supported by the threat analysis feature.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'sas_account_xxxx',
-                                        ],
-                                    ],
+                                'title' => '',
+                                'description' => 'The return value of the request.',
+                                'type' => 'object',
+                                'properties' => [
+                                    'DiplayLine' => ['title' => '', 'description' => 'The detailed information about the SLS log.', 'type' => 'string', 'example' => 'cn-shanghai.siem-project.siem-logstore'],
+                                    'SourceProdCode' => ['title' => '', 'description' => 'The code of the product.', 'type' => 'string', 'example' => 'sas'],
+                                    'SourceLogCode' => ['title' => '', 'description' => 'The code of the log.', 'type' => 'string', 'example' => 'cloud_siem_aegis_proc'],
+                                    'Displayed' => ['title' => '', 'description' => 'Indicates whether the details of the log collection task are returned. Valid values:', 'type' => 'boolean', 'example' => '0'],
+                                    'Imported' => ['title' => '', 'description' => 'Indicates whether the log is collected. Valid values:', 'type' => 'boolean', 'example' => '0'],
+                                    'MainUserId' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account that is used to purchase Threat Analysis.', 'type' => 'integer', 'format' => 'int64', 'example' => '123XXXXXXXXX'],
+                                    'SubUserId' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account for which the logs are collected.', 'type' => 'integer', 'format' => 'int64', 'example' => '123XXXXXXXX'],
+                                    'SubUserName' => ['title' => '', 'description' => 'The name of the Alibaba Cloud account for which the logs are collected.', 'type' => 'string', 'example' => 'sas_account_xxx'],
                                 ],
+                                'example' => '',
                             ],
-                            'RequestId' => [
-                                'title' => '请求消息ID。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****',
-                            ],
+                            'RequestId' => ['title' => '', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorCode' => 'InternalError',
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                    ],
+                    ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''],
                 ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"Project\\": \\"cloud-siem-project\\",\\n      \\"LogStore\\": \\"cloud-siem-logstore\\",\\n      \\"EndPoint\\": \\"cn-hangzhou.log.aliyuncs.com\\",\\n      \\"RegionId\\": \\"cn-hangzhou\\",\\n      \\"LocalName\\": \\"hangzhou\\",\\n      \\"MainUserId\\": 0,\\n      \\"SubUserId\\": 0,\\n      \\"SubUserName\\": \\"sas_account_xxxx\\"\\n    }\\n  ],\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
-            'title' => 'ListProjectLogStores',
-        ],
-        'ModifyDataSource' => [
-            'summary' => 'Modifies a data source that is added to the threat analysis feature.',
-            'methods' => [
-                'get',
-                'post',
+            'title' => 'AddUserSourceLogConfig',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'AddUserSourceLogConfig'],
+                ],
             ],
-            'schemes' => [
-                'http',
-                'https',
+            'ramActions' => [
+                [
+                    'operationType' => 'create',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:AddUserSourceLogConfig',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"DiplayLine\\": \\"cn-shanghai.siem-project.siem-logstore\\",\\n    \\"SourceProdCode\\": \\"sas\\",\\n    \\"SourceLogCode\\": \\"cloud_siem_aegis_proc\\",\\n    \\"Displayed\\": true,\\n    \\"Imported\\": true,\\n    \\"MainUserId\\": 0,\\n    \\"SubUserId\\": 0,\\n    \\"SubUserName\\": \\"sas_account_xxx\\"\\n  },\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+        ],
+        'BindAccount' => [
+            'summary' => 'Binds a multicloud account from Multicloud Assets of Security Center to Threat Analysis.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
@@ -858,360 +419,370 @@
             'operationType' => 'write',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'update',
+                'operationType' => 'create',
                 'riskType' => 'none',
                 'chargeType' => 'free',
+                'abilityTreeCode' => '194690',
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
-                    'name' => 'AccountId',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '云账号ID。',
-                        'description' => 'The ID of the cloud account.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '123xxxxxx',
-                    ],
-                ],
-                [
-                    'name' => 'DataSourceType',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '数据源类型。',
-                        'description' => 'The type of the data source. Valid values:'."\n"
-                            ."\n"
-                            .'*   ckafka: Tencent Cloud Kafka (CKafka)'."\n"
-                            .'*   obs: Huawei Cloud Object Storage Service (OBS)'."\n"
-                            .'*   wafApi: download API of Tencent Cloud Web Application Firewall (WAF)'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'obs',
-                    ],
-                ],
-                [
-                    'name' => 'DataSourceInstanceId',
+                    'name' => 'AccessId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '数据源ID，由威胁分析根据具体参数计算md5生成。',
-                        'description' => 'The ID of the data source. The ID is an MD5 hash value that is calculated by the threat analysis feature based on specific parameters. You can call the [DescribeDataSourceInstance](https://api.aliyun-inc.com/#/publishment/document/cloud-siem/863fdf54478f4cc5877e27c2a5fe9e44?tenantUuid=f382fccd88b94c5c8c864def6815b854\\&activeTabKey=api%7CDescribeDataSourceInstance) operation to query the IDs of data sources.'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The AccessKey ID of the Alibaba Cloud account.', 'type' => 'string', 'required' => true, 'example' => 'ABCXXXXXXXX'],
                 ],
                 [
-                    'name' => 'DataSourceInstanceName',
+                    'name' => 'AccountName',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '数据源名称。',
-                        'description' => 'The name of the data source.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'beijing_waf_kafka',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The name of the multicloud account.', 'type' => 'string', 'required' => true, 'example' => 'xxxx'],
                 ],
                 [
-                    'name' => 'DataSourceInstanceRemark',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '数据源备注。',
-                        'description' => 'The remarks on the data source.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'waf_alert_log',
-                    ],
-                ],
-                [
-                    'name' => 'DataSourceInstanceParams',
+                    'name' => 'AccountId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '数据源参数，json数组格式。',
-                        'description' => 'The parameters of the data source in the JSON string format.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '[{"paraCode":"region_code","paraValue":"ap-guangzhou"}]',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account.', 'type' => 'string', 'required' => true, 'example' => '123xxxxxxx'],
                 ],
                 [
                     'name' => 'CloudCode',
                     'in' => 'formData',
                     'schema' => [
-                        'title' => '多云的code。',
+                        'title' => '',
                         'description' => 'The code of the cloud service provider. Valid values:'."\n"
                             ."\n"
-                            .'*   qcloud: Tencent Cloud'."\n"
-                            .'*   aliyun: Alibaba Cloud'."\n"
-                            .'*   hcloud: Huawei Cloud'."\n",
+                            .'- aliyun: Alibaba Cloud'."\n"
+                            .'- hcloud: Huawei Cloud'."\n"
+                            .'- qcloud: Tencent Cloud',
                         'type' => 'string',
                         'required' => true,
+                        'enumValueTitles' => [],
+                        'enum' => ['qcloud', 'hcloud'],
                         'example' => 'hcloud',
-                        'enum' => [
-                            'qcloud',
-                            'hcloud',
-                            'aliyun',
-                        ],
                     ],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region where the data management center of Threat Analysis is located. You must select a region for the data management center based on the region where your assets reside. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are deployed in the Chinese mainland or Hong Kong (China).'."\n"
+                        .'- ap-southeast-1: Your assets are deployed in regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
+                ],
+                [
+                    'name' => 'RoleFor',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The user ID of the member to whose view the administrator switches.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
+                ],
+                [
+                    'name' => 'RoleType',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The type of the view.'."\n"
+                        ."\n"
+                        .'- 0: the view of the current Alibaba Cloud account.'."\n"
+                        .'- 1: the view of all accounts that belong to the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'CloudSiemSuccessResponse<ModifyDataSourceResult>',
-                        'description' => 'CloudSiemSuccessResponse'."\n",
+                        'title' => 'CloudSiemSuccessResponse<BindAccountResult>',
+                        'description' => 'CloudSiemResponse',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
+                                'title' => '',
+                                'description' => 'The detailed information returned by the Threat Analysis service.',
                                 'type' => 'object',
                                 'properties' => [
-                                    'Count' => [
-                                        'title' => '修改数据源的数量，等于1表示成功，小于等于0表示失败。',
-                                        'description' => 'The number of data sources that are modified. The value 1 indicates that the modification is successful, and a value less than or equal to 0 indicates that the modification failed.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '1',
-                                    ],
-                                    'DataSourceInstanceId' => [
-                                        'title' => '数据源ID，由威胁分析根据具体参数计算md5生成。',
-                                        'description' => 'The ID of the data source. The ID is an MD5 hash value that is calculated by the threat analysis feature based on specific parameters.'."\n",
-                                        'type' => 'string',
-                                        'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea',
-                                    ],
+                                    'Count' => ['title' => '', 'description' => 'The number of account bindings that are added.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'],
                                 ],
+                                'example' => '',
                             ],
-                            'RequestId' => [
-                                'title' => '请求消息ID。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****',
-                            ],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
+                400 => [
+                    ['errorCode' => 'InvalidOperation', 'errorMessage' => 'access ak "%s" already bound.', 'description' => ''],
+                ],
                 500 => [
-                    [
-                        'errorCode' => 'InternalError',
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
+                    ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''],
+                ],
+            ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"Count\\": 1\\n  },\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+            'title' => 'BindAccount',
+            'changeSet' => [
+                ['createdAt' => '2024-07-18T01:29:01.000Z', 'description' => 'Request parameters changed'],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'create',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:BindAccount',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
                     ],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'BindAccount'],
+                ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"Count\\": 1,\\n    \\"DataSourceInstanceId\\": \\"220ba97c9d1fdb0b9c7e8c7ca328d7ea\\"\\n  },\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
-            'title' => 'ModifyDataSource',
         ],
-        'ModifyDataSourceLog' => [
-            'summary' => 'Modifies the description of the logs that are added to the threat analysis feature for a data source within a cloud account.',
-            'methods' => [
-                'get',
-                'post',
-            ],
-            'schemes' => [
-                'http',
-                'https',
-            ],
+        'CloseDelivery' => [
+            'summary' => 'Stops log delivery from a connected cloud service. Once stopped, no new logs are added to your Logstore.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'write',
+            'operationType' => 'readAndWrite',
             'deprecated' => false,
             'systemTags' => [
                 'operationType' => 'update',
                 'riskType' => 'none',
                 'chargeType' => 'free',
+                'abilityTreeCode' => '154877',
+                'abilityTreeNodes' => ['FEATUREsasRXJ9SY'],
             ],
             'parameters' => [
                 [
+                    'name' => 'ProductCode',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The code of the cloud service. Valid values:'."\n"
+                        ."\n"
+                        .'- qcloud\\_waf'."\n"
+                        ."\n"
+                        .'- qlcoud\\_cfw'."\n"
+                        ."\n"
+                        .'- hcloud\\_waf'."\n"
+                        ."\n"
+                        .'- hcloud\\_cfw'."\n"
+                        ."\n"
+                        .'- ddos'."\n"
+                        ."\n"
+                        .'- sas'."\n"
+                        ."\n"
+                        .'- cfw'."\n"
+                        ."\n"
+                        .'- config'."\n"
+                        ."\n"
+                        .'- csk'."\n"
+                        ."\n"
+                        .'- fc'."\n"
+                        ."\n"
+                        .'- rds'."\n"
+                        ."\n"
+                        .'- nas'."\n"
+                        ."\n"
+                        .'- apigateway'."\n"
+                        ."\n"
+                        .'- cdn'."\n"
+                        ."\n"
+                        .'- mongodb'."\n"
+                        ."\n"
+                        .'- eip'."\n"
+                        ."\n"
+                        .'- slb'."\n"
+                        ."\n"
+                        .'- vpc'."\n"
+                        ."\n"
+                        .'- actiontrail'."\n"
+                        ."\n"
+                        .'- waf'."\n"
+                        ."\n"
+                        .'- bastionhost'."\n"
+                        ."\n"
+                        .'- oss'."\n"
+                        ."\n"
+                        .'- polardb', 'type' => 'string', 'required' => true, 'example' => 'sas'],
+                ],
+                [
                     'name' => 'LogCode',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '日志code。',
-                        'description' => 'The log code.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cloud_siem_waf_xxxxx',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The code of the log within the cloud service. For example, the process log of Security Center. For valid values, see the return value of the ListDelivery operation.', 'type' => 'string', 'required' => false, 'example' => 'cloud_siem_aegis_proc'],
                 ],
                 [
-                    'name' => 'AccountId',
+                    'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '云账号ID。',
-                        'description' => 'The ID of the cloud account.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '123xxxxxxx',
-                    ],
+                    'schema' => ['description' => 'The view type.'."\n"
+                        ."\n"
+                        .'- 0: The view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: The view of all accounts in your enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
-                    'name' => 'DataSourceType',
+                    'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '数据源类型。取值：'."\n"
-                            .' - obs：华为云obs。'."\n"
-                            .' - wafApi：腾讯云waf下载api。 '."\n"
-                            .' - ckafka： 腾讯云ckafka。',
-                        'description' => 'The type of the data source. Valid values:'."\n"
-                            ."\n"
-                            .'*   obs: Huawei Cloud Object Storage Service (OBS)'."\n"
-                            .'*   wafApi: download API of Tencent Cloud Web Application Firewall (WAF)'."\n"
-                            .'*   ckafka: Tencent Cloud Kafka (CKafka)'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'obs',
-                    ],
+                    'schema' => ['description' => 'The user ID of a member. An administrator can use this parameter to switch to the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
-                    'name' => 'DataSourceInstanceId',
+                    'name' => 'RegionId',
                     'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The region where the data management center of threat analysis is located. Select a region based on the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Select this region if your assets are in the Chinese mainland or Hong Kong (China).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Select this region if your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
+                ],
+            ],
+            'responses' => [
+                200 => [
                     'schema' => [
-                        'title' => '数据源ID，由威胁分析根据具体参数计算md5生成。',
-                        'description' => 'The ID of the data source. The ID is an MD5 hash value that is calculated by the threat analysis feature based on specific parameters. You can call the [DescribeDataSourceInstance](https://api.aliyun-inc.com/#/publishment/document/cloud-siem/863fdf54478f4cc5877e27c2a5fe9e44?tenantUuid=f382fccd88b94c5c8c864def6815b854\\&activeTabKey=api%7CDescribeDataSourceInstance) operation to query the IDs of data sources.'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'ef33097c9d1fdb0b9c7e8c7ca320pkl1',
+                        'title' => 'CloudSiemResponse<Boolean>',
+                        'description' => 'CloudSiemResponse',
+                        'type' => 'object',
+                        'properties' => [
+                            'Data' => ['title' => '', 'description' => 'The result of the request. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The request was successful.'."\n"
+                                ."\n"
+                                .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => 'F375A043-4F5B-55F2-A564-CC47FFC6****'],
+                        ],
+                        'example' => '',
                     ],
                 ],
+            ],
+            'errorCodes' => [
+                400 => [
+                    ['errorCode' => 'Siem.Delivery.MissingProductCode', 'errorMessage' => 'ProductCode is mandatory for this action.', 'description' => ''],
+                ],
+                500 => [
+                    ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''],
+                    ['errorCode' => 'Siem.Delivery.ErrorMapping', 'errorMessage' => 'The Mapping between productCode and logCode is error.', 'description' => ''],
+                    ['errorCode' => 'Siem.Delivery.ErrorProductCode', 'errorMessage' => 'ProductCode is error for this action.', 'description' => ''],
+                    ['errorCode' => 'SLS.Ship.Error', 'errorMessage' => 'The Simple Log Service about data shipping is unavailable.', 'description' => ''],
+                ],
+            ],
+            'title' => 'CloseDelivery',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:44:01.000Z', 'description' => 'Request parameters changed'],
+                ['createdAt' => '2023-12-13T09:49:23.000Z', 'description' => 'Error codes changed, Request parameters changed, Response parameters changed'],
+            ],
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'CloseDelivery'],
+                ],
+            ],
+            'ramActions' => [
                 [
-                    'name' => 'DataSourceInstanceLogs',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '数据源参数详情，json数组格式。',
-                        'description' => 'The parameters of the data source. Set this parameter to a JSON string.'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => '[{"LogCode":"cloud_siem_qcloud_waf_alert_log","LogParas":"[{\\"ParaCode\\":\\"api_name\\",\\"ParaValue\\":\\"GetAttackDownloadRecords\\"}]"}]',
+                    'operationType' => 'update',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:CloseDelivery',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
                     ],
                 ],
+            ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": true,\\n  \\"RequestId\\": \\"F375A043-4F5B-55F2-A564-CC47FFC6****\\"\\n}","type":"json"}]',
+        ],
+        'DeleteAutomateResponseConfig' => [
+            'summary' => 'Deletes an automated response rule by its ID.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['https', 'http'],
+            'security' => [
                 [
-                    'name' => 'LogInstanceId',
+                    'AK' => [],
+                ],
+            ],
+            'deprecated' => false,
+            'systemTags' => ['operationType' => 'delete', 'riskType' => 'none', 'chargeType' => 'free'],
+            'parameters' => [
+                [
+                    'name' => 'Id',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '日志ID，由威胁分析根据具体参数计算md5生成。',
-                        'description' => 'The ID of the log. The ID is an MD5 hash value that is calculated by the threat analysis feature based on specific parameters. You can call the [ListDataSourceLogs](https://api.aliyun-inc.com/#/publishment/document/cloud-siem/863fdf54478f4cc5877e27c2a5fe9e44?tenantUuid=f382fccd88b94c5c8c864def6815b854\\&activeTabKey=api%7CListDataSourceLogs) to query log IDs.'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'ef33097c9d1fdb0b9c7e8c7ca320pkl1',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The ID of the automated response rule.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '123'],
                 ],
                 [
-                    'name' => 'CloudCode',
+                    'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '多云的code。',
-                        'description' => 'The code of the cloud service provider. Valid values:'."\n"
-                            ."\n"
-                            .'*   qcloud: Tencent Cloud'."\n"
-                            .'*   aliyun: Alibaba Cloud'."\n"
-                            .'*   hcloud: Huawei Cloud'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'hcloud',
-                        'enum' => [
-                            'qcloud',
-                            'hcloud',
-                            'aliyun',
-                        ],
-                    ],
+                    'schema' => ['description' => 'The view type.'."\n"
+                        ."\n"
+                        .'- 0: the view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: the view of all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
+                ],
+                [
+                    'name' => 'RoleFor',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The user ID of the member. An administrator can use this ID to switch to the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region where the Data Management hub for threat analysis is located. Select the region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: your assets are in the Chinese mainland or Hong Kong (China).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'CloudSiemSuccessResponse<ModifyDataSourceLogResult>',
-                        'description' => 'CloudSiemSuccessResponse'."\n",
+                        'title' => 'BaseResponse<String>',
+                        'description' => 'BaseResponse',
                         'type' => 'object',
                         'properties' => [
-                            'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'object',
-                                'properties' => [
-                                    'Count' => [
-                                        'title' => '修改日志的数量，等于1表示成功，小于等于0表示失败。',
-                                        'description' => 'The number of logs that are modified. The value 1 indicates that the modification is successful, and a value less than or equal to 0 indicates that the modification failed.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '1',
-                                    ],
-                                    'LogInstanceId' => [
-                                        'title' => '日志的ID，由威胁分析根据具体参数计算md5生成。',
-                                        'description' => 'The ID of the log. The ID is an MD5 hash value that is calculated by the threat analysis feature based on specific parameters.'."\n",
-                                        'type' => 'string',
-                                        'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea',
-                                    ],
-                                ],
-                            ],
-                            'RequestId' => [
-                                'title' => '请求消息ID。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****',
-                            ],
+                            'Data' => ['title' => '', 'description' => 'The return value of the request.', 'type' => 'string', 'example' => '123456'],
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The request was successful.'."\n"
+                                ."\n"
+                                .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The message returned for the request.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorCode' => 'InternalError',
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"Count\\": 1,\\n    \\"LogInstanceId\\": \\"220ba97c9d1fdb0b9c7e8c7ca328d7ea\\"\\n  },\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
-            'title' => 'ModifyDataSourceLog',
-        ],
-        'ModifyBindAccount' => [
-            'summary' => 'Modifies a third-party cloud account that is added to the threat analysis feature.',
-            'methods' => [
-                'get',
-                'post',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'DeleteAutomateResponseConfig',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:43:23.000Z', 'description' => 'Error codes changed, Request parameters changed'],
             ],
-            'schemes' => [
-                'http',
-                'https',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DeleteAutomateResponseConfig'],
+                ],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'delete',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DeleteAutomateResponseConfig',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": \\"123456\\",\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
+        ],
+        'DeleteBindAccount' => [
+            'summary' => 'Detaches the AccessKey of a multicloud account, such as a Tencent Cloud or Huawei Cloud account, from a threat analysis data source. You can then attach a new account.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
@@ -1220,573 +791,347 @@
             'operationType' => 'write',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'update',
+                'operationType' => 'delete',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeCode' => '194689',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeCode' => '194688',
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
-                    'name' => 'AccessId',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '云账号的AccessKeyId。',
-                        'description' => 'The AccessKey ID of the cloud account.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'ABCXXXXXXXXX',
-                    ],
-                ],
-                [
-                    'name' => 'AccountName',
+                    'name' => 'BindId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '多云账号名称。',
-                        'description' => 'The username of the cloud account.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'sas_account_xxx',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The binding ID. Call the [ListBindAccount](https://api.aliyun-inc.com/#/publishment/document/cloud-siem/863fdf54478f4cc5877e27c2a5fe9e44?tenantUuid=f382fccd88b94c5c8c864def6815b854\\&activeTabKey=api%7CListBindAccount) operation to obtain the binding ID.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '10'],
                 ],
                 [
-                    'name' => 'BindId',
+                    'name' => 'AccountId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '绑定记录ID。ListBindAccount接口返回的BindId。',
-                        'description' => 'The ID that is generated by the system when the account is added. You can call the ListBindAccount operation to query the ID.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => true,
-                        'example' => '123',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The ID of the cloud account.', 'type' => 'string', 'required' => true, 'example' => '123xxxxxxx'],
                 ],
                 [
-                    'name' => 'AccountId',
+                    'name' => 'AccessId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '云账号ID。',
-                        'description' => 'The ID of the cloud account.'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => '123xxxxxxx',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The AccessKey ID of the cloud account.', 'type' => 'string', 'required' => true, 'example' => 'ABCXXXXXXXX'],
                 ],
                 [
                     'name' => 'CloudCode',
                     'in' => 'formData',
                     'schema' => [
-                        'title' => '多云的code。',
-                        'description' => 'The code of the cloud service provider.'."\n",
+                        'title' => '',
+                        'description' => 'The code for the cloud service provider. Valid values:'."\n"
+                            ."\n"
+                            .'- qcloud: Tencent Cloud'."\n"
+                            ."\n"
+                            .'- aliyun: Alibaba Cloud'."\n"
+                            ."\n"
+                            .'- hcloud: Huawei Cloud',
                         'type' => 'string',
                         'required' => true,
+                        'enum' => ['qcloud', 'hcloud'],
                         'example' => 'hcloud',
-                        'enum' => [
-                            'qcloud',
-                            'hcloud',
-                        ],
                     ],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region where the threat analysis data center is located. Select a region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in mainland China or the China (Hong Kong) region.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
                 [
-                    'name' => 'RoleFor',
+                    'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'integer',
-                        'format' => 'int64',
-                    ],
+                    'schema' => ['description' => 'The type of the view. Valid values:'."\n"
+                        ."\n"
+                        .'- 0: The view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: The view of all accounts that are managed by your enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
-                    'name' => 'RoleType',
+                    'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'integer',
-                        'format' => 'int32',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member. An administrator can specify this parameter to perform the operation from the perspective of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'CloudSiemSuccessResponse<ModifyBindAccountResult>',
-                        'description' => 'CloudSiemSuccessResponse'."\n",
+                        'title' => 'CloudSiemSuccessResponse<DeleteBindAccountResult>',
+                        'description' => 'CloudSiemSuccessResponse',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
+                                'title' => '',
+                                'description' => 'The data returned.',
                                 'type' => 'object',
                                 'properties' => [
-                                    'Count' => [
-                                        'title' => '修改账号绑定的数量，等于1表示成功，小于等于0表示失败。',
-                                        'description' => 'The number of the accounts that are modified. The value 1 indicates that the modification is successful, and a value less than or equal to 0 indicates that the modification failed.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '1',
-                                    ],
+                                    'Count' => ['title' => '', 'description' => 'The number of account bindings that are deleted. A value of 1 indicates that the operation was successful. A value of 0 or less indicates that the operation failed.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'],
                                 ],
+                                'example' => '',
                             ],
-                            'RequestId' => [
-                                'title' => '请求消息ID。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****',
-                            ],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorCode' => 'InternalError',
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
+                    ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''],
+                ],
+            ],
+            'title' => 'DeleteBindAccount',
+            'changeSet' => [
+                ['createdAt' => '2024-07-18T01:29:01.000Z', 'description' => 'Request parameters changed'],
+            ],
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DeleteBindAccount'],
+                ],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'delete',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DeleteBindAccount',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
                     ],
                 ],
             ],
             'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"Count\\": 1\\n  },\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
-            'title' => 'ModifyBindAccount',
         ],
-        'ListImportedLogsByProd' => [
-            'summary' => 'Queries the details of the logs in a cloud service that is added to the threat analysis feature.',
-            'methods' => [
-                'get',
-                'post',
-            ],
-            'schemes' => [
-                'http',
-                'https',
-            ],
+        'DeleteCustomizeRule' => [
+            'methods' => ['get', 'post'],
+            'schemes' => ['https', 'http'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'read',
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'list',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-                'abilityTreeCode' => '195548',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
-            ],
+            'systemTags' => ['operationType' => 'delete', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
-                    'name' => 'ProdCode',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '产品的code。',
-                        'description' => 'The code of the cloud service.'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'qcloud_waf',
-                    ],
-                ],
-                [
-                    'name' => 'CloudCode',
+                    'name' => 'RuleId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '多云的code。取值：'."\n"
-                            .' - hcloud：华为云。'."\n"
-                            .' - qcloud：腾讯云。 '."\n"
-                            .' - aliyun：阿里云。',
-                        'description' => 'The code of the cloud service provider. Valid values:'."\n"
-                            ."\n"
-                            .'*   qcloud: Tencent Cloud.'."\n"
-                            .'*   aliyun: Alibaba Cloud.'."\n"
-                            .'*   hcloud: Huawei Cloud.'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'enumValueTitles' => [],
-                        'example' => 'hcloud',
-                        'enum' => [
-                            'qcloud',
-                            'hcloud',
-                            'aliyun',
-                        ],
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The ID of the custom rule.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '123456789'],
                 ],
                 [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['description' => 'The type of the view.'."\n"
+                        ."\n"
+                        .'- 0: The view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: The view of all accounts in your enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member. This parameter is used when an administrator switches to the perspective of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region where the product is deployed.', 'type' => 'string', 'required' => false, 'example' => 'cn-shanghai'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'CloudSiemSuccessResponse<List<ListImportedLogsByProdResult>>',
-                        'description' => 'CloudSiemSuccessResponse\\<List>'."\n",
+                        'title' => 'BaseResponse<Integer>',
+                        'description' => 'BaseResponse',
                         'type' => 'object',
                         'properties' => [
-                            'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'array',
-                                'items' => [
-                                    'description' => '',
-                                    'type' => 'object',
-                                    'properties' => [
-                                        'ProdCode' => [
-                                            'title' => '日志对应的产品code。',
-                                            'description' => 'The code of the cloud service to which the log belongs.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'qcloud_waf',
-                                        ],
-                                        'LogCode' => [
-                                            'title' => '日志code。',
-                                            'description' => 'The code of the log.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'cloud_siem_waf_xxxxx',
-                                        ],
-                                        'LogMdsCode' => [
-                                            'title' => '日志显示code。',
-                                            'description' => 'The display code of the log.'."\n",
-                                            'type' => 'string',
-                                            'example' => '${siem.prod. cloud_siem_waf_xxxxx}',
-                                        ],
-                                        'ImportedUserCount' => [
-                                            'title' => '已接入该日志的用户数量。',
-                                            'description' => 'The number of users who have added the log.'."\n",
-                                            'type' => 'integer',
-                                            'format' => 'int32',
-                                            'example' => '2',
-                                        ],
-                                        'UnImportedUserCount' => [
-                                            'title' => '未接入该日志的用户数量。',
-                                            'description' => 'The number of users who have not added the log.'."\n",
-                                            'type' => 'integer',
-                                            'format' => 'int32',
-                                            'example' => '3',
-                                        ],
-                                        'TotalUserCount' => [
-                                            'title' => '该日志下总共的用户数量。',
-                                            'description' => 'The total number of users who have the log.'."\n",
-                                            'type' => 'integer',
-                                            'format' => 'int32',
-                                            'example' => '5',
-                                        ],
-                                        'ModifyTime' => [
-                                            'title' => '日志最后接入时间。',
-                                            'description' => 'The time when the log was last added.'."\n",
-                                            'type' => 'string',
-                                            'example' => '2023-11-23 12:30:00',
-                                        ],
-                                        'Imported' => [
-                                            'title' => '日志是否已经接入。取值：'."\n"
-                                                .' - 1：已接入。 '."\n"
-                                                .' - 0：未接入。',
-                                            'description' => 'Indicates whether the log is added to the threat analysis feature. Valid values:'."\n"
-                                                ."\n"
-                                                .'*   1: yes.'."\n"
-                                                .'*   0: no.'."\n",
-                                            'type' => 'integer',
-                                            'format' => 'int32',
-                                            'example' => '2023-11-23 12:30:00',
-                                        ],
-                                        'AutoImported' => [
-                                            'title' => '新增账号是否自动接入。取值：'."\n"
-                                                .' - 1：自动接入。 '."\n"
-                                                .' - 0：不自动接入。',
-                                            'description' => 'Indicates whether the log is automatically added to the threat analysis feature within newly added accounts. Valid values:'."\n"
-                                                ."\n"
-                                                .'*   1: yes.'."\n"
-                                                .'*   0: no.'."\n",
-                                            'type' => 'integer',
-                                            'format' => 'int32',
-                                            'example' => '2023-11-23 12:30:00',
-                                        ],
-                                        'LogType' => [
-                                            'title' => '日志类型。取值：'."\n"
-                                                .' - 1：中心侧接入。 '."\n"
-                                                .' - 2：预定义日志服务。 '."\n"
-                                                .' -3：自定义日志服务',
-                                            'description' => 'The type of log. Valid values:'."\n"
-                                                .' - 1: the log produced by other product'."\n"
-                                                .' - 2: the predefined log'."\n"
-                                                .' - 3: the custom log',
-                                            'type' => 'integer',
-                                            'format' => 'int32',
-                                            'example' => '1',
-                                        ],
-                                        'CloudCode' => [
-                                            'title' => '多云的code。',
-                                            'description' => 'The code of the cloud service provider. Valid values:'."\n"
-                                                ."\n"
-                                                .'*   qcloud: Tencent Cloud.'."\n"
-                                                .'*   aliyun: Alibaba Cloud.'."\n"
-                                                .'*   hcloud: Huawei Cloud.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'hcloud',
-                                            'enum' => [
-                                                'qcloud',
-                                                'hcloud',
-                                                'aliyun',
-                                            ],
-                                        ],
-                                    ],
-                                ],
-                            ],
-                            'RequestId' => [
-                                'title' => '请求消息ID。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****',
-                            ],
+                            'Data' => ['title' => '', 'description' => 'The return value of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '123456'],
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The request was successful.'."\n"
+                                ."\n"
+                                .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The returned message.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
+                400 => [
+                    ['errorCode' => 'CloudSiemCustomizeRuleDeleteExcepiton', 'errorMessage' => 'can not delete online customize rule.', 'description' => ''],
+                ],
                 500 => [
-                    [
-                        'errorCode' => 'InternalError',
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'DeleteCustomizeRule',
+            'summary' => 'You can customize rules for a specific ID.',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:43:23.000Z', 'description' => 'Error codes changed, Request parameters changed'],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"ProdCode\\": \\"qcloud_waf\\",\\n      \\"LogCode\\": \\"cloud_siem_waf_xxxxx\\",\\n      \\"LogMdsCode\\": \\"${siem.prod. cloud_siem_waf_xxxxx}\\",\\n      \\"ImportedUserCount\\": 2,\\n      \\"UnImportedUserCount\\": 3,\\n      \\"TotalUserCount\\": 5,\\n      \\"ModifyTime\\": \\"2023-11-23 12:30:00\\",\\n      \\"Imported\\": 0,\\n      \\"AutoImported\\": 0,\\n      \\"LogType\\": 0,\\n      \\"CloudCode\\": \\"hcloud\\"\\n    }\\n  ],\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
-            'title' => 'ListImportedLogsByProd',
-        ],
-        'ListDataSourceTypes' => [
-            'summary' => 'Queries a list of data source types in third-party cloud services that can be added to the threat analysis feature.',
-            'methods' => [
-                'get',
-                'post',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DeleteCustomizeRule'],
+                ],
             ],
-            'schemes' => [
-                'http',
-                'https',
+            'ramActions' => [
+                [
+                    'operationType' => 'delete',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DeleteCustomizeRule',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": 123456,\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
+        ],
+        'DeleteDataSource' => [
+            'summary' => 'Call this operation to delete a data source that is no longer required.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'read',
+            'operationType' => 'write',
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'list',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-            ],
+            'systemTags' => ['operationType' => 'delete', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
+                    'name' => 'DataSourceInstanceId',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The ID of the data source. This ID is an MD5 hash value calculated by Threat Analysis based on specific parameters. Call the [ListDataSourceLogs](https://api.aliyun-inc.com/#/publishment/document/cloud-siem/863fdf54478f4cc5877e27c2a5fe9e44?tenantUuid=f382fccd88b94c5c8c864def6815b854\\&activeTabKey=api%7CListDataSourceLogs) operation to obtain the data source ID.', 'type' => 'string', 'required' => true, 'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea'],
+                ],
+                [
+                    'name' => 'AccountId',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account.', 'type' => 'string', 'required' => true, 'example' => '123xxxxxxx'],
+                ],
+                [
                     'name' => 'CloudCode',
                     'in' => 'formData',
                     'schema' => [
-                        'title' => '多云的code。',
-                        'description' => 'The code of the third-party cloud service.'."\n"
+                        'title' => '',
+                        'description' => 'The code for the multicloud environment. Valid values:'."\n"
+                            ."\n"
+                            .'- qcloud: Tencent Cloud.'."\n"
                             ."\n"
-                            .'Valid values:'."\n"
+                            .'- aliyun: Alibaba Cloud.'."\n"
                             ."\n"
-                            .'*   qcloud'."\n"
-                            .'*   hcloud'."\n",
+                            .'- hcloud: Huawei Cloud.',
                         'type' => 'string',
                         'required' => true,
+                        'enumValueTitles' => [],
+                        'enum' => ['qcloud', 'hcloud', 'aliyun'],
                         'example' => 'hcloud',
-                        'enum' => [
-                            'qcloud',
-                            'hcloud',
-                        ],
                     ],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region where the Data Management hub of Threat Analysis is located. Select the region of the management hub based on the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'CloudSiemSuccessResponse<List<ListDataSourceTypesResult>>',
-                        'description' => 'CloudSiemSuccessResponse\\<List>'."\n",
+                        'title' => 'CloudSiemSuccessResponse<DeleteDataSourceResult>',
+                        'description' => 'CloudSiemSuccessResponse',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'array',
-                                'items' => [
-                                    'type' => 'object',
-                                    'properties' => [
-                                        'DataSourceType' => [
-                                            'title' => '数据源类型。取值：'."\n"
-                                                .' - obs：华为云obs。'."\n"
-                                                .' - wafApi：腾讯云waf下载api。 '."\n"
-                                                .' - ckafka： 腾讯云ckafka。',
-                                            'description' => 'The type of the data source. Valid values:'."\n"
-                                                ."\n"
-                                                .'*   obs: Huawei Cloud Object Storage Service (OBS)'."\n"
-                                                .'*   wafApi: download API of Tencent Cloud Web Application Firewall (WAF)'."\n"
-                                                .'*   ckafka: Tencent Cloud Kafka (CKafka)'."\n",
-                                            'type' => 'string',
-                                            'example' => 'obs',
-                                        ],
-                                        'CloudCode' => [
-                                            'title' => '多云的code。',
-                                            'description' => 'The code of the third-party cloud service.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'hcloud',
-                                            'enum' => [
-                                                'qcloud',
-                                                'hcloud',
-                                            ],
-                                        ],
-                                    ],
+                                'title' => '',
+                                'description' => 'The return value of the request.',
+                                'type' => 'object',
+                                'properties' => [
+                                    'Count' => ['title' => '', 'description' => 'The number of data sources that are deleted. A value of 1 indicates success. A value of 0 or less indicates failure.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'],
                                 ],
+                                'example' => '',
                             ],
-                            'RequestId' => [
-                                'title' => '请求消息ID。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****',
-                            ],
+                            'RequestId' => ['title' => '', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
-                400 => [
-                    [
-                        'errorCode' => 'IllegalParameter',
-                        'errorMessage' => 'The specified parameter %s is not valid, only support %s',
-                    ],
-                ],
                 500 => [
-                    [
-                        'errorCode' => 'InternalError',
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                    ],
+                    ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"DataSourceType\\": \\"obs\\",\\n      \\"CloudCode\\": \\"hcloud\\"\\n    }\\n  ],\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
-            'title' => 'ListDataSourceTypes',
-        ],
-        'ListDataSourceLogs' => [
-            'summary' => 'Queries the logs of a data source.',
-            'methods' => [
-                'get',
-                'post',
+            'title' => 'DeleteDataSource',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DeleteDataSource'],
+                ],
             ],
-            'schemes' => [
-                'http',
-                'https',
+            'ramActions' => [
+                [
+                    'operationType' => 'delete',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DeleteDataSource',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"Count\\": 1\\n  },\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+        ],
+        'DeleteDataSourceLog' => [
+            'summary' => 'Removes a log.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'read',
+            'operationType' => 'write',
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'list',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-            ],
+            'systemTags' => ['operationType' => 'delete', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
+                    'name' => 'LogInstanceId',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The ID of the log. The ID is an MD5 hash value that is calculated by the threat analysis feature based on specific parameters. You can call the [ListDataSourceLogs](https://api.aliyun-inc.com/#/publishment/document/cloud-siem/863fdf54478f4cc5877e27c2a5fe9e44?tenantUuid=f382fccd88b94c5c8c864def6815b854\\&activeTabKey=api%7CListDataSourceLogs) operation to query the IDs of logs.'."\n", 'type' => 'string', 'required' => true, 'example' => 'ef33097c9d1fdb0b9c7e8c7ca320pkl1'],
+                ],
+                [
                     'name' => 'DataSourceInstanceId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '数据源ID，由威胁分析根据具体参数计算md5生成。',
-                        'description' => 'The ID of the data source. The value is obtained after the threat analysis feature calculates the MD5 hash value of a parameter.'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The ID of the data source. The ID is an MD5 hash value that is calculated by the threat analysis feature based on specific parameters. You can call the [ListDataSourceLogs](https://api.aliyun-inc.com/#/publishment/document/cloud-siem/863fdf54478f4cc5877e27c2a5fe9e44?tenantUuid=f382fccd88b94c5c8c864def6815b854\\&activeTabKey=api%7CListDataSourceLogs) operation to query the IDs of data sources.'."\n", 'type' => 'string', 'required' => true, 'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea'],
                 ],
                 [
                     'name' => 'AccountId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '云账号ID。',
-                        'description' => 'The ID of the cloud account.'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => '123xxxxxx',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The ID of the cloud account.'."\n", 'type' => 'string', 'required' => true, 'example' => '123xxxxxxx'],
                 ],
                 [
                     'name' => 'CloudCode',
                     'in' => 'formData',
                     'schema' => [
-                        'title' => '多云的code。',
-                        'description' => 'The code that is used for multi-cloud environments. Valid values:'."\n"
+                        'title' => '',
+                        'description' => 'The code of the cloud service provider. Valid values:'."\n"
                             ."\n"
                             .'*   qcloud: Tencent Cloud'."\n"
                             .'*   aliyun: Alibaba Cloud'."\n"
@@ -1795,740 +1140,531 @@
                         'required' => true,
                         'enumValueTitles' => [],
                         'example' => 'hcloud',
-                        'enum' => [
-                            'qcloud',
-                            'hcloud',
-                            'aliyun',
-                        ],
+                        'enum' => ['qcloud', 'hcloud', 'aliyun'],
                     ],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The data management center of the threat analysis feature. Specify this parameter based on the region where your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions inside China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
+                        ."\n"
+                        .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
+                        .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n", 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'CloudSiemSuccessResponse<ListDataSourceLogsResult>',
+                        'title' => 'CloudSiemSuccessResponse<DeleteDataSourceLogResult>',
                         'description' => 'CloudSiemSuccessResponse'."\n",
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
+                                'title' => '',
                                 'description' => 'The data returned.'."\n",
                                 'type' => 'object',
                                 'properties' => [
-                                    'SubUserId' => [
-                                        'title' => '日志对应的阿里云账号ID。',
-                                        'description' => 'The ID of the Alibaba Cloud account.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int64',
-                                        'example' => '123XXXXXXXX',
-                                    ],
-                                    'DataSourceInstanceId' => [
-                                        'title' => '数据源ID，由威胁分析根据具体参数计算md5生成。',
-                                        'description' => 'The ID of the data source. The value is obtained after the threat analysis feature calculates the MD5 hash value of a parameter.'."\n",
-                                        'type' => 'string',
-                                        'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea',
-                                    ],
-                                    'DataSourceInstanceName' => [
-                                        'title' => '数据源名称。',
-                                        'description' => 'The name of the data source.'."\n",
-                                        'type' => 'string',
-                                        'example' => 'waf kafka',
-                                    ],
-                                    'DataSourceInstanceRemark' => [
-                                        'title' => '数据源备注。',
-                                        'description' => 'The remarks of the data source.'."\n",
-                                        'type' => 'string',
-                                        'example' => 'waf kafka',
-                                    ],
-                                    'DataSourceInstanceLogs' => [
-                                        'title' => '该数据源下日志列表。',
-                                        'description' => 'The logs of the data source.'."\n",
-                                        'type' => 'array',
-                                        'items' => [
-                                            'type' => 'object',
-                                            'properties' => [
-                                                'LogInstanceId' => [
-                                                    'title' => '日志的ID，由威胁分析根据具体参数计算md5生成。',
-                                                    'description' => 'The ID of the log. The value is obtained after the threat analysis feature calculates the MD5 hash value of a parameter.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea',
-                                                ],
-                                                'LogCode' => [
-                                                    'title' => '日志code。',
-                                                    'description' => 'The code of the log.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'cloud_siem_waf_xxxxx',
-                                                ],
-                                                'LogMdsCode' => [
-                                                    'title' => '日志显示code。',
-                                                    'description' => 'The display code of the log.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '${siem.prod.cloud_siem_waf_xxxxx}',
-                                                ],
-                                                'LogParams' => [
-                                                    'title' => '日志详细参数列表。',
-                                                    'description' => 'The parameters of the log.'."\n",
-                                                    'type' => 'array',
-                                                    'items' => [
-                                                        'description' => '',
-                                                        'type' => 'object',
-                                                        'properties' => [
-                                                            'ParaCode' => [
-                                                                'title' => '日志参数code。',
-                                                                'description' => 'The parameter code of the log.'."\n",
-                                                                'type' => 'string',
-                                                                'example' => 'region_code',
-                                                            ],
-                                                            'ParaValue' => [
-                                                                'title' => '日志参数值。',
-                                                                'description' => 'The parameter value of the log.'."\n",
-                                                                'type' => 'string',
-                                                                'example' => 'ap-guangzhou',
-                                                            ],
-                                                        ],
-                                                    ],
-                                                ],
-                                                'TaskStatus' => [
-                                                    'title' => '日志对应的接入任务状态。取值：'."\n"
-                                                        .' - 1：已接入。 '."\n"
-                                                        .' - 0：未接入。',
-                                                    'description' => 'Indicates whether the task for which logs are collected is enabled. Valid values:'."\n"
-                                                        ."\n"
-                                                        .'*   1: yes'."\n"
-                                                        .'*   0: no'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int32',
-                                                    'example' => '1',
-                                                ],
-                                            ],
-                                        ],
-                                    ],
-                                    'AccountId' => [
-                                        'title' => '云账号ID。',
-                                        'description' => 'The ID of the cloud account.'."\n",
-                                        'type' => 'string',
-                                        'example' => '123xxxxxxx',
-                                    ],
-                                    'CloudCode' => [
-                                        'title' => '多云的code。',
-                                        'description' => 'The code that is used for multi-cloud environments. Valid values:'."\n"
-                                            ."\n"
-                                            .'*   qcloud: Tencent Cloud'."\n"
-                                            .'*   aliyun: Alibaba Cloud'."\n"
-                                            .'*   hcloud: Huawei Cloud'."\n",
-                                        'type' => 'string',
-                                        'example' => 'hcloud',
-                                        'enum' => [
-                                            'qcloud',
-                                            'hcloud',
-                                        ],
-                                    ],
+                                    'Count' => ['title' => '', 'description' => 'The number of logs that are removed. The value 1 indicates that the log is removed, and a value less than or equal to 0 indicates that the log failed to be removed.'."\n", 'type' => 'integer', 'format' => 'int32', 'example' => '1'],
+                                    'LogInstanceId' => ['title' => '', 'description' => 'The ID of the log. The ID is an MD5 hash value that is calculated by the threat analysis feature based on specific parameters.'."\n", 'type' => 'string', 'example' => 'ef33097c9d1fdb0b9c7e8c7ca320pkl1'],
                                 ],
+                                'example' => '',
                             ],
-                            'RequestId' => [
-                                'title' => '请求消息ID。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****',
-                            ],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.'."\n", 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorCode' => 'InternalError',
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                    ],
+                    ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''],
                 ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"SubUserId\\": 0,\\n    \\"DataSourceInstanceId\\": \\"220ba97c9d1fdb0b9c7e8c7ca328d7ea\\",\\n    \\"DataSourceInstanceName\\": \\"waf kafka\\",\\n    \\"DataSourceInstanceRemark\\": \\"waf kafka\\",\\n    \\"DataSourceInstanceLogs\\": [\\n      {\\n        \\"LogInstanceId\\": \\"220ba97c9d1fdb0b9c7e8c7ca328d7ea\\",\\n        \\"LogCode\\": \\"cloud_siem_waf_xxxxx\\",\\n        \\"LogMdsCode\\": \\"${siem.prod.cloud_siem_waf_xxxxx}\\",\\n        \\"LogParams\\": [\\n          {\\n            \\"ParaCode\\": \\"region_code\\",\\n            \\"ParaValue\\": \\"ap-guangzhou\\"\\n          }\\n        ],\\n        \\"TaskStatus\\": 1\\n      }\\n    ],\\n    \\"AccountId\\": \\"123xxxxxxx\\",\\n    \\"CloudCode\\": \\"hcloud\\"\\n  },\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
-            'title' => 'ListDataSourceLogs',
-        ],
-        'ListBindDataSources' => [
-            'summary' => 'Queries a list of data sources that are added to the threat analysis feature.',
-            'methods' => [
-                'get',
-                'post',
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"Count\\": 1,\\n    \\"LogInstanceId\\": \\"ef33097c9d1fdb0b9c7e8c7ca320pkl1\\"\\n  },\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+            'title' => 'DeleteDataSourceLog',
+            'changeSet' => [],
+            'ramActions' => [
+                [
+                    'operationType' => 'delete',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DeleteDataSourceLog',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
-            'schemes' => [
-                'http',
-                'https',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DeleteDataSourceLog'],
+                ],
             ],
+        ],
+        'DeleteWhiteRuleList' => [
+            'summary' => 'Deletes an alert whitelist rule with the specified ID.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['https', 'http'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'read',
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'list',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-            ],
+            'systemTags' => ['operationType' => 'delete', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
-                    'name' => 'AccountId',
+                    'name' => 'Id',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '云账号ID。',
-                        'description' => 'The ID of the cloud account.'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => '123xxxxxxx',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The unique ID of the whitelist rule.', 'type' => 'integer', 'format' => 'int64', 'required' => true, 'example' => '123456789'],
                 ],
                 [
-                    'name' => 'CloudCode',
+                    'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '多云的code。',
-                        'description' => 'The code of the cloud service provider.'."\n"
-                            ."\n"
-                            .'Valid values:'."\n"
-                            ."\n"
-                            .'*   qcloud'."\n"
-                            .'*   hcloud'."\n"
-                            .'*   aliyun'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'hcloud',
-                        'enum' => [
-                            'qcloud',
-                            'hcloud',
-                            'aliyun',
-                        ],
-                    ],
+                    'schema' => ['description' => 'The view type.'."\n"
+                        ."\n"
+                        .'- 0: The view for the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: The view for all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
+                ],
+                [
+                    'name' => 'RoleFor',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The user ID of a member. An administrator can switch to the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region of the data management center for threat analysis. Select a region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: The assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: The assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'CloudSiemSuccessResponse<List<ListBindDataSourcesResult>>',
-                        'description' => 'CloudSiemSuccessResponse\\<List>'."\n",
+                        'title' => 'BaseResponse',
+                        'description' => 'BaseResponse',
                         'type' => 'object',
                         'properties' => [
-                            'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'array',
-                                'items' => [
-                                    'type' => 'object',
-                                    'properties' => [
-                                        'AccountName' => [
-                                            'title' => '多云账号名称。',
-                                            'description' => 'The username of the cloud account.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'sas_tq_account_xxxx',
-                                        ],
-                                        'DataSourceInstanceId' => [
-                                            'title' => '数据源ID，由威胁分析根据具体参数计算md5生成。',
-                                            'description' => 'The ID of the data source. The ID is an MD5 hash value that is calculated by the threat analysis feature based on specific parameters.'."\n",
-                                            'type' => 'string',
-                                            'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea',
-                                        ],
-                                        'DataSourceType' => [
-                                            'title' => '数据源类型。取值：'."\n"
-                                                .' - obs：华为云obs。'."\n"
-                                                .' - wafApi：腾讯云waf下载api。 '."\n"
-                                                .' - ckafka： 腾讯云ckafka。',
-                                            'description' => 'The type of the data source. Valid values:'."\n"
-                                                ."\n"
-                                                .'*   obs: Huawei Cloud Object Storage Service (OBS)'."\n"
-                                                .'*   wafApi: download API of Tencent Cloud Web Application Firewall (WAF)'."\n"
-                                                .'*   ckafka: Tencent Cloud Kafka (CKafka)'."\n",
-                                            'type' => 'string',
-                                            'example' => 'obs',
-                                        ],
-                                        'DataSourceName' => [
-                                            'title' => '数据源名称。',
-                                            'description' => 'The name of the data source.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'waf_kafka',
-                                        ],
-                                        'DataSourceRemark' => [
-                                            'title' => '数据源备注。',
-                                            'description' => 'The remarks on the data source.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'waf_kafka',
-                                        ],
-                                        'LogCount' => [
-                                            'title' => '该数据源下已添加的日志的数量。',
-                                            'description' => 'The number of logs that are added within the data source.'."\n",
-                                            'type' => 'integer',
-                                            'format' => 'int32',
-                                            'example' => '1',
-                                        ],
-                                        'TaskCount' => [
-                                            'title' => '该数据源下已创建的日志接入任务的数量。',
-                                            'description' => 'The number of existing tasks that are created to add logs within the data source.'."\n",
-                                            'type' => 'integer',
-                                            'format' => 'int32',
-                                            'example' => '0',
-                                        ],
-                                        'AccountId' => [
-                                            'title' => '云账号ID。',
-                                            'description' => 'The ID of the cloud account.'."\n",
-                                            'type' => 'string',
-                                            'example' => '123xxxxxxx',
-                                        ],
-                                        'CloudCode' => [
-                                            'title' => '多云的code。',
-                                            'description' => 'The code of the cloud service provider. Valid values:'."\n"
-                                                ."\n"
-                                                .'*   qcloud: Tencent Cloud'."\n"
-                                                .'*   aliyun: Alibaba Cloud'."\n"
-                                                .'*   hcloud: Huawei Cloud'."\n",
-                                            'type' => 'string',
-                                            'example' => 'hcloud',
-                                            'enum' => [
-                                                'qcloud',
-                                                'hcloud',
-                                            ],
-                                        ],
-                                    ],
-                                ],
-                            ],
-                            'RequestId' => [
-                                'title' => '请求消息ID。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****',
-                            ],
+                            'Data' => ['title' => '', 'description' => 'The data returned.', 'type' => 'any', 'example' => '123456'],
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The request was successful.'."\n"
+                                ."\n"
+                                .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The returned message.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorCode' => 'InternalError',
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"AccountName\\": \\"sas_tq_account_xxxx\\",\\n      \\"DataSourceInstanceId\\": \\"220ba97c9d1fdb0b9c7e8c7ca328d7ea\\",\\n      \\"DataSourceType\\": \\"obs\\",\\n      \\"DataSourceName\\": \\"waf_kafka\\",\\n      \\"DataSourceRemark\\": \\"waf_kafka\\",\\n      \\"LogCount\\": 1,\\n      \\"TaskCount\\": 0,\\n      \\"AccountId\\": \\"123xxxxxxx\\",\\n      \\"CloudCode\\": \\"hcloud\\"\\n    }\\n  ],\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
-            'title' => 'ListBindDataSources',
-        ],
-        'ListAllProds' => [
-            'summary' => 'Queries a list of cloud services that can be added to the threat analysis feature.',
-            'methods' => [
-                'get',
-                'post',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'DeleteWhiteRuleList',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:43:22.000Z', 'description' => 'Error codes changed, Request parameters changed'],
             ],
-            'schemes' => [
-                'http',
-                'https',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DeleteWhiteRuleList'],
+                ],
             ],
+            'ramActions' => [
+                [
+                    'operationType' => 'delete',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DeleteWhiteRuleList',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
+            ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": \\"123456\\",\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
+        ],
+        'DescribeAggregateFunction' => [
+            'methods' => ['get', 'post'],
+            'schemes' => ['https', 'http'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'read',
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'list',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-                'abilityTreeCode' => '195975',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
-            ],
+            'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            ."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['description' => 'The type of the view. Valid values:'."\n"
+                        ."\n"
+                        .'- 0: The view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: The view of all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The ID of the member. An administrator can switch to the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region where the data management center of Threat Analysis is located. Select a region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or Hong Kong (China).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in a region outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'CloudSiemSuccessResponse<ListAllProdsResult>',
-                        'description' => 'CloudSiemSuccessResponse'."\n",
+                        'title' => 'PlainResponse<List<RuleAggregateFunction>>',
+                        'description' => 'PlainResponse\\<List>',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'object',
-                                'properties' => [
-                                    'TotalCount' => [
-                                        'title' => '日志总数。',
-                                        'description' => 'The total number of logs.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '19',
-                                    ],
-                                    'PageSize' => [
-                                        'title' => '每页的大小。',
-                                        'description' => 'The number of entries per page.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '10',
-                                    ],
-                                    'CurrentPage' => [
-                                        'title' => '当前页。',
-                                        'description' => 'The page number.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '1',
-                                    ],
-                                    'ProdList' => [
-                                        'title' => '产品列表。',
-                                        'description' => 'The cloud services.'."\n",
-                                        'type' => 'array',
-                                        'items' => [
-                                            'type' => 'object',
-                                            'properties' => [
-                                                'ProdCode' => [
-                                                    'title' => '产品code。',
-                                                    'description' => 'The code of the cloud service.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'sas',
-                                                ],
-                                                'TotalLogCount' => [
-                                                    'title' => '该产品下总共的日志数量。',
-                                                    'description' => 'The total number of logs within the cloud service.'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int32',
-                                                    'example' => '19',
-                                                ],
-                                                'ImportedLogCount' => [
-                                                    'title' => '该产品下已经接入的日志数量。',
-                                                    'description' => 'The number of logs within the cloud service that are added to the threat analysis feature.'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int32',
-                                                    'example' => '10',
-                                                ],
-                                                'ModifyTime' => [
-                                                    'title' => '该产品下日志最近接入时间。',
-                                                    'description' => 'The time when the logs within the cloud service were last added to the threat analysis feature.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '2023-11-23 12:12:12',
-                                                ],
-                                                'CloudCode' => [
-                                                    'title' => '多云的code。',
-                                                    'description' => 'The code of the cloud service provider. Valid values:'."\n"
-                                                        ."\n"
-                                                        .'*   qcloud: Tencent Cloud.'."\n"
-                                                        .'*   aliyun: Alibaba Cloud.'."\n"
-                                                        .'*   hcloud: Huawei Cloud.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'hcloud',
-                                                    'enum' => [
-                                                        'qcloud',
-                                                        'hcloud',
-                                                        'aliyun',
-                                                    ],
-                                                ],
-                                            ],
-                                        ],
-                                        'example' => '1',
+                                'title' => '',
+                                'description' => 'The returned data.',
+                                'type' => 'array',
+                                'items' => [
+                                    'type' => 'object',
+                                    'properties' => [
+                                        'Function' => ['title' => '', 'description' => 'The aggregate function.', 'type' => 'string', 'example' => 'count'],
+                                        'FunctionName' => ['title' => '', 'description' => 'The display name of the aggregate function.', 'type' => 'string', 'example' => 'Count'],
                                     ],
+                                    'description' => '',
+                                    'title' => '',
+                                    'example' => '',
                                 ],
+                                'example' => '123456',
                             ],
-                            'RequestId' => [
-                                'title' => '请求消息ID。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****',
-                            ],
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The request was successful.'."\n"
+                                ."\n"
+                                .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The returned message.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorCode' => 'InternalError',
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'DescribeAggregateFunction',
+            'summary' => 'Describes the aggregate functions that are supported by custom rules.',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:43:22.000Z', 'description' => 'Error codes changed, Request parameters changed'],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"TotalCount\\": 19,\\n    \\"PageSize\\": 10,\\n    \\"CurrentPage\\": 1,\\n    \\"ProdList\\": [\\n      {\\n        \\"ProdCode\\": \\"sas\\",\\n        \\"TotalLogCount\\": 19,\\n        \\"ImportedLogCount\\": 10,\\n        \\"ModifyTime\\": \\"2023-11-23 12:12:12\\",\\n        \\"CloudCode\\": \\"hcloud\\"\\n      }\\n    ]\\n  },\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
-            'title' => 'ListAllProds',
-        ],
-        'EnableServiceForCloudSiem' => [
-            'summary' => 'Authorizes the threat analysis feature to access a resource directory. This operation must be called by the management account of the resource directory.',
-            'methods' => [
-                'get',
-                'post',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAggregateFunction'],
+                ],
             ],
-            'schemes' => [
-                'http',
-                'https',
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DescribeAggregateFunction',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"Function\\": \\"count\\",\\n      \\"FunctionName\\": \\"Count\\"\\n    }\\n  ],\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
+        ],
+        'DescribeAlertScene' => [
+            'methods' => ['get', 'post'],
+            'schemes' => ['https', 'http'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'write',
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'create',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-            ],
+            'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
+                    'name' => 'RoleType',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The type of the view.'."\n"
+                        ."\n"
+                        .'- 0: the view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: the view of all accounts within the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
+                ],
+                [
+                    'name' => 'RoleFor',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The user ID of the member. An administrator can use this ID to switch to the member\'s perspective.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
+                ],
+                [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region where the data management center of Threat Analysis is deployed. You must select the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'CloudSiemSuccessResponse<Boolean>',
-                        'description' => 'CloudSiemSuccessResponse'."\n",
+                        'title' => 'BaseResponse<List<SceneAndTarget>>',
+                        'description' => 'BaseResponse\\<List>',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'Indicates whether the threat analysis feature is authorized to access the resource directory. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求消息ID。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****',
+                                'title' => '',
+                                'description' => 'The data returned.',
+                                'type' => 'array',
+                                'items' => [
+                                    'type' => 'object',
+                                    'properties' => [
+                                        'AlertType' => ['title' => '', 'description' => 'The display name of the alert type. The value varies based on the language of the environment.', 'type' => 'string', 'example' => 'unusual login'],
+                                        'AlertTypeId' => ['title' => '', 'description' => 'The ID of the alert type.', 'type' => 'string', 'example' => 'unusual login'],
+                                        'AlertName' => ['title' => '', 'description' => 'The display name of the alert. The value varies based on the language of the environment.', 'type' => 'string', 'example' => 'login_common_ip'],
+                                        'AlertNameId' => ['title' => '', 'description' => 'The ID of the alert name.', 'type' => 'string', 'example' => 'login_common_ip'],
+                                        'AlertTile' => ['title' => '', 'description' => 'The display title of the alert. The value varies based on the language of the environment.', 'type' => 'string', 'example' => 'unusual login-login_common_ip'],
+                                        'AlertTileId' => ['title' => '', 'description' => 'The ID of the alert title.', 'type' => 'string', 'example' => 'unusual login-login_common_ip'],
+                                        'Targets' => [
+                                            'title' => '',
+                                            'description' => 'The objects that can be added to the whitelist.',
+                                            'type' => 'array',
+                                            'items' => [
+                                                'type' => 'object',
+                                                'properties' => [
+                                                    'Type' => ['title' => '', 'description' => 'The field of the entity that can be added to the whitelist.', 'type' => 'string', 'example' => 'host_uuid'],
+                                                    'Name' => ['title' => '', 'description' => 'The display name of the field of the entity that can be added to the whitelist.', 'type' => 'string', 'example' => 'HOST UUID'],
+                                                    'Value' => ['title' => '', 'description' => 'The default right operand that is displayed for the whitelist rule.', 'type' => 'string', 'example' => '441862da-a539-4cc0-a00d-47395582****'],
+                                                    'Values' => [
+                                                        'title' => '',
+                                                        'description' => 'The available right operands for the whitelist rule.',
+                                                        'type' => 'array',
+                                                        'items' => ['description' => 'The right operand.', 'type' => 'string', 'title' => '', 'example' => '[441862da-a539-4cc0-a00d-47395582****]'],
+                                                        'example' => '["441862da-a539-4cc0-a00d-473955826881"]',
+                                                    ],
+                                                ],
+                                                'description' => '',
+                                                'title' => '',
+                                                'example' => '',
+                                            ],
+                                            'example' => '[{"Type": "host_uuid","Value": "441862da-a539-4cc0-a00d-473955826881","Values": ["441862da-a539-4cc0-a00d-473955826881"],"Name": "${aliyun.siem.entity.host_uuid}"}]',
+                                        ],
+                                    ],
+                                    'description' => '',
+                                    'title' => '',
+                                    'example' => '',
+                                ],
+                                'example' => '123456',
                             ],
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The request was successful.'."\n"
+                                ."\n"
+                                .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The returned message.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorCode' => 'InternalError',
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": true,\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
-            'title' => 'EnableServiceForCloudSiem',
-        ],
-        'EnableAccessForCloudSiem' => [
-            'summary' => 'Creates a service-linked role named AliyunServiceRoleForSasCloudSiem for the threat analysis feature. The feature can assume this role to access cloud services.',
-            'methods' => [
-                'get',
-                'post',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'DescribeAlertScene',
+            'summary' => 'Queries the scenarios in which alerts can be whitelisted.',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:43:22.000Z', 'description' => 'Error codes changed, Request parameters changed'],
             ],
-            'schemes' => [
-                'http',
-                'https',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAlertScene'],
+                ],
             ],
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DescribeAlertScene',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
+            ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"AlertType\\": \\"unusual login\\",\\n      \\"AlertTypeId\\": \\"unusual login\\",\\n      \\"AlertName\\": \\"login_common_ip\\",\\n      \\"AlertNameId\\": \\"login_common_ip\\",\\n      \\"AlertTile\\": \\"unusual login-login_common_ip\\",\\n      \\"AlertTileId\\": \\"unusual login-login_common_ip\\",\\n      \\"Targets\\": [\\n        {\\n          \\"Type\\": \\"host_uuid\\",\\n          \\"Name\\": \\"HOST UUID\\",\\n          \\"Value\\": \\"441862da-a539-4cc0-a00d-47395582****\\",\\n          \\"Values\\": [\\n            \\"[441862da-a539-4cc0-a00d-47395582****]\\"\\n          ]\\n        }\\n      ]\\n    }\\n  ],\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
+        ],
+        'DescribeAlertSceneByEvent' => [
+            'summary' => 'Retrieves a list of alert whitelisting scenarios and objects.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['https', 'http'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'readAndWrite',
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'create',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-                'abilityTreeCode' => '158612',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
-            ],
+            'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
-                    'name' => 'AutoSubmit',
+                    'name' => 'IncidentUuid',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'Whether import the log of SAS alert, the log of WAF alert, the log of CFW alert or not. Valid values:'."\n"
-                            .'- 0: not imported automatically'."\n"
-                            .'- 1: imported automatically',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The event ID.', 'type' => 'string', 'required' => true, 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'],
                 ],
                 [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['description' => 'The view type.'."\n"
+                        ."\n"
+                        .'- 0: the view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: the view of all accounts that belong to the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member. This parameter is used when an administrator switches to the perspective of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The data management center of the threat analysis feature. Specify this parameter based on the region where your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions inside China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region of the Data Management center. Select a region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'CloudSiemSuccessResponse<Boolean>',
-                        'description' => 'CloudSiemSuccessResponse'."\n",
+                        'title' => 'BaseResponse<List<SceneAndTarget>>',
+                        'description' => 'BaseResponse\\<List>',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求消息ID。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****',
+                                'title' => '',
+                                'description' => 'The data returned.',
+                                'type' => 'array',
+                                'items' => [
+                                    'type' => 'object',
+                                    'properties' => [
+                                        'AlertType' => ['title' => '', 'description' => 'The display name of the alert type. The value varies based on the language settings.', 'type' => 'string', 'example' => 'Unusual Logon'],
+                                        'AlertTypeId' => ['title' => '', 'description' => 'The identifier of the alert type.', 'type' => 'string', 'example' => 'Unusual Logon'],
+                                        'AlertName' => ['title' => '', 'description' => 'The display name of the alert. The value varies based on the language settings.', 'type' => 'string', 'example' => 'login_common_ip'],
+                                        'AlertNameId' => ['title' => '', 'description' => 'The identifier of the alert name.', 'type' => 'string', 'example' => 'login_common_ip'],
+                                        'AlertTile' => ['title' => '', 'description' => 'The display title of the alert. The value varies based on the language settings.', 'type' => 'string', 'example' => 'Unusual Logon-login_common_ip'],
+                                        'AlertTileId' => ['title' => '', 'description' => 'The identifier of the alert title.', 'type' => 'string', 'example' => 'Unusual Logon-login_common_ip'],
+                                        'Targets' => [
+                                            'title' => '',
+                                            'description' => 'The objects to be whitelisted.',
+                                            'type' => 'array',
+                                            'items' => [
+                                                'type' => 'object',
+                                                'properties' => [
+                                                    'Type' => ['title' => '', 'description' => 'The field of the entity property that can be whitelisted.', 'type' => 'string', 'example' => 'host_uuid'],
+                                                    'Name' => ['title' => '', 'description' => 'The display name of the entity property field that can be whitelisted.', 'type' => 'string', 'example' => 'host uuid'],
+                                                    'Value' => ['title' => '', 'description' => 'The default right operand displayed for the whitelisting rule.', 'type' => 'string', 'example' => '441862da-a539-4cc0-a00d-47395582****'],
+                                                    'Values' => [
+                                                        'title' => '',
+                                                        'description' => 'The available right operands for the whitelisting rule.',
+                                                        'type' => 'array',
+                                                        'items' => ['description' => 'The right operand.', 'type' => 'string', 'title' => '', 'example' => '[441862da-a539-4cc0-a00d-47395582****]'],
+                                                        'example' => '["441862da-a539-4cc0-a00d-473955826881"]',
+                                                    ],
+                                                ],
+                                                'description' => '',
+                                                'title' => '',
+                                                'example' => '',
+                                            ],
+                                            'example' => '[{"Type": "host_uuid","Value": "441862da-a539-4cc0-a00d-473955826881","Values": ["441862da-a539-4cc0-a00d-473955826881"],"Name": "${aliyun.siem.entity.host_uuid}"}]',
+                                        ],
+                                    ],
+                                    'description' => '',
+                                    'title' => '',
+                                    'example' => '',
+                                ],
+                                'example' => '123456',
                             ],
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The request was successful.'."\n"
+                                ."\n"
+                                .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The message returned for the request.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorCode' => 'InternalError',
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'DescribeAlertSceneByEvent',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:43:24.000Z', 'description' => 'Error codes changed, Request parameters changed'],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": true,\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
-            'title' => 'EnableAccessForCloudSiem',
-        ],
-        'DescribeServiceStatus' => [
-            'summary' => 'Checks whether the threat analysis feature is authorized to access a resource directory.',
-            'methods' => [
-                'get',
-                'post',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAlertSceneByEvent'],
+                ],
             ],
-            'schemes' => [
-                'http',
-                'https',
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DescribeAlertSceneByEvent',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"AlertType\\": \\"Unusual Logon\\",\\n      \\"AlertTypeId\\": \\"Unusual Logon\\",\\n      \\"AlertName\\": \\"login_common_ip\\",\\n      \\"AlertNameId\\": \\"login_common_ip\\",\\n      \\"AlertTile\\": \\"Unusual Logon-login_common_ip\\",\\n      \\"AlertTileId\\": \\"Unusual Logon-login_common_ip\\",\\n      \\"Targets\\": [\\n        {\\n          \\"Type\\": \\"host_uuid\\",\\n          \\"Name\\": \\"host uuid\\",\\n          \\"Value\\": \\"441862da-a539-4cc0-a00d-47395582****\\",\\n          \\"Values\\": [\\n            \\"[441862da-a539-4cc0-a00d-47395582****]\\"\\n          ]\\n        }\\n      ]\\n    }\\n  ],\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
+        ],
+        'DescribeAlertSource' => [
+            'summary' => 'Retrieves a list of alert sources.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
@@ -2540,594 +1676,366 @@
                 'operationType' => 'get',
                 'riskType' => 'none',
                 'chargeType' => 'free',
+                'abilityTreeNodes' => ['FEATUREsasNB8R24'],
             ],
             'parameters' => [
                 [
-                    'name' => 'RegionId',
+                    'name' => 'Level',
                     'in' => 'formData',
+                    'style' => 'repeatList',
                     'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
+                        'title' => '',
+                        'description' => 'The threat levels. Valid values:'."\n"
                             ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
+                            .'- `serious`: High'."\n"
+                            ."\n"
+                            .'- `suspicious`: Medium'."\n"
+                            ."\n"
+                            .'- `remind`: Low',
+                        'type' => 'array',
+                        'items' => ['description' => 'A threat level. Valid values:'."\n"
+                            ."\n"
+                            .'- `serious`: High'."\n"
+                            ."\n"
+                            .'- `suspicious`: Medium'."\n"
+                            ."\n"
+                            .'- `remind`: Low', 'type' => 'string', 'required' => false, 'example' => '["remind","serious"]', 'title' => ''],
                         'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
-                ],
-            ],
-            'responses' => [
-                200 => [
-                    'schema' => [
-                        'title' => 'CloudSiemSuccessResponse<Boolean>',
-                        'description' => 'CloudSiemSuccessResponse'."\n",
-                        'type' => 'object',
-                        'properties' => [
-                            'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'Indicates whether the threat analysis feature is authorized to access the resource directory. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求消息ID。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****',
-                            ],
-                        ],
-                    ],
-                ],
-            ],
-            'errorCodes' => [
-                500 => [
-                    [
-                        'errorCode' => 'InternalError',
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
+                        'example' => '["serious","suspicious","remind"]',
+                        'maxItems' => 100,
                     ],
                 ],
-            ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": true,\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
-            'title' => 'DescribeServiceStatus',
-        ],
-        'DescribeProdCount' => [
-            'summary' => 'Queries the number of services that can be added to the threat analysis feature in Alibaba Cloud, Tenant Cloud, and Huawei Cloud.',
-            'methods' => [
-                'get',
-                'post',
-            ],
-            'schemes' => [
-                'http',
-                'https',
-            ],
-            'security' => [
                 [
-                    'AK' => [],
+                    'name' => 'StartTime',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The start of the query time range. The value is a UNIX timestamp in milliseconds.', 'type' => 'integer', 'format' => 'int64', 'example' => '1577808000000', 'title' => '', 'required' => false],
                 ],
-            ],
-            'operationType' => 'read',
-            'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'get',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-                'abilityTreeCode' => '195547',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
+                [
+                    'name' => 'EndTime',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The end of the query time range. The value is a UNIX timestamp in milliseconds.', 'type' => 'integer', 'format' => 'int64', 'example' => '1577808000000', 'title' => '', 'required' => false],
                 ],
-            ],
-            'parameters' => [
                 [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '0，单账号登录；1，全局视图；2，切换视图；3，局部视图',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                    ],
+                    'schema' => ['description' => 'The type of view. Valid values:'."\n"
+                        ."\n"
+                        .'- `0`: View data for the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- `1`: View data for all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'integer',
-                        'format' => 'int64',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member whose data you want to view. An administrator uses this parameter to view data from the perspective of a specific member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The data management center of the threat analysis feature. Specify this parameter based on the region where your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions inside China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['description' => 'The region of the data management center for threat analysis. Select the data management center that corresponds to the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- `cn-hangzhou`: for assets in the Chinese mainland and Hong Kong (China).'."\n"
+                        ."\n"
+                        .'- `ap-southeast-1`: for assets in regions outside the Chinese mainland.', 'type' => 'string', 'example' => 'cn-hangzhou', 'title' => '', 'required' => false],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'CloudSiemSuccessResponse<DescribeProdCountResult>',
-                        'description' => 'CloudSiemSuccessResponse'."\n",
+                        'title' => 'BaseResponse<List<AlertSource>>',
+                        'description' => 'BaseResponse\\<List>',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'object',
-                                'properties' => [
-                                    'AliyunProdCount' => [
-                                        'title' => '阿里云产品的数量。',
-                                        'description' => 'The number of Alibaba Cloud services.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '19',
-                                    ],
-                                    'HcloudProdCount' => [
-                                        'title' => '华为云产品的数量。',
-                                        'description' => 'The number of Huawei Cloud services.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '2',
-                                    ],
-                                    'QcloudProdCount' => [
-                                        'title' => '腾讯云产品的数量。',
-                                        'description' => 'The number of Tencent Cloud services.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '2',
-                                    ],
-                                    'IdcProdCount' => [
-                                        'title' => 'IDC产品的数量。',
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '2',
-                                    ],
-                                    'AliyunImportedCount' => [
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                    ],
-                                    'HcloudImportedCount' => [
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                    ],
-                                    'QcloudImportedCount' => [
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                    ],
-                                    'IdcImportedCount' => [
-                                        'type' => 'integer',
-                                        'format' => 'int32',
+                                'title' => '',
+                                'description' => 'The list of alert sources.',
+                                'type' => 'array',
+                                'items' => [
+                                    'type' => 'object',
+                                    'properties' => [
+                                        'SourceName' => ['description' => 'The name of the alert source.', 'type' => 'string', 'example' => 'sas', 'title' => ''],
+                                        'Source' => ['description' => 'The internal code for the alert source.', 'type' => 'string', 'title' => '', 'example' => 'aliyun.siem.alert_datasource.sas'],
+                                        'Modules' => [
+                                            'type' => 'array',
+                                            'items' => ['description' => 'A module.', 'type' => 'string', 'example' => 'alibaba_cloud_sas_cwpp', 'title' => ''],
+                                            'description' => 'The list of modules.',
+                                            'title' => '',
+                                            'example' => '',
+                                        ],
                                     ],
+                                    'description' => '',
+                                    'title' => '',
+                                    'example' => '',
                                 ],
+                                'example' => '123456',
                             ],
-                            'RequestId' => [
-                                'title' => '请求消息ID。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****',
-                            ],
+                            'Success' => ['description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- `true`: The request was successful.'."\n"
+                                ."\n"
+                                .'- `false`: The request failed.', 'type' => 'boolean', 'example' => 'true', 'title' => ''],
+                            'Code' => ['description' => 'The status code of the response. A value of 200 indicates success.', 'type' => 'integer', 'format' => 'int32', 'example' => '200', 'title' => ''],
+                            'Message' => ['description' => 'The response message.', 'type' => 'string', 'example' => 'success', 'title' => ''],
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', 'title' => ''],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorCode' => 'InternalError',
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"SourceName\\": \\"sas\\",\\n      \\"Source\\": \\"aliyun.siem.alert_datasource.sas\\",\\n      \\"Modules\\": [\\n        \\"alibaba_cloud_sas_cwpp\\"\\n      ]\\n    }\\n  ],\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
+            'title' => 'DescribeAlertSource',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:43:24.000Z', 'description' => 'Error codes changed, Request parameters changed'],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"AliyunProdCount\\": 19,\\n    \\"HcloudProdCount\\": 2,\\n    \\"QcloudProdCount\\": 2,\\n    \\"IdcProdCount\\": 2,\\n    \\"AliyunImportedCount\\": 2,\\n    \\"HcloudImportedCount\\": 2,\\n    \\"QcloudImportedCount\\": 2,\\n    \\"IdcImportedCount\\": 2\\n  },\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
-            'title' => 'DescribeProdCount',
-        ],
-        'DescribeImportedLogCount' => [
-            'summary' => 'Queries the number of logs that are added to the threat analysis feature.',
-            'methods' => [
-                'get',
-                'post',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAlertSource'],
+                ],
             ],
-            'schemes' => [
-                'http',
-                'https',
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DescribeAlertSource',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+        ],
+        'DescribeAlertSourceWithEvent' => [
+            'methods' => ['get', 'post'],
+            'schemes' => ['https', 'http'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'read',
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'get',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-                'abilityTreeCode' => '195544',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
-            ],
+            'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
-                    'name' => 'RegionId',
+                    'name' => 'IncidentUuid',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The globally unique ID of the event.', 'type' => 'string', 'required' => false, 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'],
                 ],
                 [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'string',
-                        'pattern' => '^\\d+$',
-                    ],
+                    'schema' => ['description' => 'The type of the view.'."\n"
+                        ."\n"
+                        .'- 0: The view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: The view of all accounts that are managed by the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'string',
-                        'pattern' => '^\\d+$',
-                    ],
+                    'schema' => ['description' => 'The ID of the member whose data you want to view. An administrator can use this parameter to switch to the perspective of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
+                ],
+                [
+                    'name' => 'RegionId',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The region where the Data Management center of Threat Analysis is located. Select a region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in China.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'CloudSiemSuccessResponse<DescribeImportedLogCountResult>',
-                        'description' => 'CloudSiemSuccessResponse'."\n",
+                        'title' => 'BaseResponse<List<AlertSource>>',
+                        'description' => 'BaseResponse\\<List>',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'object',
-                                'properties' => [
-                                    'TotalLogCount' => [
-                                        'title' => '日志总数。',
-                                        'description' => 'The total number of logs.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '59',
-                                    ],
-                                    'ImportedLogCount' => [
-                                        'title' => '已接入的日志的数量。',
-                                        'description' => 'The number of logs that are added.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '10',
-                                    ],
-                                    'UnImportedLogCount' => [
-                                        'title' => '未接入的日志的数量。',
-                                        'description' => 'The number of logs that are not added.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '49',
+                                'title' => '',
+                                'description' => 'The data returned.',
+                                'type' => 'array',
+                                'items' => [
+                                    'type' => 'object',
+                                    'properties' => [
+                                        'SourceName' => ['title' => '', 'description' => 'The name of the alert data source.', 'type' => 'string', 'example' => 'sas'],
+                                        'Source' => ['title' => '', 'description' => 'The Medusa code for the alert data source.', 'type' => 'string', 'example' => 'aliyun.siem.alert_datasource.sas'],
                                     ],
+                                    'description' => '',
+                                    'title' => '',
+                                    'example' => '',
                                 ],
+                                'example' => '123456',
                             ],
-                            'RequestId' => [
-                                'title' => '请求消息ID。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****',
-                            ],
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The request was successful.'."\n"
+                                ."\n"
+                                .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The returned message.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorCode' => 'InternalError',
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'DescribeAlertSourceWithEvent',
+            'summary' => 'Retrieves the alert data sources associated with an event.',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:43:24.000Z', 'description' => 'Error codes changed, Request parameters changed'],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"TotalLogCount\\": 59,\\n    \\"ImportedLogCount\\": 10,\\n    \\"UnImportedLogCount\\": 49\\n  },\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
-            'title' => 'DescribeImportedLogCount',
-        ],
-        'DescribeDataSourceParameters' => [
-            'summary' => 'Queries the parameters of a data source.',
-            'methods' => [
-                'get',
-                'post',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAlertSourceWithEvent'],
+                ],
             ],
-            'schemes' => [
-                'http',
-                'https',
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DescribeAlertSourceWithEvent',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"SourceName\\": \\"sas\\",\\n      \\"Source\\": \\"aliyun.siem.alert_datasource.sas\\"\\n    }\\n  ],\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
+        ],
+        'DescribeAlertType' => [
+            'summary' => 'Retrieves a list of threat types for custom rules.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['https', 'http'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'read',
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'get',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-            ],
+            'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
-                    'name' => 'DataSourceType',
+                    'name' => 'RuleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '接入的数据源类型。 取值: '."\n"
-                            .' - ckafka：腾讯云ckafka。 '."\n"
-                            .' - obs：华为云obs。 '."\n"
-                            .' - wafApi：腾讯云waf攻击日志下载api。 ',
-                        'description' => 'The type of the data source. Valid values:'."\n"
-                            ."\n"
-                            .'*   **ckafka**: Tencent Cloud TDMQ for CKafka'."\n"
-                            .'*   **obs**: Huawei Cloud Object Storage Service (OBS)'."\n"
-                            .'*   **wafApi**: download API of Tencent Cloud Web Application Firewall (WAF)'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'obs',
-                    ],
+                    'schema' => ['title' => '规则类型。 取值：'."\n"
+                        .'- predefine：预定义'."\n"
+                        .'- customize：自定义', 'description' => 'The type of the rule. Valid values:'."\n"
+                        ."\n"
+                        .'- predefine: predefined'."\n"
+                        ."\n"
+                        .'- customize: custom', 'type' => 'string', 'required' => false, 'example' => 'customize'],
                 ],
                 [
-                    'name' => 'CloudCode',
+                    'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '多云的code。',
-                        'description' => 'The code of the cloud service provider.'."\n"
-                            ."\n"
-                            .'Valid values:'."\n"
-                            ."\n"
-                            .'*   qcloud'."\n"
-                            .'*   hcloud'."\n"
-                            .'*   aliyun'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'hcloud',
-                        'enum' => [
-                            'qcloud',
-                            'hcloud',
-                            'aliyun',
-                        ],
-                    ],
+                    'schema' => ['description' => 'The type of the view.'."\n"
+                        ."\n"
+                        .'- 0: The view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: The view of all accounts in your enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
+                ],
+                [
+                    'name' => 'RoleFor',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The user ID of a member. An administrator can use this parameter to switch to the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region where the Data Management center is located. Select a region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'CloudSiemSuccessResponse<List<DescribeDataSourceParametersResult>>',
-                        'description' => 'CloudSiemSuccessResponse\\<List>'."\n",
+                        'title' => 'PlainResponse<List<AlertType>>',
+                        'description' => 'PlainResponse\\<List>',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
+                                'title' => '',
+                                'description' => 'The data returned.',
                                 'type' => 'array',
                                 'items' => [
-                                    'description' => '',
                                     'type' => 'object',
                                     'properties' => [
-                                        'DataSourceType' => [
-                                            'title' => '数据源类型。取值：'."\n"
-                                                .' - obs：华为云obs。'."\n"
-                                                .' - wafApi：腾讯云waf下载api。 '."\n"
-                                                .' - ckafka： 腾讯云ckafka。',
-                                            'description' => 'The type of the data source. Valid values:'."\n"
-                                                ."\n"
-                                                .'*   **obs**: Huawei Cloud Object Storage Service (OBS)'."\n"
-                                                .'*   **wafApi**: download API of Tencent Cloud Web Application Firewall (WAF)'."\n"
-                                                .'*   **ckafka**: Tencent Cloud TDMQ for CKafka'."\n",
-                                            'type' => 'string',
-                                            'example' => 'obs',
-                                        ],
-                                        'ParaLevel' => [
-                                            'title' => '参数级别。取值：'."\n"
-                                                .' - 1：数据源参数。'."\n"
-                                                .'- 2：日志参数。',
-                                            'description' => 'The parameter level. Valid values:'."\n"
-                                                ."\n"
-                                                .'*   **1**: the parameters of the data source'."\n"
-                                                .'*   **2**: the parameters of the log'."\n",
-                                            'type' => 'integer',
-                                            'format' => 'int32',
-                                            'example' => '1',
-                                        ],
-                                        'ParaCode' => [
-                                            'title' => '参数code。',
-                                            'description' => 'The code of the parameter.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'region_code',
-                                        ],
-                                        'ParaName' => [
-                                            'title' => '参数名字。',
-                                            'description' => 'The name of the parameter.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'region local',
-                                        ],
-                                        'ParaType' => [
-                                            'title' => '参数类型。',
-                                            'description' => 'The data type of the parameter.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'string',
-                                        ],
-                                        'Required' => [
-                                            'title' => '是否必选参数。取值：'."\n"
-                                                .' - 1：必选。'."\n"
-                                                .' - 0：非必选。',
-                                            'description' => 'Indicates whether the parameter is required. Valid values:'."\n"
-                                                ."\n"
-                                                .'*   **1**: required'."\n"
-                                                .'*   **0**: optional'."\n",
-                                            'type' => 'integer',
-                                            'format' => 'int32',
-                                            'example' => 'string',
-                                        ],
-                                        'FormatCheck' => [
-                                            'title' => '格式校验方式。',
-                                            'description' => 'The method that is used to check the parameter format.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'email',
-                                        ],
-                                        'Title' => [
-                                            'title' => '参数值提示。',
-                                            'description' => 'The note for the parameter value.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'obs bucket name',
-                                        ],
-                                        'Hit' => [
-                                            'title' => '更多说明。',
-                                            'description' => 'The additional information.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'obs docment',
-                                        ],
-                                        'DefaultValue' => [
-                                            'title' => '默认参数值。',
-                                            'description' => 'The default value of the parameter.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'wafApi',
-                                        ],
-                                        'Disabled' => [
-                                            'title' => '是否禁止修改。取值：'."\n"
-                                                .' - true：禁止修改。 '."\n"
-                                                .' - false：可以修改。',
-                                            'description' => 'Indicates whether the modification operation is forbidden. Valid values:'."\n"
-                                                ."\n"
-                                                .'*   **true**'."\n"
-                                                .'*   **false**'."\n",
-                                            'type' => 'boolean',
-                                            'example' => 'wafApi',
-                                        ],
-                                        'CanEditted' => [
-                                            'title' => '是否可编辑。取值：'."\n"
-                                                .' - 0：禁止修改。 '."\n"
-                                                .' - 1：可以修改。',
-                                            'description' => 'Indicates whether the edit operation is supported. Valid values:'."\n"
-                                                ."\n"
-                                                .'*   **0**'."\n"
-                                                .'*   **1**'."\n",
-                                            'type' => 'integer',
-                                            'format' => 'int32',
-                                            'example' => 'wafApi',
-                                        ],
-                                        'ParamValue' => [
-                                            'title' => '具体的参数列表。',
-                                            'description' => 'The value of the parameter.'."\n",
-                                            'type' => 'array',
-                                            'items' => [
-                                                'description' => '',
-                                                'type' => 'object',
-                                                'properties' => [
-                                                    'Label' => [
-                                                        'title' => '展示内容。',
-                                                        'description' => 'The display value.'."\n",
-                                                        'type' => 'string',
-                                                        'example' => 'guangzhou',
-                                                    ],
-                                                    'Value' => [
-                                                        'title' => '实际的参数内容。',
-                                                        'description' => 'The actual value.'."\n",
-                                                        'type' => 'string',
-                                                        'example' => 'ap-guangzhou',
-                                                    ],
-                                                ],
-                                            ],
-                                        ],
-                                        'CloudCode' => [
-                                            'title' => '多云的code。',
-                                            'description' => 'The code of the cloud service provider. Valid values:'."\n"
-                                                ."\n"
-                                                .'*   **qcloud**: Tencent Cloud'."\n"
-                                                .'*   **aliyun**: Alibaba Cloud'."\n"
-                                                .'*   **hcloud**: Huawei Cloud'."\n",
-                                            'type' => 'string',
-                                            'example' => 'hcloud',
-                                            'enum' => [
-                                                'qcloud',
-                                                'hcloud',
-                                            ],
-                                        ],
+                                        'AlertType' => ['title' => '', 'description' => 'The threat type.', 'type' => 'string', 'example' => 'WEBSHELL'],
+                                        'AlertTypeMds' => ['title' => '', 'description' => 'The Medusa code of the threat type.', 'type' => 'string', 'example' => 'siem_rule_type_process_abnormal_command'],
                                     ],
+                                    'description' => '',
+                                    'title' => '',
+                                    'example' => '',
                                 ],
+                                'example' => '123456',
                             ],
-                            'RequestId' => [
-                                'title' => '请求消息ID。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****',
-                            ],
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The request was successful.'."\n"
+                                ."\n"
+                                .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The request status code.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The returned message.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorCode' => 'InternalError',
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"DataSourceType\\": \\"obs\\",\\n      \\"ParaLevel\\": 1,\\n      \\"ParaCode\\": \\"region_code\\",\\n      \\"ParaName\\": \\"region local\\",\\n      \\"ParaType\\": \\"string\\",\\n      \\"Required\\": 0,\\n      \\"FormatCheck\\": \\"email\\",\\n      \\"Title\\": \\"obs bucket name\\",\\n      \\"Hit\\": \\"obs docment\\",\\n      \\"DefaultValue\\": \\"wafApi\\",\\n      \\"Disabled\\": true,\\n      \\"CanEditted\\": 0,\\n      \\"ParamValue\\": [\\n        {\\n          \\"Label\\": \\"guangzhou\\",\\n          \\"Value\\": \\"ap-guangzhou\\"\\n        }\\n      ],\\n      \\"CloudCode\\": \\"hcloud\\"\\n    }\\n  ],\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
-            'title' => 'DescribeDataSourceParameters',
-        ],
-        'DescribeDataSourceInstance' => [
-            'summary' => 'Queries the details of a data source.',
-            'methods' => [
-                'get',
-                'post',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'DescribeAlertType',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:43:22.000Z', 'description' => 'Error codes changed, Request parameters changed'],
             ],
-            'schemes' => [
-                'http',
-                'https',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAlertType'],
+                ],
             ],
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DescribeAlertType',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
+            ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"AlertType\\": \\"WEBSHELL\\",\\n      \\"AlertTypeMds\\": \\"siem_rule_type_process_abnormal_command\\"\\n    }\\n  ],\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
+        ],
+        'DescribeAlerts' => [
+            'summary' => 'Gets the list of alerts for a user.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
@@ -3139,1528 +2047,1715 @@
                 'operationType' => 'get',
                 'riskType' => 'none',
                 'chargeType' => 'free',
+                'abilityTreeNodes' => ['FEATUREsas731ZAS'],
             ],
             'parameters' => [
                 [
-                    'name' => 'DataSourceInstanceId',
+                    'name' => 'AlertUuid',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '数据源ID，由威胁分析根据具体参数计算md5生成。',
-                        'description' => 'The ID of the data source. The ID is an MD5 hash value that is calculated by the threat analysis feature based on specific parameters. You can call the [ListDataSourceLogs](https://api.aliyun-inc.com/#/publishment/document/cloud-siem/863fdf54478f4cc5877e27c2a5fe9e44?tenantUuid=f382fccd88b94c5c8c864def6815b854\\&activeTabKey=api%7CListDataSourceLogs) operation to query the IDs of data sources.'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea',
-                    ],
+                    'schema' => ['description' => 'The unique ID of the alert.', 'type' => 'string', 'example' => 'sas_71e24437d2797ce8fc59692905a4****', 'title' => '', 'required' => false],
                 ],
                 [
-                    'name' => 'AccountId',
+                    'name' => 'Level',
                     'in' => 'formData',
+                    'style' => 'repeatList',
                     'schema' => [
-                        'title' => '云账号ID。',
-                        'description' => 'The ID of the cloud account.'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => '123xxxxxxx',
+                        'title' => '',
+                        'description' => 'The threat levels. This parameter is a JSON array. Valid values:'."\n"
+                            ."\n"
+                            .'- `serious`: high'."\n"
+                            ."\n"
+                            .'- `suspicious`: medium'."\n"
+                            ."\n"
+                            .'- `remind`: low',
+                        'type' => 'array',
+                        'items' => ['description' => 'The threat level. Valid values:'."\n"
+                            ."\n"
+                            .'- `serious`: high'."\n"
+                            ."\n"
+                            .'- `suspicious`: medium'."\n"
+                            ."\n"
+                            .'- `remind`: low', 'type' => 'string', 'required' => false, 'example' => '["remind","serious"]', 'title' => ''],
+                        'required' => false,
+                        'example' => '["serious","suspicious","remind"]',
+                        'maxItems' => 100,
                     ],
                 ],
                 [
-                    'name' => 'CloudCode',
+                    'name' => 'Source',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '多云的code。',
-                        'description' => 'The code of the cloud service provider. Valid values:'."\n"
-                            ."\n"
-                            .'*   qcloud: Tencent Cloud'."\n"
-                            .'*   aliyun: Alibaba Cloud'."\n"
-                            .'*   hcloud: Huawei Cloud'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'hcloud',
-                        'enum' => [
-                            'qcloud',
-                            'hcloud',
-                            'aliyun',
-                        ],
-                    ],
+                    'schema' => ['description' => 'The source of the alert.', 'type' => 'string', 'example' => 'sas', 'title' => '', 'required' => false],
                 ],
                 [
-                    'name' => 'RegionId',
+                    'name' => 'IsDefend',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'Specifies whether the threat is defended. Valid values:'."\n"
+                        ."\n"
+                        .'- `0`: detected'."\n"
+                        ."\n"
+                        .'- `1`: blocked', 'type' => 'string', 'title' => '', 'required' => false, 'example' => '1'],
+                ],
+                [
+                    'name' => 'AlertTitle',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The title of the alert.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => 'Unusual Logon-login_common_account'],
+                ],
+                [
+                    'name' => 'AlertType',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The type of the alert.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => 'Scan'],
+                ],
+                [
+                    'name' => 'AlertName',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The name of the alert.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => 'Try SNMP weak password'."\n"],
+                ],
+                [
+                    'name' => 'AssetName',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The name of the asset.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => 'hostname-****'."\n"],
+                ],
+                [
+                    'name' => 'AssetId',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The ID of the asset.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => 'F3385128-69A5-3EE8-BD05-FBEE7DB2****'],
+                ],
+                [
+                    'name' => 'EntityName',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The name of the entity.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => 'launch-advisor-*****'."\n"],
+                ],
+                [
+                    'name' => 'EntityId',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The ID of the entity.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => 'f366e287ea530e7a324cbe987993****'],
+                ],
+                [
+                    'name' => 'SubUserId',
                     'in' => 'formData',
+                    'schema' => ['description' => 'The ID of the Alibaba Cloud account that is associated with the alert.', 'type' => 'string', 'example' => '176555323***', 'title' => '', 'required' => false],
+                ],
+                [
+                    'name' => 'LabelType',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The alert type. Valid values:'."\n"
+                        ."\n"
+                        .'- `system`: An alert generated from aggregated analysis'."\n"
+                        ."\n"
+                        .'- `custom`: An alert generated from custom analysis'."\n"
+                        ."\n"
+                        .'- `cfw`: firewall'."\n"
+                        ."\n"
+                        .'- `waf`: web application firewall'."\n"
+                        ."\n"
+                        .'- `edr`: endpoint detection and response'."\n"
+                        ."\n"
+                        .'- `other`: other', 'type' => 'string', 'example' => 'custom', 'title' => '', 'required' => false],
+                ],
+                [
+                    'name' => 'AlertStatus',
+                    'in' => 'formData',
+                    'style' => 'repeatList',
                     'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
+                        'type' => 'array',
+                        'items' => ['description' => 'The status of the alert.', 'type' => 'string', 'example' => '1', 'title' => '', 'required' => false],
+                        'maxItems' => 100,
+                        'description' => 'The status of the alert.',
+                        'title' => '',
+                        'example' => '',
                         'required' => false,
-                        'example' => 'cn-hangzhou',
                     ],
                 ],
+                [
+                    'name' => 'StartTime',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The beginning of the time range to query. This value is a UNIX timestamp representing the number of milliseconds that have elapsed since January 1, 1970, 00:00:00 UTC.', 'type' => 'integer', 'format' => 'int64', 'example' => '1577808000000', 'title' => '', 'required' => false],
+                ],
+                [
+                    'name' => 'EndTime',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The end of the time range to query. This value is a UNIX timestamp representing the number of milliseconds that have elapsed since January 1, 1970, 00:00:00 UTC.', 'type' => 'integer', 'format' => 'int64', 'example' => '1577808000000', 'title' => '', 'required' => false],
+                ],
+                [
+                    'name' => 'CurrentPage',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The page number. The value must be greater than or equal to 1.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'minimum' => '1', 'example' => '1', 'title' => ''],
+                ],
+                [
+                    'name' => 'PageSize',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The number of entries per page. Maximum value: 100.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'maximum' => '100', 'minimum' => '1', 'example' => '10', 'title' => ''],
+                ],
+                [
+                    'name' => 'RoleType',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The view type of the alert. Valid values:'."\n"
+                        ."\n"
+                        .'- `0`: current account'."\n"
+                        ."\n"
+                        .'- `1`: all accounts', 'type' => 'integer', 'format' => 'int32', 'title' => '', 'required' => false, 'example' => '1'],
+                ],
+                [
+                    'name' => 'RoleFor',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The ID of the user who is used to switch the account to view the data of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''],
+                ],
+                [
+                    'name' => 'RegionId',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The region where the data management center of the threat analysis feature resides. You are required to specify this parameter based on the region where your assets reside. Valid values:'."\n"
+                        ."\n"
+                        .'- `cn-hangzhou`: Your assets reside in the Chinese mainland or Hong Kong (China).'."\n"
+                        ."\n"
+                        .'- `ap-southeast-1`: Your assets reside outside the Chinese mainland.', 'type' => 'string', 'example' => 'cn-hangzhou', 'title' => '', 'required' => false],
+                ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'CloudSiemSuccessResponse<DescribeDataSourceInstanceResult>',
-                        'description' => 'CloudSiemSuccessResponse'."\n",
+                        'title' => 'PageResponse<List<AlertDetail>>',
+                        'description' => 'PageResponse\\<List>',
                         'type' => 'object',
                         'properties' => [
+                            'Success' => ['description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- `true`: The request was successful.'."\n"
+                                ."\n"
+                                .'- `false`: The request failed.', 'type' => 'boolean', 'example' => 'true', 'title' => ''],
+                            'Code' => ['description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200', 'title' => ''],
+                            'Message' => ['description' => 'The response message.', 'type' => 'string', 'example' => 'success', 'title' => ''],
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', 'title' => ''],
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
+                                'title' => '',
+                                'description' => 'The response data.',
                                 'type' => 'object',
                                 'properties' => [
-                                    'DataSourceInstanceId' => [
-                                        'title' => '数据源ID，由威胁分析根据具体参数计算md5生成。',
-                                        'description' => 'The ID of the data source. The ID is an MD5 hash value that is calculated by the threat analysis feature based on specific parameters.'."\n",
-                                        'type' => 'string',
-                                        'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea',
+                                    'PageInfo' => [
+                                        'title' => '',
+                                        'description' => 'The paging information.',
+                                        'type' => 'object',
+                                        'properties' => [
+                                            'CurrentPage' => ['description' => 'The current page number.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''],
+                                            'PageSize' => ['description' => 'The number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10', 'title' => ''],
+                                            'TotalCount' => ['description' => 'The total number of entries.', 'type' => 'integer', 'format' => 'int64', 'example' => '100', 'title' => ''],
+                                        ],
+                                        'example' => '',
                                     ],
-                                    'DataSourceInstanceParams' => [
-                                        'title' => '数据源的详细参数列表。',
-                                        'description' => 'The parameters of the data source.'."\n",
+                                    'ResponseData' => [
+                                        'title' => '',
+                                        'description' => 'A list of alerts.',
                                         'type' => 'array',
                                         'items' => [
                                             'type' => 'object',
                                             'properties' => [
-                                                'ParaCode' => [
-                                                    'title' => '参数code。',
-                                                    'description' => 'The code of the parameter.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'region_code',
-                                                ],
-                                                'ParaValue' => [
-                                                    'title' => '参数值。',
-                                                    'description' => 'The value of the parameter.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'ap-guangzhou',
+                                                'Id' => ['description' => 'The unique ID of the alert.', 'type' => 'integer', 'format' => 'int64', 'example' => '123456789', 'title' => ''],
+                                                'GmtCreate' => ['description' => 'The time when the alert was stored in the database.', 'type' => 'string', 'example' => '2021-01-06 16:37:29', 'title' => ''],
+                                                'GmtModified' => ['description' => 'The time when the alert was last updated.', 'type' => 'string', 'example' => '2021-01-06 16:37:29', 'title' => ''],
+                                                'MainUserId' => ['description' => 'The ID of the main account associated with the alert.', 'type' => 'integer', 'format' => 'int64', 'example' => '127608589417****', 'title' => ''],
+                                                'IncidentUuid' => ['description' => 'The UUID of the event.', 'type' => 'string', 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', 'title' => ''],
+                                                'AlertUuid' => ['description' => 'The UUID of the alert.', 'type' => 'string', 'example' => 'sas_71e24437d2797ce8fc59692905a4****', 'title' => ''],
+                                                'LogTime' => ['description' => 'The time when the alert was recorded.', 'type' => 'string', 'example' => '2021-01-06 16:37:29', 'title' => ''],
+                                                'AlertSrcProd' => ['description' => 'The product that generated the alert.', 'type' => 'string', 'example' => 'sas', 'title' => ''],
+                                                'AlertTitle' => ['description' => 'The title of the alert.', 'type' => 'string', 'example' => 'Scan-Try SNMP weak password', 'title' => ''],
+                                                'AlertTitleEn' => ['description' => 'The English title of the alert.', 'type' => 'string', 'example' => 'Scan-Try SNMP weak password', 'title' => ''],
+                                                'AlertType' => ['description' => 'The type of the alert.', 'type' => 'string', 'example' => 'Scan', 'title' => ''],
+                                                'AlertTypeEn' => ['description' => 'The English type of the alert.', 'type' => 'string', 'example' => 'Scan', 'title' => ''],
+                                                'AlertTypeCode' => ['description' => 'The internal code for the alert type.', 'type' => 'string', 'example' => 'security_event_config.event_name.webshellName', 'title' => ''],
+                                                'AlertName' => ['description' => 'The name of the alert.', 'type' => 'string', 'title' => '', 'example' => 'Try SNMP weak password'],
+                                                'AlertNameEn' => ['description' => 'The English name of the alert.', 'type' => 'string', 'example' => 'Try SNMP weak password', 'title' => ''],
+                                                'AlertNameCode' => ['description' => 'The internal code for the alert name.', 'type' => 'string', 'example' => 'security_event_config.event_name.webshell', 'title' => ''],
+                                                'AlertLevel' => ['description' => 'The threat level. Valid values:'."\n"
+                                                    ."\n"
+                                                    .'- `serious`: high'."\n"
+                                                    ."\n"
+                                                    .'- `suspicious`: medium'."\n"
+                                                    ."\n"
+                                                    .'- `remind`: low', 'type' => 'string', 'example' => 'remind', 'title' => ''],
+                                                'AssetList' => ['description' => 'A JSON string that contains a list of involved assets.', 'type' => 'string', 'example' => '['."\n"
+                                                    .'      {'."\n"
+                                                    .'            "is_main_asset": "1",'."\n"
+                                                    .'            "asset_name": "47.245.*",'."\n"
+                                                    .'            "port": "22",'."\n"
+                                                    .'            "ip": "47.245.*",'."\n"
+                                                    .'            "asset_type": "ip",'."\n"
+                                                    .'            "location": "ap-southeast-1",'."\n"
+                                                    .'            "asset_id": "47.245.*",'."\n"
+                                                    .'            "net_connect_dir": "in"'."\n"
+                                                    .'      }'."\n"
+                                                    .']', 'title' => ''],
+                                                'OccurTime' => ['description' => 'The time when the alert occurred.', 'type' => 'string', 'example' => '2021-01-06 16:37:29', 'title' => ''],
+                                                'StartTime' => ['description' => 'The time when the alert first occurred.', 'type' => 'string', 'example' => '2021-01-06 16:37:29', 'title' => ''],
+                                                'EndTime' => ['description' => 'The end time of the alert.', 'type' => 'string', 'example' => '2021-01-06 16:37:29', 'title' => ''],
+                                                'AlertSrcProdModule' => ['description' => 'The submodule of the product that generated the alert.', 'type' => 'string', 'example' => 'waf', 'title' => ''],
+                                                'AlertDesc' => ['description' => 'The description of the alert.', 'type' => 'string', 'title' => '', 'example' => 'The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.'],
+                                                'AlertDescEn' => ['description' => 'The English description of the alert.', 'type' => 'string', 'example' => 'The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.', 'title' => ''],
+                                                'AlertDescCode' => ['description' => 'The internal code for the alert description.', 'type' => 'string', 'title' => '', 'example' => 'security_event_config.event_name.webshell'],
+                                                'AlertDetail' => ['description' => 'A JSON string that contains alert details.', 'type' => 'string', 'title' => '', 'example' => '{"main_user_id": "165295629792****";"log_uuid_count": "99";"attack_ip": "21.92.*.*"}'],
+                                                'LogUuid' => ['description' => 'The UUID of the alert log.', 'type' => 'string', 'example' => 'cfw_d12e285a-a042-4d7e-be89-f8a795ef****', 'title' => ''],
+                                                'EntityList' => ['description' => 'A JSON string that contains a list of entities involved in the alert. The entity data is standardized for query and analysis.', 'type' => 'string', 'title' => '', 'example' => '[{&quot;entity_user_id&quot;:&quot;198921674491****&quot;,&quot;entity_account_id&quot;:&quot;N/A&quot;,&quot;entity_uuid&quot;:&quot;6245f979d5dd9ef8dd19bdc72228****&quot;,&quot;entity_type&quot;:&quot;host&quot;,&quot;entity_name&quot;:&quot;zhh-test-20240409&quot;,&quot;is_comprised&quot;:&quot;1&quot;,&quot;os_type&quot;:&quot;linux&quot;,&quot;entity_id&quot;:&quot;a88f44dd-b8d4-4ded-831c-77a4835****&quot;,&quot;host_uuid&quot;:&quot;a88f44dd-b8d4-4ded-831c-77a4835****&quot;,&quot;host_name&quot;:&quot;zhh-test-2024****&quot;}]'],
+                                                'AttCk' => ['description' => 'The ATT\\&CK attack technique.', 'type' => 'string', 'example' => 'T1595.002 Vulnerability Scanning', 'title' => ''],
+                                                'SubUserId' => ['description' => 'The ID of the sub-account that generated the alert.', 'type' => 'integer', 'format' => 'int64', 'example' => '176555323***', 'title' => ''],
+                                                'SubUserName' => ['description' => 'The name of the sub-account that generated the alert.', 'type' => 'string', 'example' => '176555323***', 'title' => ''],
+                                                'VendorId' => ['description' => 'The cloud provider code. Valid values:'."\n"
+                                                    ."\n"
+                                                    .'- `aliyun`: Alibaba Cloud'."\n"
+                                                    ."\n"
+                                                    .'- `qcloud`: Tencent Cloud'."\n"
+                                                    ."\n"
+                                                    .'- `hcloud`: Huawei Cloud', 'type' => 'string', 'example' => 'aliyun', 'title' => ''],
+                                                'IsDefend' => ['description' => 'Indicates whether the threat was blocked. Valid values:'."\n"
+                                                    ."\n"
+                                                    .'- `0`: detected'."\n"
+                                                    ."\n"
+                                                    .'- `1`: blocked', 'type' => 'string', 'title' => '', 'example' => '1'],
+                                                'AlertInfoList' => [
+                                                    'title' => '',
+                                                    'description' => 'A list of key-value pairs that contain the detailed properties of the alert.',
+                                                    'type' => 'array',
+                                                    'items' => [
+                                                        'type' => 'object',
+                                                        'properties' => [
+                                                            'Key' => ['description' => 'The key of the detailed alert property.', 'type' => 'string', 'title' => '', 'example' => 'suspicious.wbd.wb.trojanpath'],
+                                                            'KeyName' => ['description' => 'The display name of the detailed alert property.', 'type' => 'string', 'title' => '', 'example' => 'Trojan Path'],
+                                                            'Values' => ['description' => 'The value of the detailed alert property.', 'type' => 'string', 'example' => '/root/test33.php', 'title' => ''],
+                                                        ],
+                                                        'description' => '',
+                                                        'title' => '',
+                                                        'example' => '',
+                                                    ],
+                                                    'example' => 'aliyun',
                                                 ],
+                                                'ExtendContent' => ['description' => 'Extended information about the alert, in JSON string format.', 'type' => 'string', 'example' => '{"user":"Member","num":"1"}', 'title' => ''],
+                                                'ProductId' => ['description' => 'The ID of the product.', 'type' => 'string', 'example' => 'alibaba_cloud_sas', 'title' => ''],
+                                                'CloudCode' => ['description' => 'The cloud provider code. Valid values:'."\n"
+                                                    ."\n"
+                                                    .'- `aliyun`: Alibaba Cloud'."\n"
+                                                    ."\n"
+                                                    .'- `qcloud`: Tencent Cloud'."\n"
+                                                    ."\n"
+                                                    .'- `hcloud`: Huawei Cloud', 'type' => 'string', 'example' => 'aliyun', 'title' => ''],
+                                                'DetectionRuleId' => ['description' => 'The ID of the detection rule.', 'type' => 'string', 'example' => 'dr-48zs4tk7qfd4rjd9****', 'title' => ''],
+                                                'AlertStatus' => ['description' => 'The alert status.', 'type' => 'string', 'example' => '1', 'title' => ''],
+                                                'InvestigationReport' => ['description' => 'The investigation report for the alert, in JSON string format.', 'type' => 'string', 'example' => '{"agent_attack_confidence": 90, "agent_judgement_category": "false_positive", "reason": "The command line contains \'mediacenter\' which is a normal startup behavior of Lark (Feishu) client, and the process path is in the standard user installation directory.", "start_time": 1774929064, "end_time": 1774929071}', 'title' => ''],
                                             ],
+                                            'description' => '',
+                                            'title' => '',
+                                            'example' => '',
                                         ],
-                                    ],
-                                    'AccountId' => [
-                                        'title' => '云账号ID。',
-                                        'description' => 'The ID of the cloud account.'."\n",
-                                        'type' => 'string',
-                                        'example' => '123xxxxxxx',
-                                    ],
-                                    'CloudCode' => [
-                                        'title' => '多云的code。',
-                                        'description' => 'The code of the cloud service provider. Valid values:'."\n"
-                                            ."\n"
-                                            .'*   qcloud: Tencent Cloud'."\n"
-                                            .'*   aliyun: Alibaba Cloud'."\n"
-                                            .'*   hcloud: Huawei Cloud'."\n",
-                                        'type' => 'string',
-                                        'example' => 'hcloud',
-                                        'enum' => [
-                                            'qcloud',
-                                            'hcloud',
-                                        ],
+                                        'example' => '',
                                     ],
                                 ],
-                            ],
-                            'RequestId' => [
-                                'title' => '请求消息ID。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****',
+                                'example' => '123456',
                             ],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorCode' => 'InternalError',
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"DataSourceInstanceId\\": \\"220ba97c9d1fdb0b9c7e8c7ca328d7ea\\",\\n    \\"DataSourceInstanceParams\\": [\\n      {\\n        \\"ParaCode\\": \\"region_code\\",\\n        \\"ParaValue\\": \\"ap-guangzhou\\"\\n      }\\n    ],\\n    \\"AccountId\\": \\"123xxxxxxx\\",\\n    \\"CloudCode\\": \\"hcloud\\"\\n  },\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
-            'title' => 'DescribeDataSourceInstance',
-        ],
-        'DescribeAuth' => [
-            'summary' => 'Checks whether the security information and event management (SIEM) system is granted the required permissions to access other cloud resources within your Alibaba Cloud account and whether the AliyunServiceRoleForSasCloudSiem service-linked role is created.',
-            'methods' => [
-                'get',
-                'post',
-            ],
-            'schemes' => [
-                'http',
-                'https',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n  \\"Data\\": {\\n    \\"PageInfo\\": {\\n      \\"CurrentPage\\": 1,\\n      \\"PageSize\\": 10,\\n      \\"TotalCount\\": 100\\n    },\\n    \\"ResponseData\\": [\\n      {\\n        \\"Id\\": 123456789,\\n        \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n        \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n        \\"MainUserId\\": 0,\\n        \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n        \\"AlertUuid\\": \\"sas_71e24437d2797ce8fc59692905a4****\\",\\n        \\"LogTime\\": \\"2021-01-06 16:37:29\\",\\n        \\"AlertSrcProd\\": \\"sas\\",\\n        \\"AlertTitle\\": \\"Scan-Try SNMP weak password\\",\\n        \\"AlertTitleEn\\": \\"Scan-Try SNMP weak password\\",\\n        \\"AlertType\\": \\"Scan\\",\\n        \\"AlertTypeEn\\": \\"Scan\\",\\n        \\"AlertTypeCode\\": \\"security_event_config.event_name.webshellName\\",\\n        \\"AlertName\\": \\"Try SNMP weak password\\",\\n        \\"AlertNameEn\\": \\"Try SNMP weak password\\",\\n        \\"AlertNameCode\\": \\"security_event_config.event_name.webshell\\",\\n        \\"AlertLevel\\": \\"remind\\",\\n        \\"AssetList\\": \\"[\\\\n      {\\\\n            \\\\\\"is_main_asset\\\\\\": \\\\\\"1\\\\\\",\\\\n            \\\\\\"asset_name\\\\\\": \\\\\\"47.245.*\\\\\\",\\\\n            \\\\\\"port\\\\\\": \\\\\\"22\\\\\\",\\\\n            \\\\\\"ip\\\\\\": \\\\\\"47.245.*\\\\\\",\\\\n            \\\\\\"asset_type\\\\\\": \\\\\\"ip\\\\\\",\\\\n            \\\\\\"location\\\\\\": \\\\\\"ap-southeast-1\\\\\\",\\\\n            \\\\\\"asset_id\\\\\\": \\\\\\"47.245.*\\\\\\",\\\\n            \\\\\\"net_connect_dir\\\\\\": \\\\\\"in\\\\\\"\\\\n      }\\\\n]\\",\\n        \\"OccurTime\\": \\"2021-01-06 16:37:29\\",\\n        \\"StartTime\\": \\"2021-01-06 16:37:29\\",\\n        \\"EndTime\\": \\"2021-01-06 16:37:29\\",\\n        \\"AlertSrcProdModule\\": \\"waf\\",\\n        \\"AlertDesc\\": \\"The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.\\",\\n        \\"AlertDescEn\\": \\"The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.\\",\\n        \\"AlertDescCode\\": \\"security_event_config.event_name.webshell\\",\\n        \\"AlertDetail\\": \\"{\\\\\\"main_user_id\\\\\\": \\\\\\"165295629792****\\\\\\";\\\\\\"log_uuid_count\\\\\\": \\\\\\"99\\\\\\";\\\\\\"attack_ip\\\\\\": \\\\\\"21.92.*.*\\\\\\"}\\",\\n        \\"LogUuid\\": \\"cfw_d12e285a-a042-4d7e-be89-f8a795ef****\\",\\n        \\"EntityList\\": \\"[{&quot;entity_user_id&quot;:&quot;198921674491****&quot;,&quot;entity_account_id&quot;:&quot;N/A&quot;,&quot;entity_uuid&quot;:&quot;6245f979d5dd9ef8dd19bdc72228****&quot;,&quot;entity_type&quot;:&quot;host&quot;,&quot;entity_name&quot;:&quot;zhh-test-20240409&quot;,&quot;is_comprised&quot;:&quot;1&quot;,&quot;os_type&quot;:&quot;linux&quot;,&quot;entity_id&quot;:&quot;a88f44dd-b8d4-4ded-831c-77a4835****&quot;,&quot;host_uuid&quot;:&quot;a88f44dd-b8d4-4ded-831c-77a4835****&quot;,&quot;host_name&quot;:&quot;zhh-test-2024****&quot;}]\\",\\n        \\"AttCk\\": \\"T1595.002 Vulnerability Scanning\\",\\n        \\"SubUserId\\": 0,\\n        \\"SubUserName\\": \\"176555323***\\",\\n        \\"VendorId\\": \\"aliyun\\",\\n        \\"IsDefend\\": \\"1\\",\\n        \\"AlertInfoList\\": [\\n          {\\n            \\"Key\\": \\"suspicious.wbd.wb.trojanpath\\",\\n            \\"KeyName\\": \\"Trojan Path\\",\\n            \\"Values\\": \\"/root/test33.php\\"\\n          }\\n        ],\\n        \\"ExtendContent\\": \\"{\\\\\\"user\\\\\\":\\\\\\"Member\\\\\\",\\\\\\"num\\\\\\":\\\\\\"1\\\\\\"}\\",\\n        \\"ProductId\\": \\"alibaba_cloud_sas\\",\\n        \\"CloudCode\\": \\"aliyun\\",\\n        \\"DetectionRuleId\\": \\"dr-48zs4tk7qfd4rjd9****\\",\\n        \\"AlertStatus\\": \\"1\\",\\n        \\"InvestigationReport\\": \\"{\\\\\\"agent_attack_confidence\\\\\\": 90, \\\\\\"agent_judgement_category\\\\\\": \\\\\\"false_positive\\\\\\", \\\\\\"reason\\\\\\": \\\\\\"The command line contains \'mediacenter\' which is a normal startup behavior of Lark (Feishu) client, and the process path is in the standard user installation directory.\\\\\\", \\\\\\"start_time\\\\\\": 1774929064, \\\\\\"end_time\\\\\\": 1774929071}\\"\\n      }\\n    ]\\n  }\\n}","type":"json"}]',
+            'title' => 'DescribeAlerts',
+            'changeSet' => [
+                ['createdAt' => '2025-04-25T07:53:21.000Z', 'description' => 'Response parameters changed'],
+                ['createdAt' => '2024-09-26T11:11:01.000Z', 'description' => 'Request parameters changed, Response parameters changed'],
+                ['createdAt' => '2024-04-17T12:43:24.000Z', 'description' => 'Error codes changed, Request parameters changed'],
             ],
-            'security' => [
-                [
-                    'AK' => [],
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAlerts'],
                 ],
             ],
-            'operationType' => 'read',
-            'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'get',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-            ],
-            'parameters' => [
+            'ramActions' => [
                 [
-                    'name' => 'RegionId',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'enumValueTitles' => [
-                            'ap-southeast-1' => '',
-                            'cn-hangzhou' => '',
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DescribeAlerts',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
                         ],
-                        'example' => 'cn-hangzhou',
                     ],
                 ],
             ],
-            'responses' => [
-                200 => [
-                    'schema' => [
-                        'title' => 'CloudSiemSuccessResponse<Boolean>',
-                        'description' => 'CloudSiemResponse'."\n",
-                        'type' => 'object',
-                        'properties' => [
-                            'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'Indicates whether the SIEM system is granted the required permissions. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'enumValueTitles' => [],
-                                'example' => 'true',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求消息ID。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '4F539347-7D9A-51EA-8ABF-5D5507045C5C',
-                            ],
-                        ],
-                    ],
-                ],
-            ],
-            'errorCodes' => [
-                500 => [
-                    [
-                        'errorCode' => 'InternalError',
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                    ],
-                ],
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": true,\\n  \\"RequestId\\": \\"4F539347-7D9A-51EA-8ABF-5D5507045C5C\\"\\n}","type":"json"}]',
-            'title' => 'DescribeAuth',
         ],
-        'DeleteDataSourceLog' => [
-            'summary' => 'Removes a log.',
-            'methods' => [
-                'get',
-                'post',
-            ],
-            'schemes' => [
-                'http',
-                'https',
-            ],
+        'DescribeAlertsCount' => [
+            'methods' => ['get', 'post'],
+            'schemes' => ['https', 'http'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'write',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'delete',
+                'operationType' => 'get',
                 'riskType' => 'none',
                 'chargeType' => 'free',
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
-                    'name' => 'LogInstanceId',
+                    'name' => 'QueryType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '日志ID，由威胁分析根据具体参数计算md5生成。',
-                        'description' => 'The ID of the log. The ID is an MD5 hash value that is calculated by the threat analysis feature based on specific parameters. You can call the [ListDataSourceLogs](https://api.aliyun-inc.com/#/publishment/document/cloud-siem/863fdf54478f4cc5877e27c2a5fe9e44?tenantUuid=f382fccd88b94c5c8c864def6815b854\\&activeTabKey=api%7CListDataSourceLogs) operation to query the IDs of logs.'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'ef33097c9d1fdb0b9c7e8c7ca320pkl1',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The query type.', 'type' => 'string', 'required' => false, 'example' => 'bySrcProd'],
                 ],
                 [
-                    'name' => 'DataSourceInstanceId',
+                    'name' => 'StartTime',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '数据源ID，由威胁分析根据具体参数计算md5生成。',
-                        'description' => 'The ID of the data source. The ID is an MD5 hash value that is calculated by the threat analysis feature based on specific parameters. You can call the [ListDataSourceLogs](https://api.aliyun-inc.com/#/publishment/document/cloud-siem/863fdf54478f4cc5877e27c2a5fe9e44?tenantUuid=f382fccd88b94c5c8c864def6815b854\\&activeTabKey=api%7CListDataSourceLogs) operation to query the IDs of data sources.'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The start time of the query. The value is a UNIX timestamp. Unit: milliseconds.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '1577808000000'],
                 ],
                 [
-                    'name' => 'AccountId',
+                    'name' => 'EndTime',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '云账号ID。',
-                        'description' => 'The ID of the cloud account.'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => '123xxxxxxx',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The end time of the query. The value is a UNIX timestamp. Unit: milliseconds.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '1577808000000'],
                 ],
                 [
-                    'name' => 'CloudCode',
+                    'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '多云的code。',
-                        'description' => 'The code of the cloud service provider. Valid values:'."\n"
-                            ."\n"
-                            .'*   qcloud: Tencent Cloud'."\n"
-                            .'*   aliyun: Alibaba Cloud'."\n"
-                            .'*   hcloud: Huawei Cloud'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'enumValueTitles' => [],
-                        'example' => 'hcloud',
-                        'enum' => [
-                            'qcloud',
-                            'hcloud',
-                            'aliyun',
-                        ],
-                    ],
+                    'schema' => ['description' => 'The view type.'."\n"
+                        ."\n"
+                        .'- 0: The view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: The view of all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
+                ],
+                [
+                    'name' => 'RoleFor',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The user ID of a member. An administrator can specify this parameter to query alerts from the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region of the data management center. Select the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'CloudSiemSuccessResponse<DeleteDataSourceLogResult>',
-                        'description' => 'CloudSiemSuccessResponse'."\n",
+                        'title' => 'PlainResponse<CloudSiemAlertCounter>',
+                        'description' => 'PlainResponse',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
+                                'title' => '',
+                                'description' => 'The data returned.',
                                 'type' => 'object',
                                 'properties' => [
-                                    'Count' => [
-                                        'title' => '删除的日志的数量，等于1表示成功，小于等于0表示失败。',
-                                        'description' => 'The number of logs that are removed. The value 1 indicates that the log is removed, and a value less than or equal to 0 indicates that the log failed to be removed.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '1',
-                                    ],
-                                    'LogInstanceId' => [
-                                        'title' => '日志ID，由威胁分析根据具体参数计算md5生成。',
-                                        'description' => 'The ID of the log. The ID is an MD5 hash value that is calculated by the threat analysis feature based on specific parameters.'."\n",
-                                        'type' => 'string',
-                                        'example' => 'ef33097c9d1fdb0b9c7e8c7ca320pkl1',
+                                    'High' => ['title' => '', 'description' => 'The number of high-risk alerts.', 'type' => 'integer', 'format' => 'int64', 'example' => '25'],
+                                    'Medium' => ['title' => '', 'description' => 'The number of medium-risk alerts.', 'type' => 'integer', 'format' => 'int64', 'example' => '25'],
+                                    'Low' => ['title' => '', 'description' => 'The number of low-risk alerts.', 'type' => 'integer', 'format' => 'int64', 'example' => '25'],
+                                    'All' => ['title' => '', 'description' => 'The total number of alerts.', 'type' => 'integer', 'format' => 'int64', 'example' => '75'],
+                                    'ProductNum' => ['title' => '', 'description' => 'The number of connected products.', 'type' => 'integer', 'format' => 'int32', 'example' => '3'],
+                                    'CountMap' => [
+                                        'type' => 'object',
+                                        'additionalProperties' => ['type' => 'integer', 'format' => 'int64', 'description' => 'The value.', 'title' => '', 'example' => '12'],
+                                        'description' => 'The number of alerts for each severity level.',
+                                        'title' => '',
+                                        'example' => '',
                                     ],
                                 ],
+                                'example' => '123456',
                             ],
-                            'RequestId' => [
-                                'title' => '请求消息ID。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****',
-                            ],
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The request was successful.'."\n"
+                                ."\n"
+                                .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The HTTP status code returned.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The message returned.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorCode' => 'InternalError',
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"Count\\": 1,\\n    \\"LogInstanceId\\": \\"ef33097c9d1fdb0b9c7e8c7ca320pkl1\\"\\n  },\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
-            'title' => 'DeleteDataSourceLog',
-        ],
-        'DeleteDataSource' => [
-            'summary' => 'Removes a data source that is no longer required.',
-            'methods' => [
-                'get',
-                'post',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'DescribeAlertsCount',
+            'summary' => 'Queries the count of alerts for different severity levels.',
+            'changeSet' => [
+                ['createdAt' => '2024-09-26T11:11:01.000Z', 'description' => 'Request parameters changed, Response parameters changed'],
+                ['createdAt' => '2024-04-17T12:43:24.000Z', 'description' => 'Error codes changed, Request parameters changed'],
+            ],
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAlertsCount'],
+                ],
             ],
-            'schemes' => [
-                'http',
-                'https',
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DescribeAlertsCount',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"High\\": 25,\\n    \\"Medium\\": 25,\\n    \\"Low\\": 25,\\n    \\"All\\": 75,\\n    \\"ProductNum\\": 3,\\n    \\"CountMap\\": {\\n      \\"key\\": 12\\n    }\\n  },\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
+        ],
+        'DescribeAlertsWithEntity' => [
+            'summary' => 'Queries for alerts that are associated with an entity.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'write',
+            'operationType' => 'read',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'delete',
+                'operationType' => 'get',
                 'riskType' => 'none',
                 'chargeType' => 'free',
+                'abilityTreeNodes' => ['FEATUREsas731ZAS'],
             ],
             'parameters' => [
                 [
-                    'name' => 'DataSourceInstanceId',
+                    'name' => 'IncidentUuid',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '数据源ID，由威胁分析根据具体参数计算md5生成。',
-                        'description' => 'The ID of the data source. The ID is an MD5 hash value that is calculated by the threat analysis feature based on specific parameters. You can call the [ListDataSourceLogs](https://api.aliyun-inc.com/#/publishment/document/cloud-siem/863fdf54478f4cc5877e27c2a5fe9e44?tenantUuid=f382fccd88b94c5c8c864def6815b854\\&activeTabKey=api%7CListDataSourceLogs) operation to query the IDs of data sources.'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The globally unique ID of the event.', 'type' => 'string', 'required' => false, 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'],
                 ],
                 [
-                    'name' => 'AccountId',
+                    'name' => 'SophonTaskId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '云账号ID。',
-                        'description' => 'The ID of the cloud account.'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => '123xxxxxxx',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The ID of the Security Orchestration, Automation, and Response (SOAR) handling policy.', 'type' => 'string', 'required' => false, 'example' => '577bbf90-a770-44a7-8154-586aa2d318fa'],
                 ],
                 [
-                    'name' => 'CloudCode',
+                    'name' => 'EntityId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '多云的code。',
-                        'description' => 'The code of the cloud service provider. Valid values:'."\n"
-                            ."\n"
-                            .'*   qcloud: Tencent Cloud'."\n"
-                            .'*   aliyun: Alibaba Cloud'."\n"
-                            .'*   hcloud: Huawei Cloud'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'enumValueTitles' => [],
-                        'example' => 'hcloud',
-                        'enum' => [
-                            'qcloud',
-                            'hcloud',
-                            'aliyun',
-                        ],
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The ID of the entity.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '123456789'],
+                ],
+                [
+                    'name' => 'EntityUuid',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The ID of the entity.', 'type' => 'string', 'required' => false, 'example' => '123456789'],
+                ],
+                [
+                    'name' => 'StartTime',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The start time of the query. The unit is milliseconds.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '1577808000000'],
+                ],
+                [
+                    'name' => 'EndTime',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The end time of the query. The unit is milliseconds.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '1577808000000'],
+                ],
+                [
+                    'name' => 'CurrentPage',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The number of the page to return. The value must be greater than or equal to 1.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'minimum' => '1', 'example' => '1'],
+                ],
+                [
+                    'name' => 'PageSize',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The number of entries to return on each page. The maximum value is 100.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'maximum' => '100', 'minimum' => '1', 'example' => '10'],
+                ],
+                [
+                    'name' => 'RoleType',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The type of the view. Valid values:'."\n"
+                        ."\n"
+                        .'- 0: the view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: the view of all accounts that are managed by your enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
+                ],
+                [
+                    'name' => 'RoleFor',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The user ID of the member to which the administrator switches.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region of the data management center for threat analysis. Select a region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: your assets are in the Chinese mainland and China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'CloudSiemSuccessResponse<DeleteDataSourceResult>',
-                        'description' => 'CloudSiemSuccessResponse'."\n",
+                        'title' => 'PageResponse<List<AlertDetail>>',
+                        'description' => 'PageResponse\\<List\\<AlertDetail>>',
                         'type' => 'object',
                         'properties' => [
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The request was successful.'."\n"
+                                ."\n"
+                                .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The message returned for the request.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
+                                'title' => '',
+                                'description' => 'The data returned.',
                                 'type' => 'object',
                                 'properties' => [
-                                    'Count' => [
-                                        'title' => '删除的数据源的数量，等于1表示成功，小于等于0表示失败。',
-                                        'description' => 'The number of data sources that are removed. The value 1 indicates that data source is removed, and a value less than or equal to 0 indicates that the data source failed to be removed.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '1',
+                                    'PageInfo' => [
+                                        'title' => '',
+                                        'description' => 'The pagination information.',
+                                        'type' => 'object',
+                                        'properties' => [
+                                            'CurrentPage' => ['title' => '', 'description' => 'The page number of the returned page.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'],
+                                            'PageSize' => ['title' => '', 'description' => 'The number of entries returned per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10'],
+                                            'TotalCount' => ['title' => '', 'description' => 'The total number of entries.', 'type' => 'integer', 'format' => 'int64', 'example' => '100'],
+                                        ],
+                                        'example' => '',
+                                    ],
+                                    'ResponseData' => [
+                                        'title' => '',
+                                        'description' => 'The detailed data.',
+                                        'type' => 'array',
+                                        'items' => [
+                                            'type' => 'object',
+                                            'properties' => [
+                                                'Id' => ['title' => '', 'description' => 'The unique ID of the alert.', 'type' => 'integer', 'format' => 'int64', 'example' => '123456789'],
+                                                'GmtCreate' => ['title' => '', 'description' => 'The time when the alert was created.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'],
+                                                'GmtModified' => ['title' => '', 'description' => 'The time when the alert was last updated.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'],
+                                                'MainUserId' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account that is used for threat analysis.', 'type' => 'integer', 'format' => 'int64', 'example' => '127608589417****'],
+                                                'IncidentUuid' => ['title' => '', 'description' => 'The globally unique UUID of the event.', 'type' => 'string', 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'],
+                                                'AlertUuid' => ['title' => '', 'description' => 'The UUID of the alert.', 'type' => 'string', 'example' => 'sas_71e24437d2797ce8fc59692905a4****'],
+                                                'LogTime' => ['title' => '', 'description' => 'The time when the alert was recorded.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'],
+                                                'AlertSrcProd' => ['title' => '', 'description' => 'The source product of the alert.', 'type' => 'string', 'example' => 'sas'],
+                                                'AlertTitle' => ['title' => '', 'description' => 'The title of the alert.', 'type' => 'string', 'example' => 'Scan-Try SNMP weak password'],
+                                                'AlertTitleEn' => ['title' => '', 'description' => 'The English title of the alert.', 'type' => 'string', 'example' => 'Scan-Try SNMP weak password'],
+                                                'AlertType' => ['title' => '', 'description' => 'The type of the alert.', 'type' => 'string', 'example' => 'Scan'],
+                                                'AlertTypeEn' => ['title' => '', 'description' => 'The English type of the alert.', 'type' => 'string', 'example' => 'Scan'],
+                                                'AlertTypeCode' => ['title' => '', 'description' => 'The Medusa code of the alert type.', 'type' => 'string', 'example' => 'security_event_config.event_name.webshellName'],
+                                                'AlertName' => ['title' => '', 'description' => 'The name of the alert.', 'type' => 'string', 'example' => 'Try SNMP weak password'],
+                                                'AlertNameEn' => ['title' => '', 'description' => 'The name of the alert.', 'type' => 'string', 'example' => 'Try SNMP weak password'],
+                                                'AlertNameCode' => ['title' => '', 'description' => 'The Medusa code of the alert name.', 'type' => 'string', 'example' => 'security_event_config.event_name.webshell'],
+                                                'AlertLevel' => ['title' => '', 'description' => 'The threat level. Valid values:'."\n"
+                                                    ."\n"
+                                                    .'- serious: high'."\n"
+                                                    ."\n"
+                                                    .'- suspicious: medium'."\n"
+                                                    ."\n"
+                                                    .'- remind: low', 'type' => 'string', 'example' => 'remind'],
+                                                'AssetList' => ['title' => '', 'description' => 'The list of assets.', 'type' => 'string', 'example' => '['."\n"
+                                                    .'      {'."\n"
+                                                    .'            "is_main_asset": "1",'."\n"
+                                                    .'            "asset_name": "47.245.*",'."\n"
+                                                    .'            "port": "22",'."\n"
+                                                    .'            "ip": "47.245.*",'."\n"
+                                                    .'            "asset_type": "ip",'."\n"
+                                                    .'            "location": "ap-southeast-1",'."\n"
+                                                    .'            "asset_id": "47.245.*",'."\n"
+                                                    .'            "net_connect_dir": "in"'."\n"
+                                                    .'      }'."\n"
+                                                    .']'],
+                                                'OccurTime' => ['title' => '', 'description' => 'The time when the alert occurred.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'],
+                                                'StartTime' => ['title' => '', 'description' => 'The time when the alert first occurred.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'],
+                                                'EndTime' => ['title' => '', 'description' => 'The time when the alert ended.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'],
+                                                'AlertSrcProdModule' => ['title' => '', 'description' => 'The submodule of the alert source.', 'type' => 'string', 'example' => 'waf'],
+                                                'AlertDesc' => ['title' => '', 'description' => 'The description of the alert.', 'type' => 'string', 'example' => 'The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.'],
+                                                'AlertDescEn' => ['title' => '', 'description' => 'The English description of the alert.', 'type' => 'string', 'example' => 'The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.'],
+                                                'AlertDescCode' => ['title' => '', 'description' => 'The Medusa code of the alert description.', 'type' => 'string', 'example' => 'security_event_config.event_name.webshell'."\n"],
+                                                'AlertDetail' => ['title' => '', 'description' => 'The details of the alert.', 'type' => 'string', 'example' => '{"main_user_id": "165295629792****";"log_uuid_count": "99";"attack_ip": "21.92.*.*"}'],
+                                                'LogUuid' => ['title' => '', 'description' => 'The UUID of the alert log.', 'type' => 'string', 'example' => 'cfw_d12e285a-a042-4d7e-be89-f8a795ef****'],
+                                                'EntityList' => ['title' => '', 'description' => 'The details of the entity. The entity is standardized and indexed.', 'type' => 'string', 'example' => '[{"entity_uuid":"55f0c0654d7e79b035a5168fcb4****","entity_type":"cloud_account","account_id":"15176874502****","main_user_id":"15176874502****","cloud_code":"alibaba_cloud","is_asset":1,"entity_id":"151768745029****"}]'],
+                                                'AttCk' => ['title' => '', 'description' => 'The ATT\\&CK tag.', 'type' => 'string', 'example' => 'T1595.002 Vulnerability Scanning'],
+                                                'SubUserId' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account that generated the alert.', 'type' => 'integer', 'format' => 'int64', 'example' => '176555323***'],
+                                                'SubUserName' => ['title' => '', 'description' => 'The name of the Alibaba Cloud account that generated the alert.', 'type' => 'string', 'example' => '176555323***'],
+                                                'IsDefend' => ['title' => '', 'description' => 'Indicates whether the threat is defended. Valid values:'."\n"
+                                                    ."\n"
+                                                    .'- 0: detected'."\n"
+                                                    ."\n"
+                                                    .'- 1: blocked', 'type' => 'string', 'example' => '1'],
+                                                'AlertInfoList' => [
+                                                    'title' => '',
+                                                    'description' => 'The detailed information about the alert.',
+                                                    'type' => 'array',
+                                                    'items' => [
+                                                        'type' => 'object',
+                                                        'properties' => [
+                                                            'Key' => ['title' => '', 'description' => 'The key of the alert property.', 'type' => 'string', 'example' => 'suspicious.wbd.wb.trojanpath'],
+                                                            'KeyName' => ['title' => '', 'description' => 'The name of the detailed alert data.', 'type' => 'string', 'example' => 'Trojan Path'."\n"],
+                                                            'Values' => ['title' => '', 'description' => 'The value of the detailed alert data.', 'type' => 'string', 'example' => '/root/test33.php'],
+                                                        ],
+                                                        'description' => 'The detailed information about the alert.',
+                                                        'title' => '',
+                                                        'example' => '',
+                                                    ],
+                                                    'example' => 'aliyun',
+                                                ],
+                                                'CloudCode' => ['title' => '', 'description' => 'The cloud service provider. Valid values:'."\n"
+                                                    ."\n"
+                                                    .'- aliyun: Alibaba Cloud'."\n"
+                                                    ."\n"
+                                                    .'- qcloud: Tencent Cloud'."\n"
+                                                    ."\n"
+                                                    .'- hcloud: Huawei Cloud', 'type' => 'string', 'example' => 'aliyun'],
+                                                'ProductId' => ['type' => 'string', 'description' => 'The product ID.', 'title' => '', 'example' => 'alibaba_cloud_sas'],
+                                                'VendorId' => ['type' => 'string', 'description' => 'The cloud service provider. Valid values:'."\n"
+                                                    ."\n"
+                                                    .'- aliyun: Alibaba Cloud'."\n"
+                                                    ."\n"
+                                                    .'- qcloud: Tencent Cloud'."\n"
+                                                    ."\n"
+                                                    .'- hcloud: Huawei Cloud', 'title' => '', 'example' => 'aliyun'],
+                                                'DetectionRuleId' => ['type' => 'string', 'description' => 'The ID of the detection rule.', 'title' => '', 'example' => 'dr-48zs4tk7qfd4rjd9****'],
+                                            ],
+                                            'description' => 'The detailed data.',
+                                            'title' => '',
+                                            'example' => '',
+                                        ],
+                                        'example' => '',
                                     ],
                                 ],
-                            ],
-                            'RequestId' => [
-                                'title' => '请求消息ID。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****',
+                                'example' => '123456',
                             ],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorCode' => 'InternalError',
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"Count\\": 1\\n  },\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
-            'title' => 'DeleteDataSource',
-        ],
-        'DeleteBindAccount' => [
-            'summary' => 'Removes a third-party cloud account that is added to the threat analysis feature by using its AccessKey ID. You can add another cloud account based on your business requirements.',
-            'methods' => [
-                'get',
-                'post',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n  \\"Data\\": {\\n    \\"PageInfo\\": {\\n      \\"CurrentPage\\": 1,\\n      \\"PageSize\\": 10,\\n      \\"TotalCount\\": 100\\n    },\\n    \\"ResponseData\\": [\\n      {\\n        \\"Id\\": 123456789,\\n        \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n        \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n        \\"MainUserId\\": 0,\\n        \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n        \\"AlertUuid\\": \\"sas_71e24437d2797ce8fc59692905a4****\\",\\n        \\"LogTime\\": \\"2021-01-06 16:37:29\\",\\n        \\"AlertSrcProd\\": \\"sas\\",\\n        \\"AlertTitle\\": \\"Scan-Try SNMP weak password\\",\\n        \\"AlertTitleEn\\": \\"Scan-Try SNMP weak password\\",\\n        \\"AlertType\\": \\"Scan\\",\\n        \\"AlertTypeEn\\": \\"Scan\\",\\n        \\"AlertTypeCode\\": \\"security_event_config.event_name.webshellName\\",\\n        \\"AlertName\\": \\"Try SNMP weak password\\",\\n        \\"AlertNameEn\\": \\"Try SNMP weak password\\",\\n        \\"AlertNameCode\\": \\"security_event_config.event_name.webshell\\",\\n        \\"AlertLevel\\": \\"remind\\",\\n        \\"AssetList\\": \\"[\\\\n      {\\\\n            \\\\\\"is_main_asset\\\\\\": \\\\\\"1\\\\\\",\\\\n            \\\\\\"asset_name\\\\\\": \\\\\\"47.245.*\\\\\\",\\\\n            \\\\\\"port\\\\\\": \\\\\\"22\\\\\\",\\\\n            \\\\\\"ip\\\\\\": \\\\\\"47.245.*\\\\\\",\\\\n            \\\\\\"asset_type\\\\\\": \\\\\\"ip\\\\\\",\\\\n            \\\\\\"location\\\\\\": \\\\\\"ap-southeast-1\\\\\\",\\\\n            \\\\\\"asset_id\\\\\\": \\\\\\"47.245.*\\\\\\",\\\\n            \\\\\\"net_connect_dir\\\\\\": \\\\\\"in\\\\\\"\\\\n      }\\\\n]\\",\\n        \\"OccurTime\\": \\"2021-01-06 16:37:29\\",\\n        \\"StartTime\\": \\"2021-01-06 16:37:29\\",\\n        \\"EndTime\\": \\"2021-01-06 16:37:29\\",\\n        \\"AlertSrcProdModule\\": \\"waf\\",\\n        \\"AlertDesc\\": \\"The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.\\",\\n        \\"AlertDescEn\\": \\"The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.\\",\\n        \\"AlertDescCode\\": \\"security_event_config.event_name.webshell\\\\n\\",\\n        \\"AlertDetail\\": \\"{\\\\\\"main_user_id\\\\\\": \\\\\\"165295629792****\\\\\\";\\\\\\"log_uuid_count\\\\\\": \\\\\\"99\\\\\\";\\\\\\"attack_ip\\\\\\": \\\\\\"21.92.*.*\\\\\\"}\\",\\n        \\"LogUuid\\": \\"cfw_d12e285a-a042-4d7e-be89-f8a795ef****\\",\\n        \\"EntityList\\": \\"[{\\\\\\"entity_uuid\\\\\\":\\\\\\"55f0c0654d7e79b035a5168fcb4****\\\\\\",\\\\\\"entity_type\\\\\\":\\\\\\"cloud_account\\\\\\",\\\\\\"account_id\\\\\\":\\\\\\"15176874502****\\\\\\",\\\\\\"main_user_id\\\\\\":\\\\\\"15176874502****\\\\\\",\\\\\\"cloud_code\\\\\\":\\\\\\"alibaba_cloud\\\\\\",\\\\\\"is_asset\\\\\\":1,\\\\\\"entity_id\\\\\\":\\\\\\"151768745029****\\\\\\"}]\\",\\n        \\"AttCk\\": \\"T1595.002 Vulnerability Scanning\\",\\n        \\"SubUserId\\": 0,\\n        \\"SubUserName\\": \\"176555323***\\",\\n        \\"IsDefend\\": \\"1\\",\\n        \\"AlertInfoList\\": [\\n          {\\n            \\"Key\\": \\"suspicious.wbd.wb.trojanpath\\",\\n            \\"KeyName\\": \\"Trojan Path\\\\n\\",\\n            \\"Values\\": \\"/root/test33.php\\"\\n          }\\n        ],\\n        \\"CloudCode\\": \\"aliyun\\",\\n        \\"ProductId\\": \\"alibaba_cloud_sas\\",\\n        \\"VendorId\\": \\"aliyun\\",\\n        \\"DetectionRuleId\\": \\"dr-48zs4tk7qfd4rjd9****\\"\\n      }\\n    ]\\n  }\\n}","type":"json"}]',
+            'title' => 'DescribeAlertsWithEntity',
+            'changeSet' => [
+                ['createdAt' => '2024-11-04T11:26:51.000Z', 'description' => 'Request parameters changed, Response parameters changed'],
+                ['createdAt' => '2024-04-17T12:43:24.000Z', 'description' => 'Error codes changed, Request parameters changed'],
             ],
-            'schemes' => [
-                'http',
-                'https',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAlertsWithEntity'],
+                ],
             ],
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DescribeAlertsWithEntity',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
+            ],
+        ],
+        'DescribeAlertsWithEvent' => [
+            'summary' => 'Retrieves alerts associated with a specific event.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'write',
+            'operationType' => 'read',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'delete',
+                'operationType' => 'get',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeCode' => '194688',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsasAFG0OH'],
             ],
             'parameters' => [
                 [
-                    'name' => 'BindId',
+                    'name' => 'IncidentUuid',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The incident ID.', 'type' => 'string', 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', 'title' => '', 'required' => false],
+                ],
+                [
+                    'name' => 'Level',
                     'in' => 'formData',
+                    'style' => 'repeatList',
                     'schema' => [
-                        'title' => '绑定ID。',
-                        'description' => 'The ID generated when the account is added to the threat analysis feature. You can call the [ListBindAccount](https://api.aliyun-inc.com/#/publishment/document/cloud-siem/863fdf54478f4cc5877e27c2a5fe9e44?tenantUuid=f382fccd88b94c5c8c864def6815b854\\&activeTabKey=api%7CListBindAccount) operation to query the ID.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
+                        'title' => '',
+                        'description' => 'The threat level. The value is a JSON array. Valid values:'."\n"
+                            ."\n"
+                            .'- `serious`: high'."\n"
+                            ."\n"
+                            .'- `suspicious`: medium'."\n"
+                            ."\n"
+                            .'- `remind`: low',
+                        'type' => 'array',
+                        'items' => ['description' => 'The threat level. The value is a JSON array. Valid values:'."\n"
+                            ."\n"
+                            .'- `serious`: high'."\n"
+                            ."\n"
+                            .'- `suspicious`: medium'."\n"
+                            ."\n"
+                            .'- `remind`: low', 'type' => 'string', 'required' => false, 'example' => '["remind","serious"]'."\n", 'title' => ''],
                         'required' => false,
-                        'example' => '10',
+                        'example' => '["serious","suspicious","remind"]',
+                        'maxItems' => 100,
                     ],
                 ],
                 [
-                    'name' => 'AccountId',
+                    'name' => 'AlertTitle',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '云账号ID。',
-                        'description' => 'The ID of the cloud account.'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => '123xxxxxxx',
-                    ],
+                    'schema' => ['description' => 'The title of the alert.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => 'Scan-Try SNMP weak password'."\n"],
                 ],
                 [
-                    'name' => 'AccessId',
+                    'name' => 'AlertType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '云账号AccessKeyId。',
-                        'description' => 'The AccessKey ID of the cloud account.'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'ABCXXXXXXXX',
-                    ],
+                    'schema' => ['description' => 'The type of the alert.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => 'Scan'],
                 ],
                 [
-                    'name' => 'CloudCode',
+                    'name' => 'AlertName',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '多云的code。',
-                        'description' => 'The code of the cloud service provider. Valid values:'."\n"
-                            ."\n"
-                            .'*   qcloud: Tencent Cloud'."\n"
-                            .'*   aliyun: Alibaba Cloud'."\n"
-                            .'*   hcloud: Huawei Cloud'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'hcloud',
-                        'enum' => [
-                            'qcloud',
-                            'hcloud',
-                        ],
-                    ],
+                    'schema' => ['description' => 'The name of the alert.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => 'Try SNMP weak password'],
                 ],
                 [
-                    'name' => 'RegionId',
+                    'name' => 'AssetName',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['description' => 'The name of the asset.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => 'hostname-****'],
                 ],
                 [
-                    'name' => 'RoleType',
+                    'name' => 'AssetId',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'integer',
-                        'format' => 'int32',
-                    ],
+                    'schema' => ['description' => 'The ID of the asset.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => '09414e9ebaa9c19b84d851abb91d****'],
                 ],
                 [
-                    'name' => 'RoleFor',
+                    'name' => 'EntityName',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'integer',
-                        'format' => 'int64',
-                    ],
+                    'schema' => ['description' => 'The name of the entity.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => 'launch-advisor-*****'],
                 ],
-            ],
-            'responses' => [
-                200 => [
-                    'schema' => [
-                        'title' => 'CloudSiemSuccessResponse<DeleteBindAccountResult>',
-                        'description' => 'CloudSiemSuccessResponse'."\n",
-                        'type' => 'object',
-                        'properties' => [
-                            'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'object',
-                                'properties' => [
-                                    'Count' => [
-                                        'title' => '删除账号绑定的数量，等于1表示成功，小于等于0表示失败。',
-                                        'description' => 'The number of cloud accounts that are removed. The value 1 indicates that cloud account is removed, and a value less than or equal to 0 indicates that the cloud account failed to be removed.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '1',
-                                    ],
-                                ],
-                            ],
-                            'RequestId' => [
-                                'title' => '请求消息ID。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****',
-                            ],
-                        ],
-                    ],
+                [
+                    'name' => 'EntityId',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The ID of the entity.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => '21034e803f492b926cea9e5beab4****'],
                 ],
-            ],
-            'errorCodes' => [
-                500 => [
-                    [
-                        'errorCode' => 'InternalError',
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                    ],
+                [
+                    'name' => 'SubUserId',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The ID of the account that is associated with the alert.', 'type' => 'integer', 'format' => 'int64', 'example' => '176555323***', 'title' => '', 'required' => false],
                 ],
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"Count\\": 1\\n  },\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
-            'title' => 'DeleteBindAccount',
-        ],
-        'BindAccount' => [
-            'summary' => 'Adds a third-party cloud account that is displayed on the Multi-cloud assets tab of the Feature Settings page to the threat analysis feature.',
-            'methods' => [
-                'get',
-                'post',
-            ],
-            'schemes' => [
-                'http',
-                'https',
-            ],
-            'security' => [
                 [
-                    'AK' => [],
+                    'name' => 'Source',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The data source of the alert.', 'type' => 'string', 'example' => 'sas', 'title' => '', 'required' => false],
                 ],
-            ],
-            'operationType' => 'write',
-            'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'create',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-                'abilityTreeCode' => '194690',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
+                [
+                    'name' => 'IsDefend',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'Indicates whether the attack is defended. Valid values:'."\n"
+                        ."\n"
+                        .'- `0`: detected'."\n"
+                        ."\n"
+                        .'- `1`: blocked', 'type' => 'string', 'title' => '', 'required' => false, 'example' => '1'],
                 ],
-            ],
-            'parameters' => [
                 [
-                    'name' => 'AccessId',
+                    'name' => 'StartTime',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '云账号AccessKeyId。',
-                        'description' => 'The AccessKey ID of the cloud account.'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'ABCXXXXXXXX',
-                    ],
+                    'schema' => ['description' => 'The start of the time range to query. This value is a UNIX timestamp representing the number of milliseconds that have elapsed since January 1, 1970, 00:00:00 UTC.', 'type' => 'integer', 'format' => 'int64', 'example' => '1577808000000', 'title' => '', 'required' => false],
                 ],
                 [
-                    'name' => 'AccountName',
+                    'name' => 'EndTime',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '多云账号名称。',
-                        'description' => 'The username of the cloud account.'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'xxxx',
-                    ],
+                    'schema' => ['description' => 'The end of the time range to query. This value is a UNIX timestamp representing the number of milliseconds that have elapsed since January 1, 1970, 00:00:00 UTC.', 'type' => 'integer', 'format' => 'int64', 'example' => '1577808000000', 'title' => '', 'required' => false],
                 ],
                 [
-                    'name' => 'AccountId',
+                    'name' => 'CurrentPage',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '云账号ID。',
-                        'description' => 'The ID of the cloud account.'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => '123xxxxxxx',
-                    ],
+                    'schema' => ['description' => 'The page number. Pages start from page 1.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'minimum' => '1', 'example' => '1', 'title' => ''],
                 ],
                 [
-                    'name' => 'CloudCode',
+                    'name' => 'PageSize',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '多云的code。',
-                        'description' => 'The code of the cloud service provider. Valid values:'."\n"
-                            ."\n"
-                            .'*   aliyun: Alibaba Cloud'."\n"
-                            .'*   hcloud: Huawei Cloud'."\n"
-                            .'*   qcloud: Tencent Cloud'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'enumValueTitles' => [],
-                        'example' => 'hcloud',
-                        'enum' => [
-                            'qcloud',
-                            'hcloud',
-                        ],
-                    ],
+                    'schema' => ['description' => 'The number of entries per page. Maximum value: 100.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'maximum' => '100', 'minimum' => '1', 'example' => '10', 'title' => ''],
                 ],
                 [
-                    'name' => 'RegionId',
+                    'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['description' => 'The entity of the alert. Valid values:'."\n"
+                        ."\n"
+                        .'- `0`: the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- `1`: all members in the resource directory.', 'type' => 'integer', 'format' => 'int32', 'title' => '', 'required' => false, 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'integer',
-                        'format' => 'int64',
-                    ],
+                    'schema' => ['description' => 'The ID of the member in the resource directory.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''],
                 ],
                 [
-                    'name' => 'RoleType',
+                    'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'integer',
-                        'format' => 'int32',
-                    ],
+                    'schema' => ['description' => 'The region in which the data management center of Threat Analysis resides. You can determine the region based on the region in which your assets reside. Valid values:'."\n"
+                        ."\n"
+                        .'- `cn-hangzhou`: Your assets reside in the Chinese mainland or Hong Kong (China).'."\n"
+                        ."\n"
+                        .'- `ap-southeast-1`: Your assets reside in regions outside the Chinese mainland.', 'type' => 'string', 'example' => 'cn-hangzhou', 'title' => '', 'required' => false],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'CloudSiemSuccessResponse<BindAccountResult>',
-                        'description' => 'The response parameters.'."\n",
+                        'title' => 'PageResponse<List<AlertDetail>>',
+                        'description' => 'A paginated response that contains a list of alerts.',
                         'type' => 'object',
                         'properties' => [
+                            'Success' => ['description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- `true`: The request was successful.'."\n"
+                                ."\n"
+                                .'- `false`: The request failed.', 'type' => 'boolean', 'example' => 'true', 'title' => ''],
+                            'Code' => ['description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200', 'title' => ''],
+                            'Message' => ['description' => 'The response message.', 'type' => 'string', 'example' => 'success', 'title' => ''],
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', 'title' => ''],
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
+                                'title' => '',
+                                'description' => 'The response payload.',
                                 'type' => 'object',
                                 'properties' => [
-                                    'Count' => [
-                                        'title' => '添加账号绑定的数量，等于1表示成功，小于等于0表示失败。',
-                                        'description' => 'The number of the cloud accounts that are added to the threat analysis feature.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '1',
+                                    'PageInfo' => [
+                                        'title' => '',
+                                        'description' => 'The pagination information.',
+                                        'type' => 'object',
+                                        'properties' => [
+                                            'CurrentPage' => ['description' => 'The current page number.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''],
+                                            'PageSize' => ['description' => 'The number of entries returned per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10', 'title' => ''],
+                                            'TotalCount' => ['description' => 'The total number of entries.', 'type' => 'integer', 'format' => 'int64', 'example' => '100', 'title' => ''],
+                                        ],
+                                        'example' => '',
+                                    ],
+                                    'ResponseData' => [
+                                        'title' => '',
+                                        'description' => 'The details of the alerts.',
+                                        'type' => 'array',
+                                        'items' => [
+                                            'type' => 'object',
+                                            'properties' => [
+                                                'Id' => ['description' => 'The unique ID of the alert.', 'type' => 'integer', 'format' => 'int64', 'example' => '123456789', 'title' => ''],
+                                                'GmtCreate' => ['description' => 'The time when the alert was created.', 'type' => 'string', 'example' => '2021-01-06 16:37:29', 'title' => ''],
+                                                'GmtModified' => ['description' => 'The time when the alert was last updated.', 'type' => 'string', 'example' => '2021-01-06 16:37:29', 'title' => ''],
+                                                'MainUserId' => ['description' => 'The ID of the main account associated with the alert.', 'type' => 'integer', 'format' => 'int64', 'example' => '127608589417****', 'title' => ''],
+                                                'IncidentUuid' => ['description' => 'The universally unique identifier (UUID) of the event.', 'type' => 'string', 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', 'title' => ''],
+                                                'AlertUuid' => ['description' => 'The UUID of the alert.', 'type' => 'string', 'example' => 'sas_71e24437d2797ce8fc59692905a4****', 'title' => ''],
+                                                'LogTime' => ['description' => 'The time when the alert was recorded.', 'type' => 'string', 'example' => '2021-01-06 16:37:29', 'title' => ''],
+                                                'AlertSrcProd' => ['description' => 'The source product of the alert.', 'type' => 'string', 'example' => 'sas', 'title' => ''],
+                                                'AlertTitle' => ['description' => 'The title of the alert.', 'type' => 'string', 'example' => 'Scan-Try SNMP weak password', 'title' => ''],
+                                                'AlertTitleEn' => ['description' => 'The English title of the alert.', 'type' => 'string', 'example' => 'Scan-Try SNMP weak password', 'title' => ''],
+                                                'AlertType' => ['description' => 'The type of the alert.', 'type' => 'string', 'example' => 'Scan', 'title' => ''],
+                                                'AlertTypeEn' => ['description' => 'The English type of the alert.', 'type' => 'string', 'example' => 'Scan', 'title' => ''],
+                                                'AlertTypeCode' => ['description' => 'The Medusa code of the alert type.', 'type' => 'string', 'example' => 'security_event_config.event_name.webshellName', 'title' => ''],
+                                                'AlertName' => ['description' => 'The name of the alert.', 'type' => 'string', 'title' => '', 'example' => 'Try SNMP weak password'],
+                                                'AlertNameEn' => ['description' => 'The English name of the alert.', 'type' => 'string', 'example' => 'Try SNMP weak password', 'title' => ''],
+                                                'AlertNameCode' => ['description' => 'The Medusa code of the alert name.', 'type' => 'string', 'example' => 'security_event_config.event_name.webshell', 'title' => ''],
+                                                'AlertLevel' => ['description' => 'The threat level of the alert. Valid values:'."\n"
+                                                    ."\n"
+                                                    .'- `serious`: high'."\n"
+                                                    ."\n"
+                                                    .'- `suspicious`: medium'."\n"
+                                                    ."\n"
+                                                    .'- `remind`: low', 'type' => 'string', 'example' => 'remind', 'title' => ''],
+                                                'AssetList' => ['description' => 'A JSON-formatted string that lists the assets associated with the alert.', 'type' => 'string', 'example' => '['."\n"
+                                                    .'      {'."\n"
+                                                    .'            "is_main_asset": "1",'."\n"
+                                                    .'            "asset_name": "47.245.*",'."\n"
+                                                    .'            "port": "22",'."\n"
+                                                    .'            "ip": "47.245.*",'."\n"
+                                                    .'            "asset_type": "ip",'."\n"
+                                                    .'            "location": "ap-southeast-1",'."\n"
+                                                    .'            "asset_id": "47.245.*",'."\n"
+                                                    .'            "net_connect_dir": "in"'."\n"
+                                                    .'      }'."\n"
+                                                    .']', 'title' => ''],
+                                                'OccurTime' => ['description' => 'The time when the alert occurred.', 'type' => 'string', 'example' => '2021-01-06 16:37:29', 'title' => ''],
+                                                'StartTime' => ['description' => 'The time when the alert first occurred.', 'type' => 'string', 'example' => '2021-01-06 16:37:29', 'title' => ''],
+                                                'EndTime' => ['description' => 'The end time of the alert.', 'type' => 'string', 'example' => '2021-01-06 16:37:29', 'title' => ''],
+                                                'AlertSrcProdModule' => ['description' => 'The submodule of the source product.', 'type' => 'string', 'example' => 'waf', 'title' => ''],
+                                                'AlertDesc' => ['description' => 'The description of the alert.', 'type' => 'string', 'title' => '', 'example' => 'The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.'],
+                                                'AlertDescEn' => ['description' => 'The English description of the alert.', 'type' => 'string', 'example' => 'The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.', 'title' => ''],
+                                                'AlertDescCode' => ['description' => 'The Medusa code of the alert description.', 'type' => 'string', 'title' => '', 'example' => 'security_event_config.event_name.webshell'."\n"],
+                                                'AlertDetail' => ['description' => 'A JSON-formatted string that contains the alert details.', 'type' => 'string', 'title' => '', 'example' => '{"main_user_id": "165295629792****";"log_uuid_count": "99";"attack_ip": "21.92.*.*"}'],
+                                                'LogUuid' => ['description' => 'The UUID of the alert log.', 'type' => 'string', 'example' => 'cfw_d12e285a-a042-4d7e-be89-f8a795ef****', 'title' => ''],
+                                                'EntityList' => ['description' => 'A JSON-formatted string that lists the entities involved in the alert.', 'type' => 'string', 'title' => '', 'example' => '[{&quot;entity_user_id&quot;:&quot;198921674491****&quot;,&quot;entity_account_id&quot;:&quot;N/A&quot;,&quot;entity_uuid&quot;:&quot;6245f979d5dd9ef8dd19bdc72228****&quot;,&quot;entity_type&quot;:&quot;host&quot;,&quot;entity_name&quot;:&quot;zhh-test-20240409&quot;,&quot;is_comprised&quot;:&quot;1&quot;,&quot;os_type&quot;:&quot;linux&quot;,&quot;entity_id&quot;:&quot;a88f44dd-b8d4-4ded-831c-77a4835****&quot;,&quot;host_uuid&quot;:&quot;a88f44dd-b8d4-4ded-831c-77a4835****&quot;,&quot;host_name&quot;:&quot;zhh-test-2024****&quot;}]'],
+                                                'AttCk' => ['description' => 'The ATT\\&CK tag.', 'type' => 'string', 'example' => 'T1595.002 Vulnerability Scanning', 'title' => ''],
+                                                'SubUserId' => ['description' => 'The ID of the sub-account that generated the alert.', 'type' => 'integer', 'format' => 'int64', 'example' => '176555323***', 'title' => ''],
+                                                'SubUserName' => ['description' => 'The name of the sub-account that generated the alert.', 'type' => 'string', 'example' => '176555323***', 'title' => ''],
+                                                'CloudCode' => ['description' => 'The cloud service provider. Valid values:'."\n"
+                                                    ."\n"
+                                                    .'- `aliyun`: Alibaba Cloud'."\n"
+                                                    ."\n"
+                                                    .'- `qcloud`: Tencent Cloud'."\n"
+                                                    ."\n"
+                                                    .'- `hcloud`: Huawei Cloud', 'type' => 'string', 'example' => 'aliyun', 'title' => ''],
+                                                'IsDefend' => ['description' => 'Indicates whether the attack was blocked. Valid values:'."\n"
+                                                    ."\n"
+                                                    .'- `0`: detected'."\n"
+                                                    ."\n"
+                                                    .'- `1`: blocked', 'type' => 'string', 'title' => '', 'example' => '1'],
+                                                'AlertInfoList' => [
+                                                    'title' => '',
+                                                    'description' => 'A list of objects that contain detailed alert attributes.',
+                                                    'type' => 'array',
+                                                    'items' => [
+                                                        'type' => 'object',
+                                                        'properties' => [
+                                                            'Key' => ['description' => 'The key of the alert attribute.', 'type' => 'string', 'title' => '', 'example' => 'suspicious.wbd.wb.trojanpath'],
+                                                            'KeyName' => ['description' => 'The display name of the alert attribute.', 'type' => 'string', 'title' => '', 'example' => 'Trojan Path'."\n"],
+                                                            'Values' => ['description' => 'The value of the alert attribute.', 'type' => 'string', 'example' => '/root/test33.php', 'title' => ''],
+                                                        ],
+                                                        'description' => 'An object that contains the attributes of a specific alert detail.',
+                                                        'title' => '',
+                                                        'example' => '',
+                                                    ],
+                                                    'example' => 'aliyun',
+                                                ],
+                                                'ExtendContent' => ['description' => 'A JSON-formatted string that contains extended information about the alert.', 'type' => 'string', 'example' => '{"main_user_id": "165295629792****";"log_uuid_count": "99****"}', 'title' => ''],
+                                                'ProductId' => ['description' => 'The cloud service ID.', 'type' => 'string', 'example' => 'alibaba_cloud_sas', 'title' => ''],
+                                                'VendorId' => ['description' => 'The cloud service provider. Valid values:'."\n"
+                                                    ."\n"
+                                                    .'- `aliyun`: Alibaba Cloud'."\n"
+                                                    ."\n"
+                                                    .'- `qcloud`: Tencent Cloud'."\n"
+                                                    ."\n"
+                                                    .'- `hcloud`: Huawei Cloud', 'type' => 'string', 'example' => 'aliyun', 'title' => ''],
+                                                'DetectionRuleId' => ['description' => 'The ID of the detection rule.', 'type' => 'string', 'example' => 'dr-48zs4tk7qfd4rjd9****', 'title' => ''],
+                                                'InvestigationReport' => ['description' => 'A JSON-formatted string that contains the investigation report for the alert.', 'type' => 'string', 'example' => '{"agent_attack_confidence": 90, "agent_judgement_category": "false_positive", "reason": "The command line contains \'mediacenter\' which is a normal startup behavior of Lark (Feishu) client, and the process path is in the standard user installation directory.", "start_time": 1774929064, "end_time": 1774929071}', 'title' => ''],
+                                            ],
+                                            'description' => 'The details of the alert.',
+                                            'title' => '',
+                                            'example' => '',
+                                        ],
+                                        'example' => '',
                                     ],
                                 ],
-                            ],
-                            'RequestId' => [
-                                'title' => '请求消息ID。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****',
+                                'example' => '123456',
                             ],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
-                400 => [
-                    [
-                        'errorCode' => 'InvalidOperation',
-                        'errorMessage' => 'access ak "%s" already bound.',
-                    ],
-                ],
                 500 => [
-                    [
-                        'errorCode' => 'InternalError',
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
+                ],
+            ],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n  \\"Data\\": {\\n    \\"PageInfo\\": {\\n      \\"CurrentPage\\": 1,\\n      \\"PageSize\\": 10,\\n      \\"TotalCount\\": 100\\n    },\\n    \\"ResponseData\\": [\\n      {\\n        \\"Id\\": 123456789,\\n        \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n        \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n        \\"MainUserId\\": 0,\\n        \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n        \\"AlertUuid\\": \\"sas_71e24437d2797ce8fc59692905a4****\\",\\n        \\"LogTime\\": \\"2021-01-06 16:37:29\\",\\n        \\"AlertSrcProd\\": \\"sas\\",\\n        \\"AlertTitle\\": \\"Scan-Try SNMP weak password\\",\\n        \\"AlertTitleEn\\": \\"Scan-Try SNMP weak password\\",\\n        \\"AlertType\\": \\"Scan\\",\\n        \\"AlertTypeEn\\": \\"Scan\\",\\n        \\"AlertTypeCode\\": \\"security_event_config.event_name.webshellName\\",\\n        \\"AlertName\\": \\"Try SNMP weak password\\",\\n        \\"AlertNameEn\\": \\"Try SNMP weak password\\",\\n        \\"AlertNameCode\\": \\"security_event_config.event_name.webshell\\",\\n        \\"AlertLevel\\": \\"remind\\",\\n        \\"AssetList\\": \\"[\\\\n      {\\\\n            \\\\\\"is_main_asset\\\\\\": \\\\\\"1\\\\\\",\\\\n            \\\\\\"asset_name\\\\\\": \\\\\\"47.245.*\\\\\\",\\\\n            \\\\\\"port\\\\\\": \\\\\\"22\\\\\\",\\\\n            \\\\\\"ip\\\\\\": \\\\\\"47.245.*\\\\\\",\\\\n            \\\\\\"asset_type\\\\\\": \\\\\\"ip\\\\\\",\\\\n            \\\\\\"location\\\\\\": \\\\\\"ap-southeast-1\\\\\\",\\\\n            \\\\\\"asset_id\\\\\\": \\\\\\"47.245.*\\\\\\",\\\\n            \\\\\\"net_connect_dir\\\\\\": \\\\\\"in\\\\\\"\\\\n      }\\\\n]\\",\\n        \\"OccurTime\\": \\"2021-01-06 16:37:29\\",\\n        \\"StartTime\\": \\"2021-01-06 16:37:29\\",\\n        \\"EndTime\\": \\"2021-01-06 16:37:29\\",\\n        \\"AlertSrcProdModule\\": \\"waf\\",\\n        \\"AlertDesc\\": \\"The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.\\",\\n        \\"AlertDescEn\\": \\"The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.\\",\\n        \\"AlertDescCode\\": \\"security_event_config.event_name.webshell\\\\n\\",\\n        \\"AlertDetail\\": \\"{\\\\\\"main_user_id\\\\\\": \\\\\\"165295629792****\\\\\\";\\\\\\"log_uuid_count\\\\\\": \\\\\\"99\\\\\\";\\\\\\"attack_ip\\\\\\": \\\\\\"21.92.*.*\\\\\\"}\\",\\n        \\"LogUuid\\": \\"cfw_d12e285a-a042-4d7e-be89-f8a795ef****\\",\\n        \\"EntityList\\": \\"[{&quot;entity_user_id&quot;:&quot;198921674491****&quot;,&quot;entity_account_id&quot;:&quot;N/A&quot;,&quot;entity_uuid&quot;:&quot;6245f979d5dd9ef8dd19bdc72228****&quot;,&quot;entity_type&quot;:&quot;host&quot;,&quot;entity_name&quot;:&quot;zhh-test-20240409&quot;,&quot;is_comprised&quot;:&quot;1&quot;,&quot;os_type&quot;:&quot;linux&quot;,&quot;entity_id&quot;:&quot;a88f44dd-b8d4-4ded-831c-77a4835****&quot;,&quot;host_uuid&quot;:&quot;a88f44dd-b8d4-4ded-831c-77a4835****&quot;,&quot;host_name&quot;:&quot;zhh-test-2024****&quot;}]\\",\\n        \\"AttCk\\": \\"T1595.002 Vulnerability Scanning\\",\\n        \\"SubUserId\\": 0,\\n        \\"SubUserName\\": \\"176555323***\\",\\n        \\"CloudCode\\": \\"aliyun\\",\\n        \\"IsDefend\\": \\"1\\",\\n        \\"AlertInfoList\\": [\\n          {\\n            \\"Key\\": \\"suspicious.wbd.wb.trojanpath\\",\\n            \\"KeyName\\": \\"Trojan Path\\\\n\\",\\n            \\"Values\\": \\"/root/test33.php\\"\\n          }\\n        ],\\n        \\"ExtendContent\\": \\"{\\\\\\"main_user_id\\\\\\": \\\\\\"165295629792****\\\\\\";\\\\\\"log_uuid_count\\\\\\": \\\\\\"99****\\\\\\"}\\",\\n        \\"ProductId\\": \\"alibaba_cloud_sas\\",\\n        \\"VendorId\\": \\"aliyun\\",\\n        \\"DetectionRuleId\\": \\"dr-48zs4tk7qfd4rjd9****\\",\\n        \\"InvestigationReport\\": \\"{\\\\\\"agent_attack_confidence\\\\\\": 90, \\\\\\"agent_judgement_category\\\\\\": \\\\\\"false_positive\\\\\\", \\\\\\"reason\\\\\\": \\\\\\"The command line contains \'mediacenter\' which is a normal startup behavior of Lark (Feishu) client, and the process path is in the standard user installation directory.\\\\\\", \\\\\\"start_time\\\\\\": 1774929064, \\\\\\"end_time\\\\\\": 1774929071}\\"\\n      }\\n    ]\\n  }\\n}","type":"json"}]',
+            'title' => 'DescribeAlertsWithEvent',
+            'changeSet' => [
+                ['createdAt' => '2025-04-25T07:53:21.000Z', 'description' => 'Response parameters changed'],
+                ['createdAt' => '2024-11-04T11:26:50.000Z', 'description' => 'Request parameters changed'],
+                ['createdAt' => '2024-09-26T11:11:01.000Z', 'description' => 'Request parameters changed, Response parameters changed'],
+                ['createdAt' => '2024-04-17T12:43:24.000Z', 'description' => 'Error codes changed, Request parameters changed, Response parameters changed'],
+            ],
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAlertsWithEvent'],
+                ],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DescribeAlertsWithEvent',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
                     ],
                 ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"Count\\": 1\\n  },\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
-            'title' => 'BindAccount',
         ],
-        'AddUserSourceLogConfig' => [
-            'summary' => 'Adds the logs of a cloud service within a cloud account to the threat analysis feature for alert and event anslysis.',
-            'methods' => [
-                'get',
-                'post',
-            ],
-            'schemes' => [
-                'http',
-                'https',
-            ],
+        'DescribeAuth' => [
+            'summary' => 'Checks whether an Alibaba Cloud account has granted permissions to Cloud SIEM and the AliyunServiceRoleForSasCloudSiem role has been created.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'write',
+            'operationType' => 'read',
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'create',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-            ],
+            'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
-                    'name' => 'SourceProdCode',
+                    'name' => 'RegionId',
                     'in' => 'formData',
                     'schema' => [
-                        'title' => '产品code。',
-                        'description' => 'The code of the cloud service.'."\n",
+                        'title' => '',
+                        'description' => 'The region of the threat analysis center. Select a region based on where your assets are located. Valid values:'."\n"
+                            ."\n"
+                            .'- cn-hangzhou: Select this value if your assets are deployed in the Chinese mainland or the China (Hong Kong) region.'."\n"
+                            ."\n"
+                            .'- ap-southeast-1: Select this value if your assets are deployed in regions outside the Chinese mainland.',
                         'type' => 'string',
                         'required' => false,
-                        'example' => 'sas',
+                        'enumValueTitles' => ['ap-southeast-1' => 'Singapore', 'cn-hangzhou' => 'China (Hangzhou)'],
+                        'example' => 'cn-hangzhou',
                     ],
                 ],
-                [
-                    'name' => 'SourceLogCode',
-                    'in' => 'formData',
+            ],
+            'responses' => [
+                200 => [
                     'schema' => [
-                        'title' => '日志code。',
-                        'description' => 'The log code.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cloud_siem_aegis_proc',
+                        'title' => 'CloudSiemSuccessResponse<Boolean>',
+                        'description' => 'CloudSiemResponse',
+                        'type' => 'object',
+                        'properties' => [
+                            'Data' => [
+                                'title' => '',
+                                'description' => 'Indicates whether the permissions are granted.'."\n"
+                                    ."\n"
+                                    .'- true: The permissions are granted.'."\n"
+                                    ."\n"
+                                    .'- false: The permissions are not granted.',
+                                'type' => 'boolean',
+                                'enumValueTitles' => [],
+                                'example' => 'true',
+                            ],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '4F539347-7D9A-51EA-8ABF-5D5507045C5C'],
+                        ],
+                        'example' => '',
                     ],
                 ],
+            ],
+            'errorCodes' => [
+                500 => [
+                    ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''],
+                ],
+            ],
+            'title' => 'DescribeAuth',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '15', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAuth'],
+                ],
+            ],
+            'ramActions' => [
                 [
-                    'name' => 'SubUserId',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '需要接入日志的阿里云账号ID。',
-                        'description' => 'The ID of the Alibaba Cloud account.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => true,
-                        'example' => '123XXXXXX',
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DescribeAuth',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
                     ],
                 ],
+            ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": true,\\n  \\"RequestId\\": \\"4F539347-7D9A-51EA-8ABF-5D5507045C5C\\"\\n}","type":"json"}]',
+        ],
+        'DescribeAutomateResponseConfigCounter' => [
+            'summary' => 'Returns the number of automated response rules.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['https', 'http'],
+            'security' => [
                 [
-                    'name' => 'SourceLogInfo',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '需要接入日志的详细SLS信息，json数组格式。',
-                        'description' => 'The details of the Logstore that you want to use in the JSON string format.'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => '{"project":"wafnew-project-1335759343513432-cn-hangzhou","logStore":"wafnew-logstore","regionCode":"cn-hangzhou","prodCode":"waf"}',
-                    ],
+                    'AK' => [],
                 ],
+            ],
+            'deprecated' => false,
+            'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'],
+            'parameters' => [
                 [
-                    'name' => 'DisPlayLine',
+                    'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '需要接入日志的详细SLS信息。',
-                        'description' => 'The display details of the Logstore.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-shanghai.siem-project.siem-logstore',
-                    ],
+                    'schema' => ['description' => 'The view type.'."\n"
+                        ."\n"
+                        .'- 0: The view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: The view of all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
-                    'name' => 'Deleted',
+                    'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '添加接入或删除接入。取值：'."\n"
-                            .'-1：删除接入 '."\n"
-                            .'0：添加接入',
-                        'description' => 'Specifies whether to add logs or delete added logs. Valid values:'."\n"
-                            ."\n"
-                            .'*   \\-1: deletes added logs.'."\n"
-                            .'*   0: adds logs.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '0',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member whose view the administrator wants to switch to.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region of the Management Hub. Select the region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'CloudSiemSuccessResponse<UserSourceLogResult>',
-                        'description' => 'CloudSiemSuccessResponse'."\n",
+                        'title' => 'BaseResponse<AutomateResponseCounter>',
+                        'description' => 'BaseResponse',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
+                                'title' => '',
+                                'description' => 'The data returned.',
                                 'type' => 'object',
                                 'properties' => [
-                                    'DiplayLine' => [
-                                        'title' => '需要接入日志的详细SLS信息。',
-                                        'description' => 'The display details of the Logstore.'."\n",
-                                        'type' => 'string',
-                                        'example' => 'cn-shanghai.siem-project.siem-logstore',
-                                    ],
-                                    'SourceProdCode' => [
-                                        'title' => '产品code。',
-                                        'description' => 'The code of the cloud service.'."\n",
-                                        'type' => 'string',
-                                        'example' => 'sas',
-                                    ],
-                                    'SourceLogCode' => [
-                                        'title' => '日志code。',
-                                        'description' => 'The log code.'."\n",
-                                        'type' => 'string',
-                                        'example' => 'cloud_siem_aegis_proc',
-                                    ],
-                                    'Displayed' => [
-                                        'title' => '返回接入详细信息。取值：'."\n"
-                                            .' - true：已接入。'."\n"
-                                            .' - 未接入：false。',
-                                        'description' => 'Indicates whether the details of added logs are returned. Valid values: true false'."\n",
-                                        'type' => 'boolean',
-                                        'example' => '0',
-                                    ],
-                                    'Imported' => [
-                                        'title' => '是否已经接入。取值：'."\n"
-                                            .' - true：已接入。'."\n"
-                                            .' - 未接入：false。',
-                                        'description' => 'Indicates whether the logs are added to the threat analysis feature. Valid values: true false'."\n",
-                                        'type' => 'boolean',
-                                        'example' => '0',
-                                    ],
-                                    'MainUserId' => [
-                                        'title' => '购买威胁分析的阿里云账号ID。',
-                                        'description' => 'The ID of the Alibaba Cloud account that is used to purchase the threat analysis feature.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int64',
-                                        'example' => '123XXXXXXXXX',
-                                    ],
-                                    'SubUserId' => [
-                                        'title' => '威胁分析阿里云账号ID。',
-                                        'description' => 'The ID of the Alibaba Cloud account that can be used to perform operations supported by the threat analysis feature.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int64',
-                                        'example' => '123XXXXXXXX',
-                                    ],
-                                    'SubUserName' => [
-                                        'title' => '威胁分析阿里云账号名字。',
-                                        'description' => 'The username of the Alibaba Cloud account that can be used to perform operations supported by the threat analysis feature.'."\n",
-                                        'type' => 'string',
-                                        'example' => 'sas_account_xxx',
-                                    ],
+                                    'All' => ['title' => '', 'description' => 'The total number of rules.', 'type' => 'integer', 'format' => 'int64', 'example' => '20'],
+                                    'Online' => ['title' => '', 'description' => 'The number of enabled rules.', 'type' => 'integer', 'format' => 'int64', 'example' => '10'],
                                 ],
+                                'example' => '123456',
                             ],
-                            'RequestId' => [
-                                'title' => '请求消息ID。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****',
-                            ],
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The request was successful.'."\n"
+                                ."\n"
+                                .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The request status code.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The message returned.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorCode' => 'InternalError',
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"DiplayLine\\": \\"cn-shanghai.siem-project.siem-logstore\\",\\n    \\"SourceProdCode\\": \\"sas\\",\\n    \\"SourceLogCode\\": \\"cloud_siem_aegis_proc\\",\\n    \\"Displayed\\": true,\\n    \\"Imported\\": true,\\n    \\"MainUserId\\": 0,\\n    \\"SubUserId\\": 0,\\n    \\"SubUserName\\": \\"sas_account_xxx\\"\\n  },\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
-            'title' => 'AddUserSourceLogConfig',
-        ],
-        'AddDataSourceLog' => [
-            'summary' => 'Adds logs of a cloud account to the threat analysis feature.',
-            'methods' => [
-                'get',
-                'post',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'DescribeAutomateResponseConfigCounter',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:43:23.000Z', 'description' => 'Error codes changed, Request parameters changed'],
             ],
-            'schemes' => [
-                'http',
-                'https',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAutomateResponseConfigCounter'],
+                ],
             ],
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DescribeAutomateResponseConfigCounter',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
+            ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"All\\": 20,\\n    \\"Online\\": 10\\n  },\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
+        ],
+        'DescribeAutomateResponseConfigFeature' => [
+            'summary' => 'Retrieves the configurable fields and operators for automated response rules.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['https', 'http'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'write',
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'create',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-            ],
+            'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
-                    'name' => 'LogCode',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '日志code。',
-                        'description' => 'The log code.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cloud_siem_waf_xxxxx',
-                    ],
-                ],
-                [
-                    'name' => 'DataSourceInstanceId',
+                    'name' => 'AutoResponseType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '数据源ID，由威胁分析根据具体参数计算md5生成。',
-                        'description' => 'The ID of the data source. The ID is an MD5 hash value that is calculated by the threat analysis feature based on specific parameters. You can call the [ListDataSourceLogs](https://api.aliyun-inc.com/#/publishment/document/cloud-siem/863fdf54478f4cc5877e27c2a5fe9e44?tenantUuid=f382fccd88b94c5c8c864def6815b854\\&activeTabKey=api%7CListDataSourceLogs) operation to query the IDs of data sources.'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The type of automated response. Valid values:'."\n"
+                        ."\n"
+                        .'- event: event'."\n"
+                        ."\n"
+                        .'- alert: alert', 'type' => 'string', 'required' => false, 'example' => 'event'],
                 ],
                 [
-                    'name' => 'DataSourceInstanceLogs',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '数据源参数详情，json数组格式。',
-                        'description' => 'The parameters of the data source. Set this parameter to a JSON array.'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => '[{"LogCode":"cloud_siem_qcloud_waf_alert_log","LogParas":"[{\\"ParaCode\\":\\"api_name\\",\\"ParaValue\\":\\"GetAttackDownloadRecords\\"}]"}]',
-                    ],
-                ],
-                [
-                    'name' => 'AccountId',
+                    'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '云账号ID。',
-                        'description' => 'The ID of the cloud account.'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => '123xxxxxxx',
-                    ],
+                    'schema' => ['description' => 'The type of view. Valid values:'."\n"
+                        ."\n"
+                        .'- 0: the view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: the view of all accounts that are managed by the administrator account.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
-                    'name' => 'CloudCode',
+                    'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '多云的code。',
-                        'description' => 'The code of the cloud service provider. Valid values:'."\n"
-                            ."\n"
-                            .'*   qcloud: Tencent Cloud'."\n"
-                            .'*   aliyun: Alibaba Cloud'."\n"
-                            .'*   hcloud: Huawei Cloud'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'hcloud',
-                        'enum' => [
-                            'qcloud',
-                            'hcloud',
-                            'aliyun',
-                        ],
-                    ],
+                    'schema' => ['description' => 'The user ID of the member. An administrator can use this parameter to switch to the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region where the Data Management center of threat analysis is deployed. Select a region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Assets in the Chinese mainland and Hong Kong (China).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Assets outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'CloudSiemSuccessResponse<AddDataSourceLogResult>',
-                        'description' => 'CloudSiemSuccessResponse'."\n",
+                        'title' => 'BaseResponse<List<AutomateResponseConfigFeature>>',
+                        'description' => 'BaseResponse\\<List>',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'object',
-                                'properties' => [
-                                    'Count' => [
-                                        'title' => '添加的日志的数量，等于1表示成功，小于等于0表示失败。',
-                                        'description' => 'The number of logs that are added. The value 1 indicates that the log is added, and a value less than or equal to 0 indicates that the log failed to be added.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '1',
-                                    ],
-                                    'LogInstanceId' => [
-                                        'title' => '日志ID，由威胁分析根据具体参数计算md5生成。',
-                                        'description' => 'The ID of the log. The ID is an MD5 hash value that is calculated by the threat analysis feature based on specific parameters.'."\n",
-                                        'type' => 'string',
-                                        'example' => 'ef33097c9d1fdb0b9c7e8c7ca320pkl1',
+                                'title' => '',
+                                'description' => 'The returned data.',
+                                'type' => 'array',
+                                'items' => [
+                                    'type' => 'object',
+                                    'properties' => [
+                                        'Feature' => ['title' => '', 'description' => 'The name of the condition field for the automated response rule.', 'type' => 'string', 'example' => 'alert_desc'],
+                                        'DataType' => ['title' => '', 'description' => 'The data type of the condition field for the automated response rule.', 'type' => 'string', 'example' => 'varchar'],
+                                        'SupportOperators' => [
+                                            'title' => '',
+                                            'description' => 'The operators that the field supports.',
+                                            'type' => 'array',
+                                            'items' => [
+                                                'type' => 'object',
+                                                'properties' => [
+                                                    'HasRightValue' => ['title' => '', 'description' => 'Indicates whether a right operand is required. Valid values:'."\n"
+                                                        ."\n"
+                                                        .'- true: A right operand is required.'."\n"
+                                                        ."\n"
+                                                        .'- false: A right operand is not required.', 'type' => 'boolean', 'example' => 'false'],
+                                                    'Operator' => ['title' => '', 'description' => 'The operator.', 'type' => 'string', 'example' => '<='],
+                                                    'OperatorName' => ['title' => '', 'description' => 'The display name of the operator.', 'type' => 'string', 'example' => '<='],
+                                                    'OperatorDescCn' => ['title' => '', 'description' => 'The description of the operator in Chinese.', 'type' => 'string', 'example' => 'larger than or equal to'],
+                                                    'OperatorDescEn' => ['title' => '', 'description' => 'The description of the operator in English.', 'type' => 'string', 'example' => 'larger than or equal to'],
+                                                    'SupportDataType' => ['title' => '', 'description' => 'The data types that the operator supports. Multiple data types are separated by commas.', 'type' => 'string', 'example' => 'varchar'],
+                                                    'SupportTag' => [
+                                                        'title' => '',
+                                                        'description' => 'The scenarios that the operator supports. Multiple scenarios are separated by commas, such as aggregation. By default, this parameter is empty.',
+                                                        'type' => 'array',
+                                                        'items' => ['description' => 'The supported scenario.', 'type' => 'string', 'title' => '', 'example' => '[AGGREGATE]'],
+                                                        'example' => '[AGGREGATE]',
+                                                    ],
+                                                    'Index' => ['title' => '', 'description' => 'The position of the operator in the list of operators.', 'type' => 'integer', 'format' => 'int32', 'example' => '3'],
+                                                ],
+                                                'description' => '',
+                                                'title' => '',
+                                                'example' => '',
+                                            ],
+                                            'example' => '',
+                                        ],
+                                        'RightValueEnums' => [
+                                            'title' => '',
+                                            'description' => 'The enumeration of the right operand that corresponds to the field.',
+                                            'type' => 'array',
+                                            'items' => [
+                                                'type' => 'object',
+                                                'properties' => [
+                                                    'Value' => ['title' => '', 'description' => 'The enumeration value of the right operand.', 'type' => 'string', 'example' => 'serious'],
+                                                    'ValueMds' => ['title' => '', 'description' => 'The Medusa code for the enumeration value of the right operand.', 'type' => 'string', 'example' => 'aliyun.siem.automate.feature.alert_level.serious'],
+                                                ],
+                                                'description' => '',
+                                                'title' => '',
+                                                'example' => '',
+                                            ],
+                                            'example' => '',
+                                        ],
                                     ],
+                                    'description' => '',
+                                    'title' => '',
+                                    'example' => '',
                                 ],
+                                'example' => '123456',
                             ],
-                            'RequestId' => [
-                                'title' => '请求消息ID。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****',
-                            ],
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request is successful. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The request is successful.'."\n"
+                                ."\n"
+                                .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The status code.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The returned message.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorCode' => 'InternalError',
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"Count\\": 1,\\n    \\"LogInstanceId\\": \\"ef33097c9d1fdb0b9c7e8c7ca320pkl1\\"\\n  },\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
-            'title' => 'AddDataSourceLog',
-        ],
-        'AddDataSource' => [
-            'summary' => 'Adds a data source to a cloud account that is added to the threat analysis feature.',
-            'methods' => [
-                'get',
-                'post',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'DescribeAutomateResponseConfigFeature',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:43:23.000Z', 'description' => 'Error codes changed, Request parameters changed'],
+            ],
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAutomateResponseConfigFeature'],
+                ],
             ],
-            'schemes' => [
-                'http',
-                'https',
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DescribeAutomateResponseConfigFeature',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"Feature\\": \\"alert_desc\\",\\n      \\"DataType\\": \\"varchar\\",\\n      \\"SupportOperators\\": [\\n        {\\n          \\"HasRightValue\\": false,\\n          \\"Operator\\": \\"<=\\",\\n          \\"OperatorName\\": \\"<=\\",\\n          \\"OperatorDescCn\\": \\"larger than or equal to\\",\\n          \\"OperatorDescEn\\": \\"larger than or equal to\\",\\n          \\"SupportDataType\\": \\"varchar\\",\\n          \\"SupportTag\\": [\\n            \\"[AGGREGATE]\\"\\n          ],\\n          \\"Index\\": 3\\n        }\\n      ],\\n      \\"RightValueEnums\\": [\\n        {\\n          \\"Value\\": \\"serious\\",\\n          \\"ValueMds\\": \\"aliyun.siem.automate.feature.alert_level.serious\\"\\n        }\\n      ]\\n    }\\n  ],\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
+        ],
+        'DescribeCloudSiemAssets' => [
+            'summary' => 'Queries a list of assets that are associated with an event.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['https', 'http'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'write',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'create',
+                'operationType' => 'list',
                 'riskType' => 'none',
                 'chargeType' => 'free',
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
-                    'name' => 'AccountId',
+                    'name' => 'IncidentUuid',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '云账号ID。',
-                        'description' => 'The ID of the cloud account.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '123xxxxxxxx',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The UUID of the event.', 'type' => 'string', 'required' => false, 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'],
                 ],
                 [
-                    'name' => 'DataSourceType',
+                    'name' => 'AssetType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '数据源类型。取值：'."\n"
-                            .' - obs：华为云obs。'."\n"
-                            .' - wafApi：腾讯云waf下载api。 '."\n"
-                            .' - ckafka： 腾讯云ckafka。',
-                        'description' => 'The type of the data source. Valid values:'."\n"
-                            ."\n"
-                            .'*   obs: Huawei Cloud Object Storage Service (OBS)'."\n"
-                            .'*   wafApi: download API of Tencent Cloud Web Application Firewall (WAF)'."\n"
-                            .'*   ckafka: Tencent Cloud Kafka (CKafka)'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'obs',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The asset type. Valid values:'."\n"
+                        ."\n"
+                        .'- ip: IP address'."\n"
+                        ."\n"
+                        .'- domain: domain name'."\n"
+                        ."\n"
+                        .'- url: URL'."\n"
+                        ."\n"
+                        .'- process: process'."\n"
+                        ."\n"
+                        .'- file: file'."\n"
+                        ."\n"
+                        .'- host: host', 'type' => 'string', 'required' => false, 'example' => 'ip'],
                 ],
                 [
-                    'name' => 'DataSourceInstanceName',
+                    'name' => 'AssetName',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '数据源名称。',
-                        'description' => 'The name of the data source.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'beijing_waf_kafka',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The asset name.', 'type' => 'string', 'required' => false, 'example' => 'test123'],
                 ],
                 [
-                    'name' => 'DataSourceInstanceRemark',
+                    'name' => 'AssetUuid',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '数据源备注。',
-                        'description' => 'The remarks on the data source.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'waf_alert_log',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The UUID of the asset.', 'type' => 'string', 'required' => false, 'example' => '123456-2222-3333-5555-3435345****'],
                 ],
                 [
-                    'name' => 'DataSourceInstanceParams',
+                    'name' => 'CurrentPage',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '数据源参数，json数组格式。',
-                        'description' => 'The parameters of the data source. Set this parameter to a JSON array.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '[{"paraCode":"region_code","paraValue":"ap-guangzhou"}]',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The page number. The value must be greater than or equal to 1.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'minimum' => '1', 'example' => '1'],
                 ],
                 [
-                    'name' => 'CloudCode',
+                    'name' => 'PageSize',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '多云的code。',
-                        'description' => 'The code of the cloud service provider.'."\n"
-                            ."\n"
-                            .'Valid values:'."\n"
-                            ."\n"
-                            .'*   qcloud'."\n"
-                            .'*   hcloud'."\n"
-                            .'*   aliyun'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'hcloud',
-                        'enum' => [
-                            'qcloud',
-                            'hcloud',
-                            'aliyun',
-                        ],
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The number of entries to return on each page. The maximum value is 100.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'maximum' => '100', 'minimum' => '1', 'example' => '10'],
+                ],
+                [
+                    'name' => 'RoleType',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The view type.'."\n"
+                        ."\n"
+                        .'- 0: The view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: The view of all accounts that belong to the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
+                ],
+                [
+                    'name' => 'RoleFor',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The user ID of the member whose data you want to view. This parameter is available only when an administrator wants to switch to the perspective of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region where the Data Management center of Threat Analysis is deployed. Select a region based on the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: assets in the Chinese mainland or China (Hong Kong)'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: assets outside China', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'CloudSiemSuccessResponse<AddDataSourceResult>',
-                        'description' => 'CloudSiemSuccessResponse'."\n",
+                        'title' => 'PageResponse<List<AssetInfo>>',
+                        'description' => 'PageResponse\\<List>',
                         'type' => 'object',
                         'properties' => [
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The request was successful.'."\n"
+                                ."\n"
+                                .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The HTTP status code.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The returned message.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
+                                'title' => '',
+                                'description' => 'The data returned.',
                                 'type' => 'object',
                                 'properties' => [
-                                    'Count' => [
-                                        'title' => '添加数据源的数量，等于1表示成功，小于等于0表示失败。',
-                                        'description' => 'The number of data sources that are added. The value 1 indicates that data source is added, and a value less than or equal to 0 indicates that the data source failed to be added.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '1',
+                                    'PageInfo' => [
+                                        'title' => '',
+                                        'description' => 'The pagination information.',
+                                        'type' => 'object',
+                                        'properties' => [
+                                            'CurrentPage' => ['title' => '', 'description' => 'The page number of the returned page.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'],
+                                            'PageSize' => ['title' => '', 'description' => 'The number of entries returned per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10'],
+                                            'TotalCount' => ['title' => '', 'description' => 'The total number of entries.', 'type' => 'integer', 'format' => 'int64', 'example' => '100'],
+                                        ],
+                                        'example' => '',
                                     ],
-                                    'DataSourceInstanceId' => [
-                                        'title' => '数据源ID，由威胁分析根据具体参数计算md5生成。',
-                                        'description' => 'The ID of the data source. The ID is an MD5 hash value that is calculated by the threat analysis feature based on specific parameters.'."\n",
-                                        'type' => 'string',
-                                        'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea',
+                                    'ResponseData' => [
+                                        'title' => '',
+                                        'description' => 'The detailed data.',
+                                        'type' => 'array',
+                                        'items' => [
+                                            'type' => 'object',
+                                            'properties' => [
+                                                'Id' => ['title' => '', 'description' => 'The asset ID.', 'type' => 'integer', 'format' => 'int64', 'example' => '123'],
+                                                'GmtCreate' => ['title' => '', 'description' => 'The time when the asset was synchronized.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'],
+                                                'GmtModified' => ['title' => '', 'description' => 'The time when the asset was last updated.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'],
+                                                'Aliuid' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account.', 'type' => 'integer', 'format' => 'int64', 'example' => '1276085894174392'],
+                                                'SubUserId' => ['title' => '', 'description' => 'The ID of the linked account.', 'type' => 'integer', 'format' => 'int64', 'example' => '176555323***'],
+                                                'IncidentUuid' => ['title' => '', 'description' => 'The UUID of the event.', 'type' => 'string', 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'],
+                                                'AlertUuid' => ['title' => '', 'description' => 'The UUID of the alert that is associated with the event.', 'type' => 'string', 'example' => 'sas_71e24437d2797ce8fc59692905a4****'],
+                                                'AssetName' => ['title' => '', 'description' => 'The asset name.', 'type' => 'string', 'example' => 'zsw-agentless-centos****'],
+                                                'AssetType' => ['title' => '', 'description' => 'The asset type. Valid values:'."\n"
+                                                    ."\n"
+                                                    .'- ip: IP address'."\n"
+                                                    ."\n"
+                                                    .'- domain: domain name'."\n"
+                                                    ."\n"
+                                                    .'- url: URL'."\n"
+                                                    ."\n"
+                                                    .'- process: process'."\n"
+                                                    ."\n"
+                                                    .'- file: file'."\n"
+                                                    ."\n"
+                                                    .'- host: host', 'type' => 'string', 'example' => 'domain'],
+                                                'AssetInfo' => [
+                                                    'title' => '',
+                                                    'description' => 'The asset information, in a JSON array.',
+                                                    'type' => 'array',
+                                                    'items' => [
+                                                        'type' => 'object',
+                                                        'properties' => [
+                                                            'Key' => ['title' => '', 'description' => 'The key of the alert property.', 'type' => 'string', 'example' => 'suspicious.wbd.wb.trojanpath'],
+                                                            'KeyName' => ['title' => '', 'description' => 'The name of the alert property.', 'type' => 'string', 'example' => 'Trojan Path'],
+                                                            'Values' => ['title' => '', 'description' => 'The value of the alert property.', 'type' => 'string', 'example' => '/root/test33.php'],
+                                                        ],
+                                                        'description' => '',
+                                                        'title' => '',
+                                                        'example' => '',
+                                                    ],
+                                                    'example' => '[{"KeyName": "${aliyun.siem.asset.asset_name}","Values": "zsw-agentless-ubuntu20","Key": "asset_name"}]',
+                                                ],
+                                                'AssetId' => ['title' => '', 'description' => 'The logical ID of the asset.', 'type' => 'string', 'example' => '0616caeb-acb8-45e0-8520-4ee5fbe251f0'],
+                                                'CloudCode' => ['title' => '', 'description' => 'The cloud service provider of the entity. Valid values:'."\n"
+                                                    ."\n"
+                                                    .'- aliyun: Alibaba Cloud'."\n"
+                                                    ."\n"
+                                                    .'- qcloud: Tencent Cloud'."\n"
+                                                    ."\n"
+                                                    .'- hcloud: Huawei Cloud', 'type' => 'string', 'example' => 'aliyun'],
+                                            ],
+                                            'description' => '',
+                                            'title' => '',
+                                            'example' => '',
+                                        ],
+                                        'example' => '',
                                     ],
                                 ],
-                            ],
-                            'RequestId' => [
-                                'title' => '请求消息ID。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****',
+                                'example' => '123456',
                             ],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorCode' => 'InternalError',
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'DescribeCloudSiemAssets',
+            'changeSet' => [
+                ['createdAt' => '2024-11-04T11:26:50.000Z', 'description' => 'Request parameters changed'],
+                ['createdAt' => '2024-04-17T12:43:24.000Z', 'description' => 'Error codes changed, Request parameters changed'],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"Count\\": 1,\\n    \\"DataSourceInstanceId\\": \\"220ba97c9d1fdb0b9c7e8c7ca328d7ea\\"\\n  },\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
-            'title' => 'AddDataSource',
-        ],
-        'ListBindAccount' => [
-            'summary' => 'Queries a list of cloud accounts that are added to the threat analysis feature.',
-            'methods' => [
-                'get',
-                'post',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeCloudSiemAssets'],
+                ],
             ],
-            'schemes' => [
-                'http',
-                'https',
+            'ramActions' => [
+                [
+                    'operationType' => 'list',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DescribeCloudSiemAssets',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n  \\"Data\\": {\\n    \\"PageInfo\\": {\\n      \\"CurrentPage\\": 1,\\n      \\"PageSize\\": 10,\\n      \\"TotalCount\\": 100\\n    },\\n    \\"ResponseData\\": [\\n      {\\n        \\"Id\\": 123,\\n        \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n        \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n        \\"Aliuid\\": 1276085894174392,\\n        \\"SubUserId\\": 0,\\n        \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n        \\"AlertUuid\\": \\"sas_71e24437d2797ce8fc59692905a4****\\",\\n        \\"AssetName\\": \\"zsw-agentless-centos****\\",\\n        \\"AssetType\\": \\"domain\\",\\n        \\"AssetInfo\\": [\\n          {\\n            \\"Key\\": \\"suspicious.wbd.wb.trojanpath\\",\\n            \\"KeyName\\": \\"Trojan Path\\",\\n            \\"Values\\": \\"/root/test33.php\\"\\n          }\\n        ],\\n        \\"AssetId\\": \\"0616caeb-acb8-45e0-8520-4ee5fbe251f0\\",\\n        \\"CloudCode\\": \\"aliyun\\"\\n      }\\n    ]\\n  }\\n}","type":"json"}]',
+        ],
+        'DescribeCloudSiemAssetsCounter' => [
+            'summary' => 'Queries the number of assets of each type that are associated with an event.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['https', 'http'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'read',
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'list',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-            ],
+            'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
-                    'name' => 'CloudCode',
+                    'name' => 'IncidentUuid',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '多云的code。',
-                        'description' => 'The code of the cloud service provider. Valid values:'."\n"
-                            ."\n"
-                            .'*   qcloud: Tencent Cloud'."\n"
-                            .'*   aliyun: Alibaba Cloud'."\n"
-                            .'*   hcloud: Huawei Cloud'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'enumValueTitles' => [],
-                        'example' => 'hcloud',
-                        'enum' => [
-                            'qcloud',
-                            'hcloud',
-                        ],
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The UUID of the event.', 'type' => 'string', 'required' => true, 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'],
                 ],
                 [
-                    'name' => 'RegionId',
+                    'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['description' => 'The type of view.'."\n"
+                        ."\n"
+                        .'- 0: The view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: The view of all accounts that belong to the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'integer',
-                        'format' => 'int64',
-                    ],
+                    'schema' => ['description' => 'The UID of the member. An administrator can use this parameter to switch to the member\'s view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
-                    'name' => 'RoleType',
+                    'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'integer',
-                        'format' => 'int32',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region where the data management center of Threat Analysis is deployed. Select a region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or the China (Hong Kong) region.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => '已经绑定的账号列表。',
-                        'description' => 'The response parameters.'."\n",
+                        'title' => 'PlainResponse<List<CloudSiemEventAssetCounter>>',
+                        'description' => 'PlainResponse\\<List\\<CloudSiemEventAssetCounter>>',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
+                                'title' => '',
+                                'description' => 'The returned data.',
                                 'type' => 'array',
                                 'items' => [
                                     'type' => 'object',
                                     'properties' => [
-                                        'AccountName' => [
-                                            'title' => '账号名称。',
-                                            'description' => 'The username of the cloud account.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'sas_account_xxx',
-                                        ],
-                                        'AccessId' => [
-                                            'title' => '已经绑定ACCESS_KEY_ID。',
-                                            'description' => 'The AccessKey ID of the cloud account.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'ABCXXXXXXXX',
-                                        ],
-                                        'DataSourceCount' => [
-                                            'title' => '该账号下绑定数据源的数量。',
-                                            'description' => 'The number of data sources that are added to the threat analysis feature within the cloud account.'."\n",
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '2',
-                                        ],
-                                        'ModifyTime' => [
-                                            'title' => '修改时间。',
-                                            'description' => 'The modification time.'."\n",
-                                            'type' => 'string',
-                                            'example' => '2023-11-10 12:20:35',
-                                        ],
-                                        'CreateUser' => [
-                                            'title' => '该账号绑定者。',
-                                            'description' => 'The ID of the account that is used to add the cloud account.'."\n",
-                                            'type' => 'string',
-                                            'example' => '123xxxxxxx',
-                                        ],
-                                        'BindId' => [
-                                            'title' => '绑定ID。',
-                                            'description' => 'The ID that is generated when the cloud account is added.'."\n",
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '123xxxxxxx',
-                                        ],
-                                        'AccountId' => [
-                                            'title' => '云账号ID。',
-                                            'description' => 'The ID of the cloud account.'."\n",
-                                            'type' => 'string',
-                                            'example' => '123xxxxxxx',
-                                        ],
-                                        'CloudCode' => [
-                                            'title' => '多云的code。',
-                                            'description' => 'The code of the cloud service provider. Valid values:'."\n"
-                                                ."\n"
-                                                .'*   qcloud: Tencent Cloud'."\n"
-                                                .'*   aliyun: Alibaba Cloud'."\n"
-                                                .'*   hcloud: Huawei Cloud'."\n",
-                                            'type' => 'string',
-                                            'enumValueTitles' => [],
-                                            'example' => 'hcloud',
-                                            'enum' => [
-                                                'qcloud',
-                                                'hcloud',
-                                            ],
-                                        ],
+                                        'AssetType' => ['title' => '', 'description' => 'The type of the asset. Valid values:'."\n"
+                                            ."\n"
+                                            .'- ip: IP address'."\n"
+                                            ."\n"
+                                            .'- domain: domain name'."\n"
+                                            ."\n"
+                                            .'- url: URL'."\n"
+                                            ."\n"
+                                            .'- process: process'."\n"
+                                            ."\n"
+                                            .'- file: file'."\n"
+                                            ."\n"
+                                            .'- host: host', 'type' => 'string', 'example' => 'domain'],
+                                        'AssetNum' => ['title' => '', 'description' => 'The number of assets.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'],
                                     ],
                                     'description' => '',
+                                    'title' => '',
+                                    'example' => '',
                                 ],
+                                'example' => '123456',
                             ],
-                            'RequestId' => [
-                                'title' => '请求消息ID。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****',
-                            ],
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The request was successful.'."\n"
+                                ."\n"
+                                .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The status code returned.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The message returned.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorCode' => 'InternalError',
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"AccountName\\": \\"XXXX公司\\",\\n      \\"AccessId\\": \\"ABCXXXXXXXX\\",\\n      \\"DataSourceCount\\": 2,\\n      \\"ModifyTime\\": \\"2023-11-10 12:20:35\\",\\n      \\"CreateUser\\": \\"123xxxxxxx\\",\\n      \\"BindId\\": 0,\\n      \\"AccountId\\": \\"123xxxxxxx\\",\\n      \\"CloudCode\\": \\"hcloud\\"\\n    }\\n  ],\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
-            'title' => 'ListBindAccount',
-        ],
-        'ListAccountAccessId' => [
-            'summary' => 'Queries a list of AccessKey IDs of third-party cloud accounts that are added to the threat analysis feature.',
-            'methods' => [
-                'get',
-                'post',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'DescribeCloudSiemAssetsCounter',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:43:24.000Z', 'description' => 'Error codes changed, Request parameters changed'],
             ],
-            'schemes' => [
-                'http',
-                'https',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeCloudSiemAssetsCounter'],
+                ],
             ],
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DescribeCloudSiemAssetsCounter',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
+            ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"AssetType\\": \\"domain\\",\\n      \\"AssetNum\\": 1\\n    }\\n  ],\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
+        ],
+        'DescribeCloudSiemEventDetail' => [
+            'summary' => 'Retrieves the details of an event.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
@@ -4669,1973 +3764,923 @@
             'operationType' => 'read',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'list',
+                'operationType' => 'get',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeCode' => '195478',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsasAFG0OH'],
             ],
             'parameters' => [
                 [
-                    'name' => 'CloudCode',
+                    'name' => 'IncidentUuid',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '多云的code。',
-                        'description' => 'The code of the cloud service provider.'."\n"
-                            ."\n"
-                            .'Valid values:'."\n"
-                            ."\n"
-                            .'*   qcloud'."\n"
-                            .'*   hcloud',
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'hcloud',
-                        'enum' => [
-                            'qcloud',
-                            'hcloud',
-                        ],
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The UUID of the event.', 'type' => 'string', 'required' => true, 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'],
                 ],
                 [
-                    'name' => 'RegionId',
+                    'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['description' => 'The view type.'."\n"
+                        ."\n"
+                        .'- 0: the view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: the view of all accounts in your enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The ID of the member account. An administrator can use this parameter to query data from the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
-                    'name' => 'RoleType',
+                    'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'example' => '0',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region of the data management center for Threat Analysis. Select the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: assets in the Chinese mainland and China (Hong Kong)'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: assets in regions outside the Chinese mainland', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'CloudSiemSuccessResponse<List<ListAccountAccessIdResult>>',
-                        'description' => 'The response parameters.',
+                        'title' => 'PlainResponse<SiemEvent>',
+                        'description' => 'A PlainResponse object containing .',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'array',
-                                'items' => [
-                                    'description' => 'The data returned.'."\n",
-                                    'type' => 'object',
-                                    'properties' => [
-                                        'SubUserId' => [
-                                            'title' => '多云AccessKeyId对应的阿里云账号ID。',
-                                            'description' => 'The ID of the Alibaba Cloud account that is used to add the third-party cloud account.'."\n",
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => 'ABCXXXXXXXX',
-                                        ],
-                                        'AccessIdMd5' => [
-                                            'title' => '多云AccessKeyId对应的MD5值。',
-                                            'description' => 'The MD5 hash value of the AccessKey ID.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'abcXXXXXXXX',
-                                        ],
-                                        'AccountStr' => [
-                                            'title' => '多云AccessKeyId所属的账号信息，格式为阿里云账号ID|阿里云账号名称|多云AccessKeyId。',
-                                            'description' => 'The information about the cloud account to which the AccessKey ID belongs. The value is in the following format: Alibaba Cloud account ID|Alibaba Cloud account username|AccessKey ID.'."\n",
-                                            'type' => 'string',
-                                            'example' => '123xxxxxx|xxxx|ABCXXXXX',
-                                        ],
-                                        'Bound' => [
-                                            'title' => '该AccessKeyId是否已经被绑定到威胁分析。取值：'."\n"
-                                                .' - 0 : 未绑定。'."\n"
-                                                .' - 1：已绑定。',
-                                            'description' => 'Indicates whether the cloud account to which the AccessKey ID belongs is added to the threat analysis feature. Valid values:'."\n"
-                                                ."\n"
-                                                .'*   0: no'."\n"
-                                                .'*   1: yes'."\n",
-                                            'type' => 'integer',
-                                            'format' => 'int32',
-                                            'example' => '1',
-                                        ],
-                                        'AccessId' => [
-                                            'title' => '已经绑定ACCESS_KEY_ID。',
-                                            'description' => 'The AccessKey ID of the cloud account that is added to the threat analysis feature.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'ABCXXXXXXXX',
-                                        ],
-                                        'AccountId' => [
-                                            'title' => '云账号ID。',
-                                            'description' => 'The ID of the cloud account.'."\n",
-                                            'type' => 'string',
-                                            'example' => '123xxxxxxx',
-                                        ],
-                                        'CloudCode' => [
-                                            'title' => '多云的code。',
-                                            'description' => 'The code of the cloud service provider.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'hcloud',
-                                            'enum' => [
-                                                'qcloud',
-                                                'hcloud',
-                                            ],
-                                        ],
+                                'title' => '',
+                                'description' => 'The returned data.',
+                                'type' => 'object',
+                                'properties' => [
+                                    'GmtCreate' => ['title' => '', 'description' => 'The time when the event occurred.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'],
+                                    'GmtModified' => ['title' => '', 'description' => 'The time when the event was last updated.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'],
+                                    'Aliuid' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account to which the event belongs.', 'type' => 'integer', 'format' => 'int64', 'example' => '127608589417****'],
+                                    'AlertNum' => ['title' => '', 'description' => 'The number of alerts that are associated with the event.', 'type' => 'integer', 'format' => 'int32', 'example' => '4'],
+                                    'AssetNum' => ['title' => '', 'description' => 'The number of assets that are associated with the event.', 'type' => 'integer', 'format' => 'int32', 'example' => '4'],
+                                    'IncidentUuid' => ['title' => '', 'description' => 'The globally unique ID of the event.', 'type' => 'string', 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'],
+                                    'IncidentName' => ['title' => '', 'description' => 'The name of the event.', 'type' => 'string', 'example' => 'Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc'],
+                                    'IncidentNameEn' => ['title' => '', 'description' => 'The English name of the event.', 'type' => 'string', 'example' => 'Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc'],
+                                    'Description' => ['title' => '', 'description' => 'The description of the event.', 'type' => 'string', 'example' => 'The threat event contains 13 Miner Network,1 Execute suspicious encoded commands on Linux, etc'],
+                                    'DescriptionEn' => ['title' => '', 'description' => 'The English description of the event.', 'type' => 'string', 'example' => 'The threat event contains 13 Miner Network,1 Execute suspicious encoded commands on Linux, etc'],
+                                    'DataSources' => [
+                                        'title' => '',
+                                        'description' => 'The cloud services that generated the alerts associated with the event.',
+                                        'type' => 'array',
+                                        'items' => ['description' => 'The cloud service that generated the alerts associated with the event.', 'type' => 'string', 'title' => '', 'example' => '[sas,waf]'],
+                                        'example' => '[sas,waf]',
                                     ],
+                                    'ThreatLevel' => ['title' => '', 'description' => 'The threat level. Valid values:'."\n"
+                                        ."\n"
+                                        .'- serious: high'."\n"
+                                        ."\n"
+                                        .'- suspicious: medium'."\n"
+                                        ."\n"
+                                        .'- remind: low', 'type' => 'string', 'example' => 'remind'],
+                                    'ThreatScore' => ['title' => '', 'description' => 'The threat score of the event. The score is a value from 0 to 100. A higher score indicates a higher threat level.', 'type' => 'number', 'format' => 'float', 'example' => '90.2'],
+                                    'ExtContent' => ['title' => '', 'description' => 'The extended information about the event, in JSON format.', 'type' => 'string', 'example' => '{"event_transfer_type":"customize_rule"}'],
+                                    'Status' => ['title' => '', 'description' => 'The status of the event. Valid values:'."\n"
+                                        ."\n"
+                                        .'- 0: unhandled'."\n"
+                                        ."\n"
+                                        .'- 1: handling'."\n"
+                                        ."\n"
+                                        .'- 5: handling failed'."\n"
+                                        ."\n"
+                                        .'- 10: handled', 'type' => 'integer', 'format' => 'int32', 'example' => '0'],
+                                    'AttCkLabels' => [
+                                        'title' => '',
+                                        'description' => 'The ATT\\&CK technique labels.',
+                                        'type' => 'array',
+                                        'items' => ['description' => 'The ATT\\&CK technique label.', 'type' => 'string', 'title' => '', 'example' => '["T1595.002 Vulnerability Scanning"]'],
+                                        'example' => '["T1595.002 Vulnerability Scanning"]',
+                                    ],
+                                    'AttckStages' => [
+                                        'type' => 'array',
+                                        'items' => [
+                                            'type' => 'object',
+                                            'properties' => [
+                                                'TacticId' => ['type' => 'string', 'description' => 'The ID of the ATT\\&CK tactic.', 'title' => '', 'example' => 'TA0008'],
+                                                'TacticName' => ['type' => 'string', 'description' => 'The name of the tactic.', 'title' => '', 'example' => 'Persistence'],
+                                                'AlertNum' => ['type' => 'integer', 'format' => 'int32', 'description' => 'The number of alerts that are associated with the tactic.', 'title' => '', 'example' => '21'],
+                                            ],
+                                            'description' => '',
+                                            'title' => '',
+                                            'example' => '',
+                                        ],
+                                        'description' => 'The attack stages.',
+                                        'title' => '',
+                                        'example' => '',
+                                    ],
+                                    'ReferAccount' => ['description' => 'The linked accounts.', 'type' => 'string', 'title' => '', 'example' => '17661858****/****,176618448****/****'],
+                                    'IncidentType' => ['description' => 'The type of the event.'."\n"
+                                        ."\n"
+                                        .'- net-attack: Expert rule'."\n"
+                                        ."\n"
+                                        .'- graph: Graph computing'."\n"
+                                        ."\n"
+                                        .'- singleToSingle: Alert pass-through'."\n"
+                                        ."\n"
+                                        .'- allToSingle: Alert aggregation', 'type' => 'string', 'title' => '', 'example' => 'graph'],
+                                    'RuleId' => ['description' => 'The rule that is used to generate the event.', 'type' => 'string', 'title' => '', 'example' => 'net-attack/101'],
+                                    'Remark' => ['title' => '', 'description' => 'The remarks for the event.', 'type' => 'string', 'example' => 'dealed'],
                                 ],
+                                'example' => '123456',
                             ],
-                            'Success' => [
-                                'title' => '本次请求是否成功。取值：'."\n"
-                                    .'- true：成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => 'HTTP状态码。',
-                                'description' => 'The HTTP status code.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '返回消息描述。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求消息ID。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****',
-                            ],
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The request was successful.'."\n"
+                                ."\n"
+                                .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The response code.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The returned message.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorCode' => 'InternalError',
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
+                ],
+            ],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n    \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n    \\"Aliuid\\": 0,\\n    \\"AlertNum\\": 4,\\n    \\"AssetNum\\": 4,\\n    \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n    \\"IncidentName\\": \\"Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc\\",\\n    \\"IncidentNameEn\\": \\"Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc\\",\\n    \\"Description\\": \\"The threat event contains 13 Miner Network,1 Execute suspicious encoded commands on Linux, etc\\",\\n    \\"DescriptionEn\\": \\"The threat event contains 13 Miner Network,1 Execute suspicious encoded commands on Linux, etc\\",\\n    \\"DataSources\\": [\\n      \\"[sas,waf]\\"\\n    ],\\n    \\"ThreatLevel\\": \\"remind\\",\\n    \\"ThreatScore\\": 90.2,\\n    \\"ExtContent\\": \\"{\\\\\\"event_transfer_type\\\\\\":\\\\\\"customize_rule\\\\\\"}\\",\\n    \\"Status\\": 0,\\n    \\"AttCkLabels\\": [\\n      \\"[\\\\\\"T1595.002 Vulnerability Scanning\\\\\\"]\\"\\n    ],\\n    \\"AttckStages\\": [\\n      {\\n        \\"TacticId\\": \\"TA0008\\",\\n        \\"TacticName\\": \\"Persistence\\",\\n        \\"AlertNum\\": 21\\n      }\\n    ],\\n    \\"ReferAccount\\": \\"17661858****/****,176618448****/****\\",\\n    \\"IncidentType\\": \\"graph\\",\\n    \\"RuleId\\": \\"net-attack/101\\",\\n    \\"Remark\\": \\"dealed\\"\\n  },\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
+            'title' => 'DescribeCloudSiemEventDetail',
+            'changeSet' => [
+                ['createdAt' => '2024-09-26T11:11:01.000Z', 'description' => 'Response parameters changed'],
+                ['createdAt' => '2024-09-13T03:04:52.000Z', 'description' => 'Request parameters changed, Response parameters changed'],
+                ['createdAt' => '2024-04-17T12:43:23.000Z', 'description' => 'Request parameters changed'],
+                ['createdAt' => '2024-02-22T06:04:58.000Z', 'description' => 'Error codes changed, Response parameters changed'],
+            ],
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeCloudSiemEventDetail'],
+                ],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DescribeCloudSiemEventDetail',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
                     ],
                 ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"SubUserId\\": 0,\\n      \\"AccessIdMd5\\": \\"abcXXXXXXXX\\",\\n      \\"AccountStr\\": \\"123xxxxxx|xxxx|ABCXXXXX\\",\\n      \\"Bound\\": 1,\\n      \\"AccessId\\": \\"ABCXXXXXXXX\\",\\n      \\"AccountId\\": \\"123xxxxxxx\\",\\n      \\"CloudCode\\": \\"hcloud\\"\\n    }\\n  ],\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
-            'title' => 'ListAccountAccessId',
         ],
-        'SubmitImportLogTasks' => [
-            'summary' => 'Submits log collection tasks at a time.',
-            'methods' => [
-                'get',
-                'post',
-            ],
-            'schemes' => [
-                'http',
-                'https',
-            ],
+        'DescribeCloudSiemEvents' => [
+            'summary' => 'Retrieves a list of threat analysis events.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'write',
+            'operationType' => 'read',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'create',
+                'operationType' => 'list',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeCode' => '195545',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsasAFG0OH'],
             ],
             'parameters' => [
                 [
-                    'name' => 'ProdCode',
+                    'name' => 'StartTime',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '产品的code。',
-                        'description' => 'The code of the service.'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'qcloud_waf',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The start time of the query. This value is a UNIX timestamp. Unit: milliseconds.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '1577808000000'],
                 ],
                 [
-                    'name' => 'LogCodes',
+                    'name' => 'EndTime',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '提交接入的日志列表，json数组格式。',
-                        'description' => 'The logs that you want to collect. The value is a JSON array.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '["cloud_siem_qcloud_cfw_alert_log"]',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The end time of the query. This value is a UNIX timestamp. Unit: milliseconds.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '1577808000000'],
                 ],
                 [
-                    'name' => 'Accounts',
+                    'name' => 'ThreadLevel',
                     'in' => 'formData',
+                    'style' => 'repeatList',
                     'schema' => [
-                        'title' => '提交接入的账号列表，json数组格式。取值：'."\n"
-                            .' - AccountId：待接入的账号ID。 '."\n"
-                            .' - Imported：'."\n"
-                            .' - 0：取消接入。 '."\n"
-                            .' - 1：接入。',
-                        'description' => 'The accounts that you want to add. The value is a JSON array. Valid values:'."\n"
+                        'title' => '',
+                        'description' => 'The threat level of the event. The value is a JSON array. Valid values:'."\n"
                             ."\n"
-                            .'*   AccountId: the IDs of the accounts.'."\n"
+                            .'- serious: high'."\n"
                             ."\n"
-                            .'*   Imported: specifies whether to add the accounts. Valid values:'."\n"
+                            .'- suspicious: medium'."\n"
                             ."\n"
-                            .'    *   0: no'."\n"
-                            .'    *   1: yes'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '[{"AccountId":"123123","Imported":1}]',
-                    ],
-                ],
-                [
-                    'name' => 'AutoImported',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '是否自动接入配置了该日志的账号。取值：'."\n"
-                            .' - 1：自动接入。 '."\n"
-                            .' - 0：不自动接入。',
-                        'description' => 'Specifies whether to automatically add the account for which the logging feature is configured. Valid values:'."\n"
+                            .'- remind: low',
+                        'type' => 'array',
+                        'items' => ['description' => 'The threat level of the event. The value is a JSON array. Valid values:'."\n"
                             ."\n"
-                            .'*   1: yes'."\n"
-                            .'*   0: no'."\n",
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '["cloud_siem_qcloud_cfw_alert_log"]',
-                    ],
-                ],
-                [
-                    'name' => 'CloudCode',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '多云的code。',
-                        'description' => 'The code that is used for multi-cloud environments. Valid values:'."\n"
+                            .'- serious: high'."\n"
                             ."\n"
-                            .'*   qcloud: Tencent Cloud'."\n"
-                            .'*   aliyun: Alibaba Cloud'."\n"
-                            .'*   hcloud: Huawei Cloud',
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'hcloud',
-                        'enum' => [
-                            'qcloud',
-                            'hcloud',
-                            'aliyun',
-                        ],
-                    ],
-                ],
-                [
-                    'name' => 'RegionId',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The data management center of the threat analysis feature. Specify this parameter based on the region where your assets reside. Valid values:'."\n"
+                            .'- suspicious: medium'."\n"
                             ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions inside China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
-                ],
-                [
-                    'name' => 'RoleFor',
-                    'in' => 'formData',
-                    'schema' => [
-                        'type' => 'integer',
-                        'format' => 'int64',
+                            .'- remind: low', 'type' => 'string', 'required' => false, 'title' => '', 'example' => '["remind","serious"]'."\n"],
                         'required' => false,
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'example' => '113091674488****',
+                        'example' => '["serious","suspicious","remind"]',
+                        'maxItems' => 100,
                     ],
                 ],
                 [
-                    'name' => 'RoleType',
+                    'name' => 'EventName',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'example' => '0',
-                    ],
-                ],
-            ],
-            'responses' => [
-                200 => [
-                    'schema' => [
-                        'title' => 'CloudSiemSuccessResponse<SubmitImportLogTasksResult>',
-                        'description' => 'CloudSiemSuccessResponse'."\n",
-                        'type' => 'object',
-                        'properties' => [
-                            'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'object',
-                                'properties' => [
-                                    'Count' => [
-                                        'title' => '成功提交的日志接入任务数量。',
-                                        'description' => 'The number of log collection tasks that are submitted.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '10',
-                                    ],
-                                ],
-                            ],
-                            'RequestId' => [
-                                'title' => '请求消息ID。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****',
-                            ],
-                        ],
-                    ],
-                ],
-            ],
-            'errorCodes' => [
-                500 => [
-                    [
-                        'errorCode' => 'InternalError',
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The name of the event.', 'type' => 'string', 'required' => false, 'example' => 'ECS unusual log in'],
                 ],
-            ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'eventInfo' => [
-                'enable' => false,
-                'eventNames' => [],
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"Count\\": 10\\n  },\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
-            'title' => 'SubmitImportLogTasks',
-        ],
-        'DescribeAlertsWithEntity' => [
-            'summary' => 'Queries the alerts that are associated with an entity.',
-            'methods' => [
-                'get',
-                'post',
-            ],
-            'schemes' => [
-                'http',
-                'https',
-            ],
-            'security' => [
-                [
-                    'AK' => [],
-                ],
-            ],
-            'operationType' => 'read',
-            'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'get',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas731ZAS',
-                ],
-            ],
-            'parameters' => [
                 [
                     'name' => 'IncidentUuid',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '事件全局唯一ID。',
-                        'description' => 'The UUID of the event.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '85ea4241-798f-4684-a876-65d4f0c3****',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The event ID.', 'type' => 'string', 'required' => false, 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'],
                 ],
                 [
-                    'name' => 'SophonTaskId',
+                    'name' => 'AssetId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => 'soar处置策略ID。',
-                        'description' => 'The ID of the SOAR handing policy.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '577bbf90-a770-44a7-8154-586aa2d318fa',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The ID of the asset that is associated with the event.', 'type' => 'string', 'required' => false, 'example' => '6c740667-80b2-476d-8924-2e706feb****'],
                 ],
                 [
-                    'name' => 'EntityId',
+                    'name' => 'EntityUuid',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '实体ID。',
-                        'description' => 'The ID of the entity.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '123456789',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The UUID of the entity that is associated with the event.', 'type' => 'string', 'required' => false, 'example' => '6c740667-80b2-476d-8924-2e706feb****'],
                 ],
                 [
-                    'name' => 'EntityUuid',
+                    'name' => 'Status',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '实体ID。',
-                        'type' => 'string',
-                        'example' => '123456789',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The status of the event. Valid values:'."\n"
+                        ."\n"
+                        .'- 0: unhandled'."\n"
+                        ."\n"
+                        .'- 1: in progress'."\n"
+                        ."\n"
+                        .'- 5: failed'."\n"
+                        ."\n"
+                        .'- 10: handled', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '0'],
                 ],
                 [
-                    'name' => 'StartTime',
+                    'name' => 'OrderField',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '查询开始时间, 单位毫秒。',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'example' => '1577808000000',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The field to sort the event list by. Valid values:'."\n"
+                        ."\n"
+                        .'- GmtModified: Sorts by modification time. This is the default value.'."\n"
+                        ."\n"
+                        .'- ThreatScore: Sorts by threat score.', 'type' => 'string', 'required' => false, 'example' => 'ThreatScore'],
                 ],
                 [
-                    'name' => 'EndTime',
+                    'name' => 'Order',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '查询结束时间, 单位毫秒。',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'example' => '1577808000000',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The sort order. Valid values:'."\n"
+                        ."\n"
+                        .'- desc: descending'."\n"
+                        ."\n"
+                        .'- asc: ascending', 'type' => 'string', 'required' => false, 'example' => 'desc'],
                 ],
                 [
                     'name' => 'CurrentPage',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '列表当前页号， 大于等于1。',
-                        'description' => 'The page number. Pages start from page 1.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => true,
-                        'minimum' => '1',
-                        'example' => '1',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The page number. The value must be greater than or equal to 1.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'minimum' => '1', 'example' => '1'],
                 ],
                 [
                     'name' => 'PageSize',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '列表每页条数， 最大不超过100。',
-                        'description' => 'The number of entries per page. Maximum value: 100.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => true,
-                        'maximum' => '100',
-                        'minimum' => '1',
-                        'example' => '10',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The number of entries per page. The maximum value is 100.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'maximum' => '100', 'minimum' => '1', 'example' => '10'],
                 ],
                 [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                        'title' => '0，单账号登录；1，全局视图；2，切换视图；3，局部视图',
-                    ],
+                    'schema' => ['description' => 'The view type.'."\n"
+                        ."\n"
+                        .'- 0: The view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: The view of all accounts that are managed by the administrator account.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The ID of the member. The administrator can use this ID to view the data of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region where the Data Management center of Threat Analysis & Response is located. Select the region based on the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'PageResponse<List<AlertDetail>>',
-                        'description' => 'PageResponse\\<List>'."\n",
+                        'title' => 'PageResponse<List<SiemEvent>>',
+                        'description' => 'PageResponse\\<List\\<SiemEvent>>',
                         'type' => 'object',
                         'properties' => [
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true:成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
-                            ],
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- true: successful'."\n"
+                                ."\n"
+                                .'- false: failed', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The request status code.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The message returned for the request.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
+                                'title' => '',
+                                'description' => 'The return value of the request.',
                                 'type' => 'object',
                                 'properties' => [
                                     'PageInfo' => [
-                                        'title' => '分页记录。',
-                                        'description' => 'The pagination information.'."\n",
+                                        'title' => '',
+                                        'description' => 'The pagination information.',
                                         'type' => 'object',
                                         'properties' => [
-                                            'CurrentPage' => [
-                                                'title' => '列表当前页号。',
-                                                'description' => 'The current page number.'."\n",
-                                                'type' => 'integer',
-                                                'format' => 'int32',
-                                                'example' => '1',
-                                            ],
-                                            'PageSize' => [
-                                                'title' => '每页返回记录数。',
-                                                'description' => 'The number of entries per page.'."\n",
-                                                'type' => 'integer',
-                                                'format' => 'int32',
-                                                'example' => '10',
-                                            ],
-                                            'TotalCount' => [
-                                                'title' => '记录总数。',
-                                                'description' => 'The total number of entries returned.'."\n",
-                                                'type' => 'integer',
-                                                'format' => 'int64',
-                                                'example' => '100',
-                                            ],
+                                            'CurrentPage' => ['title' => '', 'description' => 'The page number of the returned page.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'],
+                                            'PageSize' => ['title' => '', 'description' => 'The number of entries returned per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10'],
+                                            'TotalCount' => ['title' => '', 'description' => 'The total number of entries.', 'type' => 'integer', 'format' => 'int64', 'example' => '100'],
                                         ],
+                                        'example' => '',
                                     ],
                                     'ResponseData' => [
-                                        'title' => '详细数据。',
-                                        'description' => 'The detailed data.'."\n",
+                                        'title' => '',
+                                        'description' => 'The detailed data.',
                                         'type' => 'array',
                                         'items' => [
                                             'type' => 'object',
                                             'properties' => [
-                                                'Id' => [
-                                                    'title' => '告警唯一ID。',
-                                                    'description' => 'The unique ID of the alert.'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int64',
-                                                    'example' => '123456789',
-                                                ],
-                                                'GmtCreate' => [
-                                                    'title' => '告警入库时间。',
-                                                    'description' => 'The time when the alert was received.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '2021-01-06 16:37:29',
-                                                ],
-                                                'GmtModified' => [
-                                                    'title' => '告警最后更新时间。',
-                                                    'description' => 'The time when the alert was last updated.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '2021-01-06 16:37:29',
-                                                ],
-                                                'MainUserId' => [
-                                                    'title' => '告警关联siem主账号ID。',
-                                                    'description' => 'The ID of the Alibaba Cloud account that is associated with the alert in SIEM.'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int64',
-                                                    'example' => '127608589417****',
-                                                ],
-                                                'IncidentUuid' => [
-                                                    'title' => '事件全局唯一id。',
-                                                    'description' => 'The UUID of the event.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '85ea4241-798f-4684-a876-65d4f0c3****',
-                                                ],
-                                                'AlertUuid' => [
-                                                    'title' => '告警id。',
-                                                    'description' => 'The UUID of the alert.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'sas_71e24437d2797ce8fc59692905a4****',
-                                                ],
-                                                'LogTime' => [
-                                                    'title' => '告警记录时间。',
-                                                    'description' => 'The time when the alert was recorded.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '2021-01-06 16:37:29',
-                                                ],
-                                                'AlertSrcProd' => [
-                                                    'title' => '事件关联告警来源产品。',
-                                                    'description' => 'The source of the alert.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'sas',
-                                                ],
-                                                'AlertTitle' => [
-                                                    'title' => '告警标题。',
-                                                    'description' => 'The title of the alert.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'Scan-Try SNMP weak password',
-                                                ],
-                                                'AlertTitleEn' => [
-                                                    'title' => '告警标题英文。',
-                                                    'description' => 'The alert title in English.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'Scan-Try SNMP weak password',
-                                                ],
-                                                'AlertType' => [
-                                                    'title' => '告警类型。',
-                                                    'description' => 'The type of the alert.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'Scan',
-                                                ],
-                                                'AlertTypeEn' => [
-                                                    'title' => '告警类型英文。',
-                                                    'description' => 'The alert type in English.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'Scan',
-                                                ],
-                                                'AlertTypeCode' => [
-                                                    'title' => '告警类型美杜莎code。',
-                                                    'description' => 'The internal code of the alert type.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'security_event_config.event_name.webshellName',
-                                                ],
-                                                'AlertName' => [
-                                                    'title' => '告警名称。',
-                                                    'description' => 'The name of the alert.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'Try SNMP weak password',
-                                                ],
-                                                'AlertNameEn' => [
-                                                    'title' => '告警名称。',
-                                                    'description' => 'The name of the alert.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'Try SNMP weak password',
-                                                ],
-                                                'AlertNameCode' => [
-                                                    'title' => '告警名称美杜莎code。',
-                                                    'description' => 'The internal code of the alert name.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'security_event_config.event_name.webshell',
-                                                ],
-                                                'AlertLevel' => [
-                                                    'title' => '威胁等级。 取值：'."\n"
-                                                        .'- serious：高危'."\n"
-                                                        .'- suspicious：中危'."\n"
-                                                        .'- remind：低危',
-                                                    'description' => 'The risk level. Valid values:'."\n"
-                                                        ."\n"
-                                                        .'*   serious: high'."\n"
-                                                        .'*   suspicious: medium'."\n"
-                                                        .'*   remind: low'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'remind',
-                                                ],
-                                                'AssetList' => [
-                                                    'title' => '资产列表。',
-                                                    'description' => 'The details of the asset.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '['."\n"
-                                                        .'      {'."\n"
-                                                        .'            "is_main_asset": "1",'."\n"
-                                                        .'            "asset_name": "47.245.*",'."\n"
-                                                        .'            "port": "22",'."\n"
-                                                        .'            "ip": "47.245.*",'."\n"
-                                                        .'            "asset_type": "ip",'."\n"
-                                                        .'            "location": "ap-southeast-1",'."\n"
-                                                        .'            "asset_id": "47.245.*",'."\n"
-                                                        .'            "net_connect_dir": "in"'."\n"
-                                                        .'      }'."\n"
-                                                        .']',
-                                                ],
-                                                'OccurTime' => [
-                                                    'title' => '告警发生时间。',
-                                                    'description' => 'The time when the alert was triggered.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '2021-01-06 16:37:29',
-                                                ],
-                                                'StartTime' => [
-                                                    'title' => '告警首次发生时间。',
-                                                    'description' => 'The time at which the alert was first generated.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '2021-01-06 16:37:29',
-                                                ],
-                                                'EndTime' => [
-                                                    'title' => '告警结束时间。',
-                                                    'description' => 'The time when the alert was closed.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '2021-01-06 16:37:29',
-                                                ],
-                                                'AlertSrcProdModule' => [
-                                                    'title' => '事件关联告警来源产品子模块。',
-                                                    'description' => 'The sub-module of the alert source.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'waf',
-                                                ],
-                                                'AlertDesc' => [
-                                                    'title' => '告警描述。',
-                                                    'description' => 'The description of the alert.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.',
-                                                ],
-                                                'AlertDescEn' => [
-                                                    'title' => '告警英文描述。',
-                                                    'description' => 'The alert description in English.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.',
-                                                ],
-                                                'AlertDescCode' => [
-                                                    'title' => '告警描述美杜莎code。',
-                                                    'description' => 'The internal code of the alert description.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'security_event_config.event_name.webshell'."\n",
-                                                ],
-                                                'AlertDetail' => [
-                                                    'title' => '告警详情。',
-                                                    'description' => 'The details of the alert.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '{"main_user_id": "165295629792****";"log_uuid_count": "99";"attack_ip": "21.92.*.*"}',
-                                                ],
-                                                'LogUuid' => [
-                                                    'title' => '告警log UUID。',
-                                                    'description' => 'The UUID of the alert log.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'cfw_d12e285a-a042-4d7e-be89-f8a795ef****',
-                                                ],
-                                                'EntityList' => [
-                                                    'title' => '实体详情（标准化/开启索引）',
-                                                    'type' => 'string',
-                                                ],
-                                                'AttCk' => [
-                                                    'title' => 'ATTCT&攻击技术标签。',
-                                                    'description' => 'The tag of the ATT\\&CK attack.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'T1595.002 Vulnerability Scanning',
-                                                ],
-                                                'SubUserId' => [
-                                                    'title' => '产生告警阿里账号ID。',
-                                                    'description' => 'The ID of the Alibaba Cloud account within which the alert is generated.'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int64',
-                                                    'example' => '176555323***',
-                                                ],
-                                                'SubUserName' => [
-                                                    'title' => '产生告警阿里账号ID。',
-                                                    'type' => 'string',
-                                                    'example' => '176555323***',
+                                                'GmtCreate' => ['title' => '', 'description' => 'The time when the event occurred.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'],
+                                                'GmtModified' => ['title' => '', 'description' => 'The time when the event was last updated.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'],
+                                                'Aliuid' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account to which the event belongs.', 'type' => 'integer', 'format' => 'int64', 'example' => '127608589417****'],
+                                                'AlertNum' => ['title' => '', 'description' => 'The number of alerts that are associated with the event.', 'type' => 'integer', 'format' => 'int32', 'example' => '4'],
+                                                'AssetNum' => ['title' => '', 'description' => 'The number of assets that are associated with the event.', 'type' => 'integer', 'format' => 'int32', 'example' => '4'],
+                                                'IncidentUuid' => ['title' => '', 'description' => 'The globally unique UUID of the event.', 'type' => 'string', 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'],
+                                                'IncidentName' => ['title' => '', 'description' => 'The name of the event.', 'type' => 'string', 'example' => 'Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc'],
+                                                'IncidentNameEn' => ['title' => '', 'description' => 'The English name of the event.', 'type' => 'string', 'example' => 'Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc'],
+                                                'Description' => ['title' => '', 'description' => 'The description of the event.', 'type' => 'string', 'example' => 'The threat event contains 13 Miner Network,1 Execute suspicious encoded commands on Linux, etc'],
+                                                'DescriptionEn' => ['title' => '', 'description' => 'The English description of the event.', 'type' => 'string', 'example' => 'The threat event contains 13 Miner Network,1 Execute suspicious encoded commands on Linux, etc'],
+                                                'DataSources' => [
+                                                    'title' => '',
+                                                    'description' => 'The cloud services that generated the alerts, which are associated with the event.',
+                                                    'type' => 'array',
+                                                    'items' => ['description' => 'The cloud service that generated the alert, which is associated with the event.', 'type' => 'string', 'title' => '', 'example' => '[sas,waf]'],
+                                                    'example' => '[sas,waf]',
                                                 ],
-                                                'IsDefend' => [
-                                                    'title' => '是否已防御',
-                                                    'description' => 'Specifies whether an attack is defended. Valid values:'."\n"
-                                                        ."\n"
-                                                        .'*   0: detected'."\n"
-                                                        .'*   1: blocked'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '1',
+                                                'ThreatLevel' => ['title' => '', 'description' => 'The threat level. Valid values:'."\n"
+                                                    ."\n"
+                                                    .'- serious: high'."\n"
+                                                    ."\n"
+                                                    .'- suspicious: medium'."\n"
+                                                    ."\n"
+                                                    .'- remind: low', 'type' => 'string', 'example' => 'remind'],
+                                                'ThreatScore' => ['title' => '', 'description' => 'The threat score of the event. The score ranges from 0 to 100. A higher score indicates a higher risk level.', 'type' => 'number', 'format' => 'float', 'example' => '90.2'],
+                                                'ExtContent' => ['title' => '', 'description' => 'The extended information about the event, in the JSON format.', 'type' => 'string', 'example' => '{"event_transfer_type":"customize_rule"}'],
+                                                'Status' => ['title' => '', 'description' => 'The status of the event. Valid values:'."\n"
+                                                    ."\n"
+                                                    .'- 0: unhandled'."\n"
+                                                    ."\n"
+                                                    .'- 1: in progress'."\n"
+                                                    ."\n"
+                                                    .'- 5: failed'."\n"
+                                                    ."\n"
+                                                    .'- 10: handled', 'type' => 'integer', 'format' => 'int32', 'example' => '0'],
+                                                'AttCkLabels' => [
+                                                    'title' => '',
+                                                    'description' => 'The tags of the ATT\\&CK attack technique.',
+                                                    'type' => 'array',
+                                                    'items' => ['description' => 'The tag of the ATT\\&CK attack technique.', 'type' => 'string', 'title' => '', 'example' => '["T1595.002 Vulnerability Scanning"]'],
+                                                    'example' => '["T1595.002 Vulnerability Scanning"]',
                                                 ],
-                                                'AlertInfoList' => [
-                                                    'title' => '告警详细数据。',
-                                                    'description' => 'The displayed details of the alert.'."\n",
+                                                'AttckStages' => [
                                                     'type' => 'array',
                                                     'items' => [
                                                         'type' => 'object',
                                                         'properties' => [
-                                                            'Key' => [
-                                                                'title' => '告警详细属性key。',
-                                                                'description' => 'The attribute key.'."\n",
-                                                                'type' => 'string',
-                                                                'example' => 'suspicious.wbd.wb.trojanpath',
-                                                            ],
-                                                            'KeyName' => [
-                                                                'title' => '告警详细数据名称。',
-                                                                'description' => 'The name of the key.'."\n",
-                                                                'type' => 'string',
-                                                                'example' => 'Trojan Path'."\n",
-                                                            ],
-                                                            'Values' => [
-                                                                'title' => '告警详细数据值。',
-                                                                'description' => 'The value of the key.'."\n",
-                                                                'type' => 'string',
-                                                                'example' => '/root/test33.php',
-                                                            ],
+                                                            'TacticId' => ['type' => 'string', 'description' => 'The ID of the ATT\\&CK attack stage.', 'title' => '', 'example' => 'TA0001'],
+                                                            'TacticName' => ['type' => 'string', 'description' => 'The name of the attack stage.', 'title' => '', 'example' => 'Persistence'],
+                                                            'AlertNum' => ['type' => 'integer', 'format' => 'int32', 'description' => 'The number of alerts that are associated with the attack stage.', 'title' => '', 'example' => '21'],
                                                         ],
+                                                        'description' => '',
+                                                        'title' => '',
+                                                        'example' => '',
                                                     ],
-                                                    'example' => 'aliyun',
-                                                ],
-                                                'CloudCode' => [
+                                                    'description' => 'The list of attack stages.',
                                                     'title' => '',
-                                                    'description' => 'The cloud code. Valid values:'."\n"
-                                                        ."\n"
-                                                        .'*   aliyun: Alibaba Cloud'."\n"
-                                                        .'*   qcloud: Tencent Cloud'."\n"
-                                                        .'*   hcloud: Huawei Cloud'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'aliyun',
-                                                ],
-                                                'ProductId' => [
-                                                    'type' => 'string',
-                                                ],
-                                                'VendorId' => [
-                                                    'type' => 'string',
-                                                ],
-                                                'DetectionRuleId' => [
-                                                    'type' => 'string',
+                                                    'example' => '',
                                                 ],
+                                                'ReferAccount' => ['description' => 'The linked account.', 'type' => 'string', 'title' => '', 'example' => '127608589417****'],
+                                                'IncidentType' => ['type' => 'string', 'description' => 'The event type.'."\n"
+                                                    ."\n"
+                                                    .'- net-attack: expert rule'."\n"
+                                                    ."\n"
+                                                    .'- graph: graph computing', 'title' => '', 'example' => 'graph'],
+                                                'RuleId' => ['type' => 'string', 'description' => 'The rule ID.', 'title' => '', 'example' => 'crecr-21d7pogu9v4a****'],
+                                                'Remark' => ['title' => '', 'description' => 'The remarks on the event.', 'type' => 'string', 'example' => 'dealed'],
                                             ],
+                                            'description' => '',
+                                            'title' => '',
+                                            'example' => '',
                                         ],
+                                        'example' => '',
                                     ],
                                 ],
                                 'example' => '123456',
                             ],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'DescribeCloudSiemEvents',
+            'changeSet' => [
+                ['createdAt' => '2024-11-04T11:26:50.000Z', 'description' => 'Request parameters changed, Response parameters changed'],
+                ['createdAt' => '2024-04-17T12:43:24.000Z', 'description' => 'Error codes changed, Request parameters changed, Response parameters changed'],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n  \\"Data\\": {\\n    \\"PageInfo\\": {\\n      \\"CurrentPage\\": 1,\\n      \\"PageSize\\": 10,\\n      \\"TotalCount\\": 100\\n    },\\n    \\"ResponseData\\": [\\n      {\\n        \\"Id\\": 123456789,\\n        \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n        \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n        \\"MainUserId\\": 0,\\n        \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n        \\"AlertUuid\\": \\"sas_71e24437d2797ce8fc59692905a4****\\",\\n        \\"LogTime\\": \\"2021-01-06 16:37:29\\",\\n        \\"AlertSrcProd\\": \\"sas\\",\\n        \\"AlertTitle\\": \\"Scan-Try SNMP weak password\\",\\n        \\"AlertTitleEn\\": \\"Scan-Try SNMP weak password\\",\\n        \\"AlertType\\": \\"Scan\\",\\n        \\"AlertTypeEn\\": \\"Scan\\",\\n        \\"AlertTypeCode\\": \\"security_event_config.event_name.webshellName\\",\\n        \\"AlertName\\": \\"Try SNMP weak password\\",\\n        \\"AlertNameEn\\": \\"Try SNMP weak password\\",\\n        \\"AlertNameCode\\": \\"security_event_config.event_name.webshell\\",\\n        \\"AlertLevel\\": \\"remind\\",\\n        \\"AssetList\\": \\"[\\\\n      {\\\\n            \\\\\\"is_main_asset\\\\\\": \\\\\\"1\\\\\\",\\\\n            \\\\\\"asset_name\\\\\\": \\\\\\"47.245.*\\\\\\",\\\\n            \\\\\\"port\\\\\\": \\\\\\"22\\\\\\",\\\\n            \\\\\\"ip\\\\\\": \\\\\\"47.245.*\\\\\\",\\\\n            \\\\\\"asset_type\\\\\\": \\\\\\"ip\\\\\\",\\\\n            \\\\\\"location\\\\\\": \\\\\\"ap-southeast-1\\\\\\",\\\\n            \\\\\\"asset_id\\\\\\": \\\\\\"47.245.*\\\\\\",\\\\n            \\\\\\"net_connect_dir\\\\\\": \\\\\\"in\\\\\\"\\\\n      }\\\\n]\\",\\n        \\"OccurTime\\": \\"2021-01-06 16:37:29\\",\\n        \\"StartTime\\": \\"2021-01-06 16:37:29\\",\\n        \\"EndTime\\": \\"2021-01-06 16:37:29\\",\\n        \\"AlertSrcProdModule\\": \\"waf\\",\\n        \\"AlertDesc\\": \\"The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.\\",\\n        \\"AlertDescEn\\": \\"The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.\\",\\n        \\"AlertDescCode\\": \\"security_event_config.event_name.webshell\\\\n\\",\\n        \\"AlertDetail\\": \\"{\\\\\\"main_user_id\\\\\\": \\\\\\"165295629792****\\\\\\";\\\\\\"log_uuid_count\\\\\\": \\\\\\"99\\\\\\";\\\\\\"attack_ip\\\\\\": \\\\\\"21.92.*.*\\\\\\"}\\",\\n        \\"LogUuid\\": \\"cfw_d12e285a-a042-4d7e-be89-f8a795ef****\\",\\n        \\"EntityList\\": \\"[{\\\\\\"entity_uuid\\\\\\":\\\\\\"55f0c0654d7e79b035a5168fcb4****\\\\\\",\\\\\\"entity_type\\\\\\":\\\\\\"cloud_account\\\\\\",\\\\\\"account_id\\\\\\":\\\\\\"15176874502****\\\\\\",\\\\\\"main_user_id\\\\\\":\\\\\\"15176874502****\\\\\\",\\\\\\"cloud_code\\\\\\":\\\\\\"alibaba_cloud\\\\\\",\\\\\\"is_asset\\\\\\":1,\\\\\\"entity_id\\\\\\":\\\\\\"151768745029****\\\\\\"}]\\",\\n        \\"AttCk\\": \\"T1595.002 Vulnerability Scanning\\",\\n        \\"SubUserId\\": 0,\\n        \\"SubUserName\\": \\"176555323***\\",\\n        \\"IsDefend\\": \\"1\\",\\n        \\"AlertInfoList\\": [\\n          {\\n            \\"Key\\": \\"suspicious.wbd.wb.trojanpath\\",\\n            \\"KeyName\\": \\"Trojan Path\\\\n\\",\\n            \\"Values\\": \\"/root/test33.php\\"\\n          }\\n        ],\\n        \\"CloudCode\\": \\"aliyun\\",\\n        \\"ProductId\\": \\"alibaba_cloud_sas\\",\\n        \\"VendorId\\": \\"aliyun\\",\\n        \\"DetectionRuleId\\": \\"dr-48zs4tk7qfd4rjd9****\\"\\n      }\\n    ]\\n  }\\n}","type":"json"}]',
-            'title' => 'DescribeAlertsWithEntity',
-        ],
-        'DescribeAlerts' => [
-            'summary' => 'Queries alerts within your account.',
-            'methods' => [
-                'get',
-                'post',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeCloudSiemEvents'],
+                ],
             ],
-            'schemes' => [
-                'http',
-                'https',
+            'ramActions' => [
+                [
+                    'operationType' => 'list',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DescribeCloudSiemEvents',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n  \\"Data\\": {\\n    \\"PageInfo\\": {\\n      \\"CurrentPage\\": 1,\\n      \\"PageSize\\": 10,\\n      \\"TotalCount\\": 100\\n    },\\n    \\"ResponseData\\": [\\n      {\\n        \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n        \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n        \\"Aliuid\\": 0,\\n        \\"AlertNum\\": 4,\\n        \\"AssetNum\\": 4,\\n        \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n        \\"IncidentName\\": \\"Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc\\",\\n        \\"IncidentNameEn\\": \\"Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc\\",\\n        \\"Description\\": \\"The threat event contains 13 Miner Network,1 Execute suspicious encoded commands on Linux, etc\\",\\n        \\"DescriptionEn\\": \\"The threat event contains 13 Miner Network,1 Execute suspicious encoded commands on Linux, etc\\",\\n        \\"DataSources\\": [\\n          \\"[sas,waf]\\"\\n        ],\\n        \\"ThreatLevel\\": \\"remind\\",\\n        \\"ThreatScore\\": 90.2,\\n        \\"ExtContent\\": \\"{\\\\\\"event_transfer_type\\\\\\":\\\\\\"customize_rule\\\\\\"}\\",\\n        \\"Status\\": 0,\\n        \\"AttCkLabels\\": [\\n          \\"[\\\\\\"T1595.002 Vulnerability Scanning\\\\\\"]\\"\\n        ],\\n        \\"AttckStages\\": [\\n          {\\n            \\"TacticId\\": \\"TA0001\\",\\n            \\"TacticName\\": \\"Persistence\\",\\n            \\"AlertNum\\": 21\\n          }\\n        ],\\n        \\"ReferAccount\\": \\"127608589417****\\",\\n        \\"IncidentType\\": \\"graph\\",\\n        \\"RuleId\\": \\"crecr-21d7pogu9v4a****\\",\\n        \\"Remark\\": \\"dealed\\"\\n      }\\n    ]\\n  }\\n}","type":"json"}]',
+        ],
+        'DescribeCustomizeRuleCount' => [
+            'methods' => ['get', 'post'],
+            'schemes' => ['https', 'http'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'read',
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'get',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas731ZAS',
-                ],
-            ],
+            'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
-                    'name' => 'AlertUuid',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '事件关联告警ID。',
-                        'description' => 'The UUID of the alert.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'sas_71e24437d2797ce8fc59692905a4****',
-                    ],
-                ],
-                [
-                    'name' => 'Level',
-                    'in' => 'formData',
-                    'style' => 'repeatList',
-                    'schema' => [
-                        'title' => '威胁等级，格式为json数组。取值：'."\n"
-                            .'- serious：高危'."\n"
-                            .'- suspicious：中危'."\n"
-                            .'- remind：低危',
-                        'description' => 'The risk level. The value is a JSON array. Valid values:'."\n"
-                            ."\n"
-                            .'*   serious: high'."\n"
-                            .'*   suspicious: medium'."\n"
-                            .'*   remind: low'."\n",
-                        'type' => 'array',
-                        'items' => [
-                            'description' => 'The risk level. The value is a JSON string. Valid values:'."\n"
-                                ."\n"
-                                .'*   serious: high'."\n"
-                                .'*   suspicious: medium'."\n"
-                                .'*   remind: low'."\n",
-                            'type' => 'string',
-                            'required' => false,
-                            'example' => '["remind","serious"]',
-                        ],
-                        'required' => false,
-                        'example' => '["serious","suspicious","remind"]',
-                        'maxItems' => 100,
-                    ],
-                ],
-                [
-                    'name' => 'Source',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '事件关联告警来源产品。',
-                        'description' => 'The source of the alert.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'sas',
-                    ],
-                ],
-                [
-                    'name' => 'IsDefend',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '是否已防御',
-                        'description' => 'Specifies whether an attack is defended. Valid values:'."\n"
-                            ."\n"
-                            .'*   0: detected.'."\n"
-                            .'*   1: blocked.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '1',
-                    ],
-                ],
-                [
-                    'name' => 'AlertTitle',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '告警标题。',
-                        'description' => 'The title of the alert.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'Unusual Logon-login_common_account',
-                    ],
-                ],
-                [
-                    'name' => 'AlertType',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '告警类型。',
-                        'type' => 'string',
-                    ],
-                ],
-                [
-                    'name' => 'AlertName',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '告警名称。',
-                        'type' => 'string',
-                    ],
-                ],
-                [
-                    'name' => 'AssetName',
+                    'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '资产名称。',
-                        'type' => 'string',
-                    ],
+                    'schema' => ['description' => 'The type of view. Valid values:'."\n"
+                        ."\n"
+                        .'- 0: the view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: the view of all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
-                    'name' => 'AssetId',
+                    'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '资产id。',
-                        'type' => 'string',
-                    ],
+                    'schema' => ['description' => 'The user ID of a member. An administrator can use this ID to switch to the member\'s perspective.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
-                    'name' => 'EntityName',
+                    'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '实体名称。',
-                        'type' => 'string',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region of the management center for threat analysis. Select a region based on where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Assets are in regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
-                [
-                    'name' => 'EntityId',
-                    'in' => 'formData',
+            ],
+            'responses' => [
+                200 => [
                     'schema' => [
-                        'title' => '实体id。',
-                        'type' => 'string',
+                        'title' => 'PlainResponse<CustomizeRuleCounter>',
+                        'description' => 'PlainResponse',
+                        'type' => 'object',
+                        'properties' => [
+                            'Data' => [
+                                'title' => '',
+                                'description' => 'The data returned.',
+                                'type' => 'object',
+                                'properties' => [
+                                    'InUseRuleNum' => ['title' => '', 'description' => 'The number of rules in use.', 'type' => 'integer', 'format' => 'int32', 'example' => '20'],
+                                    'HighRuleNum' => ['title' => '', 'description' => 'The number of high-risk rules.', 'type' => 'integer', 'format' => 'int32', 'example' => '12'],
+                                    'MediumRuleNum' => ['title' => '', 'description' => 'The number of medium-risk rules.', 'type' => 'integer', 'format' => 'int32', 'example' => '5'],
+                                    'LowRuleNum' => ['title' => '', 'description' => 'The number of low-risk rules.', 'type' => 'integer', 'format' => 'int32', 'example' => '3'],
+                                    'TotalRuleNum' => ['title' => '总规则数', 'description' => 'The total number of rules.', 'type' => 'integer', 'format' => 'int32', 'example' => '10'],
+                                    'CustomizeRuleNum' => ['title' => '自定义规则数', 'description' => 'The number of custom rules.', 'type' => 'integer', 'format' => 'int32', 'example' => '10'],
+                                    'PredefinedRuleNum' => ['title' => '预定义规则数', 'description' => 'The number of predefined rules.', 'type' => 'integer', 'format' => 'int32', 'example' => '10'],
+                                    'UnEventRuleNum' => ['title' => '不产生事件规则数', 'description' => 'The number of rules that do not generate events.', 'type' => 'integer', 'format' => 'int32', 'example' => '3'],
+                                    'ExpertRuleNum' => ['title' => '专家规则数', 'description' => 'The number of expert rules.', 'type' => 'integer', 'format' => 'int32', 'example' => '7'],
+                                    'GraphComputingRuleNum' => ['title' => '图计算规则数', 'description' => 'The number of graph computing rules.', 'type' => 'integer', 'format' => 'int32', 'example' => '2'],
+                                    'SingleAlertRuleNum' => ['title' => '告警透传规则数', 'description' => 'The number of alert pass-through rules.', 'type' => 'integer', 'format' => 'int32', 'example' => '3'],
+                                    'AggregationRuleNum' => ['title' => '同类聚合规则数', 'description' => 'The number of rules for intra-class aggregation.', 'type' => 'integer', 'format' => 'int32', 'example' => '3'],
+                                ],
+                                'example' => '123456',
+                            ],
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The request was successful.'."\n"
+                                ."\n"
+                                .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The message returned.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
+                        ],
+                        'example' => '',
                     ],
                 ],
-                [
-                    'name' => 'SubUserId',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '告警史记关联阿里账号ID。',
-                        'description' => 'The ID of the Alibaba Cloud account within which the alert is generated.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '176555323***',
-                    ],
+            ],
+            'errorCodes' => [
+                500 => [
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
-                [
-                    'name' => 'LabelType',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '告警史记关联阿里账号ID。',
-                        'type' => 'string',
-                        'example' => '176555323***',
-                    ],
+            ],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'DescribeCustomizeRuleCount',
+            'summary' => 'Retrieves the count of custom rules.',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:43:22.000Z', 'description' => 'Error codes changed, Request parameters changed, Response parameters changed'],
+            ],
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeCustomizeRuleCount'],
                 ],
+            ],
+            'ramActions' => [
                 [
-                    'name' => 'AlertStatus',
-                    'in' => 'formData',
-                    'style' => 'repeatList',
-                    'schema' => [
-                        'title' => '告警状态',
-                        'type' => 'array',
-                        'items' => [
-                            'title' => '告警状态',
-                            'type' => 'string',
-                            'example' => '1',
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DescribeCustomizeRuleCount',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
                         ],
-                        'maxItems' => 100,
-                    ],
-                ],
-                [
-                    'name' => 'StartTime',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '查询开始时间, 单位毫秒。',
-                        'description' => 'The beginning of the time range to query. Unit: milliseconds.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '1577808000000',
-                    ],
-                ],
-                [
-                    'name' => 'EndTime',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '查询结束时间, 单位毫秒。',
-                        'description' => 'The end of the time range to query. Unit: milliseconds.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '1577808000000',
                     ],
                 ],
+            ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"InUseRuleNum\\": 20,\\n    \\"HighRuleNum\\": 12,\\n    \\"MediumRuleNum\\": 5,\\n    \\"LowRuleNum\\": 3,\\n    \\"TotalRuleNum\\": 10,\\n    \\"CustomizeRuleNum\\": 10,\\n    \\"PredefinedRuleNum\\": 10,\\n    \\"UnEventRuleNum\\": 3,\\n    \\"ExpertRuleNum\\": 7,\\n    \\"GraphComputingRuleNum\\": 2,\\n    \\"SingleAlertRuleNum\\": 3,\\n    \\"AggregationRuleNum\\": 3\\n  },\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
+        ],
+        'DescribeCustomizeRuleTest' => [
+            'methods' => ['get', 'post'],
+            'schemes' => ['https', 'http'],
+            'security' => [
                 [
-                    'name' => 'CurrentPage',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '列表当前页号， 大于等于1。',
-                        'description' => 'The page number. Pages start from page 1.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => true,
-                        'minimum' => '1',
-                        'example' => '1',
-                    ],
+                    'AK' => [],
                 ],
+            ],
+            'deprecated' => false,
+            'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'],
+            'parameters' => [
                 [
-                    'name' => 'PageSize',
+                    'name' => 'Id',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '列表每页条数， 最大不超过100。',
-                        'description' => 'The number of entries per page. Maximum value: 100.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => true,
-                        'maximum' => '100',
-                        'minimum' => '1',
-                        'example' => '10',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The ID of the custom rule.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '123456789'],
                 ],
                 [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                        'title' => '0，单账号登录；1，全局视图；2，切换视图；3，局部视图',
-                    ],
+                    'schema' => ['description' => 'The view type.'."\n"
+                        ."\n"
+                        .'- 0: The view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: The view of all accounts within the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member account to which the administrator switches.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region of the Data Management center for Threat Analysis. Select a region based on where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in regions outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'PageResponse<List<AlertDetail>>',
-                        'description' => 'PageResponse\\<List>'."\n",
+                        'title' => 'BaseResponse<CustomizeRuleTest>',
+                        'description' => 'BaseResponse',
                         'type' => 'object',
                         'properties' => [
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true:成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
-                            ],
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
+                                'title' => '',
+                                'description' => 'The data returned.',
                                 'type' => 'object',
                                 'properties' => [
-                                    'PageInfo' => [
-                                        'title' => '分页记录。',
-                                        'description' => 'The pagination information.'."\n",
-                                        'type' => 'object',
-                                        'properties' => [
-                                            'CurrentPage' => [
-                                                'title' => '列表当前页号。',
-                                                'description' => 'The current page number.'."\n",
-                                                'type' => 'integer',
-                                                'format' => 'int32',
-                                                'example' => '1',
-                                            ],
-                                            'PageSize' => [
-                                                'title' => '每页返回记录数。',
-                                                'description' => 'The number of entries per page.'."\n",
-                                                'type' => 'integer',
-                                                'format' => 'int32',
-                                                'example' => '10',
-                                            ],
-                                            'TotalCount' => [
-                                                'title' => '记录总数。',
-                                                'description' => 'The total number of entries returned.'."\n",
-                                                'type' => 'integer',
-                                                'format' => 'int64',
-                                                'example' => '100',
-                                            ],
-                                        ],
-                                    ],
-                                    'ResponseData' => [
-                                        'title' => '详细数据。',
-                                        'description' => 'The detailed data.'."\n",
-                                        'type' => 'array',
-                                        'items' => [
-                                            'type' => 'object',
-                                            'properties' => [
-                                                'Id' => [
-                                                    'title' => '告警唯一ID。',
-                                                    'description' => 'The unique ID of the alert.'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int64',
-                                                    'example' => '123456789',
-                                                ],
-                                                'GmtCreate' => [
-                                                    'title' => '告警入库时间。',
-                                                    'description' => 'The time when the alert was received.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '2021-01-06 16:37:29',
-                                                ],
-                                                'GmtModified' => [
-                                                    'title' => '告警最后更新时间。',
-                                                    'description' => 'The time when the alert was last updated.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '2021-01-06 16:37:29',
-                                                ],
-                                                'MainUserId' => [
-                                                    'title' => '告警关联siem主账号ID。',
-                                                    'description' => 'The ID of the Alibaba Cloud account that is associated with the alert in SIEM.'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int64',
-                                                    'example' => '127608589417****',
-                                                ],
-                                                'IncidentUuid' => [
-                                                    'title' => '事件全局唯一id。',
-                                                    'description' => 'The UUID of the event.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '85ea4241-798f-4684-a876-65d4f0c3****',
-                                                ],
-                                                'AlertUuid' => [
-                                                    'title' => '告警id。',
-                                                    'description' => 'The UUID of the alert.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'sas_71e24437d2797ce8fc59692905a4****',
-                                                ],
-                                                'LogTime' => [
-                                                    'title' => '告警记录时间。',
-                                                    'description' => 'The time when the alert was recorded.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '2021-01-06 16:37:29',
-                                                ],
-                                                'AlertSrcProd' => [
-                                                    'title' => '事件关联告警来源产品。',
-                                                    'description' => 'The service for which the alert associated with the event is generated.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'sas',
-                                                ],
-                                                'AlertTitle' => [
-                                                    'title' => '告警标题。',
-                                                    'description' => 'The title of the alert.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'Scan-Try SNMP weak password',
-                                                ],
-                                                'AlertTitleEn' => [
-                                                    'title' => '告警标题英文。',
-                                                    'description' => 'The title of the alert in English.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'Scan-Try SNMP weak password',
-                                                ],
-                                                'AlertType' => [
-                                                    'title' => '告警类型。',
-                                                    'description' => 'The alert type.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'Scan',
-                                                ],
-                                                'AlertTypeEn' => [
-                                                    'title' => '告警类型英文。',
-                                                    'description' => 'The type of the alert in English.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'Scan',
-                                                ],
-                                                'AlertTypeCode' => [
-                                                    'title' => '告警类型美杜莎code。',
-                                                    'description' => 'The internal code of the alert type.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'security_event_config.event_name.webshellName',
-                                                ],
-                                                'AlertName' => [
-                                                    'title' => '告警名称。',
-                                                    'description' => 'The name of the alert.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'Try SNMP weak password',
-                                                ],
-                                                'AlertNameEn' => [
-                                                    'title' => '告警名称。',
-                                                    'description' => 'The name of the alert in English.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'Try SNMP weak password',
-                                                ],
-                                                'AlertNameCode' => [
-                                                    'title' => '告警名称美杜莎code。',
-                                                    'description' => 'The internal code of the alert name.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'security_event_config.event_name.webshell',
-                                                ],
-                                                'AlertLevel' => [
-                                                    'title' => '威胁等级。 取值：'."\n"
-                                                        .'- serious：高危'."\n"
-                                                        .'- suspicious：中危'."\n"
-                                                        .'- remind：低危',
-                                                    'description' => 'The threat level. Valid values:'."\n"
-                                                        ."\n"
-                                                        .'*   serious: high'."\n"
-                                                        .'*   suspicious: medium'."\n"
-                                                        .'*   remind: low'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'remind',
-                                                ],
-                                                'AssetList' => [
-                                                    'title' => '资产列表。',
-                                                    'description' => 'The details of the asset.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '['."\n"
-                                                        .'      {'."\n"
-                                                        .'            "is_main_asset": "1",'."\n"
-                                                        .'            "asset_name": "47.245.*",'."\n"
-                                                        .'            "port": "22",'."\n"
-                                                        .'            "ip": "47.245.*",'."\n"
-                                                        .'            "asset_type": "ip",'."\n"
-                                                        .'            "location": "ap-southeast-1",'."\n"
-                                                        .'            "asset_id": "47.245.*",'."\n"
-                                                        .'            "net_connect_dir": "in"'."\n"
-                                                        .'      }'."\n"
-                                                        .']',
-                                                ],
-                                                'OccurTime' => [
-                                                    'title' => '告警发生时间。',
-                                                    'description' => 'The time when the alert is triggered.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '2021-01-06 16:37:29',
-                                                ],
-                                                'StartTime' => [
-                                                    'title' => '告警首次发生时间。',
-                                                    'description' => 'The time at which the alert was first generated.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '2021-01-06 16:37:29',
-                                                ],
-                                                'EndTime' => [
-                                                    'title' => '告警结束时间。',
-                                                    'description' => 'The time when the alert was closed.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '2021-01-06 16:37:29',
-                                                ],
-                                                'AlertSrcProdModule' => [
-                                                    'title' => '事件关联告警来源产品子模块。',
-                                                    'description' => 'The sub-module of ther alert source.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'waf',
-                                                ],
-                                                'AlertDesc' => [
-                                                    'title' => '告警描述。',
-                                                    'description' => 'The description of the alert.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.',
-                                                ],
-                                                'AlertDescEn' => [
-                                                    'title' => '告警英文描述。',
-                                                    'description' => 'The description of the alert in English.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.',
-                                                ],
-                                                'AlertDescCode' => [
-                                                    'title' => '告警描述美杜莎code。',
-                                                    'description' => 'The internal code of the alert description.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'security_event_config.event_name.webshell',
-                                                ],
-                                                'AlertDetail' => [
-                                                    'title' => '告警详情。',
-                                                    'description' => 'The details of the alert.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '{"main_user_id": "165295629792****";"log_uuid_count": "99";"attack_ip": "21.92.*.*"}',
-                                                ],
-                                                'LogUuid' => [
-                                                    'title' => '告警log UUID。',
-                                                    'description' => 'The UUID of the alert log.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'cfw_d12e285a-a042-4d7e-be89-f8a795ef****',
-                                                ],
-                                                'EntityList' => [
-                                                    'title' => '实体详情（标准化/开启索引）',
-                                                    'type' => 'string',
-                                                ],
-                                                'AttCk' => [
-                                                    'title' => 'ATTCT&攻击技术标签。',
-                                                    'description' => 'The tag of the ATT\\&CK attack.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'T1595.002 Vulnerability Scanning',
-                                                ],
-                                                'SubUserId' => [
-                                                    'title' => '产生告警阿里账号ID。',
-                                                    'description' => 'The ID of the Alibaba Cloud account within which the alert is generated.'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int64',
-                                                    'example' => '176555323***',
-                                                ],
-                                                'SubUserName' => [
-                                                    'title' => '产生告警阿里账号ID。',
-                                                    'type' => 'string',
-                                                    'example' => '176555323***',
-                                                ],
-                                                'VendorId' => [
-                                                    'title' => '云code。  取值：'."\n"
-                                                        .'- aliyun：阿里云'."\n"
-                                                        .'- qcloud：腾讯云'."\n"
-                                                        .'- hcloud：华为云',
-                                                    'type' => 'string',
-                                                    'example' => 'aliyun',
-                                                ],
-                                                'IsDefend' => [
-                                                    'title' => '是否已防御',
-                                                    'description' => 'Indicates whether an attack is defended. Valid values:'."\n"
-                                                        ."\n"
-                                                        .'*   0: detected.'."\n"
-                                                        .'*   1: blocked.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '1',
-                                                ],
-                                                'AlertInfoList' => [
-                                                    'title' => '告警详细数据。',
-                                                    'description' => 'The displayed details of the alert.'."\n",
-                                                    'type' => 'array',
-                                                    'items' => [
-                                                        'type' => 'object',
-                                                        'properties' => [
-                                                            'Key' => [
-                                                                'title' => '告警详细属性key。',
-                                                                'description' => 'The attribute key.'."\n",
-                                                                'type' => 'string',
-                                                                'example' => 'suspicious.wbd.wb.trojanpath',
-                                                            ],
-                                                            'KeyName' => [
-                                                                'title' => '告警详细数据名称。',
-                                                                'description' => 'The name of the key.'."\n",
-                                                                'type' => 'string',
-                                                                'example' => 'Trojan Path',
-                                                            ],
-                                                            'Values' => [
-                                                                'title' => '告警详细数据值。',
-                                                                'description' => 'The value of the key.'."\n",
-                                                                'type' => 'string',
-                                                                'example' => '/root/test33.php',
-                                                            ],
-                                                        ],
-                                                    ],
-                                                    'example' => 'aliyun',
-                                                ],
-                                                'ExtendContent' => [
-                                                    'type' => 'string',
-                                                ],
-                                                'ProductId' => [
-                                                    'type' => 'string',
-                                                ],
-                                                'CloudCode' => [
-                                                    'title' => '',
-                                                    'description' => 'The cloud code. Valid values:'."\n"
-                                                        ."\n"
-                                                        .'*   aliyun: Alibaba Cloud'."\n"
-                                                        .'*   qcloud: Tencent Cloud'."\n"
-                                                        .'*   hcloud: Huawei Cloud'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'aliyun',
-                                                ],
-                                                'DetectionRuleId' => [
-                                                    'type' => 'string',
-                                                ],
-                                                'AlertStatus' => [
-                                                    'title' => '告警状态',
-                                                    'type' => 'string',
-                                                    'example' => '1',
-                                                ],
-                                            ],
-                                        ],
-                                    ],
+                                    'Id' => ['title' => '', 'description' => 'The ID of the custom rule.', 'type' => 'integer', 'format' => 'int64', 'example' => '123456789'],
+                                    'Status' => ['title' => '', 'description' => 'The status of the rule. Valid values:'."\n"
+                                        ."\n"
+                                        .'- 0: initial'."\n"
+                                        ."\n"
+                                        .'- 10: simulated data test'."\n"
+                                        ."\n"
+                                        .'- 15: real-time data test in progress'."\n"
+                                        ."\n"
+                                        .'- 20: real-time data test complete'."\n"
+                                        ."\n"
+                                        .'- 100: published', 'type' => 'integer', 'format' => 'int32', 'example' => '0'],
+                                    'SimulateData' => ['title' => '', 'description' => 'The historical data of the simulated test case.', 'type' => 'string', 'example' => '[{"key1":"value1","key2":"value2","key3":"value3","key4":"value4","key5":"value5"}]'],
                                 ],
                                 'example' => '123456',
                             ],
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The request was successful.'."\n"
+                                ."\n"
+                                .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The HTTP status code returned.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The returned message.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'DescribeCustomizeRuleTest',
+            'summary' => 'Retrieves historical simulated data from a test scenario.',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:43:22.000Z', 'description' => 'Error codes changed, Request parameters changed'],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n  \\"Data\\": {\\n    \\"PageInfo\\": {\\n      \\"CurrentPage\\": 1,\\n      \\"PageSize\\": 10,\\n      \\"TotalCount\\": 100\\n    },\\n    \\"ResponseData\\": [\\n      {\\n        \\"Id\\": 123456789,\\n        \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n        \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n        \\"MainUserId\\": 0,\\n        \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n        \\"AlertUuid\\": \\"sas_71e24437d2797ce8fc59692905a4****\\",\\n        \\"LogTime\\": \\"2021-01-06 16:37:29\\",\\n        \\"AlertSrcProd\\": \\"sas\\",\\n        \\"AlertTitle\\": \\"Scan-Try SNMP weak password\\",\\n        \\"AlertTitleEn\\": \\"Scan-Try SNMP weak password\\",\\n        \\"AlertType\\": \\"Scan\\",\\n        \\"AlertTypeEn\\": \\"Scan\\",\\n        \\"AlertTypeCode\\": \\"security_event_config.event_name.webshellName\\",\\n        \\"AlertName\\": \\"Try SNMP weak password\\",\\n        \\"AlertNameEn\\": \\"Try SNMP weak password\\",\\n        \\"AlertNameCode\\": \\"security_event_config.event_name.webshell\\",\\n        \\"AlertLevel\\": \\"remind\\",\\n        \\"AssetList\\": \\"[\\\\n      {\\\\n            \\\\\\"is_main_asset\\\\\\": \\\\\\"1\\\\\\",\\\\n            \\\\\\"asset_name\\\\\\": \\\\\\"47.245.*\\\\\\",\\\\n            \\\\\\"port\\\\\\": \\\\\\"22\\\\\\",\\\\n            \\\\\\"ip\\\\\\": \\\\\\"47.245.*\\\\\\",\\\\n            \\\\\\"asset_type\\\\\\": \\\\\\"ip\\\\\\",\\\\n            \\\\\\"location\\\\\\": \\\\\\"ap-southeast-1\\\\\\",\\\\n            \\\\\\"asset_id\\\\\\": \\\\\\"47.245.*\\\\\\",\\\\n            \\\\\\"net_connect_dir\\\\\\": \\\\\\"in\\\\\\"\\\\n      }\\\\n]\\",\\n        \\"OccurTime\\": \\"2021-01-06 16:37:29\\",\\n        \\"StartTime\\": \\"2021-01-06 16:37:29\\",\\n        \\"EndTime\\": \\"2021-01-06 16:37:29\\",\\n        \\"AlertSrcProdModule\\": \\"waf\\",\\n        \\"AlertDesc\\": \\"The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.\\",\\n        \\"AlertDescEn\\": \\"The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.\\",\\n        \\"AlertDescCode\\": \\"security_event_config.event_name.webshell\\",\\n        \\"AlertDetail\\": \\"{\\\\\\"main_user_id\\\\\\": \\\\\\"165295629792****\\\\\\";\\\\\\"log_uuid_count\\\\\\": \\\\\\"99\\\\\\";\\\\\\"attack_ip\\\\\\": \\\\\\"21.92.*.*\\\\\\"}\\",\\n        \\"LogUuid\\": \\"cfw_d12e285a-a042-4d7e-be89-f8a795ef****\\",\\n        \\"EntityList\\": \\"[{&quot;entity_user_id&quot;:&quot;198921674491****&quot;,&quot;entity_account_id&quot;:&quot;N/A&quot;,&quot;entity_uuid&quot;:&quot;6245f979d5dd9ef8dd19bdc72228****&quot;,&quot;entity_type&quot;:&quot;host&quot;,&quot;entity_name&quot;:&quot;zhh-test-20240409&quot;,&quot;is_comprised&quot;:&quot;1&quot;,&quot;os_type&quot;:&quot;linux&quot;,&quot;entity_id&quot;:&quot;a88f44dd-b8d4-4ded-831c-77a4835****&quot;,&quot;host_uuid&quot;:&quot;a88f44dd-b8d4-4ded-831c-77a4835****&quot;,&quot;host_name&quot;:&quot;zhh-test-2024****&quot;}]\\",\\n        \\"AttCk\\": \\"T1595.002 Vulnerability Scanning\\",\\n        \\"SubUserId\\": 0,\\n        \\"SubUserName\\": \\"176555323***\\",\\n        \\"VendorId\\": \\"aliyun\\",\\n        \\"IsDefend\\": \\"1\\",\\n        \\"AlertInfoList\\": [\\n          {\\n            \\"Key\\": \\"suspicious.wbd.wb.trojanpath\\",\\n            \\"KeyName\\": \\"Trojan Path\\",\\n            \\"Values\\": \\"/root/test33.php\\"\\n          }\\n        ],\\n        \\"ExtendContent\\": \\"{\\\\\\"user\\\\\\":\\\\\\"Member\\\\\\",\\\\\\"num\\\\\\":\\\\\\"1\\\\\\"}\\",\\n        \\"ProductId\\": \\"alibaba_cloud_sas\\",\\n        \\"CloudCode\\": \\"aliyun\\",\\n        \\"DetectionRuleId\\": \\"dr-48zs4tk7qfd4rjd9****\\",\\n        \\"AlertStatus\\": \\"1\\"\\n      }\\n    ]\\n  }\\n}","type":"json"}]',
-            'title' => 'DescribeAlerts',
-        ],
-        'DescribeAlertSource' => [
-            'summary' => 'Queries alert data sources.',
-            'methods' => [
-                'get',
-                'post',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeCustomizeRuleTest'],
+                ],
             ],
-            'schemes' => [
-                'https',
-                'http',
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DescribeCustomizeRuleTest',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"Id\\": 123456789,\\n    \\"Status\\": 0,\\n    \\"SimulateData\\": \\"[{\\\\\\"key1\\\\\\":\\\\\\"value1\\\\\\",\\\\\\"key2\\\\\\":\\\\\\"value2\\\\\\",\\\\\\"key3\\\\\\":\\\\\\"value3\\\\\\",\\\\\\"key4\\\\\\":\\\\\\"value4\\\\\\",\\\\\\"key5\\\\\\":\\\\\\"value5\\\\\\"}]\\"\\n  },\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
+        ],
+        'DescribeCustomizeRuleTestHistogram' => [
+            'methods' => ['get', 'post'],
+            'schemes' => ['https', 'http'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'get',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-            ],
+            'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
-                    'name' => 'Level',
-                    'in' => 'formData',
-                    'style' => 'repeatList',
-                    'schema' => [
-                        'title' => '威胁等级，格式为json数组。取值：'."\n"
-                            .'- serious：高危'."\n"
-                            .'- suspicious：中危'."\n"
-                            .'- remind：低危',
-                        'description' => 'The risk levels. The value is a JSON array. Valid values:'."\n"
-                            ."\n"
-                            .'*   serious: high'."\n"
-                            .'*   suspicious: medium'."\n"
-                            .'*   remind: low'."\n",
-                        'type' => 'array',
-                        'items' => [
-                            'description' => 'The risk level. The value is a JSON string. Valid values:'."\n"
-                                ."\n"
-                                .'*   serious: high'."\n"
-                                .'*   suspicious: medium'."\n"
-                                .'*   remind: low'."\n",
-                            'type' => 'string',
-                            'required' => false,
-                            'example' => '["remind","serious"]',
-                        ],
-                        'required' => false,
-                        'example' => '["serious","suspicious","remind"]',
-                        'maxItems' => 100,
-                    ],
-                ],
-                [
-                    'name' => 'StartTime',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '查询开始时间, 单位毫秒。',
-                        'description' => 'The beginning of the time range to query. Unit: milliseconds.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '1577808000000',
-                    ],
-                ],
-                [
-                    'name' => 'EndTime',
+                    'name' => 'Id',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '查询结束时间, 单位毫秒。',
-                        'description' => 'The end of the time range to query. Unit: milliseconds.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '1577808000000',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The ID of the custom rule.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '123456789'],
                 ],
                 [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['description' => 'The view type.'."\n"
+                        ."\n"
+                        .'- 0: The view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: The view of all accounts in your enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member. This parameter is used when an administrator switches to the perspective of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region where the Management Hub of threat analysis is located. Select the region of the Management Hub based on the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'BaseResponse<List<AlertSource>>',
-                        'description' => 'BaseResponse\\<List>'."\n",
+                        'title' => 'BaseResponse<List<CustomizeRuleAlertHistogram>>',
+                        'description' => 'BaseResponse\\<List>',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
+                                'title' => '',
+                                'description' => 'The data returned.',
                                 'type' => 'array',
                                 'items' => [
                                     'type' => 'object',
                                     'properties' => [
-                                        'SourceName' => [
-                                            'title' => '告警数据源名称。',
-                                            'description' => 'The name of the alert data source.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'sas',
-                                        ],
-                                        'Source' => [
-                                            'title' => '告警数据源名称美杜莎code。',
-                                            'description' => 'The internal code of the alert data source.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'aliyun.siem.alert_datasource.sas',
-                                        ],
+                                        'From' => ['title' => '', 'description' => 'The start of the time range for the alert. This value is a UNIX timestamp. Unit: seconds.', 'type' => 'integer', 'format' => 'int64', 'example' => '1599897188'],
+                                        'To' => ['title' => '', 'description' => 'The end of the time range for the alert. This value is a UNIX timestamp. Unit: seconds.', 'type' => 'integer', 'format' => 'int64', 'example' => '1599997188'],
+                                        'Count' => ['title' => '', 'description' => 'The number of alerts generated in the subinterval.', 'type' => 'integer', 'format' => 'int64', 'example' => '125'],
                                     ],
+                                    'description' => '',
+                                    'title' => '',
+                                    'example' => '',
                                 ],
                                 'example' => '123456',
                             ],
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true：成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
-                            ],
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The request was successful.'."\n"
+                                ."\n"
+                                .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The message returned for the request.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'DescribeCustomizeRuleTestHistogram',
+            'summary' => 'Retrieves the chart of test results for a custom rule.',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:43:23.000Z', 'description' => 'Error codes changed, Request parameters changed'],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"SourceName\\": \\"sas\\",\\n      \\"Source\\": \\"aliyun.siem.alert_datasource.sas\\"\\n    }\\n  ],\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
-            'title' => 'DescribeAlertSource',
-        ],
-        'DescribeAlertsCount' => [
-            'summary' => 'Queries the number of alerts of different severities.',
-            'methods' => [
-                'get',
-                'post',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeCustomizeRuleTestHistogram'],
+                ],
             ],
-            'schemes' => [
-                'https',
-                'http',
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DescribeCustomizeRuleTestHistogram',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"From\\": 1599897188,\\n      \\"To\\": 1599997188,\\n      \\"Count\\": 125\\n    }\\n  ],\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
+        ],
+        'DescribeDataSourceInstance' => [
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
+            'operationType' => 'read',
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'get',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
-            ],
+            'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
-                    'name' => 'QueryType',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '查询类型。',
-                        'type' => 'string',
-                        'example' => 'bySrcProd',
-                    ],
-                ],
-                [
-                    'name' => 'StartTime',
+                    'name' => 'DataSourceInstanceId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '查询开始时间, 单位毫秒。',
-                        'description' => 'The beginning of the time range to query. Unit: milliseconds.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '1577808000000',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The ID of the data source. The threat analysis service generates the ID by calculating the MD5 hash of specific parameters. Call the [ListDataSourceLogs](https://api.aliyun-inc.com/#/publishment/document/cloud-siem/863fdf54478f4cc5877e27c2a5fe9e44?tenantUuid=f382fccd88b94c5c8c864def6815b854\\&activeTabKey=api%7CListDataSourceLogs) operation to obtain the data source ID.', 'type' => 'string', 'required' => true, 'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea'],
                 ],
                 [
-                    'name' => 'EndTime',
+                    'name' => 'AccountId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '查询结束时间, 单位毫秒。',
-                        'description' => 'The end of the time range to query. Unit: milliseconds.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '1577808000000',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account.', 'type' => 'string', 'required' => true, 'example' => '123xxxxxxx'],
                 ],
                 [
-                    'name' => 'RoleType',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                        'title' => '0，单账号登录；1，全局视图；2，切换视图；3，局部视图',
-                    ],
-                ],
-                [
-                    'name' => 'RoleFor',
+                    'name' => 'CloudCode',
                     'in' => 'formData',
                     'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
+                        'title' => '',
+                        'description' => 'The code for the multicloud environment. Valid values:'."\n"
+                            ."\n"
+                            .'- qcloud: Tencent Cloud.'."\n"
+                            ."\n"
+                            .'- aliyun: Alibaba Cloud.'."\n"
+                            ."\n"
+                            .'- hcloud: Huawei Cloud.',
+                        'type' => 'string',
+                        'required' => true,
+                        'enum' => ['qcloud', 'hcloud', 'aliyun'],
+                        'example' => 'hcloud',
                     ],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region where the Data Management center of the threat analysis service is located. Select a region based on the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'PlainResponse<CloudSiemAlertCounter>',
-                        'description' => 'PlainResponse'."\n",
+                        'title' => 'CloudSiemSuccessResponse<DescribeDataSourceInstanceResult>',
+                        'description' => 'CloudSiemSuccessResponse',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
+                                'title' => '',
+                                'description' => 'The data returned.',
                                 'type' => 'object',
                                 'properties' => [
-                                    'High' => [
-                                        'title' => '高威胁告警数。',
-                                        'description' => 'The number of high-risk alerts.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int64',
-                                        'example' => '25',
-                                    ],
-                                    'Medium' => [
-                                        'title' => '中威胁告警数。',
-                                        'description' => 'The number of medium-risk alerts.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int64',
-                                        'example' => '25',
-                                    ],
-                                    'Low' => [
-                                        'title' => '低威胁告警数。',
-                                        'description' => 'The number of low-risk alerts.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int64',
-                                        'example' => '25',
-                                    ],
-                                    'All' => [
-                                        'title' => '告警总数。',
-                                        'description' => 'The total number of alerts.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int64',
-                                        'example' => '75',
-                                    ],
-                                    'ProductNum' => [
-                                        'title' => '接入产品数。',
-                                        'description' => 'The number of connected services.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '3',
-                                    ],
-                                    'CountMap' => [
-                                        'type' => 'object',
-                                        'additionalProperties' => [
-                                            'type' => 'integer',
-                                            'format' => 'int64',
+                                    'DataSourceInstanceId' => ['title' => '', 'description' => 'The ID of the data source. The threat analysis service generates the ID by calculating the MD5 hash of specific parameters.', 'type' => 'string', 'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea'],
+                                    'DataSourceInstanceParams' => [
+                                        'title' => '',
+                                        'description' => 'The list of detailed parameters for the data source.',
+                                        'type' => 'array',
+                                        'items' => [
+                                            'type' => 'object',
+                                            'properties' => [
+                                                'ParaCode' => ['title' => '', 'description' => 'The parameter code.', 'type' => 'string', 'example' => 'region_code'],
+                                                'ParaValue' => ['title' => '', 'description' => 'The parameter value.', 'type' => 'string', 'example' => 'ap-guangzhou'],
+                                            ],
+                                            'description' => '',
+                                            'title' => '',
+                                            'example' => '',
                                         ],
+                                        'example' => '',
+                                    ],
+                                    'AccountId' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account.', 'type' => 'string', 'example' => '123xxxxxxx'],
+                                    'CloudCode' => [
+                                        'title' => '',
+                                        'description' => 'The code for the multicloud environment. Valid values:'."\n"
+                                            ."\n"
+                                            .'- qcloud: Tencent Cloud.'."\n"
+                                            ."\n"
+                                            .'- aliyun: Alibaba Cloud.'."\n"
+                                            ."\n"
+                                            .'- hcloud: Huawei Cloud.',
+                                        'type' => 'string',
+                                        'enum' => ['qcloud', 'hcloud'],
+                                        'example' => 'hcloud',
                                     ],
                                 ],
-                                'example' => '123456',
-                            ],
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true：成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
+                                'example' => '',
                             ],
+                            'RequestId' => ['title' => '', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"High\\": 25,\\n    \\"Medium\\": 25,\\n    \\"Low\\": 25,\\n    \\"All\\": 75,\\n    \\"ProductNum\\": 3,\\n    \\"CountMap\\": {\\n      \\"key\\": 12\\n    }\\n  },\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
-            'title' => 'DescribeAlertsCount',
-        ],
-        'ListEntities' => [
-            'summary' => 'Queries entities.',
-            'methods' => [
-                'get',
-                'post',
+            'title' => 'DescribeDataSourceInstance',
+            'summary' => 'Queries the details of a data source.',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeDataSourceInstance'],
+                ],
             ],
-            'schemes' => [
-                'https',
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DescribeDataSourceInstance',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"DataSourceInstanceId\\": \\"220ba97c9d1fdb0b9c7e8c7ca328d7ea\\",\\n    \\"DataSourceInstanceParams\\": [\\n      {\\n        \\"ParaCode\\": \\"region_code\\",\\n        \\"ParaValue\\": \\"ap-guangzhou\\"\\n      }\\n    ],\\n    \\"AccountId\\": \\"123xxxxxxx\\",\\n    \\"CloudCode\\": \\"hcloud\\"\\n  },\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+        ],
+        'DescribeDataSourceParameters' => [
+            'summary' => 'Describes the parameters for a data source.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
@@ -6643,1289 +4688,949 @@
             ],
             'operationType' => 'read',
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'get',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsasAFG0OH',
-                ],
-            ],
+            'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
-                    'name' => 'IncidentUuid',
+                    'name' => 'DataSourceType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '事件ID。',
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => '85ea4241-798f-4684-a876-65d4f0c3****',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The type of the data source. Valid values:'."\n"
+                        ."\n"
+                        .'- **ckafka**: Tencent Cloud CKafka.'."\n"
+                        ."\n"
+                        .'- **obs**: Huawei Cloud OBS.'."\n"
+                        ."\n"
+                        .'- **wafApi**: Tencent Cloud WAF attack log download API.', 'type' => 'string', 'required' => true, 'example' => 'obs'],
                 ],
                 [
-                    'name' => 'EntityType',
+                    'name' => 'CloudCode',
                     'in' => 'formData',
                     'schema' => [
-                        'title' => '实体类型。',
-                        'description' => '',
+                        'title' => '',
+                        'description' => 'The code for the multicloud environment.',
                         'type' => 'string',
-                        'required' => false,
-                        'example' => 'ip',
+                        'required' => true,
+                        'enum' => ['qcloud', 'hcloud', 'aliyun'],
+                        'example' => 'hcloud',
                     ],
                 ],
                 [
-                    'name' => 'EntityName',
+                    'name' => 'RegionId',
                     'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The region where the Data Management center for threat analysis is deployed. Select a region based on the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
+                ],
+            ],
+            'responses' => [
+                200 => [
                     'schema' => [
-                        'title' => '实体名称。',
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'host1****',
+                        'title' => 'CloudSiemSuccessResponse<List<DescribeDataSourceParametersResult>>',
+                        'description' => 'CloudSiemSuccessResponse\\<List>',
+                        'type' => 'object',
+                        'properties' => [
+                            'Data' => [
+                                'title' => '',
+                                'description' => 'The data returned.',
+                                'type' => 'array',
+                                'items' => [
+                                    'description' => 'The data returned.',
+                                    'type' => 'object',
+                                    'properties' => [
+                                        'DataSourceType' => ['title' => '', 'description' => 'The type of the data source. Valid values:'."\n"
+                                            ."\n"
+                                            .'- **obs**: Huawei Cloud OBS.'."\n"
+                                            ."\n"
+                                            .'- **wafApi**: Tencent Cloud WAF download API.'."\n"
+                                            ."\n"
+                                            .'- **ckafka**: Tencent Cloud CKafka.', 'type' => 'string', 'example' => 'obs'],
+                                        'ParaLevel' => ['title' => '', 'description' => 'The level of the parameter. Valid values:'."\n"
+                                            ."\n"
+                                            .'- **1**: data source parameter.'."\n"
+                                            ."\n"
+                                            .'- **2**: log parameter.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'],
+                                        'ParaCode' => ['title' => '', 'description' => 'The code of the parameter.', 'type' => 'string', 'example' => 'region_code'],
+                                        'ParaName' => ['title' => '', 'description' => 'The name of the parameter.', 'type' => 'string', 'example' => 'region local'],
+                                        'ParaType' => ['title' => '', 'description' => 'The type of the parameter.', 'type' => 'string', 'example' => 'string'],
+                                        'Required' => ['title' => '', 'description' => 'Indicates whether the parameter is required. Valid values:'."\n"
+                                            ."\n"
+                                            .'- **1**: The parameter is required.'."\n"
+                                            ."\n"
+                                            .'- **0**: The parameter is optional.', 'type' => 'integer', 'format' => 'int32', 'example' => 'string'],
+                                        'FormatCheck' => ['title' => '', 'description' => 'The format check method.', 'type' => 'string', 'example' => 'email'],
+                                        'Title' => ['title' => '', 'description' => 'The prompt for the parameter value.', 'type' => 'string', 'example' => 'obs bucket name'],
+                                        'Hit' => ['title' => '', 'description' => 'Additional information.', 'type' => 'string', 'example' => 'obs docment'],
+                                        'DefaultValue' => ['title' => '', 'description' => 'The default value of the parameter.', 'type' => 'string', 'example' => 'wafApi'],
+                                        'Disabled' => ['title' => '', 'description' => 'Indicates whether the parameter can be modified. Valid values:'."\n"
+                                            ."\n"
+                                            .'- **true**: The parameter cannot be modified.'."\n"
+                                            ."\n"
+                                            .'- **false**: The parameter can be modified.', 'type' => 'boolean', 'example' => 'wafApi'],
+                                        'CanEditted' => ['title' => '', 'description' => 'Indicates whether the parameter is editable. Valid values:'."\n"
+                                            ."\n"
+                                            .'- **0**: The parameter cannot be modified.'."\n"
+                                            ."\n"
+                                            .'- **1**: The parameter can be modified.', 'type' => 'integer', 'format' => 'int32', 'example' => 'wafApi'],
+                                        'ParamValue' => [
+                                            'title' => '',
+                                            'description' => 'The list of parameters.',
+                                            'type' => 'array',
+                                            'items' => [
+                                                'description' => 'The parameter value.',
+                                                'type' => 'object',
+                                                'properties' => [
+                                                    'Label' => ['title' => '', 'description' => 'The displayed content.', 'type' => 'string', 'example' => 'guangzhou'],
+                                                    'Value' => ['title' => '', 'description' => 'The actual value of the parameter.', 'type' => 'string', 'example' => 'ap-guangzhou'],
+                                                ],
+                                                'title' => '',
+                                                'example' => '',
+                                            ],
+                                            'example' => '',
+                                        ],
+                                        'CloudCode' => [
+                                            'title' => '',
+                                            'description' => 'The code for the multicloud environment. Valid values:'."\n"
+                                                ."\n"
+                                                .'- **qcloud**: Tencent Cloud.'."\n"
+                                                ."\n"
+                                                .'- **aliyun**: Alibaba Cloud.'."\n"
+                                                ."\n"
+                                                .'- **hcloud**: Huawei Cloud.',
+                                            'type' => 'string',
+                                            'enum' => ['qcloud', 'hcloud'],
+                                            'example' => 'hcloud',
+                                        ],
+                                    ],
+                                    'title' => '',
+                                    'example' => '',
+                                ],
+                                'example' => '',
+                            ],
+                            'RequestId' => ['title' => '', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
+                        ],
+                        'example' => '',
                     ],
                 ],
+            ],
+            'errorCodes' => [
+                500 => [
+                    ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''],
+                ],
+            ],
+            'title' => 'DescribeDataSourceParameters',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeDataSourceParameters'],
+                ],
+            ],
+            'ramActions' => [
                 [
-                    'name' => 'EntityUuid',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '实体ID。',
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '6c740667-80b2-476d-8924-2e706feb****',
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DescribeDataSourceParameters',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
                     ],
                 ],
+            ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"DataSourceType\\": \\"obs\\",\\n      \\"ParaLevel\\": 1,\\n      \\"ParaCode\\": \\"region_code\\",\\n      \\"ParaName\\": \\"region local\\",\\n      \\"ParaType\\": \\"string\\",\\n      \\"Required\\": 0,\\n      \\"FormatCheck\\": \\"email\\",\\n      \\"Title\\": \\"obs bucket name\\",\\n      \\"Hit\\": \\"obs docment\\",\\n      \\"DefaultValue\\": \\"wafApi\\",\\n      \\"Disabled\\": true,\\n      \\"CanEditted\\": 0,\\n      \\"ParamValue\\": [\\n        {\\n          \\"Label\\": \\"guangzhou\\",\\n          \\"Value\\": \\"ap-guangzhou\\"\\n        }\\n      ],\\n      \\"CloudCode\\": \\"hcloud\\"\\n    }\\n  ],\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+        ],
+        'DescribeDisposeAndPlaybook' => [
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
+            'security' => [
                 [
-                    'name' => 'EntityUuids',
-                    'in' => 'formData',
-                    'schema' => [
-                        'type' => 'string',
-                    ],
+                    'AK' => [],
                 ],
+            ],
+            'operationType' => 'read',
+            'deprecated' => false,
+            'systemTags' => [
+                'operationType' => 'get',
+                'riskType' => 'none',
+                'chargeType' => 'free',
+                'abilityTreeNodes' => ['FEATUREsas104PTS'],
+            ],
+            'parameters' => [
                 [
-                    'name' => 'MalwareType',
+                    'name' => 'EntityType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '恶意实体类型。 取值：'."\n"
-                            .'- 0:否'."\n"
-                            .'- 1:是。',
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'aliyun.siem.sas.alert_tag.miner_software',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The entity type. Valid values:'."\n"
+                        .'- ip: IP address'."\n"
+                        .'- process: process'."\n"
+                        .'- file: file', 'type' => 'string', 'example' => 'ip', 'required' => false],
                 ],
                 [
-                    'name' => 'IsMalwareEntity',
+                    'name' => 'IncidentUuid',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '是否恶意实体。 取值：'."\n"
-                            .'- 0:否'."\n"
-                            .'- 1:是。',
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The event UUID.', 'type' => 'string', 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', 'required' => false],
                 ],
                 [
-                    'name' => 'Tags',
+                    'name' => 'EntityUuid',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '实体标签。格式为JSON数组字符串：\\"[{\\"tagKey1\\":\\"tagValue1\\"},{\\"tagKey2\\":\\"tagValue2\\"}]\\"',
-                        'type' => 'string',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The entity UUID.', 'type' => 'string', 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', 'required' => false],
                 ],
                 [
                     'name' => 'CurrentPage',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '列表当前页号， 大于等于1。',
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => true,
-                        'minimum' => '1',
-                        'example' => '1',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The page number. The value must be greater than or equal to 1.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'required' => false],
                 ],
                 [
                     'name' => 'PageSize',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '列表每页条数， 最大不超过100。',
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => true,
-                        'maximum' => '100',
-                        'minimum' => '1',
-                        'example' => '10',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The number of entries per page. Maximum value: 100.', 'type' => 'integer', 'format' => 'int32', 'example' => '10', 'required' => false],
                 ],
                 [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '0，单账号登录；1，全局视图；2，切换视图；3，局部视图',
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The view type. Valid values:'."\n"
+                        ."\n"
+                        .'- 0: the view of the current Alibaba Cloud account.'."\n"
+                        .'- 1: the view of all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member to which the administrator switches the view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region in which the data management center of the threat analysis feature resides. Select the data management center based on the region of your assets. Valid values:'."\n"
+                        .'- cn-hangzhou: Your assets reside in the Chinese mainland or Hong Kong (China).'."\n"
+                        .'- ap-southeast-1: Your assets reside in regions outside the Chinese mainland.', 'type' => 'string', 'example' => 'cn-hangzhou', 'required' => false],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'PageResponse<List<EntityInfo>>',
-                        'description' => 'PageResponse<List<EntityInfo>>',
+                        'title' => '',
+                        'description' => 'PageResponse<List<DisposeAndScopeView>>',
                         'type' => 'object',
                         'properties' => [
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true:成功'."\n"
-                                    .'- false：失败',
-                                'description' => '',
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
-                            ],
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                .'- true: Successful.'."\n"
+                                .'- false: Failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The response status code.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The response message.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => '',
+                                'title' => '',
+                                'description' => 'The response data.',
                                 'type' => 'object',
                                 'properties' => [
                                     'PageInfo' => [
-                                        'title' => '分页记录。',
-                                        'description' => '',
+                                        'title' => '',
+                                        'description' => 'The pagination information.',
                                         'type' => 'object',
                                         'properties' => [
-                                            'CurrentPage' => [
-                                                'title' => '列表当前页号。',
-                                                'description' => '',
-                                                'type' => 'integer',
-                                                'format' => 'int32',
-                                                'example' => '1',
-                                            ],
-                                            'PageSize' => [
-                                                'title' => '每页返回记录数。',
-                                                'description' => '',
-                                                'type' => 'integer',
-                                                'format' => 'int32',
-                                                'example' => '10',
-                                            ],
-                                            'TotalCount' => [
-                                                'title' => '记录总数。',
-                                                'description' => '',
-                                                'type' => 'integer',
-                                                'format' => 'int64',
-                                                'example' => '100',
-                                            ],
+                                            'CurrentPage' => ['title' => '', 'description' => 'The current page number.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'],
+                                            'PageSize' => ['title' => '', 'description' => 'The number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10'],
+                                            'TotalCount' => ['title' => '', 'description' => 'The total number of entries.', 'type' => 'integer', 'format' => 'int64', 'example' => '100'],
                                         ],
+                                        'example' => '',
                                     ],
                                     'ResponseData' => [
-                                        'title' => '详细数据。',
-                                        'description' => '',
+                                        'title' => '',
+                                        'description' => 'The detailed data.',
                                         'type' => 'array',
                                         'items' => [
                                             'type' => 'object',
                                             'properties' => [
-                                                'Id' => [
-                                                    'title' => '实体ID。',
-                                                    'description' => '',
-                                                    'type' => 'integer',
-                                                    'format' => 'int64',
-                                                    'example' => '123456789***',
-                                                ],
-                                                'GmtCreate' => [
-                                                    'title' => '实体采集时间。',
-                                                    'description' => '',
-                                                    'type' => 'string',
-                                                    'example' => '2021-01-06 16:37:29',
-                                                ],
-                                                'GmtModified' => [
-                                                    'title' => '实体最后更新时间。',
-                                                    'description' => '',
-                                                    'type' => 'string',
-                                                    'example' => '2021-01-06 16:37:29',
-                                                ],
-                                                'Aliuid' => [
-                                                    'title' => 'siem主用户ID。',
-                                                    'description' => '',
-                                                    'type' => 'integer',
-                                                    'format' => 'int64',
-                                                    'example' => '123456789****',
-                                                ],
-                                                'IncidentUuid' => [
-                                                    'title' => '事件ID。',
-                                                    'description' => '',
-                                                    'type' => 'string',
-                                                    'example' => '85ea4241-798f-4684-a876-65d4f0c3****',
-                                                ],
-                                                'AlertUuid' => [
-                                                    'title' => '告警ID。',
-                                                    'description' => '',
-                                                    'type' => 'string',
-                                                    'example' => 'sas_71e24437d2797ce8fc59692905a4****',
-                                                ],
-                                                'AlertNum' => [
-                                                    'title' => '实体关联告警数量。',
-                                                    'description' => '',
-                                                    'type' => 'integer',
-                                                    'format' => 'int32',
-                                                    'example' => '1',
-                                                ],
-                                                'EventNum' => [
-                                                    'title' => '实体关联事件数量。',
-                                                    'description' => '',
-                                                    'type' => 'integer',
-                                                    'format' => 'int32',
-                                                    'example' => '1',
-                                                ],
-                                                'CloudCode' => [
-                                                    'title' => '实体来源云code。  取值：'."\n"
-                                                        .'- aliyun：阿里云'."\n"
-                                                        .'- qcloud：腾讯云'."\n"
-                                                        .'- hcloud：华为云',
-                                                    'description' => '',
-                                                    'type' => 'string',
-                                                    'example' => 'aliyun',
-                                                ],
-                                                'EntityType' => [
-                                                    'title' => '实体类型。取值：'."\n"
-                                                        .'- ip:ip'."\n"
-                                                        .'- domain：域名'."\n"
-                                                        .'- url：url'."\n"
-                                                        .'- process：进程'."\n"
-                                                        .'- file：文件'."\n"
-                                                        .'- host：主机',
-                                                    'description' => '',
-                                                    'type' => 'string',
-                                                    'example' => 'ip',
-                                                ],
-                                                'EntityName' => [
-                                                    'title' => '实体名称。',
-                                                    'description' => '',
-                                                    'type' => 'string',
-                                                    'example' => '123.123.123.123',
-                                                ],
-                                                'EntityInfo' => [
-                                                    'title' => '实体展示信息 json格式。',
-                                                    'description' => '',
-                                                    'type' => 'string',
-                                                    'example' => '{"file_path": "c:/www/leixi.jsp","file_hash": "aa0ca926ad948cd820e0a3d9a18c****","host_uuid": "efed2cf7-0b77-45d9-a97b-d2cf246b****","malware_type": "${aliyun.siem.sas.alert_tag.webshell}","host_name": "launch-advisor-2023****"}',
-                                                ],
-                                                'SubUserId' => [
-                                                    'title' => '实体关联账号id',
-                                                    'description' => '',
-                                                    'type' => 'integer',
-                                                    'format' => 'int64',
-                                                    'example' => '113091674488****',
-                                                ],
-                                                'EntityId' => [
-                                                    'title' => '实体逻辑id',
-                                                    'description' => '',
-                                                    'type' => 'string',
-                                                    'example' => '12345****',
-                                                ],
-                                                'EntityUuid' => [
-                                                    'title' => '实体uuid',
-                                                    'description' => '',
-                                                    'type' => 'string',
-                                                    'example' => '8087b3e4aa6862852c100c8738cf****',
-                                                ],
-                                                'MalwareType' => [
-                                                    'title' => '实体恶意类型',
-                                                    'description' => '',
-                                                    'type' => 'string',
-                                                    'example' => 'aliyun.siem.sas.alert_tag.webshell',
-                                                ],
-                                                'IsAsset' => [
-                                                    'type' => 'string',
-                                                ],
-                                                'IsMalware' => [
-                                                    'type' => 'string',
-                                                ],
-                                                'Tags' => [
-                                                    'type' => 'string',
-                                                ],
-                                                'AgentDisposalMethod' => [
-                                                    'type' => 'string',
+                                                'EntityId' => ['title' => '', 'description' => 'The entity ID.', 'type' => 'integer', 'format' => 'int64', 'example' => '12345****'],
+                                                'EntityType' => ['title' => '', 'description' => 'The entity type. Valid values:'."\n"
+                                                    .'- ip: IP address'."\n"
+                                                    .'- domain: domain name'."\n"
+                                                    .'- url: URL'."\n"
+                                                    .'- process: process'."\n"
+                                                    .'- file: file'."\n"
+                                                    .'- host: host', 'type' => 'string', 'example' => 'ip'],
+                                                'OpcodeMap' => [
+                                                    'title' => '',
+                                                    'description' => 'The key-value pairs of opcode and oplevel.',
+                                                    'type' => 'object',
+                                                    'additionalProperties' => ['description' => 'The key-value pairs of opcode and oplevel.', 'type' => 'string', 'example' => '{"7","2"}', 'title' => ''],
+                                                    'example' => '12345',
                                                 ],
-                                                'AgentDisposalPlaybookUuid' => [
-                                                    'type' => 'string',
+                                                'OpcodeSet' => [
+                                                    'title' => '',
+                                                    'description' => 'The recommended playbook opcodes for entity disposition.',
+                                                    'type' => 'array',
+                                                    'items' => ['description' => 'The recommended playbook opcodes for entity disposition.', 'type' => 'string', 'example' => '7', 'title' => ''],
+                                                    'example' => '[1,3]',
                                                 ],
-                                                'AgentDisposalSuggestion' => [
-                                                    'type' => 'string',
+                                                'EntityInfo' => ['title' => '', 'description' => 'The entity information.', 'type' => 'object', 'example' => '{"file_path": "c:/www/leixi.jsp","file_hash": "aa0ca926ad948cd820e0a3d9a18c****","host_uuid": "efed2cf7-0b77-45d9-a97b-d2cf246b****","malware_type": "${aliyun.siem.sas.alert_tag.webshell}","host_name": "launch-advisor-2023****"}'],
+                                                'Dispose' => ['title' => '', 'description' => 'The disposition object.', 'type' => 'string', 'example' => '192.168.*.*'],
+                                                'Scope' => [
+                                                    'title' => '',
+                                                    'description' => 'The disposition scope. The list of user IDs that can perform the disposition.',
+                                                    'type' => 'array',
+                                                    'items' => ['description' => 'The disposition scope. The list of user IDs that can perform the disposition.', 'type' => 'any', 'example' => '[127608589417****]', 'title' => ''],
+                                                    'example' => '176618589410****',
                                                 ],
-                                                'AgentConfidence' => [
-                                                    'type' => 'string',
+                                                'PlaybookList' => [
+                                                    'title' => '',
+                                                    'description' => 'The list of playbooks that can dispose of the entity.',
+                                                    'type' => 'array',
+                                                    'items' => [
+                                                        'type' => 'object',
+                                                        'properties' => [
+                                                            'OpCode' => ['title' => '', 'description' => 'The playbook opcode, which corresponds to the recommended playbook opcode for entity disposition.', 'type' => 'string', 'example' => '7'],
+                                                            'OpLevel' => ['title' => '', 'description' => 'Indicates whether the playbook is selected by default for one-click event disposition. Valid values:'."\n"
+                                                                ."\n"
+                                                                .'- 2: Selected. '."\n"
+                                                                .'- 1: Displayed but not selected.', 'type' => 'string', 'example' => '2'],
+                                                            'Description' => ['title' => '', 'description' => 'The playbook description.', 'type' => 'string', 'example' => 'WafBlockIP'],
+                                                            'DisplayName' => ['title' => '', 'description' => 'The display name of the playbook.', 'type' => 'string', 'example' => 'WafBlockIP'],
+                                                            'TaskConfig' => ['title' => '', 'description' => 'The opcode configuration.', 'type' => 'string', 'example' => '{"opCode":"3"}'],
+                                                            'Name' => ['title' => '', 'description' => 'The playbook name, which is the unique identifier of the playbook.', 'type' => 'string', 'example' => 'kill_process_isolate_file'],
+                                                            'Uuid' => ['title' => '', 'description' => 'The playbook UUID, which is the unique identifier of the playbook.', 'type' => 'string', 'example' => 'kill_process_isolate_file'],
+                                                            'ParamConfig' => [
+                                                                'title' => '',
+                                                                'description' => 'The parameter list and corresponding parameter properties of the playbook.',
+                                                                'type' => 'array',
+                                                                'items' => ['description' => 'The input parameter list and input parameter format requirements of the current playbook.', 'type' => 'any', 'example' => '{'."\n"
+                                                                    .'	"ParamConfig": ['."\n"
+                                                                    .'		{'."\n"
+                                                                    .'			"Field": "dispose",'."\n"
+                                                                    .'			"Necessary": true,'."\n"
+                                                                    .'			"CheckField": "[{&quot;fieldPath&quot;:&quot;$.ip&quot;,&quot;fieldName&quot;:&quot;ip&quot;}]"'."\n"
+                                                                    .'		},'."\n"
+                                                                    .'		{'."\n"
+                                                                    .'			"Field": "alert",'."\n"
+                                                                    .'			"Necessary": true,'."\n"
+                                                                    .'			"CheckField": "[{&quot;fieldPath&quot;:&quot;$.host_uuid&quot;,&quot;fieldName&quot;:&quot;host_uuid&quot;}]"'."\n"
+                                                                    .'		},'."\n"
+                                                                    .'		{'."\n"
+                                                                    .'			"Field": "scope",'."\n"
+                                                                    .'			"Necessary": true,'."\n"
+                                                                    .'			"Value": "$.main_user_id"'."\n"
+                                                                    .'		},'."\n"
+                                                                    .'		{'."\n"
+                                                                    .'			"Field": "startTime",'."\n"
+                                                                    .'			"Necessary": true'."\n"
+                                                                    .'		},'."\n"
+                                                                    .'		{'."\n"
+                                                                    .'			"Field": "endTime",'."\n"
+                                                                    .'			"Necessary": true'."\n"
+                                                                    .'		}'."\n"
+                                                                    .'	]'."\n"
+                                                                    .'}', 'title' => ''],
+                                                                'example' => '',
+                                                            ],
+                                                            'WafPlaybook' => ['title' => '', 'description' => 'Indicates whether this is a WAF playbook. Valid values:'."\n"
+                                                                ."\n"
+                                                                .'- true: Yes.'."\n"
+                                                                .'- false: No.', 'type' => 'boolean', 'example' => 'false'],
+                                                            'Available' => ['description' => 'Indicates whether the playbook is available. Valid values:'."\n"
+                                                                ."\n"
+                                                                .'- 1: Available.'."\n"
+                                                                .'- 0: Unavailable.', 'type' => 'string', 'example' => '1', 'title' => ''],
+                                                            'UnAvailableCode' => ['description' => 'The code that indicates why the playbook is unavailable. Valid values:'."\n"
+                                                                ."\n"
+                                                                .'- PARAM_INVALID: The input parameters are invalid. '."\n"
+                                                                .'- NO_INGESTION: The corresponding product is not connected.', 'type' => 'string', 'example' => 'PARAM_INVALID', 'title' => ''],
+                                                            'DisposeStatus' => ['type' => 'string', 'description' => '', 'title' => '', 'example' => ''],
+                                                            'ErrorMessage' => ['type' => 'string', 'description' => '', 'title' => '', 'example' => ''],
+                                                        ],
+                                                        'description' => '',
+                                                        'title' => '',
+                                                        'example' => '',
+                                                    ],
+                                                    'example' => '[{"name":"云安全中心-云服务器安全","code":"1"}]',
                                                 ],
+                                                'AlertNum' => ['title' => '', 'description' => 'The number of alerts associated with the entity.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'],
                                             ],
+                                            'description' => '',
+                                            'title' => '',
+                                            'example' => '',
                                         ],
+                                        'example' => '',
                                     ],
                                 ],
                                 'example' => '123456',
                             ],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'Retrieve entities and playbooks for disposition',
+            'summary' => 'Retrieves the list of entities that require disposition and the list of playbooks.',
+            'changeSet' => [
+                ['createdAt' => '2024-11-04T11:26:51.000Z', 'description' => 'Request parameters changed, Response parameters changed'],
+                ['createdAt' => '2024-04-17T12:43:23.000Z', 'description' => 'Request parameters changed'],
+                ['createdAt' => '2024-01-18T11:56:37.000Z', 'description' => 'Error codes changed, Response parameters changed'],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n  \\"Data\\": {\\n    \\"PageInfo\\": {\\n      \\"CurrentPage\\": 1,\\n      \\"PageSize\\": 10,\\n      \\"TotalCount\\": 100\\n    },\\n    \\"ResponseData\\": [\\n      {\\n        \\"Id\\": 0,\\n        \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n        \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n        \\"Aliuid\\": 0,\\n        \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n        \\"AlertUuid\\": \\"sas_71e24437d2797ce8fc59692905a4****\\",\\n        \\"AlertNum\\": 1,\\n        \\"EventNum\\": 1,\\n        \\"CloudCode\\": \\"aliyun\\",\\n        \\"EntityType\\": \\"ip\\",\\n        \\"EntityName\\": \\"123.123.123.123\\",\\n        \\"EntityInfo\\": \\"{\\\\\\"file_path\\\\\\": \\\\\\"c:/www/leixi.jsp\\\\\\",\\\\\\"file_hash\\\\\\": \\\\\\"aa0ca926ad948cd820e0a3d9a18c****\\\\\\",\\\\\\"host_uuid\\\\\\": \\\\\\"efed2cf7-0b77-45d9-a97b-d2cf246b****\\\\\\",\\\\\\"malware_type\\\\\\": \\\\\\"${aliyun.siem.sas.alert_tag.webshell}\\\\\\",\\\\\\"host_name\\\\\\": \\\\\\"launch-advisor-2023****\\\\\\"}\\",\\n        \\"SubUserId\\": 0,\\n        \\"EntityId\\": \\"12345****\\",\\n        \\"EntityUuid\\": \\"8087b3e4aa6862852c100c8738cf****\\",\\n        \\"MalwareType\\": \\"aliyun.siem.sas.alert_tag.webshell\\",\\n        \\"IsAsset\\": \\"1\\",\\n        \\"IsMalware\\": \\"0\\",\\n        \\"Tags\\": \\"[{\\\\\\"tagKey1\\\\\\":\\\\\\"tagValue1\\\\\\"},{\\\\\\"tagKey2\\\\\\":\\\\\\"tagValue2\\\\\\"}]\\",\\n        \\"AgentDisposalMethod\\": \\"delete_file\\",\\n        \\"AgentDisposalPlaybookUuid\\": \\"12XAD-SFQ-WAF-2ca2\\",\\n        \\"AgentDisposalSuggestion\\": \\"{}\\",\\n        \\"AgentConfidence\\": \\"85\\"\\n      }\\n    ]\\n  }\\n}","type":"json"}]',
-            'title' => 'ListEntities',
-        ],
-        'DescribeEntityInfo' => [
-            'summary' => 'Queries the details of an entity.',
-            'methods' => [
-                'get',
-                'post',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeDisposeAndPlaybook'],
+                ],
             ],
-            'schemes' => [
-                'https',
-                'http',
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DescribeDisposeAndPlaybook',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n  \\"Data\\": {\\n    \\"PageInfo\\": {\\n      \\"CurrentPage\\": 1,\\n      \\"PageSize\\": 10,\\n      \\"TotalCount\\": 100\\n    },\\n    \\"ResponseData\\": [\\n      {\\n        \\"EntityId\\": 0,\\n        \\"EntityType\\": \\"ip\\",\\n        \\"OpcodeMap\\": {\\n          \\"key\\": \\"{\\\\\\"7\\\\\\",\\\\\\"2\\\\\\"}\\"\\n        },\\n        \\"OpcodeSet\\": [\\n          \\"7\\"\\n        ],\\n        \\"EntityInfo\\": {\\n          \\"file_path\\": \\"c:/www/leixi.jsp\\",\\n          \\"file_hash\\": \\"aa0ca926ad948cd820e0a3d9a18c****\\",\\n          \\"host_uuid\\": \\"efed2cf7-0b77-45d9-a97b-d2cf246b****\\",\\n          \\"malware_type\\": \\"${aliyun.siem.sas.alert_tag.webshell}\\",\\n          \\"host_name\\": \\"launch-advisor-2023****\\"\\n        },\\n        \\"Dispose\\": \\"192.168.*.*\\",\\n        \\"Scope\\": [\\n          \\"[127608589417****]\\"\\n        ],\\n        \\"PlaybookList\\": [\\n          {\\n            \\"OpCode\\": \\"7\\",\\n            \\"OpLevel\\": \\"2\\",\\n            \\"Description\\": \\"WafBlockIP\\",\\n            \\"DisplayName\\": \\"WafBlockIP\\",\\n            \\"TaskConfig\\": \\"{\\\\\\"opCode\\\\\\":\\\\\\"3\\\\\\"}\\",\\n            \\"Name\\": \\"kill_process_isolate_file\\",\\n            \\"Uuid\\": \\"kill_process_isolate_file\\",\\n            \\"ParamConfig\\": [\\n              \\"{\\\\n\\\\t\\\\\\"ParamConfig\\\\\\": [\\\\n\\\\t\\\\t{\\\\n\\\\t\\\\t\\\\t\\\\\\"Field\\\\\\": \\\\\\"dispose\\\\\\",\\\\n\\\\t\\\\t\\\\t\\\\\\"Necessary\\\\\\": true,\\\\n\\\\t\\\\t\\\\t\\\\\\"CheckField\\\\\\": \\\\\\"[{&quot;fieldPath&quot;:&quot;$.ip&quot;,&quot;fieldName&quot;:&quot;ip&quot;}]\\\\\\"\\\\n\\\\t\\\\t},\\\\n\\\\t\\\\t{\\\\n\\\\t\\\\t\\\\t\\\\\\"Field\\\\\\": \\\\\\"alert\\\\\\",\\\\n\\\\t\\\\t\\\\t\\\\\\"Necessary\\\\\\": true,\\\\n\\\\t\\\\t\\\\t\\\\\\"CheckField\\\\\\": \\\\\\"[{&quot;fieldPath&quot;:&quot;$.host_uuid&quot;,&quot;fieldName&quot;:&quot;host_uuid&quot;}]\\\\\\"\\\\n\\\\t\\\\t},\\\\n\\\\t\\\\t{\\\\n\\\\t\\\\t\\\\t\\\\\\"Field\\\\\\": \\\\\\"scope\\\\\\",\\\\n\\\\t\\\\t\\\\t\\\\\\"Necessary\\\\\\": true,\\\\n\\\\t\\\\t\\\\t\\\\\\"Value\\\\\\": \\\\\\"$.main_user_id\\\\\\"\\\\n\\\\t\\\\t},\\\\n\\\\t\\\\t{\\\\n\\\\t\\\\t\\\\t\\\\\\"Field\\\\\\": \\\\\\"startTime\\\\\\",\\\\n\\\\t\\\\t\\\\t\\\\\\"Necessary\\\\\\": true\\\\n\\\\t\\\\t},\\\\n\\\\t\\\\t{\\\\n\\\\t\\\\t\\\\t\\\\\\"Field\\\\\\": \\\\\\"endTime\\\\\\",\\\\n\\\\t\\\\t\\\\t\\\\\\"Necessary\\\\\\": true\\\\n\\\\t\\\\t}\\\\n\\\\t]\\\\n}\\"\\n            ],\\n            \\"WafPlaybook\\": false,\\n            \\"Available\\": \\"1\\",\\n            \\"UnAvailableCode\\": \\"PARAM_INVALID\\",\\n            \\"DisposeStatus\\": \\"\\",\\n            \\"ErrorMessage\\": \\"\\"\\n          }\\n        ],\\n        \\"AlertNum\\": 1\\n      }\\n    ]\\n  }\\n}","type":"json"}]',
+        ],
+        'DescribeDisposeStrategyPlaybook' => [
+            'summary' => 'Retrieves the list of playbooks used in a disposal policy.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['https', 'http'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'get',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-            ],
+            'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
-                    'name' => 'EntityId',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '实体逻辑ID。',
-                        'description' => 'The logical ID of the entity.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '12345',
-                    ],
-                ],
-                [
-                    'name' => 'EntityIdentity',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '实体特征值，可以对处置实体进行模糊搜索。',
-                        'description' => 'The feature value of the entity. Fuzzy match is supported.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'test22.php',
-                    ],
-                ],
-                [
-                    'name' => 'IncidentUuid',
+                    'name' => 'StartTime',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '事件全局唯一ID。',
-                        'description' => 'The UUID of the event.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '85ea4241-798f-4684-a876-65d4f0c3****',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The start time of the query. This value is a UNIX timestamp in milliseconds.', 'type' => 'integer', 'format' => 'int64', 'required' => true, 'example' => '1577808000000'],
                 ],
                 [
-                    'name' => 'SophonTaskId',
+                    'name' => 'EndTime',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => 'soar处置策略ID。',
-                        'description' => 'The ID of the SOAR handling policy.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '577bbf90-a770-44a7-8154-586aa2d318fa',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The end time of the query. This value is a UNIX timestamp in milliseconds.', 'type' => 'integer', 'format' => 'int64', 'required' => true, 'example' => '1577808000000'],
                 ],
                 [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['description' => 'The view type.'."\n"
+                        ."\n"
+                        .'- 0: The view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: The view of all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member. An administrator can use this parameter to switch to the member\'s view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region of the Data Management center for Threat Analysis. Select a region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: The assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: The assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'BaseResponse<EventEntityInfo>',
-                        'description' => 'BaseResponse'."\n",
+                        'title' => 'BaseResponse<List<StrategyPlaybookList>>',
+                        'description' => 'BaseResponse\\<List>',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'object',
-                                'properties' => [
-                                    'EntityId' => [
-                                        'title' => '实体逻辑id。',
-                                        'description' => 'The logical ID of the entity.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int64',
-                                        'example' => '12345',
-                                    ],
-                                    'EntityType' => [
-                                        'title' => '实体类型，ip:ip, 域名：domain， url：url， 进程：process， 文件：file， 主机：host。',
-                                        'description' => 'The type of the entity. Valid values:'."\n"
-                                            ."\n"
-                                            .'*   ip'."\n"
-                                            .'*   domain'."\n"
-                                            .'*   url'."\n"
-                                            .'*   process'."\n"
-                                            .'*   file'."\n"
-                                            .'*   host'."\n",
-                                        'type' => 'string',
-                                        'example' => 'ip',
-                                    ],
-                                    'EntityInfo' => [
-                                        'title' => '实体信息。',
-                                        'description' => 'The information about the entry.'."\n",
-                                        'type' => 'object',
-                                        'example' => '{ location: "xian", net_connect_dir: "in", malware_type: "${aliyun.siem.sas.alert_tag.login_unusual_account}" }',
-                                    ],
-                                    'TipInfo' => [
-                                        'title' => '威胁情报信息。',
-                                        'description' => 'The information about the risk Intelligence.'."\n",
-                                        'type' => 'object',
-                                        'example' => '{'."\n"
-                                            .'      "Ip": {'."\n"
-                                            .'            "queryHot": "0",'."\n"
-                                            .'            "country": "China",'."\n"
-                                            .'            "province": "shanxi",'."\n"
-                                            .'            "ip": "221.11.XX.XXX",'."\n"
-                                            .'            "asn": "4837",'."\n"
-                                            .'            "asn_label": "CHINAXXX-Backbone - CHINA UNICOM ChinaXXX Backbone, CN"'."\n"
-                                            .'      }'."\n"
-                                            .'}',
+                                'title' => '',
+                                'description' => 'The data returned.',
+                                'type' => 'array',
+                                'items' => [
+                                    'type' => 'object',
+                                    'properties' => [
+                                        'PlaybookName' => ['title' => '', 'description' => 'The unique name of the playbook.', 'type' => 'string', 'example' => 'WafBlockIP'],
+                                        'PlaybookUuid' => ['title' => '', 'description' => 'The UUID of the playbook.', 'type' => 'string', 'example' => 'system_aliyun_clb_process_book'],
                                     ],
+                                    'description' => '',
+                                    'title' => '',
+                                    'example' => '',
                                 ],
                                 'example' => '123456',
                             ],
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true：成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
-                            ],
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The request was successful.'."\n"
+                                ."\n"
+                                .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The returned message.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'DescribeDisposeStrategyPlaybook',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:43:22.000Z', 'description' => 'Error codes changed, Request parameters changed'],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"EntityId\\": 12345,\\n    \\"EntityType\\": \\"ip\\",\\n    \\"EntityInfo\\": {\\n      \\"test\\": \\"test\\",\\n      \\"test2\\": 1\\n    },\\n    \\"TipInfo\\": {\\n      \\"Ip\\": {\\n        \\"queryHot\\": \\"0\\",\\n        \\"country\\": \\"China\\",\\n        \\"province\\": \\"shanxi\\",\\n        \\"ip\\": \\"221.11.XX.XXX\\",\\n        \\"asn\\": \\"4837\\",\\n        \\"asn_label\\": \\"CHINAXXX-Backbone - CHINA UNICOM ChinaXXX Backbone, CN\\"\\n      }\\n    }\\n  },\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
-            'title' => 'DescribeEntityInfo',
-        ],
-        'PostEventDisposeAndWhiteruleList' => [
-            'summary' => 'Submits event handling information.',
-            'methods' => [
-                'get',
-                'post',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeDisposeStrategyPlaybook'],
+                ],
             ],
-            'schemes' => [
-                'http',
-                'https',
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DescribeDisposeStrategyPlaybook',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"PlaybookName\\": \\"WafBlockIP\\",\\n      \\"PlaybookUuid\\": \\"system_aliyun_clb_process_book\\"\\n    }\\n  ],\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
+        ],
+        'DescribeEntityInfo' => [
+            'summary' => 'Retrieves the details of an entity.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['https', 'http'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'write',
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'create',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsasAFG0OH',
-                ],
-            ],
+            'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
-                    'name' => 'IncidentUuid',
+                    'name' => 'EntityId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '事件id。',
-                        'description' => 'The UUID of the event.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '85ea4241-798f-4684-a876-65d4f0c3****',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The logical ID of the entity.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '12345'],
                 ],
                 [
-                    'name' => 'Status',
+                    'name' => 'EntityIdentity',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '事件状态。  取值：'."\n"
-                            .'- 0:未处理 '."\n"
-                            .'-1:处理中 '."\n"
-                            .'-5：处理失败 '."\n"
-                            .'-10:已处理',
-                        'description' => 'The status of the event. Valid values:'."\n"
-                            ."\n"
-                            .'*   0: unhandled'."\n"
-                            .'*   1: handing'."\n"
-                            .'*   5: handling failed'."\n"
-                            .'*   10: handled'."\n",
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '0',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The feature value of the entity. You can perform a fuzzy search for the entity.', 'type' => 'string', 'required' => false, 'example' => 'test22.php'],
                 ],
                 [
-                    'name' => 'Remark',
+                    'name' => 'IncidentUuid',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '事件备注。',
-                        'description' => 'The remarks of the event.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'dealed',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The globally unique UUID of the event.', 'type' => 'string', 'required' => false, 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'],
                 ],
                 [
-                    'name' => 'EventDispose',
+                    'name' => 'SophonTaskId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '事件处置配置 json对象。',
-                        'description' => 'The configuration of event handling. The value is a JSON object.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '['."\n"
-                            .'      {'."\n"
-                            .'            "playbookName": "WafBlockIP",'."\n"
-                            .'            "entityId": "104466118",'."\n"
-                            .'            "scope": ['."\n"
-                            .'                  "176618589410****"'."\n"
-                            .'            ],'."\n"
-                            .'            "startTime": 1604168946281,'."\n"
-                            .'            "endTime": 1614168946281'."\n"
-                            .'      },'."\n"
-                            .'      {'."\n"
-                            .'            "playbookName": "WafBlockIP",'."\n"
-                            .'            "entityId": "104466118",'."\n"
-                            .'            "scope": ['."\n"
-                            .'                  {'."\n"
-                            .'                        "instanceId": "waf-cn-n6w1oy1****",'."\n"
-                            .'                        "domains": ['."\n"
-                            .'                              "lmfip.wafqax.***"'."\n"
-                            .'                        ]'."\n"
-                            .'                  }'."\n"
-                            .'            ],'."\n"
-                            .'            "startTime": 1604168946281,'."\n"
-                            .'            "endTime": 1614168946281'."\n"
-                            .'      }'."\n"
-                            .']',
-                    ],
-                ],
-                [
-                    'name' => 'ReceiverInfo',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '告警接收人配置 json对象',
-                        'description' => 'The configuration of the alert recipient. The value is a JSON object.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '{'."\n"
-                            .'      "messageTitle": "test",'."\n"
-                            .'      "receiver": "xiaowang",'."\n"
-                            .'      "channel": "message"'."\n"
-                            .'}',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The ID of the SOAR response policy.', 'type' => 'string', 'required' => false, 'example' => '577bbf90-a770-44a7-8154-586aa2d318fa'],
                 ],
                 [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['description' => 'The view type.'."\n"
+                        ."\n"
+                        .'- 0: the view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: the view of all accounts that belong to the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member. The administrator can use this ID to switch to the view of this member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
-                ],
-                [
-                    'name' => 'ThreatLevel',
-                    'in' => 'formData',
-                    'schema' => [
-                        'type' => 'string',
-                    ],
-                ],
-                [
-                    'name' => 'Owner',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '事件责任人账号uid',
-                        'type' => 'string',
-                        'example' => '1234567890xxxxxx',
-                    ],
-                ],
-                [
-                    'name' => 'ResponseSource',
-                    'in' => 'formData',
-                    'schema' => [
-                        'type' => 'string',
-                    ],
-                ],
-                [
-                    'name' => 'DisposeStrategyIds',
-                    'in' => 'formData',
-                    'schema' => [
-                        'type' => 'string',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region of the Data Management center. Select a region based on the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'BaseResponse<String>',
-                        'description' => 'BaseResponse'."\n",
+                        'title' => 'BaseResponse<EventEntityInfo>',
+                        'description' => 'BaseResponse',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'string',
+                                'title' => '',
+                                'description' => 'The data returned.',
+                                'type' => 'object',
+                                'properties' => [
+                                    'EntityId' => ['title' => '', 'description' => 'The logical ID of the entity.', 'type' => 'integer', 'format' => 'int64', 'example' => '12345'],
+                                    'EntityType' => ['title' => '', 'description' => 'The type of the entity. Valid values:'."\n"
+                                        ."\n"
+                                        .'- ip: IP address'."\n"
+                                        ."\n"
+                                        .'- domain: domain name'."\n"
+                                        ."\n"
+                                        .'- url: URL'."\n"
+                                        ."\n"
+                                        .'- process: process'."\n"
+                                        ."\n"
+                                        .'- file: file'."\n"
+                                        ."\n"
+                                        .'- host: host', 'type' => 'string', 'example' => 'ip'],
+                                    'EntityInfo' => ['title' => '', 'description' => 'The information about the entity.', 'type' => 'object', 'example' => '{ location: "xian", net_connect_dir: "in", malware_type: "${aliyun.siem.sas.alert_tag.login_unusual_account}" }'],
+                                    'TipInfo' => ['title' => '', 'description' => 'The threat intelligence information.', 'type' => 'object', 'example' => '{'."\n"
+                                        .'      "Ip": {'."\n"
+                                        .'            "queryHot": "0",'."\n"
+                                        .'            "country": "China",'."\n"
+                                        .'            "province": "shanxi",'."\n"
+                                        .'            "ip": "221.11.XX.XXX",'."\n"
+                                        .'            "asn": "4837",'."\n"
+                                        .'            "asn_label": "CHINAXXX-Backbone - CHINA UNICOM ChinaXXX Backbone, CN"'."\n"
+                                        .'      }'."\n"
+                                        .'}'],
+                                ],
                                 'example' => '123456',
                             ],
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true：成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
-                            ],
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The request was successful.'."\n"
+                                ."\n"
+                                .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The message returned for the request.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'DescribeEntityInfo',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:43:24.000Z', 'description' => 'Error codes changed, Request parameters changed'],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": \\"123456\\",\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
-            'title' => 'PostEventDisposeAndWhiteruleList',
-        ],
-        'DescribeWafScope' => [
-            'summary' => 'Queries the protected domain names of the WAF instance for a user to which an entity belongs.',
-            'methods' => [
-                'get',
-                'post',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeEntityInfo'],
+                ],
             ],
-            'schemes' => [
-                'https',
-                'http',
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DescribeEntityInfo',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"EntityId\\": 12345,\\n    \\"EntityType\\": \\"ip\\",\\n    \\"EntityInfo\\": {\\n      \\"test\\": \\"test\\",\\n      \\"test2\\": 1\\n    },\\n    \\"TipInfo\\": {\\n      \\"Ip\\": {\\n        \\"queryHot\\": \\"0\\",\\n        \\"country\\": \\"China\\",\\n        \\"province\\": \\"shanxi\\",\\n        \\"ip\\": \\"221.11.XX.XXX\\",\\n        \\"asn\\": \\"4837\\",\\n        \\"asn_label\\": \\"CHINAXXX-Backbone - CHINA UNICOM ChinaXXX Backbone, CN\\"\\n      }\\n    }\\n  },\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
+        ],
+        'DescribeEventCountByThreatLevel' => [
+            'summary' => 'You can obtain the count for each event type.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
+            'operationType' => 'read',
             'deprecated' => false,
             'systemTags' => [
                 'operationType' => 'get',
                 'riskType' => 'none',
                 'chargeType' => 'free',
+                'abilityTreeNodes' => ['FEATUREsasAFG0OH'],
             ],
             'parameters' => [
                 [
-                    'name' => 'EntityId',
+                    'name' => 'StartTime',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '实体ID。',
-                        'description' => 'The ID of the entity.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '20617784',
-                    ],
+                    'schema' => ['description' => 'Start time of the query, in milliseconds.', 'type' => 'integer', 'format' => 'int64', 'example' => '1577808000000', 'title' => '', 'required' => false],
+                ],
+                [
+                    'name' => 'EndTime',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'End time of the query, in milliseconds.', 'type' => 'integer', 'format' => 'int64', 'example' => '1577808000000', 'title' => '', 'required' => false],
                 ],
                 [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['description' => 'View type.'."\n"
+                        ."\n"
+                        .'- 0: View for the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: View for all accounts in your enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'Resource directory member account ID.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['description' => 'Region where the Data Management Center for threat analysis is located. Select a region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Assets are in the Chinese mainland or Hong Kong (China).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Assets are outside China.', 'type' => 'string', 'example' => 'cn-hangzhou', 'title' => '', 'required' => false],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'BaseResponse<List<WafScope>>',
-                        'description' => 'BaseResponse\\<List>'."\n",
+                        'title' => 'PlainResponse<EventCounter>',
+                        'description' => 'PlainResponse\\<eventcounter>\\</eventcounter>',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'array',
-                                'items' => [
-                                    'type' => 'object',
-                                    'properties' => [
-                                        'InstanceId' => [
-                                            'title' => 'waf实例ID。',
-                                            'description' => 'The ID of the WAF instance.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'waf-cn-tl123ast****',
-                                        ],
-                                        'Aliuid' => [
-                                            'title' => 'siem主账号ID。',
-                                            'description' => 'The ID of the Alibaba Cloud account in SIEM.'."\n",
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '127608589417****',
-                                        ],
-                                        'Domains' => [
-                                            'title' => 'waf实例下的防护的域名列表。',
-                                            'description' => 'The domain names that are protected by the WAF instance.'."\n",
-                                            'type' => 'array',
-                                            'items' => [
-                                                'description' => 'The domain name that is protected by the WAF instance.'."\n",
-                                                'type' => 'string',
-                                                'example' => '[123***.com, 456***.com]',
+                                'title' => '',
+                                'description' => 'Response data.',
+                                'type' => 'object',
+                                'properties' => [
+                                    'EventNum' => ['description' => 'Total number of events.', 'type' => 'integer', 'format' => 'int64', 'example' => '100', 'title' => ''],
+                                    'UndealEventNum' => ['description' => 'Number of unhandled events.', 'type' => 'integer', 'format' => 'int64', 'example' => '75', 'title' => ''],
+                                    'HighLevelEventNum' => ['description' => 'Number of high-risk events.', 'type' => 'integer', 'format' => 'int64', 'example' => '20', 'title' => ''],
+                                    'MediumLevelEventNum' => ['description' => 'Number of medium-risk events.', 'type' => 'integer', 'format' => 'int64', 'example' => '3', 'title' => ''],
+                                    'LowLevelEventNum' => ['description' => 'Number of low-risk events.', 'type' => 'integer', 'format' => 'int64', 'example' => '52', 'title' => ''],
+                                    'SeriousLevelEventNum' => ['description' => 'Number of critical events.', 'type' => 'integer', 'format' => 'int64', 'example' => '0', 'title' => ''],
+                                    'InfoLevelEventNum' => ['description' => 'Number of informational events.', 'type' => 'integer', 'format' => 'int64', 'example' => '0', 'title' => ''],
+                                    'EventDailyNum' => [
+                                        'type' => 'array',
+                                        'items' => [
+                                            'type' => 'object',
+                                            'properties' => [
+                                                'Date' => ['description' => 'Date.', 'type' => 'string', 'example' => '2025-10-06', 'title' => ''],
+                                                'EventNum' => ['description' => 'Total number of security events.', 'type' => 'integer', 'format' => 'int64', 'example' => '100', 'title' => ''],
+                                                'UndealEventNum' => ['description' => 'Number of unhandled security events.', 'type' => 'integer', 'format' => 'int64', 'example' => '34', 'title' => ''],
                                             ],
-                                            'example' => '[123.com, 456.com]',
+                                            'description' => '',
+                                            'title' => '',
+                                            'example' => '',
                                         ],
+                                        'description' => 'Daily event statistics.',
+                                        'title' => '',
+                                        'example' => '',
                                     ],
                                 ],
                                 'example' => '123456',
                             ],
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true：成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
-                            ],
+                            'Success' => ['description' => 'Indicates whether the request succeeded. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The request succeeded.'."\n"
+                                ."\n"
+                                .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true', 'title' => ''],
+                            'Code' => ['description' => 'HTTP status code.', 'type' => 'integer', 'format' => 'int32', 'example' => '200', 'title' => ''],
+                            'Message' => ['description' => 'Response message.', 'type' => 'string', 'example' => 'success', 'title' => ''],
+                            'RequestId' => ['description' => 'Request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', 'title' => ''],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"EventNum\\": 100,\\n    \\"UndealEventNum\\": 75,\\n    \\"HighLevelEventNum\\": 20,\\n    \\"MediumLevelEventNum\\": 3,\\n    \\"LowLevelEventNum\\": 52,\\n    \\"SeriousLevelEventNum\\": 0,\\n    \\"InfoLevelEventNum\\": 0,\\n    \\"EventDailyNum\\": [\\n      {\\n        \\"Date\\": \\"2025-10-06\\",\\n        \\"EventNum\\": 100,\\n        \\"UndealEventNum\\": 34\\n      }\\n    ]\\n  },\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
+            'title' => 'DescribeEventCountByThreatLevel',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:43:22.000Z', 'description' => 'Error codes changed, Request parameters changed'],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"InstanceId\\": \\"waf-cn-tl123ast****\\",\\n      \\"Aliuid\\": 0,\\n      \\"Domains\\": [\\n        \\"[123***.com, 456***.com]\\"\\n      ]\\n    }\\n  ],\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
-            'title' => 'DescribeWafScope',
-        ],
-        'DescribeEventDispose' => [
-            'summary' => 'Queries the handling policies of a historical event.',
-            'methods' => [
-                'get',
-                'post',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeEventCountByThreatLevel'],
+                ],
             ],
-            'schemes' => [
-                'https',
-                'http',
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DescribeEventCountByThreatLevel',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+        ],
+        'DescribeEventDispose' => [
+            'methods' => ['get', 'post'],
+            'schemes' => ['https', 'http'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'get',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-            ],
+            'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
                     'name' => 'IncidentUuid',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '事件ID。',
-                        'description' => 'The UUID of the event.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '85ea4241-798f-4684-a876-65d4f0c3****',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The globally unique UUID of the event.', 'type' => 'string', 'required' => false, 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'],
                 ],
                 [
                     'name' => 'CurrentPage',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '列表当前页号， 大于等于1。',
-                        'description' => 'The page number. Pages start from page 1.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'minimum' => '1',
-                        'example' => '1',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The number of the page to return. The value must be greater than or equal to 1.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'minimum' => '1', 'example' => '1'],
                 ],
                 [
                     'name' => 'PageSize',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '列表每页条数， 最大不超过100。',
-                        'description' => 'The number of entries per page. Maximum value: 500.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'maximum' => '500',
-                        'minimum' => '1',
-                        'example' => '10',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The number of entries to return on each page. The maximum value is 500.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'maximum' => '500', 'minimum' => '1', 'example' => '10'],
                 ],
                 [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['description' => 'The view type.'."\n"
+                        ."\n"
+                        .'- 0: The view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: The view of all accounts that belong to the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member. An administrator can use this parameter to switch to the perspective of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The data management center of the threat analysis feature. Specify this parameter based on the region in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions inside China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region where the Data Management center of Threat Analysis is located. Select the region based on the region where your assets are deployed. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are deployed in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are deployed in regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'BaseResponse<EventDisposeConfig>',
-                        'description' => 'BaseResponse'."\n",
+                        'description' => 'BaseResponse',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
+                                'title' => '',
+                                'description' => 'The data returned.',
                                 'type' => 'object',
                                 'properties' => [
-                                    'Status' => [
-                                        'title' => '事件状态。  0:未处理  1:处理中 5：处理失败 10:已处理。',
-                                        'description' => 'The status of the event. Valid values:'."\n"
-                                            ."\n"
-                                            .'*   0: not handled'."\n"
-                                            .'*   1: handing'."\n"
-                                            .'*   5: handling failed'."\n"
-                                            .'*   10: handled'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '0',
-                                    ],
-                                    'Remark' => [
-                                        'title' => '事件备注。',
-                                        'description' => 'The description of the event.'."\n",
-                                        'type' => 'string',
-                                        'example' => 'dealed',
-                                    ],
+                                    'Status' => ['title' => '', 'description' => 'The status of the event. Valid values:'."\n"
+                                        ."\n"
+                                        .'- 0: unhandled'."\n"
+                                        ."\n"
+                                        .'- 1: handling'."\n"
+                                        ."\n"
+                                        .'- 5: failed'."\n"
+                                        ."\n"
+                                        .'- 10: handled', 'type' => 'integer', 'format' => 'int32', 'example' => '0'],
+                                    'Remark' => ['title' => '', 'description' => 'The remarks on the event.', 'type' => 'string', 'example' => 'dealed'],
                                     'EventDispose' => [
-                                        'title' => '事件处置配置 json对象。',
-                                        'description' => 'An array consisting of JSON objects that are configured for event handling.'."\n",
+                                        'title' => '',
+                                        'description' => 'The JSON object of the event handling configuration.',
                                         'type' => 'array',
-                                        'items' => [
-                                            'description' => 'The JSON object that is configured for event handling.'."\n",
-                                            'type' => 'any',
-                                            'example' => '{ playbookName: "WafBlockIP", sophonTaskId: "400442a5-4f98-45ed-97db-5ab117eb0b8f", … }',
-                                        ],
+                                        'items' => ['description' => 'The JSON object of the event handling configuration.', 'type' => 'any', 'title' => '', 'example' => '{ playbookName: "WafBlockIP", sophonTaskId: "400442a5-4f98-45ed-97db-5ab117eb0b8f", … }'],
                                         'example' => '{ playbookName: "使用安全组封禁入方向IP", sophonTaskId: "400442a5-4f98-45ed-97db-5ab117eb0b8f", … }',
                                     ],
                                     'ReceiverInfo' => [
-                                        'title' => '告警接收人配置 json对象',
-                                        'description' => 'The JSON object that is configured for an alert recipient.'."\n",
+                                        'title' => '',
+                                        'description' => 'The JSON object of the alert recipient configuration.',
                                         'type' => 'object',
                                         'properties' => [
-                                            'Id' => [
-                                                'title' => '事件处置结果接收人记录ID。',
-                                                'description' => 'The ID of the recipient who receives the event handling result.'."\n",
-                                                'type' => 'integer',
-                                                'format' => 'int64',
-                                                'example' => '123',
-                                            ],
-                                            'GmtCreate' => [
-                                                'title' => '创建时间。',
-                                                'description' => 'The creation time.'."\n",
-                                                'type' => 'string',
-                                                'example' => '2021-01-06 16:37:29',
-                                            ],
-                                            'GmtModified' => [
-                                                'title' => '修改时间。',
-                                                'description' => 'The modification time.'."\n",
-                                                'type' => 'string',
-                                                'example' => '2021-01-06 16:37:29',
-                                            ],
-                                            'IncidentUuid' => [
-                                                'title' => '事件ID。',
-                                                'description' => 'The UUID of the event.'."\n",
-                                                'type' => 'string',
-                                                'example' => '85ea4241-798f-4684-a876-65d4f0c3****',
-                                            ],
-                                            'MessageTitle' => [
-                                                'title' => '消息title。',
-                                                'description' => 'The message title.'."\n",
-                                                'type' => 'string',
-                                                'example' => 'siem event dealed message',
-                                            ],
-                                            'Receiver' => [
-                                                'title' => '接收人联系方式。',
-                                                'description' => 'The contact information of the recipient.'."\n",
-                                                'type' => 'string',
-                                                'example' => '138xxxxxx',
-                                            ],
-                                            'Channel' => [
-                                                'title' => '联系方式渠道。 取值：'."\n"
-                                                    .'- message:短信 '."\n"
-                                                    .'- mail：邮件',
-                                                'description' => 'The channel of the contact information. Valid values:'."\n"
-                                                    ."\n"
-                                                    .'*   message'."\n"
-                                                    .'*   mail'."\n",
-                                                'type' => 'string',
-                                                'example' => 'message',
-                                            ],
-                                            'Status' => [
-                                                'title' => '发送状态 0:未发送 1:已发送',
-                                                'description' => 'Indicates whether the message is sent. Valid values:'."\n"
-                                                    ."\n"
-                                                    .'*   0: not sent'."\n"
-                                                    .'*   1: sent'."\n",
-                                                'type' => 'integer',
-                                                'format' => 'int32',
-                                                'example' => '1',
-                                            ],
+                                            'Id' => ['title' => '', 'description' => 'The record ID of the recipient for the event handling result.', 'type' => 'integer', 'format' => 'int64', 'example' => '123'],
+                                            'GmtCreate' => ['title' => '', 'description' => 'The time when the record was created.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'],
+                                            'GmtModified' => ['title' => '', 'description' => 'The time when the record was last modified.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'],
+                                            'IncidentUuid' => ['title' => '', 'description' => 'The globally unique UUID of the event.', 'type' => 'string', 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'],
+                                            'MessageTitle' => ['title' => '', 'description' => 'The title of the message.', 'type' => 'string', 'example' => 'siem event dealed message'],
+                                            'Receiver' => ['title' => '', 'description' => 'The contact information of the recipient.', 'type' => 'string', 'example' => '138xxxxxx'],
+                                            'Channel' => ['title' => '', 'description' => 'The channel to send the notification. Valid values:'."\n"
+                                                ."\n"
+                                                .'- message: text message'."\n"
+                                                ."\n"
+                                                .'- mail: email', 'type' => 'string', 'example' => 'message'],
+                                            'Status' => ['title' => '', 'description' => 'The sending status of the notification. Valid values:'."\n"
+                                                ."\n"
+                                                .'- 0: not sent'."\n"
+                                                ."\n"
+                                                .'- 1: sent', 'type' => 'integer', 'format' => 'int32', 'example' => '1'],
                                         ],
+                                        'example' => '',
                                     ],
                                 ],
                                 'example' => '123456',
                             ],
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true：成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code that is returned.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
-                            ],
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- true'."\n"
+                                ."\n"
+                                .'- false', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The message returned for the request.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"Status\\": 0,\\n    \\"Remark\\": \\"dealed\\",\\n    \\"EventDispose\\": [\\n      \\"{ playbookName: \\\\\\"WafBlockIP\\\\\\", sophonTaskId: \\\\\\"400442a5-4f98-45ed-97db-5ab117eb0b8f\\\\\\", … }\\"\\n    ],\\n    \\"ReceiverInfo\\": {\\n      \\"Id\\": 123,\\n      \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n      \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n      \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n      \\"MessageTitle\\": \\"siem event dealed message\\",\\n      \\"Receiver\\": \\"138xxxxxx\\",\\n      \\"Channel\\": \\"message\\",\\n      \\"Status\\": 1\\n    }\\n  },\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
+            'staticInfo' => ['returnType' => 'synchronous'],
             'title' => 'DescribeEventDispose',
-        ],
-        'DescribeEventCountByThreatLevel' => [
-            'summary' => 'Queries the number of events by type.',
-            'methods' => [
-                'get',
-                'post',
+            'summary' => 'Queries the policy handling history for an event.',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:43:24.000Z', 'description' => 'Error codes changed, Request parameters changed'],
             ],
-            'schemes' => [
-                'http',
-                'https',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeEventDispose'],
+                ],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DescribeEventDispose',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"Status\\": 0,\\n    \\"Remark\\": \\"dealed\\",\\n    \\"EventDispose\\": [\\n      \\"{ playbookName: \\\\\\"WafBlockIP\\\\\\", sophonTaskId: \\\\\\"400442a5-4f98-45ed-97db-5ab117eb0b8f\\\\\\", … }\\"\\n    ],\\n    \\"ReceiverInfo\\": {\\n      \\"Id\\": 123,\\n      \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n      \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n      \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n      \\"MessageTitle\\": \\"siem event dealed message\\",\\n      \\"Receiver\\": \\"138xxxxxx\\",\\n      \\"Channel\\": \\"message\\",\\n      \\"Status\\": 1\\n    }\\n  },\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
+        ],
+        'DescribeImportedLogCount' => [
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
@@ -7937,1123 +5642,544 @@
                 'operationType' => 'get',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsasAFG0OH',
-                ],
+                'abilityTreeCode' => '195544',
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
-                    'name' => 'StartTime',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '查询开始时间, 单位毫秒。',
-                        'description' => 'The beginning of the time range to query. Unit: milliseconds.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '1577808000000',
-                    ],
-                ],
-                [
-                    'name' => 'EndTime',
+                    'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '查询结束时间, 单位毫秒。',
-                        'description' => 'The end of the time range to query. Unit: milliseconds.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '1577808000000',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region where the management hub of Threat Analysis is located. Select the region of the management hub based on the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
                 [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view.'."\n"
-                            ."\n"
-                            .'*   0: view of the current Alibaba Cloud account.'."\n"
-                            .'*   1: view of all accounts for the enterprise.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['description' => 'The type of the view.'."\n"
+                        ."\n"
+                        .'- 0: The view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: The view of all accounts that belong to the enterprise.', 'type' => 'string', 'required' => false, 'pattern' => '^\\d+$', 'title' => '', 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the member in the resource directory.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
-                ],
-                [
-                    'name' => 'RegionId',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member. An administrator can specify this parameter to switch to the perspective of the member.', 'type' => 'string', 'required' => false, 'pattern' => '^\\d+$', 'title' => '', 'example' => '113091674488****'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'PlainResponse<EventCounter>',
-                        'description' => 'PlainResponse'."\n",
+                        'title' => 'CloudSiemSuccessResponse<DescribeImportedLogCountResult>',
+                        'description' => 'CloudSiemSuccessResponse',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
+                                'title' => '',
+                                'description' => 'The returned data.',
                                 'type' => 'object',
                                 'properties' => [
-                                    'EventNum' => [
-                                        'title' => '事件总数。',
-                                        'description' => 'The total number of events.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int64',
-                                        'example' => '100',
-                                    ],
-                                    'UndealEventNum' => [
-                                        'title' => '未处理事件数。',
-                                        'description' => 'The number of unhandled events.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int64',
-                                        'example' => '75',
-                                    ],
-                                    'HighLevelEventNum' => [
-                                        'title' => '高风险事件数。',
-                                        'description' => 'The number of high-risk events.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int64',
-                                        'example' => '20',
-                                    ],
-                                    'MediumLevelEventNum' => [
-                                        'title' => '中风险事件数。',
-                                        'description' => 'The number of medium-risk events.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int64',
-                                        'example' => '3',
-                                    ],
-                                    'LowLevelEventNum' => [
-                                        'title' => '低分险事件数。',
-                                        'description' => 'The number of low-risk events.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int64',
-                                        'example' => '52',
-                                    ],
-                                    'SeriousLevelEventNum' => [
-                                        'type' => 'integer',
-                                        'format' => 'int64',
-                                    ],
-                                    'InfoLevelEventNum' => [
-                                        'type' => 'integer',
-                                        'format' => 'int64',
-                                    ],
-                                    'EventDailyNum' => [
-                                        'type' => 'array',
-                                        'items' => [
-                                            'type' => 'object',
-                                            'properties' => [
-                                                'Date' => [
-                                                    'type' => 'string',
-                                                ],
-                                                'EventNum' => [
-                                                    'type' => 'integer',
-                                                    'format' => 'int64',
-                                                ],
-                                                'UndealEventNum' => [
-                                                    'type' => 'integer',
-                                                    'format' => 'int64',
-                                                ],
-                                            ],
-                                        ],
-                                    ],
+                                    'TotalLogCount' => ['title' => '', 'description' => 'The total number of logs.', 'type' => 'integer', 'format' => 'int32', 'example' => '59'],
+                                    'ImportedLogCount' => ['title' => '', 'description' => 'The number of ingested logs.', 'type' => 'integer', 'format' => 'int32', 'example' => '10'],
+                                    'UnImportedLogCount' => ['title' => '', 'description' => 'The number of logs that are not ingested.', 'type' => 'integer', 'format' => 'int32', 'example' => '49'],
                                 ],
-                                'example' => '123456',
-                            ],
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true：成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
+                                'example' => '',
                             ],
+                            'RequestId' => ['title' => '', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'DescribeImportedLogCount',
+            'summary' => 'Queries the number of imported logs.',
+            'changeSet' => [
+                ['createdAt' => '2024-12-16T08:46:55.000Z', 'description' => 'Request parameters changed'],
+                ['createdAt' => '2024-07-08T11:46:03.000Z', 'description' => 'Request parameters changed'],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"EventNum\\": 100,\\n    \\"UndealEventNum\\": 75,\\n    \\"HighLevelEventNum\\": 20,\\n    \\"MediumLevelEventNum\\": 3,\\n    \\"LowLevelEventNum\\": 52,\\n    \\"SeriousLevelEventNum\\": 0,\\n    \\"InfoLevelEventNum\\": 0,\\n    \\"EventDailyNum\\": [\\n      {\\n        \\"Date\\": \\"2025-10-06\\",\\n        \\"EventNum\\": 100,\\n        \\"UndealEventNum\\": 34\\n      }\\n    ]\\n  },\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
-            'title' => 'DescribeEventCountByThreatLevel',
-        ],
-        'DescribeDisposeAndPlaybook' => [
-            'summary' => 'Queries the list of entities and playbooks that need to be handled.',
-            'methods' => [
-                'get',
-                'post',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeImportedLogCount'],
+                ],
             ],
-            'schemes' => [
-                'http',
-                'https',
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DescribeImportedLogCount',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"TotalLogCount\\": 59,\\n    \\"ImportedLogCount\\": 10,\\n    \\"UnImportedLogCount\\": 49\\n  },\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+        ],
+        'DescribeLogFields' => [
+            'methods' => ['get', 'post'],
+            'schemes' => ['https', 'http'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'read',
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'get',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas104PTS',
-                ],
-            ],
+            'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
-                    'name' => 'EntityType',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '实体类型。取值：'."\n"
-                            .'- ip：ip'."\n"
-                            .'- process：进程'."\n"
-                            .'- file：文件机',
-                        'description' => 'The entity type. Valid values:'."\n"
-                            ."\n"
-                            .'*   ip'."\n"
-                            .'*   process'."\n"
-                            .'*   file'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'ip',
-                    ],
-                ],
-                [
-                    'name' => 'IncidentUuid',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '事件id。',
-                        'description' => 'The UUID of the event.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '85ea4241-798f-4684-a876-65d4f0c3****',
-                    ],
-                ],
-                [
-                    'name' => 'EntityUuid',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '实体uuid。',
-                        'type' => 'string',
-                        'example' => '85ea4241-798f-4684-a876-65d4f0c3****',
-                    ],
-                ],
-                [
-                    'name' => 'CurrentPage',
+                    'name' => 'LogType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '列表当前页号， 大于等于1。',
-                        'description' => 'The page number. Pages start from page 1.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The log source for the rule.', 'type' => 'string', 'required' => false, 'example' => 'cloud_siem_aegis_sas_alert'],
                 ],
                 [
-                    'name' => 'PageSize',
+                    'name' => 'LogSource',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '列表每页条数， 最大不超过100。',
-                        'description' => 'The number of entries to return on each page. Maximum value: 100.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '10',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The log source for the rule.', 'type' => 'string', 'required' => false, 'example' => 'cloud_siem_aegis_sas_alert'],
                 ],
                 [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                        'title' => '0，单账号登录；1，全局视图；2，切换视图；3，局部视图',
-                    ],
+                    'schema' => ['description' => 'The view type.'."\n"
+                        ."\n"
+                        .'- 0: The view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: The view of all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member whose view the administrator switches to.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The data management center of the threat analysis feature. Specify this parameter based on the region in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions inside China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region where the threat analysis Management Hub is located. Select the region of the Management Hub based on the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'PageResponse<List<DisposeAndScopeView>>',
-                        'description' => 'PageResponse\\<List>'."\n",
+                        'title' => 'PlainResponse<List<CustomizeRuleField>>',
+                        'description' => 'PlainResponse\\<List>',
                         'type' => 'object',
                         'properties' => [
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true:成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code that is returned.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
-                            ],
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'object',
-                                'properties' => [
-                                    'PageInfo' => [
-                                        'title' => '分页记录。',
-                                        'description' => 'The pagination information.'."\n",
-                                        'type' => 'object',
-                                        'properties' => [
-                                            'CurrentPage' => [
-                                                'title' => '列表当前页号。',
-                                                'description' => 'The current page number.'."\n",
-                                                'type' => 'integer',
-                                                'format' => 'int32',
-                                                'example' => '1',
-                                            ],
-                                            'PageSize' => [
-                                                'title' => '每页返回记录数。',
-                                                'description' => 'The number of entries per page.'."\n",
-                                                'type' => 'integer',
-                                                'format' => 'int32',
-                                                'example' => '10',
-                                            ],
-                                            'TotalCount' => [
-                                                'title' => '记录总数。',
-                                                'description' => 'The total number of entries returned.'."\n",
-                                                'type' => 'integer',
-                                                'format' => 'int64',
-                                                'example' => '100',
-                                            ],
-                                        ],
-                                    ],
-                                    'ResponseData' => [
-                                        'title' => '详细数据。',
-                                        'description' => 'The detailed data.'."\n",
-                                        'type' => 'array',
-                                        'items' => [
-                                            'type' => 'object',
-                                            'properties' => [
-                                                'EntityId' => [
-                                                    'title' => '实体id。',
-                                                    'description' => 'The entity ID'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int64',
-                                                    'example' => '12345',
-                                                ],
-                                                'EntityType' => [
-                                                    'title' => '实体类型。取值：'."\n"
-                                                        .'- ip:ip'."\n"
-                                                        .'- domain：域名'."\n"
-                                                        .'- url：url'."\n"
-                                                        .'- process：进程'."\n"
-                                                        .'- file：文件'."\n"
-                                                        .'- host：主机',
-                                                    'type' => 'string',
-                                                    'example' => 'ip',
-                                                ],
-                                                'OpcodeMap' => [
-                                                    'title' => '实体id。',
-                                                    'description' => 'The key-value pairs each of which consists of opcode and oplevel.'."\n",
-                                                    'type' => 'object',
-                                                    'additionalProperties' => [
-                                                        'type' => 'string',
-                                                        'example' => '{"7","2"}',
-                                                        'description' => 'The key-value pair that consists of opcode and oplevel.'."\n",
-                                                    ],
-                                                    'example' => '12345',
-                                                ],
-                                                'OpcodeSet' => [
-                                                    'title' => '实体处置推荐剧本code。',
-                                                    'description' => 'The codes of the playbooks that are recommended for entity handling.'."\n",
-                                                    'type' => 'array',
-                                                    'items' => [
-                                                        'description' => 'The code of the playbook that is recommended for entity handling.'."\n",
-                                                        'type' => 'string',
-                                                        'example' => '7',
-                                                    ],
-                                                    'example' => '[1,3]',
-                                                ],
-                                                'EntityInfo' => [
-                                                    'title' => '实体信息。',
-                                                    'description' => 'The entity information.'."\n",
-                                                    'type' => 'object',
-                                                    'example' => '{"file_path": "c:/www/leixi.jsp","file_hash": "aa0ca926ad948cd820e0a3d9a18c09d0","host_uuid": "efed2cf7-0b77-45d9-a97b-d2cf246bcbb3","malware_type": "${aliyun.siem.sas.alert_tag.webshell}","host_name": "launch-advisor-20230531"}',
-                                                ],
-                                                'Dispose' => [
-                                                    'title' => '处置对象。',
-                                                    'description' => 'The object for handling.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '192.168.1.1',
-                                                ],
-                                                'Scope' => [
-                                                    'title' => '处置作用域，可进行处置用户id列表。',
-                                                    'description' => 'The IDs of the users who can handle objects.'."\n",
-                                                    'type' => 'array',
-                                                    'items' => [
-                                                        'description' => 'The ID of the user who can handle objects.'."\n",
-                                                        'type' => 'any',
-                                                        'example' => '[1276085894174392]',
-                                                    ],
-                                                    'example' => '176618589410****',
-                                                ],
-                                                'PlaybookList' => [
-                                                    'title' => '能够处置该实体的剧本列表。',
-                                                    'description' => 'The playbooks that can handle the entity.'."\n",
-                                                    'type' => 'array',
-                                                    'items' => [
-                                                        'type' => 'object',
-                                                        'properties' => [
-                                                            'OpCode' => [
-                                                                'title' => '剧本opcode，与处置实体的推荐剧本opcode相对应。',
-                                                                'description' => 'The opcode of the playbook, which corresponds to the opcode of the playbook recommended for entity handling.'."\n",
-                                                                'type' => 'string',
-                                                                'example' => '7',
-                                                            ],
-                                                            'OpLevel' => [
-                                                                'title' => '事件一键处置是否默认勾选，2：勾选 1：只展示不勾选。',
-                                                                'description' => 'Indicates whether quick event handling is selected by default. Valid values:'."\n"
-                                                                    ."\n"
-                                                                    .'*   2: Quick event handling is selected.'."\n"
-                                                                    .'*   1: Quick event handling is displayed but not selected.'."\n",
-                                                                'type' => 'string',
-                                                                'example' => '2',
-                                                            ],
-                                                            'Description' => [
-                                                                'title' => '剧本描述。',
-                                                                'description' => 'The playbook description.'."\n",
-                                                                'type' => 'string',
-                                                                'example' => 'WafBlockIP',
-                                                            ],
-                                                            'DisplayName' => [
-                                                                'title' => '剧本显示名称。',
-                                                                'description' => 'The display name of the playbook.'."\n",
-                                                                'type' => 'string',
-                                                                'example' => 'WafBlockIP',
-                                                            ],
-                                                            'TaskConfig' => [
-                                                                'title' => 'opcode配置。',
-                                                                'description' => 'The opcode configuration.'."\n",
-                                                                'type' => 'string',
-                                                                'example' => '{"opCode":"3"}',
-                                                            ],
-                                                            'Name' => [
-                                                                'title' => '剧本名称，剧本唯一标识。',
-                                                                'description' => 'The playbook name, which is the unique identifier of the playbook.'."\n",
-                                                                'type' => 'string',
-                                                                'example' => 'kill_process_isolate_file',
-                                                            ],
-                                                            'Uuid' => [
-                                                                'title' => '剧本uuid，剧本唯一标识。',
-                                                                'type' => 'string',
-                                                                'example' => 'kill_process_isolate_file',
-                                                            ],
-                                                            'ParamConfig' => [
-                                                                'title' => '剧本的参数列表以及对应参数属性',
-                                                                'description' => 'The playbook parameters and the corresponding properties.'."\n",
-                                                                'type' => 'array',
-                                                                'items' => [
-                                                                    'description' => 'The input parameters and format requirements of the current playbook.'."\n",
-                                                                    'type' => 'any',
-                                                                    'example' => '{'."\n"
-                                                                        .'	"ParamConfig": ['."\n"
-                                                                        .'		{'."\n"
-                                                                        .'			"Field": "dispose",'."\n"
-                                                                        .'			"Necessary": true,'."\n"
-                                                                        .'			"CheckField": "[{&quot;fieldPath&quot;:&quot;$.ip&quot;,&quot;fieldName&quot;:&quot;ip&quot;}]"'."\n"
-                                                                        .'		},'."\n"
-                                                                        .'		{'."\n"
-                                                                        .'			"Field": "alert",'."\n"
-                                                                        .'			"Necessary": true,'."\n"
-                                                                        .'			"CheckField": "[{&quot;fieldPath&quot;:&quot;$.host_uuid&quot;,&quot;fieldName&quot;:&quot;host_uuid&quot;}]"'."\n"
-                                                                        .'		},'."\n"
-                                                                        .'		{'."\n"
-                                                                        .'			"Field": "scope",'."\n"
-                                                                        .'			"Necessary": true,'."\n"
-                                                                        .'			"Value": "$.main_user_id"'."\n"
-                                                                        .'		},'."\n"
-                                                                        .'		{'."\n"
-                                                                        .'			"Field": "startTime",'."\n"
-                                                                        .'			"Necessary": true'."\n"
-                                                                        .'		},'."\n"
-                                                                        .'		{'."\n"
-                                                                        .'			"Field": "endTime",'."\n"
-                                                                        .'			"Necessary": true'."\n"
-                                                                        .'		}'."\n"
-                                                                        .'	]'."\n"
-                                                                        .'}',
-                                                                ],
-                                                            ],
-                                                            'WafPlaybook' => [
-                                                                'title' => '是否是waf剧本。',
-                                                                'description' => 'Indicates whether the playbook is intended for Web Application Firewall (WAF). Valid values:'."\n"
-                                                                    ."\n"
-                                                                    .'*   true'."\n"
-                                                                    .'*   false'."\n",
-                                                                'type' => 'boolean',
-                                                                'example' => 'false',
-                                                            ],
-                                                            'Available' => [
-                                                                'type' => 'string',
-                                                            ],
-                                                        ],
-                                                    ],
-                                                    'example' => '',
-                                                ],
-                                                'AlertNum' => [
-                                                    'title' => '该实体关联的告警数。',
-                                                    'description' => 'The number of alerts that are associated with the entity.'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int32',
-                                                    'example' => '1',
-                                                ],
-                                            ],
-                                        ],
+                                'title' => '',
+                                'description' => 'The data returned.',
+                                'type' => 'array',
+                                'items' => [
+                                    'type' => 'object',
+                                    'properties' => [
+                                        'FieldName' => ['title' => '', 'description' => 'The name of the rule field.', 'type' => 'string', 'example' => 'activity_name'],
+                                        'FieldDesc' => ['title' => '', 'description' => 'The Medusa code for the field description.', 'type' => 'string', 'example' => 'sas.cloudsiem.prod.activity_name'],
+                                        'LogCode' => ['title' => '', 'description' => 'The log source to which the field belongs.', 'type' => 'string', 'example' => 'cloud_siem_aegis_sas_alert'],
+                                        'ActivityName' => ['title' => '', 'description' => 'The log type to which the field belongs.', 'type' => 'string', 'example' => 'HTTP_ACTIVITY'],
+                                        'FieldType' => ['title' => '', 'description' => 'The data type of the field. Valid values:'."\n"
+                                            ."\n"
+                                            .'- varchar: string'."\n"
+                                            ."\n"
+                                            .'- bigint: number', 'type' => 'string', 'example' => 'varchar'],
                                     ],
+                                    'description' => '',
+                                    'title' => '',
+                                    'example' => '',
                                 ],
                                 'example' => '123456',
                             ],
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The request was successful.'."\n"
+                                ."\n"
+                                .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The request status code.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The message returned.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'DescribeLogFields',
+            'summary' => 'Retrieves the list of configurable fields for custom rules.',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:43:22.000Z', 'description' => 'Error codes changed, Request parameters changed'],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n  \\"Data\\": {\\n    \\"PageInfo\\": {\\n      \\"CurrentPage\\": 1,\\n      \\"PageSize\\": 10,\\n      \\"TotalCount\\": 100\\n    },\\n    \\"ResponseData\\": [\\n      {\\n        \\"EntityId\\": 0,\\n        \\"EntityType\\": \\"ip\\",\\n        \\"OpcodeMap\\": {\\n          \\"key\\": \\"{\\\\\\"7\\\\\\",\\\\\\"2\\\\\\"}\\"\\n        },\\n        \\"OpcodeSet\\": [\\n          \\"7\\"\\n        ],\\n        \\"EntityInfo\\": {\\n          \\"file_path\\": \\"c:/www/leixi.jsp\\",\\n          \\"file_hash\\": \\"aa0ca926ad948cd820e0a3d9a18c****\\",\\n          \\"host_uuid\\": \\"efed2cf7-0b77-45d9-a97b-d2cf246b****\\",\\n          \\"malware_type\\": \\"${aliyun.siem.sas.alert_tag.webshell}\\",\\n          \\"host_name\\": \\"launch-advisor-2023****\\"\\n        },\\n        \\"Dispose\\": \\"192.168.*.*\\",\\n        \\"Scope\\": [\\n          \\"[127608589417****]\\"\\n        ],\\n        \\"PlaybookList\\": [\\n          {\\n            \\"OpCode\\": \\"7\\",\\n            \\"OpLevel\\": \\"2\\",\\n            \\"Description\\": \\"WafBlockIP\\",\\n            \\"DisplayName\\": \\"WafBlockIP\\",\\n            \\"TaskConfig\\": \\"{\\\\\\"opCode\\\\\\":\\\\\\"3\\\\\\"}\\",\\n            \\"Name\\": \\"kill_process_isolate_file\\",\\n            \\"Uuid\\": \\"kill_process_isolate_file\\",\\n            \\"ParamConfig\\": [\\n              \\"{\\\\n\\\\t\\\\\\"ParamConfig\\\\\\": [\\\\n\\\\t\\\\t{\\\\n\\\\t\\\\t\\\\t\\\\\\"Field\\\\\\": \\\\\\"dispose\\\\\\",\\\\n\\\\t\\\\t\\\\t\\\\\\"Necessary\\\\\\": true,\\\\n\\\\t\\\\t\\\\t\\\\\\"CheckField\\\\\\": \\\\\\"[{&quot;fieldPath&quot;:&quot;$.ip&quot;,&quot;fieldName&quot;:&quot;ip&quot;}]\\\\\\"\\\\n\\\\t\\\\t},\\\\n\\\\t\\\\t{\\\\n\\\\t\\\\t\\\\t\\\\\\"Field\\\\\\": \\\\\\"alert\\\\\\",\\\\n\\\\t\\\\t\\\\t\\\\\\"Necessary\\\\\\": true,\\\\n\\\\t\\\\t\\\\t\\\\\\"CheckField\\\\\\": \\\\\\"[{&quot;fieldPath&quot;:&quot;$.host_uuid&quot;,&quot;fieldName&quot;:&quot;host_uuid&quot;}]\\\\\\"\\\\n\\\\t\\\\t},\\\\n\\\\t\\\\t{\\\\n\\\\t\\\\t\\\\t\\\\\\"Field\\\\\\": \\\\\\"scope\\\\\\",\\\\n\\\\t\\\\t\\\\t\\\\\\"Necessary\\\\\\": true,\\\\n\\\\t\\\\t\\\\t\\\\\\"Value\\\\\\": \\\\\\"$.main_user_id\\\\\\"\\\\n\\\\t\\\\t},\\\\n\\\\t\\\\t{\\\\n\\\\t\\\\t\\\\t\\\\\\"Field\\\\\\": \\\\\\"startTime\\\\\\",\\\\n\\\\t\\\\t\\\\t\\\\\\"Necessary\\\\\\": true\\\\n\\\\t\\\\t},\\\\n\\\\t\\\\t{\\\\n\\\\t\\\\t\\\\t\\\\\\"Field\\\\\\": \\\\\\"endTime\\\\\\",\\\\n\\\\t\\\\t\\\\t\\\\\\"Necessary\\\\\\": true\\\\n\\\\t\\\\t}\\\\n\\\\t]\\\\n}\\"\\n            ],\\n            \\"WafPlaybook\\": false,\\n            \\"Available\\": \\"1\\"\\n          }\\n        ],\\n        \\"AlertNum\\": 1\\n      }\\n    ]\\n  }\\n}","type":"json"}]',
-            'title' => 'DescribeDisposeAndPlaybook',
-        ],
-        'DescribeCloudSiemEvents' => [
-            'summary' => 'Queries events in SIEM.',
-            'methods' => [
-                'get',
-                'post',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeLogFields'],
+                ],
             ],
-            'schemes' => [
-                'http',
-                'https',
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DescribeLogFields',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"FieldName\\": \\"activity_name\\",\\n      \\"FieldDesc\\": \\"sas.cloudsiem.prod.activity_name\\",\\n      \\"LogCode\\": \\"cloud_siem_aegis_sas_alert\\",\\n      \\"ActivityName\\": \\"HTTP_ACTIVITY\\",\\n      \\"FieldType\\": \\"varchar\\"\\n    }\\n  ],\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
+        ],
+        'DescribeLogSource' => [
+            'summary' => 'Retrieves a list of configurable log sources for custom rules.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['https', 'http'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'read',
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'list',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsasAFG0OH',
-                ],
-            ],
+            'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
-                    'name' => 'StartTime',
+                    'name' => 'LogType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '查询开始时间, 单位毫秒。',
-                        'description' => 'The beginning of the time range to query. Unit: milliseconds.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '1577808000000',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The log type of the rule.', 'type' => 'string', 'required' => false, 'example' => 'HTTP_ACTIVITY'],
                 ],
                 [
-                    'name' => 'EndTime',
+                    'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '查询结束时间, 单位毫秒。',
-                        'description' => 'The end of the time range to query. Unit: milliseconds.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '1577808000000',
-                    ],
+                    'schema' => ['description' => 'The view type.'."\n"
+                        ."\n"
+                        .'- 0: The view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: The view of all accounts within the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
-                    'name' => 'ThreadLevel',
+                    'name' => 'RoleFor',
                     'in' => 'formData',
-                    'style' => 'repeatList',
-                    'schema' => [
-                        'title' => '事件威胁等级，格式为json数组。取值：'."\n"
-                            .'- serious：高危'."\n"
-                            .'- suspicious：中危'."\n"
-                            .'- remind：低危',
-                        'description' => 'The risk levels of the events. The value is a JSON array. Valid values:'."\n"
-                            ."\n"
-                            .'*   serious: high'."\n"
-                            .'*   suspicious: medium'."\n"
-                            .'*   remind: low'."\n",
-                        'type' => 'array',
-                        'items' => [
-                            'description' => 'The risk level of the event. The value is a JSON string. Valid values:'."\n"
-                                ."\n"
-                                .'*   serious: high'."\n"
-                                .'*   suspicious: medium'."\n"
-                                .'*   remind: low'."\n",
-                            'type' => 'string',
-                            'required' => false,
-                            'example' => '["remind","serious"]'."\n",
-                        ],
-                        'required' => false,
-                        'example' => '["serious","suspicious","remind"]',
-                        'maxItems' => 100,
-                    ],
+                    'schema' => ['description' => 'The user ID of the member. An administrator can use this parameter to switch to the perspective of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
-                    'name' => 'EventName',
+                    'name' => 'RegionId',
                     'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The region where the Data Management center of Threat Analysis is deployed. You must select the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
+                ],
+            ],
+            'responses' => [
+                200 => [
                     'schema' => [
-                        'title' => '事件名称。',
-                        'description' => 'The name of the event.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'ECS unusual log in',
+                        'title' => 'PlainResponse<List<LogSource>>',
+                        'description' => 'PlainResponse\\<List>',
+                        'type' => 'object',
+                        'properties' => [
+                            'Data' => [
+                                'title' => '',
+                                'description' => 'The data returned.',
+                                'type' => 'array',
+                                'items' => [
+                                    'type' => 'object',
+                                    'properties' => [
+                                        'LogSource' => ['title' => '', 'description' => 'The log source of the rule.', 'type' => 'string', 'example' => 'cloud_siem_aegis_sas_alert'],
+                                        'LogSourceName' => ['title' => '', 'description' => 'The Medusa code of the log source for the rule.', 'type' => 'string', 'example' => 'sas.cloudsiem.prod.cloud_siem_aegis_sas_alert'],
+                                    ],
+                                    'description' => '',
+                                    'title' => '',
+                                    'example' => '',
+                                ],
+                                'example' => '123456',
+                            ],
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The request was successful.'."\n"
+                                ."\n"
+                                .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The request status code.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The message returned.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
+                        ],
+                        'example' => '',
                     ],
                 ],
+            ],
+            'errorCodes' => [
+                500 => [
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
+                ],
+            ],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'DescribeLogSource',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:43:23.000Z', 'description' => 'Error codes changed, Request parameters changed'],
+            ],
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeLogSource'],
+                ],
+            ],
+            'ramActions' => [
                 [
-                    'name' => 'IncidentUuid',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '事件ID。',
-                        'description' => 'The ID of the event.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '85ea4241-798f-4684-a876-65d4f0c3****',
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DescribeLogSource',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
                     ],
                 ],
+            ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"LogSource\\": \\"cloud_siem_aegis_sas_alert\\",\\n      \\"LogSourceName\\": \\"sas.cloudsiem.prod.cloud_siem_aegis_sas_alert\\"\\n    }\\n  ],\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
+        ],
+        'DescribeLogType' => [
+            'summary' => 'Retrieves the log types that can be configured for custom rules.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['https', 'http'],
+            'security' => [
                 [
-                    'name' => 'AssetId',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '事件关联的资产ID。',
-                        'description' => 'The ID of the asset that is associated with the event.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '6c740667-80b2-476d-8924-2e706feb****',
-                    ],
+                    'AK' => [],
                 ],
+            ],
+            'deprecated' => false,
+            'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'],
+            'parameters' => [
                 [
-                    'name' => 'EntityUuid',
+                    'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '事件关联的实体Uuid。',
-                        'type' => 'string',
-                        'example' => '6c740667-80b2-476d-8924-2e706feb****',
-                    ],
+                    'schema' => ['description' => 'The type of the view. Valid values:'."\n"
+                        ."\n"
+                        .'- 0: The view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: The view of all accounts in an enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
-                    'name' => 'Status',
+                    'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '事件状态。  取值：'."\n"
-                            .'- 0:未处理'."\n"
-                            .'- 1:处理中'."\n"
-                            .'- 5：处理失败'."\n"
-                            .'- 10:已处理',
-                        'description' => 'The status of the event. Valid values:'."\n"
-                            ."\n"
-                            .'*   0: unhandled'."\n"
-                            .'*   1: handling'."\n"
-                            .'*   5: handling failed'."\n"
-                            .'*   10: handled'."\n",
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '0',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member. An administrator can use this parameter to switch to the perspective of a specific member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
-                    'name' => 'OrderField',
+                    'name' => 'RegionId',
                     'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The region of the Data Management center. Select a region based on where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: for assets in the Chinese mainland and China (Hong Kong)'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: for assets in regions outside China', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
+                ],
+            ],
+            'responses' => [
+                200 => [
                     'schema' => [
-                        'title' => '事件列表排列字段。 取值：'."\n"
-                            .'- GmtModified：基于事件产生事件排序（默认）'."\n"
-                            .'- ThreatScore：基于事件威胁评分排序。',
-                        'description' => 'The sort field. Valid values:'."\n"
-                            ."\n"
-                            .'*   GmtModified: sorts the events by creation time. This is the default value.'."\n"
-                            .'*   ThreatScore: sorts the events by risk score.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'ThreatScore',
+                        'title' => 'PlainResponse<List<LogType>>',
+                        'description' => 'PlainResponse\\<List\\<LogType>>',
+                        'type' => 'object',
+                        'properties' => [
+                            'Data' => [
+                                'title' => '',
+                                'description' => 'The data returned.',
+                                'type' => 'array',
+                                'items' => [
+                                    'type' => 'object',
+                                    'properties' => [
+                                        'LogType' => ['title' => '', 'description' => 'The log type for the rule.', 'type' => 'string', 'example' => 'HTTP_ACTIVITY'],
+                                        'LogTypeName' => ['title' => '', 'description' => 'The code for the log type name.', 'type' => 'string', 'example' => 'sas.cloudsiem.prod.http_activity'],
+                                    ],
+                                    'description' => '',
+                                    'title' => '',
+                                    'example' => '',
+                                ],
+                                'example' => '123456',
+                            ],
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The request was successful.'."\n"
+                                ."\n"
+                                .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The message returned.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
+                        ],
+                        'example' => '',
                     ],
                 ],
+            ],
+            'errorCodes' => [
+                500 => [
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
+                ],
+            ],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'DescribeLogType',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:43:23.000Z', 'description' => 'Error codes changed, Request parameters changed'],
+            ],
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeLogType'],
+                ],
+            ],
+            'ramActions' => [
                 [
-                    'name' => 'Order',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '事件列表排列方向。 取值：'."\n"
-                            .'- desc：降序排列'."\n"
-                            .'- asc：升序排列。',
-                        'description' => 'The sort order. Valid values:'."\n"
-                            ."\n"
-                            .'*   desc: descending order'."\n"
-                            .'*   asc: ascending order'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'desc',
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DescribeLogType',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
                     ],
                 ],
+            ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"LogType\\": \\"HTTP_ACTIVITY\\",\\n      \\"LogTypeName\\": \\"sas.cloudsiem.prod.http_activity\\"\\n    }\\n  ],\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
+        ],
+        'DescribeOperators' => [
+            'summary' => 'Retrieves the list of operators for custom rules.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['https', 'http'],
+            'security' => [
                 [
-                    'name' => 'CurrentPage',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '列表当前页号， 大于等于1。',
-                        'description' => 'The page number. Pages start from page 1.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => true,
-                        'minimum' => '1',
-                        'example' => '1',
-                    ],
+                    'AK' => [],
                 ],
+            ],
+            'deprecated' => false,
+            'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'],
+            'parameters' => [
                 [
-                    'name' => 'PageSize',
+                    'name' => 'SceneType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '列表每页条数， 最大不超过100。',
-                        'description' => 'The number of entries per page. Maximum value: 100.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => true,
-                        'maximum' => '100',
-                        'minimum' => '1',
-                        'example' => '10',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The scenario for the operator. Valid values:'."\n"
+                        ."\n"
+                        .'- If you leave this parameter empty, the default scenario is used.'."\n"
+                        ."\n"
+                        .'- AGGREGATE: The aggregate function scenario.', 'type' => 'string', 'required' => false, 'example' => 'AGGREGATE'],
                 ],
                 [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                        'title' => '0，单账号登录；1，全局视图；2，切换视图；3，局部视图',
-                    ],
+                    'schema' => ['description' => 'The view type.'."\n"
+                        ."\n"
+                        .'- 0: The view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: The view of all accounts that are managed by your enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member. An administrator can use this parameter to switch to the perspective of this member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region of the Data Management center for threat analysis. Select a region based on your asset location. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Assets in the Chinese mainland and China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Assets outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'PageResponse<List<SiemEvent>>',
-                        'description' => 'PageResponse\\<List>'."\n",
+                        'title' => 'PlainResponse<List<CustomizeRuleOperator>>',
+                        'description' => 'PlainResponse\\<List>',
                         'type' => 'object',
                         'properties' => [
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true:成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
-                            ],
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'object',
-                                'properties' => [
-                                    'PageInfo' => [
-                                        'title' => '分页记录。',
-                                        'description' => 'The pagination information.'."\n",
-                                        'type' => 'object',
-                                        'properties' => [
-                                            'CurrentPage' => [
-                                                'title' => '列表当前页号。',
-                                                'description' => 'The current page number.'."\n",
-                                                'type' => 'integer',
-                                                'format' => 'int32',
-                                                'example' => '1',
-                                            ],
-                                            'PageSize' => [
-                                                'title' => '每页返回记录数。',
-                                                'description' => 'The number of entries per page.'."\n",
-                                                'type' => 'integer',
-                                                'format' => 'int32',
-                                                'example' => '10',
-                                            ],
-                                            'TotalCount' => [
-                                                'title' => '记录总数。',
-                                                'description' => 'The total number of entries returned.'."\n",
-                                                'type' => 'integer',
-                                                'format' => 'int64',
-                                                'example' => '100',
-                                            ],
-                                        ],
-                                    ],
-                                    'ResponseData' => [
-                                        'title' => '详细数据。',
-                                        'description' => 'The detailed data.'."\n",
-                                        'type' => 'array',
-                                        'items' => [
-                                            'type' => 'object',
-                                            'properties' => [
-                                                'GmtCreate' => [
-                                                    'title' => '事件发生时间。',
-                                                    'description' => 'The time when the event occurred.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '2021-01-06 16:37:29',
-                                                ],
-                                                'GmtModified' => [
-                                                    'title' => '事件最后更新时间。',
-                                                    'description' => 'The time when the event was last updated.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '2021-01-06 16:37:29',
-                                                ],
-                                                'Aliuid' => [
-                                                    'title' => '事件归属主账号ID。',
-                                                    'description' => 'The ID of the Alibaba Cloud account to which the event belongs.'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int64',
-                                                    'example' => '127608589417****',
-                                                ],
-                                                'AlertNum' => [
-                                                    'title' => '事件关联告警数。',
-                                                    'description' => 'The number of alerts that are associated with the event.'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int32',
-                                                    'example' => '4',
-                                                ],
-                                                'AssetNum' => [
-                                                    'title' => '事件关联资产数。',
-                                                    'description' => 'The number of assets that are associated with the event.'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int32',
-                                                    'example' => '4',
-                                                ],
-                                                'IncidentUuid' => [
-                                                    'title' => '事件全局唯一ID。',
-                                                    'description' => 'The UUID of the event.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '85ea4241-798f-4684-a876-65d4f0c3****',
-                                                ],
-                                                'IncidentName' => [
-                                                    'title' => '事件名称。',
-                                                    'description' => 'The name of the event.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc',
-                                                ],
-                                                'IncidentNameEn' => [
-                                                    'title' => '事件英文名称。',
-                                                    'description' => 'The event name in English.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc',
-                                                ],
-                                                'Description' => [
-                                                    'title' => '事件描述。',
-                                                    'description' => 'The description of the event.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'The threat event contains 13 Miner Network,1 Execute suspicious encoded commands on Linux, etc',
-                                                ],
-                                                'DescriptionEn' => [
-                                                    'title' => '事件英文描述。',
-                                                    'description' => 'The event description in English.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'The threat event contains 13 Miner Network,1 Execute suspicious encoded commands on Linux, etc',
-                                                ],
-                                                'DataSources' => [
-                                                    'title' => '事件关联告警来源产品。',
-                                                    'description' => 'The sources of the alert.'."\n",
-                                                    'type' => 'array',
-                                                    'items' => [
-                                                        'description' => 'The source.'."\n",
-                                                        'type' => 'string',
-                                                        'example' => '[sas,waf]',
-                                                    ],
-                                                    'example' => '[sas,waf]',
-                                                ],
-                                                'ThreatLevel' => [
-                                                    'title' => '威胁等级。取值：'."\n"
-                                                        .'- serious：高危'."\n"
-                                                        .'- suspicious：中危'."\n"
-                                                        .'- remind：低危',
-                                                    'description' => 'The risk level. Valid values:'."\n"
-                                                        ."\n"
-                                                        .'*   serious: high.'."\n"
-                                                        .'*   suspicious: medium.'."\n"
-                                                        .'*   remind: low.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'remind',
-                                                ],
-                                                'ThreatScore' => [
-                                                    'title' => '事件的威胁分值, 范围 0~100, 分值越高风险等级越高。',
-                                                    'description' => 'The risk score of the event. Valid values: 0 to 100. A higher value indicates a higher risk level.'."\n",
-                                                    'type' => 'number',
-                                                    'format' => 'float',
-                                                    'example' => '90.2',
-                                                ],
-                                                'ExtContent' => [
-                                                    'title' => '事件扩展信息 json格式。',
-                                                    'description' => 'The extended event information in the JSON format.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '{"event_transfer_type":"customize_rule"}',
-                                                ],
-                                                'Status' => [
-                                                    'title' => '事件状态。  取值：'."\n"
-                                                        .'- 0:未处理 '."\n"
-                                                        .'-1:处理中 '."\n"
-                                                        .'-5：处理失败 '."\n"
-                                                        .'-10:已处理',
-                                                    'description' => 'The status of the event. Valid values:'."\n"
-                                                        ."\n"
-                                                        .'*   0: unhandled.'."\n"
-                                                        .'*   1: handling.'."\n"
-                                                        .'*   5: handling failed.'."\n"
-                                                        .'*   10: handled.'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int32',
-                                                    'example' => '0',
-                                                ],
-                                                'AttCkLabels' => [
-                                                    'title' => 'ATTCT&攻击技术标签集合。',
-                                                    'description' => 'The tags of the ATT\\&CK techniques.'."\n",
-                                                    'type' => 'array',
-                                                    'items' => [
-                                                        'description' => 'The tag of the ATT\\&CK technique.'."\n",
-                                                        'type' => 'string',
-                                                        'example' => '["T1595.002 Vulnerability Scanning"]',
-                                                    ],
-                                                    'example' => '["T1595.002 Vulnerability Scanning"]',
-                                                ],
-                                                'AttckStages' => [
-                                                    'type' => 'array',
-                                                    'items' => [
-                                                        'type' => 'object',
-                                                        'properties' => [
-                                                            'TacticId' => [
-                                                                'type' => 'string',
-                                                            ],
-                                                            'TacticName' => [
-                                                                'type' => 'string',
-                                                            ],
-                                                            'AlertNum' => [
-                                                                'type' => 'integer',
-                                                                'format' => 'int32',
-                                                            ],
-                                                        ],
-                                                    ],
-                                                ],
-                                                'ReferAccount' => [
-                                                    'description' => 'the refer account info.',
-                                                    'type' => 'string',
-                                                    'example' => '127608589417****',
-                                                ],
-                                                'IncidentType' => [
-                                                    'type' => 'string',
-                                                ],
-                                                'RuleId' => [
-                                                    'type' => 'string',
-                                                ],
-                                                'Remark' => [
-                                                    'title' => '事件备注。',
-                                                    'description' => 'The remarks of the event.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'dealed',
-                                                ],
-                                            ],
+                                'title' => '',
+                                'description' => 'The data returned.',
+                                'type' => 'array',
+                                'items' => [
+                                    'type' => 'object',
+                                    'properties' => [
+                                        'Operator' => ['title' => '', 'description' => 'The operator.', 'type' => 'string', 'example' => '<='],
+                                        'OperatorName' => ['title' => '', 'description' => 'The display name of the operator.', 'type' => 'string', 'example' => '<='],
+                                        'OperatorDescCn' => ['title' => '', 'description' => 'The Chinese description of the operator.', 'type' => 'string', 'example' => 'arger than or equal to'],
+                                        'OperatorDescEn' => ['title' => '', 'description' => 'The English description of the operator.', 'type' => 'string', 'example' => 'larger than or equal to'],
+                                        'SupportDataType' => ['title' => '', 'description' => 'The data types that the operator supports. Multiple data types are separated by commas.', 'type' => 'string', 'example' => 'varchar'],
+                                        'SupportTag' => [
+                                            'title' => '',
+                                            'description' => 'The scenarios that the operator supports. Multiple scenarios are separated by commas, such as aggregation (AGGREGATE). The default value is empty.',
+                                            'type' => 'array',
+                                            'items' => ['description' => 'The scenarios that the operator supports. Multiple scenarios are separated by commas, such as aggregation (AGGREGATE). The default value is empty.', 'type' => 'string', 'title' => '', 'example' => '[AGGREGATE]'],
+                                            'example' => '[AGGREGATE]',
                                         ],
+                                        'Index' => ['title' => '', 'description' => 'The position of the operator in the operator list.', 'type' => 'integer', 'format' => 'int32', 'example' => '3'],
                                     ],
+                                    'description' => '',
+                                    'title' => '',
+                                    'example' => '',
                                 ],
                                 'example' => '123456',
                             ],
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The request was successful.'."\n"
+                                ."\n"
+                                .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The message returned.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'DescribeOperators',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:43:22.000Z', 'description' => 'Error codes changed, Request parameters changed'],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n  \\"Data\\": {\\n    \\"PageInfo\\": {\\n      \\"CurrentPage\\": 1,\\n      \\"PageSize\\": 10,\\n      \\"TotalCount\\": 100\\n    },\\n    \\"ResponseData\\": [\\n      {\\n        \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n        \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n        \\"Aliuid\\": 0,\\n        \\"AlertNum\\": 4,\\n        \\"AssetNum\\": 4,\\n        \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n        \\"IncidentName\\": \\"Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc\\",\\n        \\"IncidentNameEn\\": \\"Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc\\",\\n        \\"Description\\": \\"The threat event contains 13 Miner Network,1 Execute suspicious encoded commands on Linux, etc\\",\\n        \\"DescriptionEn\\": \\"The threat event contains 13 Miner Network,1 Execute suspicious encoded commands on Linux, etc\\",\\n        \\"DataSources\\": [\\n          \\"[sas,waf]\\"\\n        ],\\n        \\"ThreatLevel\\": \\"remind\\",\\n        \\"ThreatScore\\": 90.2,\\n        \\"ExtContent\\": \\"{\\\\\\"event_transfer_type\\\\\\":\\\\\\"customize_rule\\\\\\"}\\",\\n        \\"Status\\": 0,\\n        \\"AttCkLabels\\": [\\n          \\"[\\\\\\"T1595.002 Vulnerability Scanning\\\\\\"]\\"\\n        ],\\n        \\"AttckStages\\": [\\n          {\\n            \\"TacticId\\": \\"TA0001\\",\\n            \\"TacticName\\": \\"Persistence\\",\\n            \\"AlertNum\\": 21\\n          }\\n        ],\\n        \\"ReferAccount\\": \\"127608589417****\\",\\n        \\"IncidentType\\": \\"graph\\",\\n        \\"RuleId\\": \\"crecr-21d7pogu9v4a****\\",\\n        \\"Remark\\": \\"dealed\\"\\n      }\\n    ]\\n  }\\n}","type":"json"}]',
-            'title' => 'DescribeCloudSiemEvents',
-        ],
-        'DescribeCloudSiemEventDetail' => [
-            'summary' => 'Queries the details of an event.',
-            'methods' => [
-                'get',
-                'post',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeOperators'],
+                ],
             ],
-            'schemes' => [
-                'http',
-                'https',
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DescribeOperators',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"Operator\\": \\"<=\\",\\n      \\"OperatorName\\": \\"<=\\",\\n      \\"OperatorDescCn\\": \\"arger than or equal to\\",\\n      \\"OperatorDescEn\\": \\"larger than or equal to\\",\\n      \\"SupportDataType\\": \\"varchar\\",\\n      \\"SupportTag\\": [\\n        \\"[AGGREGATE]\\"\\n      ],\\n      \\"Index\\": 3\\n    }\\n  ],\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
+        ],
+        'DescribeProdCount' => [
+            'summary' => 'Queries the number of Alibaba Cloud, Tencent Cloud, and Huawei Cloud products that can be integrated with Threat Analysis.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
@@ -9065,831 +6191,374 @@
                 'operationType' => 'get',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsasAFG0OH',
-                ],
+                'abilityTreeCode' => '195547',
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
-                    'name' => 'IncidentUuid',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '事件ID。',
-                        'description' => 'The UUID of the event.'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => '85ea4241-798f-4684-a876-65d4f0c3****',
-                    ],
-                ],
-                [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                        'title' => '0，单账号登录；1，全局视图；2，切换视图；3，局部视图',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The type of the view.'."\n"
+                        ."\n"
+                        .'- 0: the view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: the view of all accounts that belong to the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The user ID of a member. This parameter allows an administrator to switch to the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region where the Data Management center of Threat Analysis is located. Select a region for the Management Center based on the region where your assets reside. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'PlainResponse<SiemEvent>',
-                        'description' => 'PlainResponse'."\n",
+                        'title' => 'CloudSiemSuccessResponse<DescribeProdCountResult>',
+                        'description' => 'CloudSiemSuccessResponse',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
+                                'title' => '',
+                                'description' => 'The data returned.',
                                 'type' => 'object',
                                 'properties' => [
-                                    'GmtCreate' => [
-                                        'title' => '事件发生时间。',
-                                        'description' => 'The time when the event occurred.'."\n",
-                                        'type' => 'string',
-                                        'example' => '2021-01-06 16:37:29',
-                                    ],
-                                    'GmtModified' => [
-                                        'title' => '事件最后更新时间。',
-                                        'description' => 'The time when the event was last updated.'."\n",
-                                        'type' => 'string',
-                                        'example' => '2021-01-06 16:37:29',
-                                    ],
-                                    'Aliuid' => [
-                                        'title' => '事件归属主账号ID。',
-                                        'description' => 'The ID of the Alibaba Cloud account to which the event belongs.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int64',
-                                        'example' => '127608589417****',
-                                    ],
-                                    'AlertNum' => [
-                                        'title' => '事件关联告警数。',
-                                        'description' => 'The number of alerts that are associated with the event.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '4',
-                                    ],
-                                    'AssetNum' => [
-                                        'title' => '事件关联资产数。',
-                                        'description' => 'The number of assets that are associated with the event.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '4',
-                                    ],
-                                    'IncidentUuid' => [
-                                        'title' => '事件全局唯一ID。',
-                                        'description' => 'The UUID of the event.'."\n",
-                                        'type' => 'string',
-                                        'example' => '85ea4241-798f-4684-a876-65d4f0c3****',
-                                    ],
-                                    'IncidentName' => [
-                                        'title' => '事件名称。',
-                                        'description' => 'The name of the event.'."\n",
-                                        'type' => 'string',
-                                        'example' => 'Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc',
-                                    ],
-                                    'IncidentNameEn' => [
-                                        'title' => '事件英文名称。',
-                                        'description' => 'The name of the event in English.'."\n",
-                                        'type' => 'string',
-                                        'example' => 'Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc',
-                                    ],
-                                    'Description' => [
-                                        'title' => '事件描述。',
-                                        'description' => 'The description of the event.'."\n",
-                                        'type' => 'string',
-                                        'example' => 'The threat event contains 13 Miner Network,1 Execute suspicious encoded commands on Linux, etc',
-                                    ],
-                                    'DescriptionEn' => [
-                                        'title' => '事件英文描述。',
-                                        'description' => 'The description of the event in English.'."\n",
-                                        'type' => 'string',
-                                        'example' => 'The threat event contains 13 Miner Network,1 Execute suspicious encoded commands on Linux, etc',
-                                    ],
-                                    'DataSources' => [
-                                        'title' => '事件关联告警来源产品。',
-                                        'description' => 'The source of the alert.'."\n",
-                                        'type' => 'array',
-                                        'items' => [
-                                            'description' => 'The source.'."\n",
-                                            'type' => 'string',
-                                            'example' => '[sas,waf]',
-                                        ],
-                                        'example' => '[sas,waf]',
-                                    ],
-                                    'ThreatLevel' => [
-                                        'title' => '威胁等级。取值：'."\n"
-                                            .'- serious：高危'."\n"
-                                            .'- suspicious：中危'."\n"
-                                            .'- remind：低危',
-                                        'description' => 'The risk level. Valid values:'."\n"
-                                            ."\n"
-                                            .'*   serious: high'."\n"
-                                            .'*   suspicious: medium'."\n"
-                                            .'*   remind: low'."\n",
-                                        'type' => 'string',
-                                        'example' => 'remind',
-                                    ],
-                                    'ThreatScore' => [
-                                        'title' => '事件的威胁分值, 范围 0~100, 分值越高风险等级越高。',
-                                        'description' => 'The risk score of the event. The score ranges from 0 to 100. A higher score indicates a higher risk level.'."\n",
-                                        'type' => 'number',
-                                        'format' => 'float',
-                                        'example' => '90.2',
-                                    ],
-                                    'ExtContent' => [
-                                        'title' => '事件扩展信息 json格式。',
-                                        'description' => 'The extended information of the event in the JSON format.'."\n",
-                                        'type' => 'string',
-                                        'example' => '{"event_transfer_type":"customize_rule"}',
-                                    ],
-                                    'Status' => [
-                                        'title' => '事件状态。  取值：'."\n"
-                                            .'- 0:未处理 '."\n"
-                                            .'-1:处理中 '."\n"
-                                            .'-5：处理失败 '."\n"
-                                            .'-10:已处理',
-                                        'description' => 'The status of the event. Valid values:'."\n"
-                                            ."\n"
-                                            .'*   0: not handled'."\n"
-                                            .'*   1: handing'."\n"
-                                            .'*   5: handling failed'."\n"
-                                            .'*   10: handled'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '0',
-                                    ],
-                                    'AttCkLabels' => [
-                                        'title' => 'ATTCT&攻击技术标签集合。',
-                                        'description' => 'The tags of the ATT\\&CK attacks.'."\n",
-                                        'type' => 'array',
-                                        'items' => [
-                                            'description' => 'The tag.'."\n",
-                                            'type' => 'string',
-                                            'example' => '["T1595.002 Vulnerability Scanning"]',
-                                        ],
-                                        'example' => '["T1595.002 Vulnerability Scanning"]',
-                                    ],
-                                    'AttckStages' => [
-                                        'type' => 'array',
-                                        'items' => [
-                                            'type' => 'object',
-                                            'properties' => [
-                                                'TacticId' => [
-                                                    'type' => 'string',
-                                                ],
-                                                'TacticName' => [
-                                                    'type' => 'string',
-                                                ],
-                                                'AlertNum' => [
-                                                    'type' => 'integer',
-                                                    'format' => 'int32',
-                                                ],
-                                            ],
-                                        ],
-                                    ],
-                                    'ReferAccount' => [
-                                        'description' => 'Users associated with the event.',
-                                        'type' => 'string',
-                                        'example' => '17661858****/****,176618448****/****',
-                                    ],
-                                    'IncidentType' => [
-                                        'type' => 'string',
-                                    ],
-                                    'RuleId' => [
-                                        'type' => 'string',
-                                    ],
-                                    'Remark' => [
-                                        'title' => '事件备注。',
-                                        'description' => 'The remarks of the event.'."\n",
-                                        'type' => 'string',
-                                        'example' => 'dealed',
-                                    ],
+                                    'AliyunProdCount' => ['title' => '', 'description' => 'The number of Alibaba Cloud products.', 'type' => 'integer', 'format' => 'int32', 'example' => '19'],
+                                    'HcloudProdCount' => ['title' => '', 'description' => 'The number of Huawei Cloud products.', 'type' => 'integer', 'format' => 'int32', 'example' => '2'],
+                                    'QcloudProdCount' => ['title' => '', 'description' => 'The number of Tencent Cloud products.', 'type' => 'integer', 'format' => 'int32', 'example' => '2'],
+                                    'IdcProdCount' => ['title' => '', 'description' => 'The number of IDC products.', 'type' => 'integer', 'format' => 'int32', 'example' => '2'],
+                                    'AliyunImportedCount' => ['type' => 'integer', 'format' => 'int32', 'description' => 'The number of automatically connected Alibaba Cloud products.', 'title' => '', 'example' => '2'],
+                                    'HcloudImportedCount' => ['type' => 'integer', 'format' => 'int32', 'description' => 'The number of automatically connected Huawei Cloud products.', 'title' => '', 'example' => '2'],
+                                    'QcloudImportedCount' => ['type' => 'integer', 'format' => 'int32', 'description' => 'The number of automatically connected Tencent Cloud products.', 'title' => '', 'example' => '2'],
+                                    'IdcImportedCount' => ['type' => 'integer', 'format' => 'int32', 'description' => 'The number of automatically connected IDC products.', 'title' => '', 'example' => '2'],
                                 ],
-                                'example' => '123456',
-                            ],
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true：成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
+                                'example' => '',
                             ],
+                            'RequestId' => ['title' => '', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'DescribeProdCount',
+            'changeSet' => [
+                ['createdAt' => '2024-08-13T11:50:56.000Z', 'description' => 'Request parameters changed, Response parameters changed'],
+                ['createdAt' => '2024-07-18T01:29:00.000Z', 'description' => 'Request parameters changed'],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n    \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n    \\"Aliuid\\": 0,\\n    \\"AlertNum\\": 4,\\n    \\"AssetNum\\": 4,\\n    \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n    \\"IncidentName\\": \\"Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc\\",\\n    \\"IncidentNameEn\\": \\"Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc\\",\\n    \\"Description\\": \\"The threat event contains 13 Miner Network,1 Execute suspicious encoded commands on Linux, etc\\",\\n    \\"DescriptionEn\\": \\"The threat event contains 13 Miner Network,1 Execute suspicious encoded commands on Linux, etc\\",\\n    \\"DataSources\\": [\\n      \\"[sas,waf]\\"\\n    ],\\n    \\"ThreatLevel\\": \\"remind\\",\\n    \\"ThreatScore\\": 90.2,\\n    \\"ExtContent\\": \\"{\\\\\\"event_transfer_type\\\\\\":\\\\\\"customize_rule\\\\\\"}\\",\\n    \\"Status\\": 0,\\n    \\"AttCkLabels\\": [\\n      \\"[\\\\\\"T1595.002 Vulnerability Scanning\\\\\\"]\\"\\n    ],\\n    \\"AttckStages\\": [\\n      {\\n        \\"TacticId\\": \\"TA0008\\",\\n        \\"TacticName\\": \\"Persistence\\",\\n        \\"AlertNum\\": 21\\n      }\\n    ],\\n    \\"ReferAccount\\": \\"17661858****/****,176618448****/****\\",\\n    \\"IncidentType\\": \\"graph\\",\\n    \\"RuleId\\": \\"net-attack/101\\",\\n    \\"Remark\\": \\"dealed\\"\\n  },\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
-            'title' => 'DescribeCloudSiemEventDetail',
-        ],
-        'DescribeCloudSiemAssetsCounter' => [
-            'summary' => 'Queries the number of assets that are associated with an event by asset type.',
-            'methods' => [
-                'get',
-                'post',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeProdCount'],
+                ],
             ],
-            'schemes' => [
-                'https',
-                'http',
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DescribeProdCount',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"AliyunProdCount\\": 19,\\n    \\"HcloudProdCount\\": 2,\\n    \\"QcloudProdCount\\": 2,\\n    \\"IdcProdCount\\": 2,\\n    \\"AliyunImportedCount\\": 2,\\n    \\"HcloudImportedCount\\": 2,\\n    \\"QcloudImportedCount\\": 2,\\n    \\"IdcImportedCount\\": 2\\n  },\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+        ],
+        'DescribeScopeUsers' => [
+            'summary' => 'Retrieves the list of users in the playbook scope.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['https', 'http'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'get',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-            ],
+            'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
-                    'name' => 'IncidentUuid',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '事件id。',
-                        'description' => 'The UUID of the event.'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => '85ea4241-798f-4684-a876-65d4f0c3****',
-                    ],
-                ],
-                [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['description' => 'The view type.'."\n"
+                        ."\n"
+                        .'- 0: The view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: The view of all accounts that belong to the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member. This parameter is used when an administrator switches to the view of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region of the Data Management center. Select the region based on where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Assets are in regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'PlainResponse<List<CloudSiemEventAssetCounter>>',
-                        'description' => 'PlainResponse\\<List>'."\n",
+                        'title' => 'BaseResponse<List<SoarScope>>',
+                        'description' => 'BaseResponse\\<List>',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
+                                'title' => '',
+                                'description' => 'The data returned.',
                                 'type' => 'array',
                                 'items' => [
                                     'type' => 'object',
                                     'properties' => [
-                                        'AssetType' => [
-                                            'title' => '资产类型。取值：'."\n"
-                                                .'- ip:ip'."\n"
-                                                .'- domain：域名'."\n"
-                                                .'- url：url'."\n"
-                                                .'- process：进程'."\n"
-                                                .'- file：文件'."\n"
-                                                .'- host：主机',
-                                            'description' => 'The type of the asset. Valid values:'."\n"
-                                                ."\n"
-                                                .'*   ip'."\n"
-                                                .'*   domain'."\n"
-                                                .'*   url'."\n"
-                                                .'*   process'."\n"
-                                                .'*   file'."\n"
-                                                .'*   host'."\n",
-                                            'type' => 'string',
-                                            'example' => 'domain',
-                                        ],
-                                        'AssetNum' => [
-                                            'title' => '资产数量。',
-                                            'description' => 'The number of assets.'."\n",
-                                            'type' => 'integer',
-                                            'format' => 'int32',
-                                            'example' => '1',
+                                        'AliUid' => ['title' => '', 'description' => 'The user ID in Security Information and Event Management (SIEM).', 'type' => 'integer', 'format' => 'int64', 'example' => '123456789****'],
+                                        'UserName' => ['title' => '', 'description' => 'The username.', 'type' => 'string', 'example' => 'test001'],
+                                        'UserId' => ['title' => '多云用户ID。', 'description' => 'The multicloud user ID.', 'type' => 'string', 'example' => '123456789****'],
+                                        'CloudCode' => ['title' => '云code。  取值：'."\n"
+                                            .'- qcloud：腾讯云'."\n"
+                                            .'- hcloud：华为云', 'description' => 'The cloud code. Valid values:'."\n"
+                                            ."\n"
+                                            .'- qcloud: Tencent Cloud'."\n"
+                                            ."\n"
+                                            .'- hcloud: Huawei Cloud', 'type' => 'string', 'example' => 'qcloud'],
+                                        'InstanceId' => ['title' => '', 'description' => 'The ID of the Web Application Firewall (WAF) instance.', 'type' => 'string', 'example' => 'waf-cn-tl123ast****'],
+                                        'Domains' => [
+                                            'title' => '',
+                                            'description' => 'The list of domain names protected by the WAF instance.',
+                                            'type' => 'array',
+                                            'items' => ['description' => 'The list of domain names protected by the WAF instance.', 'type' => 'string', 'title' => '', 'example' => '[123***.com, 456***.com]'],
+                                            'example' => '[123.com, 456.com]',
                                         ],
                                     ],
+                                    'description' => '',
+                                    'title' => '',
+                                    'example' => '',
                                 ],
                                 'example' => '123456',
                             ],
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true：成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
-                            ],
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The request was successful.'."\n"
+                                ."\n"
+                                .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The message returned for the request.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'DescribeScopeUsers',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:43:23.000Z', 'description' => 'Error codes changed, Request parameters changed, Response parameters changed'],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"AssetType\\": \\"domain\\",\\n      \\"AssetNum\\": 1\\n    }\\n  ],\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
-            'title' => 'DescribeCloudSiemAssetsCounter',
-        ],
-        'DescribeCloudSiemAssets' => [
-            'summary' => 'Queries the assets that are associated with an event.',
-            'methods' => [
-                'get',
-                'post',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeScopeUsers'],
+                ],
             ],
-            'schemes' => [
-                'https',
-                'http',
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DescribeScopeUsers',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"AliUid\\": 0,\\n      \\"UserName\\": \\"test001\\",\\n      \\"UserId\\": \\"123456789****\\",\\n      \\"CloudCode\\": \\"qcloud\\",\\n      \\"InstanceId\\": \\"waf-cn-tl123ast****\\",\\n      \\"Domains\\": [\\n        \\"[123***.com, 456***.com]\\"\\n      ]\\n    }\\n  ],\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
+        ],
+        'DescribeServiceStatus' => [
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
+            'operationType' => 'read',
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'list',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
-            ],
+            'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
-                    'name' => 'IncidentUuid',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '事件ID。',
-                        'description' => 'The UUID of the event.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '85ea4241-798f-4684-a876-65d4f0c3****',
-                    ],
-                ],
-                [
-                    'name' => 'AssetType',
+                    'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '资产类型。取值：'."\n"
-                            .'- ip：ip'."\n"
-                            .'- domain：域名'."\n"
-                            .'- url：url'."\n"
-                            .'- process:进程'."\n"
-                            .'- file:文件'."\n"
-                            .'- host:主机',
-                        'description' => 'The type of the asset. Valid values:'."\n"
-                            ."\n"
-                            .'*   ip'."\n"
-                            .'*   domain'."\n"
-                            .'*   url'."\n"
-                            .'*   process'."\n"
-                            .'*   file'."\n"
-                            .'*   host'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'ip',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region of the Data Management hub. Select a region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: For assets in the Chinese mainland and China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: For assets in regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
-                [
-                    'name' => 'AssetName',
-                    'in' => 'formData',
+            ],
+            'responses' => [
+                200 => [
                     'schema' => [
-                        'title' => '资产名称。',
-                        'type' => 'string',
-                        'example' => 'test123',
+                        'title' => 'CloudSiemSuccessResponse<Boolean>',
+                        'description' => 'CloudSiemSuccessResponse',
+                        'type' => 'object',
+                        'properties' => [
+                            'Data' => ['title' => '', 'description' => 'The return value.'."\n"
+                                ."\n"
+                                .'- true: The authorization is granted.'."\n"
+                                ."\n"
+                                .'- false: The authorization is not granted.', 'type' => 'boolean', 'example' => 'true'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
+                        ],
+                        'example' => '',
                     ],
                 ],
-                [
-                    'name' => 'AssetUuid',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '资产uuid。',
-                        'type' => 'string',
-                        'example' => '123456-2222-3333-5555-3435345****',
-                    ],
+            ],
+            'errorCodes' => [
+                500 => [
+                    ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''],
                 ],
-                [
-                    'name' => 'CurrentPage',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '列表当前页号， 大于等于1。',
-                        'description' => 'The page number. Pages start from page 1.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => true,
-                        'minimum' => '1',
-                        'example' => '1',
+            ],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'DescribeServiceStatus',
+            'summary' => 'Checks whether a resource directory is authorized for threat analysis.',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeServiceStatus'],
+                ],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DescribeServiceStatus',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
                     ],
                 ],
+            ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": true,\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+        ],
+        'DescribeStorage' => [
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
+            'security' => [
                 [
-                    'name' => 'PageSize',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '列表每页条数， 最大不超过100。',
-                        'description' => 'The number of entries per page. Maximum value: 100.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => true,
-                        'maximum' => '100',
-                        'minimum' => '1',
-                        'example' => '10',
-                    ],
+                    'AK' => [],
                 ],
+            ],
+            'deprecated' => false,
+            'systemTags' => [
+                'operationType' => 'get',
+                'abilityTreeCode' => '190429',
+                'abilityTreeNodes' => ['FEATUREsasRXJ9SY'],
+            ],
+            'parameters' => [
                 [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                        'title' => '0，单账号登录；1，全局视图；2，切换视图；3，局部视图',
-                    ],
+                    'schema' => ['description' => 'The type of view. Valid values:'."\n"
+                        ."\n"
+                        .'- 0: The view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: The view of all accounts in your enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member whose view you want to use. This parameter is available only for administrators.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '137820528780****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region of the Data Management center for threat analysis. Select a region for the center based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Select this value if your assets are in the Chinese mainland or the China (Hong Kong) region.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Select this value if your assets are in regions outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'PageResponse<List<AssetInfo>>',
-                        'description' => 'PageResponse\\<List>'."\n",
+                        'title' => 'CloudSiemResponse<Boolean>',
+                        'description' => 'CloudSiemResponse',
                         'type' => 'object',
                         'properties' => [
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true:成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
-                            ],
-                            'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'object',
-                                'properties' => [
-                                    'PageInfo' => [
-                                        'title' => '分页记录。',
-                                        'description' => 'The pagination information.'."\n",
-                                        'type' => 'object',
-                                        'properties' => [
-                                            'CurrentPage' => [
-                                                'title' => '列表当前页号。',
-                                                'description' => 'The current page number.'."\n",
-                                                'type' => 'integer',
-                                                'format' => 'int32',
-                                                'example' => '1',
-                                            ],
-                                            'PageSize' => [
-                                                'title' => '每页返回记录数。',
-                                                'description' => 'The number of entries per page.'."\n",
-                                                'type' => 'integer',
-                                                'format' => 'int32',
-                                                'example' => '10',
-                                            ],
-                                            'TotalCount' => [
-                                                'title' => '记录总数。',
-                                                'description' => 'The total number of entries returned.'."\n",
-                                                'type' => 'integer',
-                                                'format' => 'int64',
-                                                'example' => '100',
-                                            ],
-                                        ],
-                                    ],
-                                    'ResponseData' => [
-                                        'title' => '详细数据。',
-                                        'description' => 'The detailed data.'."\n",
-                                        'type' => 'array',
-                                        'items' => [
-                                            'type' => 'object',
-                                            'properties' => [
-                                                'Id' => [
-                                                    'title' => '资产ID。',
-                                                    'description' => 'The ID of the asset.'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int64',
-                                                    'example' => '123',
-                                                ],
-                                                'GmtCreate' => [
-                                                    'title' => '资产同步时间。',
-                                                    'description' => 'The time when the asset was synchronized.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '2021-01-06 16:37:29',
-                                                ],
-                                                'GmtModified' => [
-                                                    'title' => '资产最后更新时间。',
-                                                    'description' => 'The time when the asset was last updated.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '2021-01-06 16:37:29',
-                                                ],
-                                                'Aliuid' => [
-                                                    'title' => 'siem主账号ID。',
-                                                    'description' => 'The ID of the Alibaba Cloud account in SIEM.'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int64',
-                                                    'example' => '1276085894174392',
-                                                ],
-                                                'SubUserId' => [
-                                                    'title' => '资产关联账号ID。',
-                                                    'description' => 'The ID of the associated account to which the asset belongs.'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int64',
-                                                    'example' => '176555323***',
-                                                ],
-                                                'IncidentUuid' => [
-                                                    'title' => '事件ID。',
-                                                    'description' => 'The UUID of the event.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '85ea4241-798f-4684-a876-65d4f0c3****',
-                                                ],
-                                                'AlertUuid' => [
-                                                    'title' => '事件关联告警ID。',
-                                                    'description' => 'The UUID of the alert associated with the event.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'sas_71e24437d2797ce8fc59692905a4****',
-                                                ],
-                                                'AssetName' => [
-                                                    'title' => '资产名称。',
-                                                    'description' => 'The name of the asset.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'zsw-agentless-centos****',
-                                                ],
-                                                'AssetType' => [
-                                                    'title' => '资产类型。取值：'."\n"
-                                                        .'- ip:ip'."\n"
-                                                        .'- domain：域名'."\n"
-                                                        .'- url：url'."\n"
-                                                        .'- process：进程'."\n"
-                                                        .'- file：文件'."\n"
-                                                        .'- host：主机',
-                                                    'description' => 'The type of the asset. Valid values:'."\n"
-                                                        ."\n"
-                                                        .'*   ip'."\n"
-                                                        .'*   domain'."\n"
-                                                        .'*   url'."\n"
-                                                        .'*   process'."\n"
-                                                        .'*   file'."\n"
-                                                        .'*   host'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'domain',
-                                                ],
-                                                'AssetInfo' => [
-                                                    'title' => '资产展示信息 json数组格式。',
-                                                    'description' => 'The display information of the asset is in the JSON format.'."\n",
-                                                    'type' => 'array',
-                                                    'items' => [
-                                                        'type' => 'object',
-                                                        'properties' => [
-                                                            'Key' => [
-                                                                'title' => '告警详细属性key。',
-                                                                'description' => 'The attribute key.'."\n",
-                                                                'type' => 'string',
-                                                                'example' => 'suspicious.wbd.wb.trojanpath',
-                                                            ],
-                                                            'KeyName' => [
-                                                                'title' => '告警详细数据名称。',
-                                                                'description' => 'The name of the key.'."\n",
-                                                                'type' => 'string',
-                                                                'example' => 'Trojan Path',
-                                                            ],
-                                                            'Values' => [
-                                                                'title' => '告警详细数据值。',
-                                                                'description' => 'The value of the key.'."\n",
-                                                                'type' => 'string',
-                                                                'example' => '/root/test33.php',
-                                                            ],
-                                                        ],
-                                                    ],
-                                                    'example' => '[{"KeyName": "${aliyun.siem.asset.asset_name}","Values": "zsw-agentless-ubuntu20","Key": "asset_name"}]',
-                                                ],
-                                                'AssetId' => [
-                                                    'title' => '资产逻辑ID。',
-                                                    'description' => 'The logical ID of the asset.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '0616caeb-acb8-45e0-8520-4ee5fbe251f0',
-                                                ],
-                                                'CloudCode' => [
-                                                    'title' => '实体来源云code。  取值：'."\n"
-                                                        .'- aliyun：阿里云'."\n"
-                                                        .'- qcloud：腾讯云'."\n"
-                                                        .'- hcloud：华为云',
-                                                    'description' => 'The cloud code of the entity. Valid values:'."\n"
-                                                        ."\n"
-                                                        .'*   aliyun: Alibaba Cloud'."\n"
-                                                        .'*   qcloud: Tencent Cloud'."\n"
-                                                        .'*   hcloud: Huawei Cloud'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'aliyun',
-                                                ],
-                                            ],
-                                        ],
-                                    ],
-                                ],
-                                'example' => '123456',
-                            ],
+                            'Data' => ['title' => '', 'description' => 'Indicates whether the project and Logstore created by the threat analysis service exist in your Simple Log Service. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The project and Logstore exist.'."\n"
+                                ."\n"
+                                .'- false: The project and Logstore do not exist.', 'type' => 'boolean', 'example' => 'true'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => 'CCEEE128-6607-503E-AAA6-C5E57D94****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''],
+                    ['errorCode' => 'SLS.Operation.Error', 'errorMessage' => 'SLS service is unavailable!', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'title' => 'DescribeStorage',
+            'summary' => 'Checks the status of the storage for the threat analysis feature. The storage is a Logstore in Simple Log Service.',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:44:01.000Z', 'description' => 'Request parameters changed'],
+                ['createdAt' => '2023-12-13T09:49:23.000Z', 'description' => 'Error codes changed, Request parameters changed, Response parameters changed'],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n  \\"Data\\": {\\n    \\"PageInfo\\": {\\n      \\"CurrentPage\\": 1,\\n      \\"PageSize\\": 10,\\n      \\"TotalCount\\": 100\\n    },\\n    \\"ResponseData\\": [\\n      {\\n        \\"Id\\": 123,\\n        \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n        \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n        \\"Aliuid\\": 1276085894174392,\\n        \\"SubUserId\\": 0,\\n        \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n        \\"AlertUuid\\": \\"sas_71e24437d2797ce8fc59692905a4****\\",\\n        \\"AssetName\\": \\"zsw-agentless-centos****\\",\\n        \\"AssetType\\": \\"domain\\",\\n        \\"AssetInfo\\": [\\n          {\\n            \\"Key\\": \\"suspicious.wbd.wb.trojanpath\\",\\n            \\"KeyName\\": \\"Trojan Path\\",\\n            \\"Values\\": \\"/root/test33.php\\"\\n          }\\n        ],\\n        \\"AssetId\\": \\"0616caeb-acb8-45e0-8520-4ee5fbe251f0\\",\\n        \\"CloudCode\\": \\"aliyun\\"\\n      }\\n    ]\\n  }\\n}","type":"json"}]',
-            'title' => 'DescribeCloudSiemAssets',
-        ],
-        'DescribeAlertsWithEvent' => [
-            'summary' => 'Queries the alerts that are associated with an event.',
-            'methods' => [
-                'get',
-                'post',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeStorage'],
+                ],
             ],
-            'schemes' => [
-                'http',
-                'https',
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DescribeStorage',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": true,\\n  \\"RequestId\\": \\"CCEEE128-6607-503E-AAA6-C5E57D94****\\"\\n}","type":"json"}]',
+        ],
+        'DescribeUserBuyStatus' => [
+            'summary' => 'Checks whether the current Alibaba Cloud account or its associated enterprise organization has purchased threat analysis.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
@@ -9901,2492 +6570,1910 @@
                 'operationType' => 'get',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsasAFG0OH',
-                ],
+                'abilityTreeCode' => '157646',
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
-                    'name' => 'IncidentUuid',
+                    'name' => 'SubUserId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '事件ID。',
-                        'description' => 'The ID of the event.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '85ea4241-798f-4684-a876-65d4f0c3****',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '123XXXXXX'],
                 ],
                 [
-                    'name' => 'Level',
+                    'name' => 'RegionId',
                     'in' => 'formData',
-                    'style' => 'repeatList',
+                    'schema' => ['title' => '', 'description' => 'The region of the Data Management center for threat analysis. Select a region for the management center based on where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
+                ],
+            ],
+            'responses' => [
+                200 => [
                     'schema' => [
-                        'title' => '威胁等级，格式为json数组。取值：'."\n"
-                            .'- serious：高危'."\n"
-                            .'- suspicious：中危'."\n"
-                            .'- remind：低危',
-                        'description' => 'The risk levels. The value is a JSON array. Valid values:'."\n"
-                            ."\n"
-                            .'*   serious: high'."\n"
-                            .'*   suspicious: medium'."\n"
-                            .'*   remind: low'."\n",
-                        'type' => 'array',
-                        'items' => [
-                            'description' => 'The risk level. The value is a JSON string. Valid values:'."\n"
-                                ."\n"
-                                .'*   serious: high'."\n"
-                                .'*   suspicious: medium'."\n"
-                                .'*   remind: low'."\n",
-                            'type' => 'string',
-                            'required' => false,
-                            'example' => '["remind","serious"]'."\n",
+                        'title' => 'CloudSiemSuccessResponse<UserBuyOrderStatusResult>',
+                        'description' => 'CloudSiemSuccessResponse',
+                        'type' => 'object',
+                        'properties' => [
+                            'Data' => [
+                                'description' => 'The response parameters.',
+                                'type' => 'object',
+                                'properties' => [
+                                    'MasterUserId' => ['title' => '', 'description' => 'The ID of the master account of the resource directory.', 'type' => 'integer', 'format' => 'int64', 'example' => '123XXXXXX'],
+                                    'MasterUserName' => ['title' => '', 'description' => 'The display name of the master account of the resource directory.', 'type' => 'string', 'example' => 'rd_master_xxx'],
+                                    'MainUserId' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account that purchased threat analysis.', 'type' => 'integer', 'format' => 'int64', 'example' => '123XXXXXX'],
+                                    'MainUserName' => ['title' => '', 'description' => 'The name of the Alibaba Cloud account that purchased threat analysis.', 'type' => 'string', 'example' => 'sas_account_xxx'],
+                                    'SubUserId' => ['title' => '', 'description' => 'The ID of the currently logged-on Alibaba Cloud account.', 'type' => 'integer', 'format' => 'int64', 'example' => '123XXXXXX'],
+                                    'SubUserName' => ['title' => '', 'description' => 'The name of the currently logged-on Alibaba Cloud account.', 'type' => 'string', 'example' => 'sas_account_xxx'],
+                                    'Capacity' => ['title' => '', 'description' => 'The purchased capacity of Simple Log Service (SLS) for threat analysis. Unit: GB.', 'type' => 'integer', 'format' => 'int32', 'example' => '1024'],
+                                    'SasInstanceId' => ['title' => '', 'description' => 'The ID of the Security Center instance.', 'type' => 'string', 'example' => 'sas-instance-xxxxx'],
+                                    'CanBuy' => ['title' => '', 'description' => 'Indicates whether the current account can perform operations on threat analysis orders. Valid values:'."\n"
+                                        ."\n"
+                                        .'- true: The account can purchase, upgrade, or downgrade threat analysis.'."\n"
+                                        ."\n"
+                                        .'- false: The account cannot perform operations on threat analysis orders.', 'type' => 'boolean', 'example' => 'true'],
+                                    'EndTime' => ['title' => '', 'description' => 'The expiration time of threat analysis. This value is a UNIX timestamp in milliseconds.', 'type' => 'integer', 'format' => 'int64', 'example' => '1669823999000'],
+                                    'DurationDays' => ['title' => '', 'description' => 'The number of days before threat analysis expires.', 'type' => 'integer', 'format' => 'int64', 'example' => '3'],
+                                    'RdOrder' => ['type' => 'integer', 'format' => 'int32', 'title' => '', 'description' => 'The type of the current order.'."\n"
+                                        ."\n"
+                                        .'- 0: The order includes threat analysis traffic and capacity.'."\n"
+                                        ."\n"
+                                        .'- 1: The order includes only threat analysis capacity.', 'example' => '1'],
+                                ],
+                                'title' => '',
+                                'example' => '',
+                            ],
+                            'RequestId' => ['title' => '', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '81D8EC0C-0804-51AD-8C38-17ED0BC74892'],
                         ],
-                        'required' => false,
-                        'example' => '["serious","suspicious","remind"]',
-                        'maxItems' => 100,
+                        'example' => '',
                     ],
                 ],
-                [
-                    'name' => 'AlertTitle',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '告警标题。',
-                        'description' => 'The title of the alert.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'Scan-Try SNMP weak password'."\n",
-                    ],
+            ],
+            'errorCodes' => [
+                500 => [
+                    ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''],
+                ],
+            ],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"MasterUserId\\": 0,\\n    \\"MasterUserName\\": \\"rd_master_xxx\\",\\n    \\"MainUserId\\": 0,\\n    \\"MainUserName\\": \\"sas_account_xxx\\",\\n    \\"SubUserId\\": 0,\\n    \\"SubUserName\\": \\"sas_account_xxx\\",\\n    \\"Capacity\\": 1024,\\n    \\"SasInstanceId\\": \\"sas-instance-xxxxx\\",\\n    \\"CanBuy\\": true,\\n    \\"EndTime\\": 1669823999000,\\n    \\"DurationDays\\": 3,\\n    \\"RdOrder\\": 1\\n  },\\n  \\"RequestId\\": \\"81D8EC0C-0804-51AD-8C38-17ED0BC74892\\"\\n}","type":"json"}]',
+            'title' => 'DescribeUserBuyStatus',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:47:27.000Z', 'description' => 'Request parameters changed, Response parameters changed'],
+            ],
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeUserBuyStatus'],
                 ],
+            ],
+            'ramActions' => [
                 [
-                    'name' => 'AlertType',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '告警类型。',
-                        'type' => 'string',
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DescribeUserBuyStatus',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
                     ],
                 ],
+            ],
+        ],
+        'DescribeWafScope' => [
+            'summary' => 'Retrieves the list of domain names protected by Web Application Firewall (WAF) instances.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['https', 'http'],
+            'security' => [
                 [
-                    'name' => 'AlertName',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '告警名称。',
-                        'type' => 'string',
-                    ],
+                    'AK' => [],
                 ],
+            ],
+            'deprecated' => false,
+            'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'],
+            'parameters' => [
                 [
-                    'name' => 'AssetName',
+                    'name' => 'EntityId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '资产名称。',
-                        'type' => 'string',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The entity ID.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '20617784'],
                 ],
                 [
-                    'name' => 'AssetId',
+                    'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '资产id。',
-                        'type' => 'string',
-                    ],
+                    'schema' => ['description' => 'The view type.'."\n"
+                        ."\n"
+                        .'- 0: the view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: the view of all accounts within the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
-                    'name' => 'EntityName',
+                    'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '实体名称。',
-                        'type' => 'string',
-                    ],
+                    'schema' => ['description' => 'The ID of a member. An administrator can use this parameter to assume the permissions of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
-                    'name' => 'EntityId',
+                    'name' => 'RegionId',
                     'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The region where the Data Management center of threat analysis is located. Select a region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
+                ],
+            ],
+            'responses' => [
+                200 => [
                     'schema' => [
-                        'title' => '实体id。',
-                        'type' => 'string',
+                        'title' => 'BaseResponse<List<WafScope>>',
+                        'description' => 'BaseResponse\\<List>',
+                        'type' => 'object',
+                        'properties' => [
+                            'Data' => [
+                                'title' => '',
+                                'description' => 'The data returned.',
+                                'type' => 'array',
+                                'items' => [
+                                    'type' => 'object',
+                                    'properties' => [
+                                        'InstanceId' => ['title' => '', 'description' => 'The ID of the WAF instance.', 'type' => 'string', 'example' => 'waf-cn-tl123ast****'],
+                                        'Aliuid' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account.', 'type' => 'integer', 'format' => 'int64', 'example' => '127608589417****'],
+                                        'Domains' => [
+                                            'title' => '',
+                                            'description' => 'The list of domain names that are protected by the WAF instance.',
+                                            'type' => 'array',
+                                            'items' => ['description' => 'The domain names that are protected by the WAF instance.', 'type' => 'string', 'title' => '', 'example' => '[123***.com, 456***.com]'],
+                                            'example' => '[123.com, 456.com]',
+                                        ],
+                                    ],
+                                    'description' => '',
+                                    'title' => '',
+                                    'example' => '',
+                                ],
+                                'example' => '123456',
+                            ],
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The request was successful.'."\n"
+                                ."\n"
+                                .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The message returned.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
+                        ],
+                        'example' => '',
                     ],
                 ],
+            ],
+            'errorCodes' => [
+                500 => [
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
+                ],
+            ],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'DescribeWafScope',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:43:24.000Z', 'description' => 'Error codes changed, Request parameters changed'],
+            ],
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeWafScope'],
+                ],
+            ],
+            'ramActions' => [
                 [
-                    'name' => 'SubUserId',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '告警关联账号ID。',
-                        'description' => 'The ID of the account within which the alert is generated.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '176555323***',
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DescribeWafScope',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
                     ],
                 ],
+            ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"InstanceId\\": \\"waf-cn-tl123ast****\\",\\n      \\"Aliuid\\": 0,\\n      \\"Domains\\": [\\n        \\"[123***.com, 456***.com]\\"\\n      ]\\n    }\\n  ],\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
+        ],
+        'DescribeWhiteRuleList' => [
+            'summary' => 'Queries the rules in the alert whitelist.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['https', 'http'],
+            'security' => [
                 [
-                    'name' => 'Source',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '告警数据源。',
-                        'description' => 'The data source of the alert.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'sas',
-                    ],
+                    'AK' => [],
                 ],
+            ],
+            'deprecated' => false,
+            'systemTags' => ['operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free'],
+            'parameters' => [
                 [
-                    'name' => 'IsDefend',
+                    'name' => 'AlertType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '是否已防御',
-                        'description' => 'Specifies whether an attack is defended. Valid values:'."\n"
-                            ."\n"
-                            .'*   0: detected'."\n"
-                            .'*   1: blocked'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The alert type.', 'type' => 'string', 'required' => false, 'example' => 'scan'],
                 ],
                 [
-                    'name' => 'StartTime',
+                    'name' => 'AlertName',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '查询开始时间, 单位毫秒。',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'example' => '1577808000000',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The alert name.', 'type' => 'string', 'required' => false, 'example' => 'Try SNMP weak password'],
                 ],
                 [
-                    'name' => 'EndTime',
+                    'name' => 'IncidentUuid',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '查询结束时间, 单位毫秒。',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'example' => '1577808000000',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The universally unique identifier (UUID) of the event.', 'type' => 'string', 'required' => false, 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'],
                 ],
                 [
                     'name' => 'CurrentPage',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '列表当前页号， 大于等于1。',
-                        'description' => 'The page number. Pages start from page 1.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => true,
-                        'minimum' => '1',
-                        'example' => '1',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The page number. The value must be greater than or equal to 1.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'minimum' => '1', 'example' => '1'],
                 ],
                 [
                     'name' => 'PageSize',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '列表每页条数， 最大不超过100。',
-                        'description' => 'The number of entries per page. Maximum value: 100.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => true,
-                        'maximum' => '100',
-                        'minimum' => '1',
-                        'example' => '10',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The number of entries per page. The maximum value is 100.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'maximum' => '100', 'minimum' => '1', 'example' => '10'],
                 ],
                 [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view.'."\n"
-                            ."\n"
-                            .'*   0: view of the current Alibaba Cloud account.'."\n"
-                            .'*   1: view of all accounts for the enterprise.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                        'title' => '0，单账号登录；1，全局视图；2，切换视图；3，局部视图',
-                    ],
+                    'schema' => ['description' => 'The view type.'."\n"
+                        ."\n"
+                        .'- 0: the view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: the view of all accounts that are managed by the administrator account.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the member in the resource directory.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The ID of the member. This parameter is used in a multi-account management scenario. An administrator can specify this parameter to query the data of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region where the data management center of Threat Analysis is deployed. You must select the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are deployed in the Chinese mainland or in the China (Hong Kong) region.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are deployed in regions outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'PageResponse<List<AlertDetail>>',
-                        'description' => 'PageResponse\\<List>'."\n",
+                        'title' => 'PageResponse<List<WhitelistRule>>',
+                        'description' => 'PageResponse\\<List>',
                         'type' => 'object',
                         'properties' => [
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true:成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
-                            ],
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The request was successful.'."\n"
+                                ."\n"
+                                .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The returned message.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
+                                'title' => '',
+                                'description' => 'The return value.',
                                 'type' => 'object',
                                 'properties' => [
                                     'PageInfo' => [
-                                        'title' => '分页记录。',
-                                        'description' => 'The pagination information.'."\n",
+                                        'title' => '',
+                                        'description' => 'The pagination information.',
                                         'type' => 'object',
                                         'properties' => [
-                                            'CurrentPage' => [
-                                                'title' => '列表当前页号。',
-                                                'description' => 'The current page number.'."\n",
-                                                'type' => 'integer',
-                                                'format' => 'int32',
-                                                'example' => '1',
-                                            ],
-                                            'PageSize' => [
-                                                'title' => '每页返回记录数。',
-                                                'description' => 'The number of entries per page.'."\n",
-                                                'type' => 'integer',
-                                                'format' => 'int32',
-                                                'example' => '10',
-                                            ],
-                                            'TotalCount' => [
-                                                'title' => '记录总数。',
-                                                'description' => 'The total number of entries returned.'."\n",
-                                                'type' => 'integer',
-                                                'format' => 'int64',
-                                                'example' => '100',
-                                            ],
+                                            'CurrentPage' => ['title' => '', 'description' => 'The current page number.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'],
+                                            'PageSize' => ['title' => '', 'description' => 'The number of entries returned per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10'],
+                                            'TotalCount' => ['title' => '', 'description' => 'The total number of entries.', 'type' => 'integer', 'format' => 'int64', 'example' => '100'],
                                         ],
+                                        'example' => '',
                                     ],
                                     'ResponseData' => [
-                                        'title' => '详细数据。',
-                                        'description' => 'The detailed data.'."\n",
+                                        'title' => '',
+                                        'description' => 'The detailed data.',
                                         'type' => 'array',
                                         'items' => [
                                             'type' => 'object',
                                             'properties' => [
-                                                'Id' => [
-                                                    'title' => '告警唯一ID。',
-                                                    'description' => 'The unique ID of the alert.'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int64',
-                                                    'example' => '123456789',
-                                                ],
-                                                'GmtCreate' => [
-                                                    'title' => '告警入库时间。',
-                                                    'description' => 'The time when the alert was received.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '2021-01-06 16:37:29',
-                                                ],
-                                                'GmtModified' => [
-                                                    'title' => '告警最后更新时间。',
-                                                    'description' => 'The time when the alert was last updated.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '2021-01-06 16:37:29',
-                                                ],
-                                                'MainUserId' => [
-                                                    'title' => '告警关联siem主账号ID。',
-                                                    'description' => 'The ID of the Alibaba Cloud account that is associated with the alert in SIEM.'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int64',
-                                                    'example' => '127608589417****',
-                                                ],
-                                                'IncidentUuid' => [
-                                                    'title' => '事件全局唯一id。',
-                                                    'description' => 'The UUID of the event.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '85ea4241-798f-4684-a876-65d4f0c3****',
-                                                ],
-                                                'AlertUuid' => [
-                                                    'title' => '告警id。',
-                                                    'description' => 'The UUID of the alert.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'sas_71e24437d2797ce8fc59692905a4****',
-                                                ],
-                                                'LogTime' => [
-                                                    'title' => '告警记录时间。',
-                                                    'description' => 'The time when the alert was recorded.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '2021-01-06 16:37:29',
-                                                ],
-                                                'AlertSrcProd' => [
-                                                    'title' => '事件关联告警来源产品。',
-                                                    'description' => 'The source of the alert.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'sas',
-                                                ],
-                                                'AlertTitle' => [
-                                                    'title' => '告警标题。',
-                                                    'description' => 'The title of the alert.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'Scan-Try SNMP weak password',
-                                                ],
-                                                'AlertTitleEn' => [
-                                                    'title' => '告警标题英文。',
-                                                    'description' => 'The alert title in English.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'Scan-Try SNMP weak password',
-                                                ],
-                                                'AlertType' => [
-                                                    'title' => '告警类型。',
-                                                    'description' => 'The type of the alert.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'Scan',
-                                                ],
-                                                'AlertTypeEn' => [
-                                                    'title' => '告警类型英文。',
-                                                    'description' => 'The alert type in English.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'Scan',
-                                                ],
-                                                'AlertTypeCode' => [
-                                                    'title' => '告警类型美杜莎code。',
-                                                    'description' => 'The internal code of the alert type.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'security_event_config.event_name.webshellName',
-                                                ],
-                                                'AlertName' => [
-                                                    'title' => '告警名称。',
-                                                    'description' => 'The name of the alert.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'Try SNMP weak password',
-                                                ],
-                                                'AlertNameEn' => [
-                                                    'title' => '告警名称。',
-                                                    'description' => 'The alert name in English.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'Try SNMP weak password',
-                                                ],
-                                                'AlertNameCode' => [
-                                                    'title' => '告警名称美杜莎code。',
-                                                    'description' => 'The internal code of the alert name.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'security_event_config.event_name.webshell',
-                                                ],
-                                                'AlertLevel' => [
-                                                    'title' => '威胁等级。 取值：'."\n"
-                                                        .'- serious：高危'."\n"
-                                                        .'- suspicious：中危'."\n"
-                                                        .'- remind：低危',
-                                                    'description' => 'The risk level. Valid values:'."\n"
-                                                        ."\n"
-                                                        .'*   serious: high.'."\n"
-                                                        .'*   suspicious: medium.'."\n"
-                                                        .'*   remind: low.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'remind',
-                                                ],
-                                                'AssetList' => [
-                                                    'title' => '资产列表。',
-                                                    'description' => 'The details of the asset.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '['."\n"
-                                                        .'      {'."\n"
-                                                        .'            "is_main_asset": "1",'."\n"
-                                                        .'            "asset_name": "47.245.*",'."\n"
-                                                        .'            "port": "22",'."\n"
-                                                        .'            "ip": "47.245.*",'."\n"
-                                                        .'            "asset_type": "ip",'."\n"
-                                                        .'            "location": "ap-southeast-1",'."\n"
-                                                        .'            "asset_id": "47.245.*",'."\n"
-                                                        .'            "net_connect_dir": "in"'."\n"
-                                                        .'      }'."\n"
-                                                        .']',
-                                                ],
-                                                'OccurTime' => [
-                                                    'title' => '告警发生时间。',
-                                                    'description' => 'The time when the alert was triggered.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '2021-01-06 16:37:29',
-                                                ],
-                                                'StartTime' => [
-                                                    'title' => '告警首次发生时间。',
-                                                    'description' => 'The time at which the alert was first generated.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '2021-01-06 16:37:29',
-                                                ],
-                                                'EndTime' => [
-                                                    'title' => '告警结束时间。',
-                                                    'description' => 'The time when the alert was closed.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '2021-01-06 16:37:29',
-                                                ],
-                                                'AlertSrcProdModule' => [
-                                                    'title' => '事件关联告警来源产品子模块。',
-                                                    'description' => 'The sub-module of the alert source.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'waf',
-                                                ],
-                                                'AlertDesc' => [
-                                                    'title' => '告警描述。',
-                                                    'description' => 'The description of the alert.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.',
-                                                ],
-                                                'AlertDescEn' => [
-                                                    'title' => '告警英文描述。',
-                                                    'description' => 'The alert description in English.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.',
-                                                ],
-                                                'AlertDescCode' => [
-                                                    'title' => '告警描述美杜莎code。',
-                                                    'description' => 'The internal code of the alert description.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'security_event_config.event_name.webshell'."\n",
-                                                ],
-                                                'AlertDetail' => [
-                                                    'title' => '告警详情。',
-                                                    'description' => 'The details of the alert.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '{"main_user_id": "165295629792****";"log_uuid_count": "99";"attack_ip": "21.92.*.*"}',
-                                                ],
-                                                'LogUuid' => [
-                                                    'title' => '告警log UUID。',
-                                                    'description' => 'The UUID of the alert log.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'cfw_d12e285a-a042-4d7e-be89-f8a795ef****',
-                                                ],
-                                                'EntityList' => [
-                                                    'title' => '实体详情（标准化/开启索引）',
-                                                    'description' => 'The details of the entity.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '[{&quot;entity_user_id&quot;:&quot;198921674491****&quot;,&quot;entity_account_id&quot;:&quot;N/A&quot;,&quot;entity_uuid&quot;:&quot;6245f979d5dd9ef8dd19bdc72228****&quot;,&quot;entity_type&quot;:&quot;host&quot;,&quot;entity_name&quot;:&quot;zhh-test-20240409&quot;,&quot;is_comprised&quot;:&quot;1&quot;,&quot;os_type&quot;:&quot;linux&quot;,&quot;entity_id&quot;:&quot;a88f44dd-b8d4-4ded-831c-77a4835****&quot;,&quot;host_uuid&quot;:&quot;a88f44dd-b8d4-4ded-831c-77a4835****&quot;,&quot;host_name&quot;:&quot;zhh-test-2024****&quot;}]',
-                                                ],
-                                                'AttCk' => [
-                                                    'title' => 'ATTCT&攻击技术标签。',
-                                                    'description' => 'The tag of the ATT\\&CK technique.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'T1595.002 Vulnerability Scanning',
-                                                ],
-                                                'SubUserId' => [
-                                                    'title' => '产生告警阿里账号ID。',
-                                                    'description' => 'The ID of the Alibaba Cloud account within which the alert is generated.'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int64',
-                                                    'example' => '176555323***',
-                                                ],
-                                                'SubUserName' => [
-                                                    'title' => '产生告警阿里账号ID。',
-                                                    'type' => 'string',
-                                                    'example' => '176555323***',
-                                                ],
-                                                'CloudCode' => [
-                                                    'title' => '云code。  取值：'."\n"
-                                                        .'- aliyun：阿里云'."\n"
-                                                        .'- qcloud：腾讯云'."\n"
-                                                        .'- hcloud：华为云',
-                                                    'description' => 'The code of the cloud service provider. Valid values:'."\n"
-                                                        ."\n"
-                                                        .'*   aliyun: Alibaba Cloud.'."\n"
-                                                        .'*   qcloud: Tencent Cloud.'."\n"
-                                                        .'*   hcloud: Huawei Cloud.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'aliyun',
-                                                ],
-                                                'IsDefend' => [
-                                                    'title' => '是否已防御',
-                                                    'description' => 'Indicates whether an attack is defended against. Valid values:'."\n"
-                                                        ."\n"
-                                                        .'*   0: detected.'."\n"
-                                                        .'*   1: blocked.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '1',
-                                                ],
-                                                'AlertInfoList' => [
-                                                    'title' => '告警详细数据。',
-                                                    'description' => 'The displayed details of the alert.'."\n",
-                                                    'type' => 'array',
-                                                    'items' => [
-                                                        'type' => 'object',
-                                                        'properties' => [
-                                                            'Key' => [
-                                                                'title' => '告警详细属性key。',
-                                                                'description' => 'The attribute key.'."\n",
-                                                                'type' => 'string',
-                                                                'example' => 'suspicious.wbd.wb.trojanpath',
-                                                            ],
-                                                            'KeyName' => [
-                                                                'title' => '告警详细数据名称。',
-                                                                'description' => 'The name of the key.'."\n",
-                                                                'type' => 'string',
-                                                                'example' => 'Trojan Path'."\n",
-                                                            ],
-                                                            'Values' => [
-                                                                'title' => '告警详细数据值。',
-                                                                'description' => 'The value of the key.'."\n",
-                                                                'type' => 'string',
-                                                                'example' => '/root/test33.php',
+                                                'Id' => ['title' => '', 'description' => 'The unique ID of the whitelist rule.', 'type' => 'integer', 'format' => 'int64', 'example' => '123456789'],
+                                                'GmtCreate' => ['title' => '', 'description' => 'The time when the rule was created.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'],
+                                                'GmtModified' => ['title' => '', 'description' => 'The time when the rule was last modified.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'],
+                                                'Aliuid' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account that is used to purchase Threat Analysis.', 'type' => 'integer', 'format' => 'int64', 'example' => '127608589417****'],
+                                                'SubAliuid' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account that is used to create the rule.', 'type' => 'integer', 'format' => 'int64', 'example' => '176555323***'],
+                                                'AlertType' => ['title' => '', 'description' => 'The alert type.', 'type' => 'string', 'example' => 'scan'],
+                                                'AlertTypeId' => ['title' => '', 'description' => 'The ID of the alert type.', 'type' => 'string', 'example' => 'scan'],
+                                                'AlertName' => ['title' => '', 'description' => 'The alert name.', 'type' => 'string', 'example' => 'Try SNMP weak password'],
+                                                'AlertNameId' => ['title' => '', 'description' => 'The ID of the alert name.', 'type' => 'string', 'example' => 'Try SNMP weak password'],
+                                                'Status' => ['title' => '', 'description' => 'The status of the rule. Valid values:'."\n"
+                                                    ."\n"
+                                                    .'- 1: enabled'."\n"
+                                                    ."\n"
+                                                    .'- 0: disabled', 'type' => 'integer', 'format' => 'int32', 'example' => '1'],
+                                                'IncidentUuid' => ['title' => '', 'description' => 'The UUID of the event.', 'type' => 'string', 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'],
+                                                'AlertUuid' => ['title' => '', 'description' => 'The UUID of the alert.', 'type' => 'string', 'example' => 'sas_71e24437d2797ce8fc59692905a4****'],
+                                                'Expression' => [
+                                                    'title' => '',
+                                                    'description' => 'The rule conditions, which are in the JSON array format.',
+                                                    'type' => 'object',
+                                                    'properties' => [
+                                                        'Logic' => ['description' => 'The logical relation for the conditions.', 'type' => 'string', 'title' => '', 'example' => '(1&2)|(3&4)'],
+                                                        'Conditions' => [
+                                                            'description' => 'The array of rule conditions.',
+                                                            'type' => 'array',
+                                                            'items' => [
+                                                                'description' => 'The array of rule conditions.',
+                                                                'type' => 'object',
+                                                                'properties' => [
+                                                                    'ItemId' => ['description' => 'The condition ID.', 'type' => 'integer', 'format' => 'int32', 'title' => '', 'example' => '1'],
+                                                                    'Operator' => ['description' => 'The operator. Valid values:'."\n"
+                                                                        ."\n"
+                                                                        .'- `=`: equals'."\n"
+                                                                        ."\n"
+                                                                        .'- `<>`: does not equal'."\n"
+                                                                        ."\n"
+                                                                        .'- `in`: includes'."\n"
+                                                                        ."\n"
+                                                                        .'- `not in`: does not include'."\n"
+                                                                        ."\n"
+                                                                        .'- `REGEXP`: matches a regular expression'."\n"
+                                                                        ."\n"
+                                                                        .'- `NOT REGEXP`: does not match a regular expression', 'type' => 'string', 'title' => '', 'example' => 'REGEXP'],
+                                                                    'IsNot' => ['description' => 'Indicates whether to negate the result. Valid values:'."\n"
+                                                                        ."\n"
+                                                                        .'- true: The result is negated.'."\n"
+                                                                        ."\n"
+                                                                        .'- false: The result is not negated.', 'type' => 'boolean', 'title' => '', 'example' => 'false'],
+                                                                    'Left' => [
+                                                                        'description' => 'The left operand of the condition.',
+                                                                        'type' => 'object',
+                                                                        'properties' => [
+                                                                            'Value' => ['description' => 'The variable of the left operand.', 'type' => 'string', 'title' => '', 'example' => 'ip'],
+                                                                            'IsVar' => ['description' => 'Indicates whether the left operand is a variable. Valid values:'."\n"
+                                                                                ."\n"
+                                                                                .'- true: variable'."\n"
+                                                                                ."\n"
+                                                                                .'- false: constant', 'type' => 'boolean', 'title' => '', 'example' => 'true'],
+                                                                            'Type' => ['description' => 'Specifies whether the value is a constant. Valid values:'."\n"
+                                                                                ."\n"
+                                                                                .'- true: The value is a constant.'."\n"
+                                                                                ."\n"
+                                                                                .'- false: The value is not a constant.', 'type' => 'string', 'title' => '', 'example' => 'false'],
+                                                                            'Modifier' => ['description' => 'The remarks.', 'type' => 'string', 'title' => '', 'example' => 'length'],
+                                                                            'ModifierParam' => [
+                                                                                'description' => 'The key-value pair for the remarks.',
+                                                                                'type' => 'object',
+                                                                                'additionalProperties' => ['type' => 'any', 'description' => 'The key-value pair for the remarks.', 'title' => '', 'example' => '{"tage":"description"}'],
+                                                                                'title' => '',
+                                                                                'example' => '',
+                                                                            ],
+                                                                        ],
+                                                                        'title' => '',
+                                                                        'example' => '',
+                                                                    ],
+                                                                    'Right' => [
+                                                                        'description' => 'The right operand.',
+                                                                        'type' => 'object',
+                                                                        'properties' => [
+                                                                            'Value' => ['description' => 'The value of the right operand.', 'type' => 'string', 'title' => '', 'example' => '12345'],
+                                                                            'IsVar' => ['description' => 'Specifies whether the right operand is a constant or a runtime variable. A runtime variable obtains a value from the runtime context. Valid values:'."\n"
+                                                                                ."\n"
+                                                                                .'- true: runtime variable'."\n"
+                                                                                ."\n"
+                                                                                .'- false: constant', 'type' => 'boolean', 'title' => '', 'example' => 'false'],
+                                                                            'Type' => ['description' => 'The data type.', 'type' => 'string', 'title' => '', 'example' => 'String'],
+                                                                            'Modifier' => ['description' => 'The remarks.', 'type' => 'string', 'title' => '', 'example' => 'length'],
+                                                                            'ModifierParam' => [
+                                                                                'description' => 'The key-value pair for the remarks.',
+                                                                                'type' => 'object',
+                                                                                'additionalProperties' => ['type' => 'any', 'description' => 'The key-value pair for the remarks.', 'title' => '', 'example' => '{"tage":"description"}'],
+                                                                                'title' => '',
+                                                                                'example' => '',
+                                                                            ],
+                                                                        ],
+                                                                        'title' => '',
+                                                                        'example' => '',
+                                                                    ],
+                                                                ],
+                                                                'title' => '',
+                                                                'example' => '',
                                                             ],
+                                                            'title' => '',
+                                                            'example' => '',
                                                         ],
                                                     ],
-                                                    'example' => 'aliyun',
-                                                ],
-                                                'ExtendContent' => [
-                                                    'type' => 'string',
-                                                ],
-                                                'ProductId' => [
-                                                    'type' => 'string',
-                                                ],
-                                                'VendorId' => [
-                                                    'type' => 'string',
-                                                ],
-                                                'DetectionRuleId' => [
-                                                    'type' => 'string',
+                                                    'example' => '[{"conditions":[{"isNot":false,"itemId":0,"left":{"value":"host_uuid.host_name"},"operator":"containsString","right":{"value":"Cloud-MCH"}}]}]',
                                                 ],
                                             ],
+                                            'description' => '',
+                                            'title' => '',
+                                            'example' => '',
                                         ],
+                                        'example' => '',
                                     ],
                                 ],
                                 'example' => '123456',
                             ],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'DescribeWhiteRuleList',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:43:22.000Z', 'description' => 'Error codes changed, Request parameters changed'],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n  \\"Data\\": {\\n    \\"PageInfo\\": {\\n      \\"CurrentPage\\": 1,\\n      \\"PageSize\\": 10,\\n      \\"TotalCount\\": 100\\n    },\\n    \\"ResponseData\\": [\\n      {\\n        \\"Id\\": 123456789,\\n        \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n        \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n        \\"MainUserId\\": 0,\\n        \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n        \\"AlertUuid\\": \\"sas_71e24437d2797ce8fc59692905a4****\\",\\n        \\"LogTime\\": \\"2021-01-06 16:37:29\\",\\n        \\"AlertSrcProd\\": \\"sas\\",\\n        \\"AlertTitle\\": \\"Scan-Try SNMP weak password\\",\\n        \\"AlertTitleEn\\": \\"Scan-Try SNMP weak password\\",\\n        \\"AlertType\\": \\"Scan\\",\\n        \\"AlertTypeEn\\": \\"Scan\\",\\n        \\"AlertTypeCode\\": \\"security_event_config.event_name.webshellName\\",\\n        \\"AlertName\\": \\"Try SNMP weak password\\",\\n        \\"AlertNameEn\\": \\"Try SNMP weak password\\",\\n        \\"AlertNameCode\\": \\"security_event_config.event_name.webshell\\",\\n        \\"AlertLevel\\": \\"remind\\",\\n        \\"AssetList\\": \\"[\\\\n      {\\\\n            \\\\\\"is_main_asset\\\\\\": \\\\\\"1\\\\\\",\\\\n            \\\\\\"asset_name\\\\\\": \\\\\\"47.245.*\\\\\\",\\\\n            \\\\\\"port\\\\\\": \\\\\\"22\\\\\\",\\\\n            \\\\\\"ip\\\\\\": \\\\\\"47.245.*\\\\\\",\\\\n            \\\\\\"asset_type\\\\\\": \\\\\\"ip\\\\\\",\\\\n            \\\\\\"location\\\\\\": \\\\\\"ap-southeast-1\\\\\\",\\\\n            \\\\\\"asset_id\\\\\\": \\\\\\"47.245.*\\\\\\",\\\\n            \\\\\\"net_connect_dir\\\\\\": \\\\\\"in\\\\\\"\\\\n      }\\\\n]\\",\\n        \\"OccurTime\\": \\"2021-01-06 16:37:29\\",\\n        \\"StartTime\\": \\"2021-01-06 16:37:29\\",\\n        \\"EndTime\\": \\"2021-01-06 16:37:29\\",\\n        \\"AlertSrcProdModule\\": \\"waf\\",\\n        \\"AlertDesc\\": \\"The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.\\",\\n        \\"AlertDescEn\\": \\"The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.\\",\\n        \\"AlertDescCode\\": \\"security_event_config.event_name.webshell\\\\n\\",\\n        \\"AlertDetail\\": \\"{\\\\\\"main_user_id\\\\\\": \\\\\\"165295629792****\\\\\\";\\\\\\"log_uuid_count\\\\\\": \\\\\\"99\\\\\\";\\\\\\"attack_ip\\\\\\": \\\\\\"21.92.*.*\\\\\\"}\\",\\n        \\"LogUuid\\": \\"cfw_d12e285a-a042-4d7e-be89-f8a795ef****\\",\\n        \\"EntityList\\": \\"[{&quot;entity_user_id&quot;:&quot;198921674491****&quot;,&quot;entity_account_id&quot;:&quot;N/A&quot;,&quot;entity_uuid&quot;:&quot;6245f979d5dd9ef8dd19bdc72228****&quot;,&quot;entity_type&quot;:&quot;host&quot;,&quot;entity_name&quot;:&quot;zhh-test-20240409&quot;,&quot;is_comprised&quot;:&quot;1&quot;,&quot;os_type&quot;:&quot;linux&quot;,&quot;entity_id&quot;:&quot;a88f44dd-b8d4-4ded-831c-77a4835****&quot;,&quot;host_uuid&quot;:&quot;a88f44dd-b8d4-4ded-831c-77a4835****&quot;,&quot;host_name&quot;:&quot;zhh-test-2024****&quot;}]\\",\\n        \\"AttCk\\": \\"T1595.002 Vulnerability Scanning\\",\\n        \\"SubUserId\\": 0,\\n        \\"SubUserName\\": \\"176555323***\\",\\n        \\"CloudCode\\": \\"aliyun\\",\\n        \\"IsDefend\\": \\"1\\",\\n        \\"AlertInfoList\\": [\\n          {\\n            \\"Key\\": \\"suspicious.wbd.wb.trojanpath\\",\\n            \\"KeyName\\": \\"Trojan Path\\\\n\\",\\n            \\"Values\\": \\"/root/test33.php\\"\\n          }\\n        ],\\n        \\"ExtendContent\\": \\"{\\\\\\"main_user_id\\\\\\": \\\\\\"165295629792****\\\\\\";\\\\\\"log_uuid_count\\\\\\": \\\\\\"99****\\\\\\"}\\",\\n        \\"ProductId\\": \\"alibaba_cloud_sas\\",\\n        \\"VendorId\\": \\"aliyun\\",\\n        \\"DetectionRuleId\\": \\"dr-48zs4tk7qfd4rjd9****\\"\\n      }\\n    ]\\n  }\\n}","type":"json"}]',
-            'title' => 'DescribeAlertsWithEvent',
-        ],
-        'DescribeAlertSourceWithEvent' => [
-            'summary' => 'Queries the data sources of the alert that is associated with an event.',
-            'methods' => [
-                'get',
-                'post',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeWhiteRuleList'],
+                ],
             ],
-            'schemes' => [
-                'https',
-                'http',
+            'ramActions' => [
+                [
+                    'operationType' => 'list',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DescribeWhiteRuleList',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n  \\"Data\\": {\\n    \\"PageInfo\\": {\\n      \\"CurrentPage\\": 1,\\n      \\"PageSize\\": 10,\\n      \\"TotalCount\\": 100\\n    },\\n    \\"ResponseData\\": [\\n      {\\n        \\"Id\\": 123456789,\\n        \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n        \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n        \\"Aliuid\\": 0,\\n        \\"SubAliuid\\": 0,\\n        \\"AlertType\\": \\"scan\\",\\n        \\"AlertTypeId\\": \\"scan\\",\\n        \\"AlertName\\": \\"Try SNMP weak password\\",\\n        \\"AlertNameId\\": \\"Try SNMP weak password\\",\\n        \\"Status\\": 1,\\n        \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n        \\"AlertUuid\\": \\"sas_71e24437d2797ce8fc59692905a4****\\",\\n        \\"Expression\\": {\\n          \\"Logic\\": \\"(1&2)|(3&4)\\",\\n          \\"Conditions\\": [\\n            {\\n              \\"ItemId\\": 1,\\n              \\"Operator\\": \\"REGEXP\\",\\n              \\"IsNot\\": false,\\n              \\"Left\\": {\\n                \\"Value\\": \\"ip\\",\\n                \\"IsVar\\": true,\\n                \\"Type\\": \\"false\\",\\n                \\"Modifier\\": \\"length\\",\\n                \\"ModifierParam\\": {\\n                  \\"key\\": \\"{\\\\\\"tage\\\\\\":\\\\\\"description\\\\\\"}\\"\\n                }\\n              },\\n              \\"Right\\": {\\n                \\"Value\\": \\"12345\\",\\n                \\"IsVar\\": false,\\n                \\"Type\\": \\"String\\",\\n                \\"Modifier\\": \\"length\\",\\n                \\"ModifierParam\\": {\\n                  \\"key\\": \\"{\\\\\\"tage\\\\\\":\\\\\\"description\\\\\\"}\\"\\n                }\\n              }\\n            }\\n          ]\\n        }\\n      }\\n    ]\\n  }\\n}","type":"json"}]',
+        ],
+        'EnableAccessForCloudSiem' => [
+            'summary' => 'Grants permissions to Threat Analysis and creates the AliyunServiceRoleForSasCloudSiem service-linked role.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
+            'operationType' => 'readAndWrite',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'get',
+                'operationType' => 'create',
                 'riskType' => 'none',
                 'chargeType' => 'free',
+                'abilityTreeCode' => '158612',
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
-                    'name' => 'IncidentUuid',
+                    'name' => 'AutoSubmit',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '事件全局唯一id。',
-                        'description' => 'The UUID of the event.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '85ea4241-798f-4684-a876-65d4f0c3****',
-                    ],
+                    'schema' => ['description' => 'Specifies whether to automatically add alert logs from Security Center, Web Application Firewall (WAF), and Cloud Firewall. By default, alert logs are automatically added.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['description' => 'The type of the view.'."\n"
+                        ."\n"
+                        .'- 0: The view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: The view of all member accounts.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The user ID of a member. An administrator can use this parameter to switch to the perspective of the specified member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the region where your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   Valid values: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region of the Data Management center for Threat Analysis. Select the region based on where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or Hong Kong (China).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'BaseResponse<List<AlertSource>>',
-                        'description' => 'BaseResponse\\<List>'."\n",
+                        'title' => 'CloudSiemSuccessResponse<Boolean>',
+                        'description' => 'CloudSiemSuccessResponse',
                         'type' => 'object',
                         'properties' => [
-                            'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'array',
-                                'items' => [
-                                    'type' => 'object',
-                                    'properties' => [
-                                        'SourceName' => [
-                                            'title' => '告警数据源名称。',
-                                            'description' => 'The name of the alert data source.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'sas',
-                                        ],
-                                        'Source' => [
-                                            'title' => '告警数据源名称美杜莎code。',
-                                            'description' => 'The internal code of the alert data source.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'aliyun.siem.alert_datasource.sas',
-                                        ],
-                                    ],
-                                ],
-                                'example' => '123456',
-                            ],
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true：成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
-                            ],
+                            'Data' => ['title' => '', 'description' => 'The return value of the request.', 'type' => 'boolean', 'example' => 'true'],
+                            'RequestId' => ['title' => '', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'EnableAccessForCloudSiem',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:47:27.000Z', 'description' => 'Request parameters changed'],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"SourceName\\": \\"sas\\",\\n      \\"Source\\": \\"aliyun.siem.alert_datasource.sas\\"\\n    }\\n  ],\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
-            'title' => 'DescribeAlertSourceWithEvent',
-        ],
-        'DescribeAlertType' => [
-            'summary' => 'Queries the threat types that you can select when you create a custom rule.',
-            'methods' => [
-                'get',
-                'post',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'EnableAccessForCloudSiem'],
+                ],
             ],
-            'schemes' => [
-                'https',
-                'http',
+            'ramActions' => [
+                [
+                    'operationType' => 'create',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:EnableAccessForCloudSiem',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": true,\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+        ],
+        'EnableServiceForCloudSiem' => [
+            'summary' => 'Enables resource directory authorization for threat analysis. This operation can be called only by a resource directory administrator.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
+            'operationType' => 'write',
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'get',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-            ],
+            'systemTags' => ['operationType' => 'create', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
-                    'name' => 'RuleType',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '规则类型。 取值：'."\n"
-                            .'- predefine：预定义'."\n"
-                            .'- customize：自定义',
-                        'description' => 'The type of rule. Valid values:'."\n"
-                            .'- predefine: the defined rule by system'."\n"
-                            .'- customize: the customed rule by user',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'customize',
-                    ],
-                ],
-                [
-                    'name' => 'RoleType',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
-                ],
-                [
-                    'name' => 'RoleFor',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
-                ],
-                [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region of the Data Management center for threat analysis. Select a region based on where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'PlainResponse<List<AlertType>>',
-                        'description' => 'PlainResponse\\<List>'."\n",
+                        'title' => 'CloudSiemSuccessResponse<Boolean>',
+                        'description' => 'CloudSiemSuccessResponse',
                         'type' => 'object',
                         'properties' => [
-                            'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'array',
-                                'items' => [
-                                    'type' => 'object',
-                                    'properties' => [
-                                        'AlertType' => [
-                                            'title' => '威胁类型。',
-                                            'description' => 'The type of the risk.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'WEBSHELL',
-                                        ],
-                                        'AlertTypeMds' => [
-                                            'title' => '威胁类型美杜莎code。',
-                                            'description' => 'The internal code of the risk type.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'siem_rule_type_process_abnormal_command',
-                                        ],
-                                    ],
-                                ],
-                                'example' => '123456',
-                            ],
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true：成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
-                            ],
+                            'Data' => ['title' => '', 'description' => 'The return value. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The service is enabled.'."\n"
+                                ."\n"
+                                .'- false: The service failed to be enabled.', 'type' => 'boolean', 'example' => 'true'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"AlertType\\": \\"WEBSHELL\\",\\n      \\"AlertTypeMds\\": \\"siem_rule_type_process_abnormal_command\\"\\n    }\\n  ],\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
-            'title' => 'DescribeAlertType',
-        ],
-        'DeleteCustomizeRule' => [
-            'summary' => 'Deletes a rule by rule ID.',
-            'methods' => [
-                'get',
-                'post',
+            'title' => 'EnableServiceForCloudSiem',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'EnableServiceForCloudSiem'],
+                ],
             ],
-            'schemes' => [
-                'https',
-                'http',
+            'ramActions' => [
+                [
+                    'operationType' => 'create',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:EnableServiceForCloudSiem',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": true,\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+        ],
+        'GetCapacity' => [
+            'summary' => 'Retrieves the current billable storage usage and subscription purchase volume for threat analysis. Units are in GB.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
+            'operationType' => 'read',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'delete',
+                'operationType' => 'get',
                 'riskType' => 'none',
                 'chargeType' => 'free',
+                'abilityTreeCode' => '155452',
+                'abilityTreeNodes' => ['FEATUREsasRXJ9SY'],
             ],
             'parameters' => [
                 [
-                    'name' => 'RuleId',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '自定义规则ID。',
-                        'description' => 'The ID of the rule.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '123456789',
-                    ],
-                ],
-                [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['description' => 'View type.'."\n"
+                        ."\n"
+                        .'- 0: View for the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: View for all accounts under your enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'User ID of the member whose view the administrator switches to.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the service is deployed.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-shanghai',
-                    ],
+                    'schema' => ['description' => 'Region where the Data Management Center for threat analysis is located. Choose a region based on where your assets are located.'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Select this if your assets are in the Chinese mainland or Hong Kong (China).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Select this if your assets are outside China.', 'type' => 'string', 'example' => 'cn-hangzhou', 'title' => '', 'required' => false],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'BaseResponse<Integer>',
-                        'description' => 'BaseResponse'."\n",
+                        'title' => 'CloudSiemResponse<CloudSiemCapacityResponse>',
+                        'description' => 'CloudSiemResponse',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '123456',
-                            ],
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true：成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code that is returned.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
+                                'title' => '',
+                                'description' => 'Storage capacity details.',
+                                'type' => 'object',
+                                'properties' => [
+                                    'UsedCapacity' => ['description' => 'Current billable storage usage for threat analysis, in GB.', 'type' => 'number', 'format' => 'double', 'title' => '', 'example' => '10'],
+                                    'PreservedCapacity' => ['description' => 'Purchased storage capacity for threat analysis, in GB.', 'type' => 'integer', 'format' => 'int64', 'title' => '', 'example' => '9000'],
+                                    'ExistLogStore' => ['description' => 'Indicates whether the LogStore for threat analysis exists.'."\n"
+                                        ."\n"
+                                        .'- true: Logs are normal and log analysis is available.'."\n"
+                                        ."\n"
+                                        .'- false: Logs are being cleaned up and log analysis is unavailable.', 'type' => 'boolean', 'title' => '', 'example' => 'true'],
+                                    'AgentManagedAssetQuota' => ['description' => 'Purchased quota for Agent-managed instances.', 'type' => 'integer', 'format' => 'int64', 'example' => '1', 'title' => ''],
+                                    'AgentManagedAssetUsed' => ['description' => 'Used quota for Agent-managed instances.', 'type' => 'integer', 'format' => 'int64', 'example' => '1', 'title' => ''],
+                                ],
+                                'example' => '',
                             ],
+                            'RequestId' => ['description' => 'ID of the request.', 'type' => 'string', 'example' => '27D27DCB-D76B-5064-8B3B-0900DEF7****', 'title' => ''],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
-                400 => [
-                    [
-                        'errorCode' => 'CloudSiemCustomizeRuleDeleteExcepiton',
-                        'errorMessage' => 'can not delete online customize rule.',
-                    ],
-                ],
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''],
+                    ['errorCode' => 'Siem.Storage.Exception', 'errorMessage' => 'The request timed out, try again.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"UsedCapacity\\": 10,\\n    \\"PreservedCapacity\\": 9000,\\n    \\"ExistLogStore\\": true,\\n    \\"AgentManagedAssetQuota\\": 1,\\n    \\"AgentManagedAssetUsed\\": 1\\n  },\\n  \\"RequestId\\": \\"27D27DCB-D76B-5064-8B3B-0900DEF7****\\"\\n}","type":"json"}]',
+            'title' => 'GetCapacity',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:44:02.000Z', 'description' => 'Request parameters changed'],
+                ['createdAt' => '2023-12-13T09:49:23.000Z', 'description' => 'Error codes changed, Request parameters changed, Response parameters changed'],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": 123456,\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
-            'title' => 'DeleteCustomizeRule',
-        ],
-        'DescribeAggregateFunction' => [
-            'summary' => 'Queries the aggregate functions that are supported for a custom rule.',
-            'methods' => [
-                'get',
-                'post',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'GetCapacity'],
+                ],
             ],
-            'schemes' => [
-                'https',
-                'http',
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:GetCapacity',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+        ],
+        'GetEntitiyStat' => [
+            'methods' => ['get', 'post'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
+            'operationType' => 'read',
             'deprecated' => false,
             'systemTags' => [
                 'operationType' => 'get',
                 'riskType' => 'none',
                 'chargeType' => 'free',
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
+                    'name' => 'IncidentUuid',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The incident ID.', 'type' => 'string', 'required' => true, 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'],
+                ],
+                [
+                    'name' => 'EntityType',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The asset ID associated with the incident.', 'type' => 'string', 'example' => '6c740667-80b2-476d-8924-2e706feb****', 'required' => false],
+                ],
+                [
+                    'name' => 'AssetName',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The asset ID associated with the incident.', 'type' => 'string', 'example' => '6c740667-80b2-476d-8924-2e706feb****', 'required' => false],
+                ],
+                [
+                    'name' => 'AssetUuid',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The asset ID associated with the incident.', 'type' => 'string', 'example' => '6c740667-80b2-476d-8924-2e706feb****', 'required' => false],
+                ],
+                [
+                    'name' => 'EntityName',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The asset ID associated with the incident.', 'type' => 'string', 'example' => '6c740667-80b2-476d-8924-2e706feb****', 'required' => false],
+                ],
+                [
+                    'name' => 'EntityUuid',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The asset ID associated with the incident.', 'type' => 'string', 'example' => '6c740667-80b2-476d-8924-2e706feb****', 'required' => false],
+                ],
+                [
+                    'name' => 'IsAsset',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The asset ID associated with the incident.', 'type' => 'string', 'required' => false, 'example' => '6c740667-80b2-476d-8924-2e706feb****'],
+                ],
+                [
+                    'name' => 'IsMalwareEntity',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The sort order of the incident list. Valid values:'."\n"
+                        ."\n"
+                        .'- desc: descending order.'."\n"
+                        .'- asc: ascending order.', 'type' => 'string', 'required' => false, 'example' => 'desc'],
+                ],
+                [
+                    'name' => 'Tags',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The entity tags. The value is a JSON array string in the following format: \\"[{\\"tagKey1\\":\\"tagValue1\\"},{\\"tagKey2\\":\\"tagValue2\\"}]\\"', 'type' => 'string', 'required' => false, 'example' => 'sys:agent:dispose'],
+                ],
+                [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The view type. Valid values:'."\n"
+                        ."\n"
+                        .'- 0: single-account logon.'."\n"
+                        .'- 1: global view.'."\n"
+                        .'- 2: switched view.'."\n"
+                        .'- 3: partial view.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member to which the administrator switches the view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '1637941677243702', 'title' => ''],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region where the threat detection and response data management center resides. Select the management center based on the region of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: the asset belongs to the Chinese mainland or Hong Kong (China).'."\n"
+                        .'- ap-southeast-1: the asset belongs to a region outside the Chinese mainland.', 'type' => 'string', 'example' => 'cn-hangzhou', 'required' => false],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'PlainResponse<List<RuleAggregateFunction>>',
-                        'description' => 'PlainResponse\\<List>'."\n",
+                        'title' => '',
+                        'description' => 'BaseResponse<List<EntitiyStat>>',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
+                                'title' => '',
+                                'description' => 'The response data.',
                                 'type' => 'array',
                                 'items' => [
+                                    'description' => 'The capacity details.',
                                     'type' => 'object',
                                     'properties' => [
-                                        'Function' => [
-                                            'title' => '聚合函数。',
-                                            'description' => 'The aggregate function.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'count',
-                                        ],
-                                        'FunctionName' => [
-                                            'title' => '聚合函数显示名称。',
-                                            'description' => 'The display name of the aggregate function.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'Count',
-                                        ],
+                                        'EntityType' => ['title' => '', 'description' => 'The entity type.', 'type' => 'string', 'example' => 'ip'],
+                                        'EntityNum' => ['description' => 'The number of entities.', 'type' => 'integer', 'format' => 'int32', 'example' => '3', 'title' => ''],
+                                        'EntityUuid' => ['title' => '', 'description' => 'The entity UUID.', 'type' => 'string', 'example' => '5cde2118666ffda40783ebd7cec9a60a'],
                                     ],
+                                    'title' => '',
+                                    'example' => '',
                                 ],
                                 'example' => '123456',
                             ],
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true：成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
-                            ],
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- true: successful.'."\n"
+                                .'- false: failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The response message.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'Query entity counts',
+            'summary' => 'Queries entity counts.',
+            'description' => 'The input parameter JsonConfig is a complex JSON configuration. A utility class with configuration examples is provided. For more information, refer to [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"Function\\": \\"count\\",\\n      \\"FunctionName\\": \\"Count\\"\\n    }\\n  ],\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
-            'title' => 'DescribeAggregateFunction',
+            'ramActions' => [],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"EntityType\\": \\"ip\\",\\n      \\"EntityNum\\": 3,\\n      \\"EntityUuid\\": \\"5cde2118666ffda40783ebd7cec9a60a\\"\\n    }\\n  ],\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
         ],
-        'DescribeCustomizeRuleCount' => [
-            'summary' => 'Queries the number of custom rules.',
-            'methods' => [
-                'get',
-                'post',
-            ],
-            'schemes' => [
-                'https',
-                'http',
-            ],
+        'GetStorage' => [
+            'summary' => 'Retrieves the storage settings created by the Threat Analysis and Response product in your Simple Log Service (SLS). These settings include the storage duration and storage region.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
+            'operationType' => 'read',
             'deprecated' => false,
             'systemTags' => [
                 'operationType' => 'get',
-                'riskType' => 'none',
-                'chargeType' => 'free',
+                'abilityTreeCode' => '179222',
+                'abilityTreeNodes' => ['FEATUREsasRXJ9SY'],
             ],
             'parameters' => [
                 [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['description' => 'The type of the view. Valid values:'."\n"
+                        ."\n"
+                        .'- 0: The view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: The view of all accounts that belong to the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member. This parameter is used by an administrator to switch to the perspective of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '127XXXX'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The data management center of the threat analysis feature. Specify this parameter based on the region in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions inside China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region where the Data Management hub for threat analysis is located. Select a region for the management hub based on the region of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Select this value if your assets are in the Chinese mainland or the China (Hong Kong) region.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Select this value if your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'PlainResponse<CustomizeRuleCounter>',
-                        'description' => 'PlainResponse'."\n",
+                        'title' => 'CloudSiemResponse<CloudSiemStorageResponse>',
+                        'description' => 'CloudSiemResponse',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
+                                'title' => '',
+                                'description' => 'The details of the storage settings.',
                                 'type' => 'object',
                                 'properties' => [
-                                    'InUseRuleNum' => [
-                                        'title' => '全部规则数。',
-                                        'description' => 'The total number of rules.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '20',
-                                    ],
-                                    'HighRuleNum' => [
-                                        'title' => '高危规则数。',
-                                        'description' => 'The number of rules that are used to identify high-risk threats.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '12',
-                                    ],
-                                    'MediumRuleNum' => [
-                                        'title' => '中危规则数。',
-                                        'description' => 'The number of rules that are used to identify medium-risk threats.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '5',
-                                    ],
-                                    'LowRuleNum' => [
-                                        'title' => '低危规则数。',
-                                        'description' => 'The number of rules that are used to identify low-risk threats.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '3',
-                                    ],
-                                    'TotalRuleNum' => [
-                                        'title' => '总规则数',
-                                        'description' => '总规则数。',
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '10',
-                                    ],
-                                    'CustomizeRuleNum' => [
-                                        'title' => '自定义规则数',
-                                        'description' => '自定义规则数。',
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '10',
-                                    ],
-                                    'PredefinedRuleNum' => [
-                                        'title' => '预定义规则数',
-                                        'description' => '预定义规则数。',
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '10',
-                                    ],
-                                    'UnEventRuleNum' => [
-                                        'title' => '不产生事件规则数',
-                                        'description' => '不产生事件规则数。',
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '3',
-                                    ],
-                                    'ExpertRuleNum' => [
-                                        'title' => '专家规则数',
-                                        'description' => '专家规则数。',
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '7',
-                                    ],
-                                    'GraphComputingRuleNum' => [
-                                        'title' => '图计算规则数',
-                                        'description' => '图计算规则数。',
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '2',
-                                    ],
-                                    'SingleAlertRuleNum' => [
-                                        'title' => '告警透传规则数',
-                                        'description' => '告警透传规则数。',
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '3',
-                                    ],
-                                    'AggregationRuleNum' => [
-                                        'title' => '同类聚合规则数',
-                                        'description' => '同类聚合规则数。',
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '3',
-                                    ],
+                                    'Ttl' => ['title' => '', 'description' => 'The storage duration in days. The default value is 180. The value must be an integer from 30 to 3000.', 'type' => 'integer', 'format' => 'int32', 'example' => '180'],
+                                    'Region' => ['title' => '', 'description' => 'The storage region.'."\n"
+                                        ."\n"
+                                        .'If the Data Management hub is in the **cn-hangzhou** region, the default value of **Region** is \\`cn-shanghai\\`. If the Data Management hub is in the **ap-southeast-1** region, the default value of **Region** is \\`ap-southeast-1\\`.', 'type' => 'string', 'example' => 'cn-shanghai'],
+                                    'DisplayRegion' => ['title' => '', 'description' => 'Indicates whether you have permission to change the storage region. The default value is false. Valid values:'."\n"
+                                        ."\n"
+                                        .'- true: You have permission.'."\n"
+                                        ."\n"
+                                        .'- false: You do not have permission.', 'type' => 'boolean', 'example' => 'false'],
+                                    'CanOperate' => ['title' => '', 'description' => 'Indicates whether you can change the storage region. You can change the storage region only once. The default value is false. Valid values:'."\n"
+                                        ."\n"
+                                        .'- true: You can change the storage region.'."\n"
+                                        ."\n"
+                                        .'- false: You cannot change the storage region.', 'type' => 'boolean', 'example' => 'false'],
                                 ],
-                                'example' => '123456',
-                            ],
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true：成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code that is returned.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
+                                'example' => '',
                             ],
+                            'RequestId' => ['title' => '', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '97A31C3A-3F9F-5866-8979-5159E3DC****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'title' => 'GetStorage',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:44:01.000Z', 'description' => 'Request parameters changed'],
+                ['createdAt' => '2023-12-13T09:49:23.000Z', 'description' => 'Error codes changed, Request parameters changed, Response parameters changed'],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"InUseRuleNum\\": 20,\\n    \\"HighRuleNum\\": 12,\\n    \\"MediumRuleNum\\": 5,\\n    \\"LowRuleNum\\": 3,\\n    \\"TotalRuleNum\\": 10,\\n    \\"CustomizeRuleNum\\": 10,\\n    \\"PredefinedRuleNum\\": 10,\\n    \\"UnEventRuleNum\\": 3,\\n    \\"ExpertRuleNum\\": 7,\\n    \\"GraphComputingRuleNum\\": 2,\\n    \\"SingleAlertRuleNum\\": 3,\\n    \\"AggregationRuleNum\\": 3\\n  },\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
-            'title' => 'DescribeCustomizeRuleCount',
-        ],
-        'DescribeCustomizeRuleTest' => [
-            'summary' => 'Queries the historical simulation data that is used in a simulation test scenario.',
-            'methods' => [
-                'get',
-                'post',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'GetStorage'],
+                ],
             ],
-            'schemes' => [
-                'https',
-                'http',
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:GetStorage',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"Ttl\\": 180,\\n    \\"Region\\": \\"cn-shanghai\\",\\n    \\"DisplayRegion\\": false,\\n    \\"CanOperate\\": false\\n  },\\n  \\"RequestId\\": \\"97A31C3A-3F9F-5866-8979-5159E3DC****\\"\\n}","type":"json"}]',
+        ],
+        'ListAccountAccessId' => [
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
+            'operationType' => 'read',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'get',
+                'operationType' => 'list',
                 'riskType' => 'none',
                 'chargeType' => 'free',
+                'abilityTreeCode' => '195478',
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
-                    'name' => 'Id',
+                    'name' => 'CloudCode',
                     'in' => 'formData',
                     'schema' => [
-                        'title' => '自定义规则ID。',
-                        'description' => 'The ID of the rule.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '123456789',
+                        'title' => '',
+                        'description' => 'The code for the multicloud environment.',
+                        'type' => 'string',
+                        'required' => true,
+                        'enum' => ['qcloud', 'hcloud'],
+                        'example' => 'hcloud',
                     ],
                 ],
                 [
-                    'name' => 'RoleType',
+                    'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region of the Data Management center for threat analysis. Select the region of the Management Center based on where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['type' => 'integer', 'format' => 'int64', 'required' => false, 'description' => 'The user ID of a member. This parameter allows an administrator to switch to the member\'s view.', 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
-                    'name' => 'RegionId',
+                    'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['type' => 'integer', 'format' => 'int32', 'required' => false, 'description' => 'The type of view. Valid values:'."\n"
+                        ."\n"
+                        .'- 0: The view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: The view of all accounts in your enterprise.', 'title' => '', 'example' => '1'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'BaseResponse<CustomizeRuleTest>',
-                        'description' => 'BaseResponse'."\n",
+                        'title' => 'CloudSiemSuccessResponse<List<ListAccountAccessIdResult>>',
+                        'description' => 'CloudSiemSuccessResponse\\<List>',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'object',
-                                'properties' => [
-                                    'Id' => [
-                                        'title' => '自定义规则ID。',
-                                        'description' => 'The ID of the rule.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int64',
-                                        'example' => '123456789',
-                                    ],
-                                    'Status' => [
-                                        'title' => '规则状态。 取值：'."\n"
-                                            .'- 0：初始状态'."\n"
-                                            .'- 10：模拟数据测试'."\n"
-                                            .'- 15：业务数据测试中'."\n"
-                                            .'- 20：业务数据测试结束'."\n"
-                                            .'- 100：规则上线',
-                                        'description' => 'The status of the rule. Valid values:'."\n"
+                                'title' => '',
+                                'description' => 'The data returned.',
+                                'type' => 'array',
+                                'items' => [
+                                    'description' => 'The data returned.',
+                                    'type' => 'object',
+                                    'properties' => [
+                                        'SubUserId' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account that corresponds to the multicloud AccessKey ID.', 'type' => 'integer', 'format' => 'int64', 'example' => 'ABCXXXXXXXX'],
+                                        'AccessIdMd5' => ['title' => '', 'description' => 'The MD5 value of the multicloud AccessKey ID.', 'type' => 'string', 'example' => 'abcXXXXXXXX'],
+                                        'AccountStr' => ['title' => '', 'description' => 'The information of the account to which the multicloud AccessKey ID belongs. The format is: Alibaba Cloud account ID|Alibaba Cloud account name|Multicloud AccessKey ID.', 'type' => 'string', 'example' => '123xxxxxx|xxxx|ABCXXXXX'],
+                                        'Bound' => ['title' => '', 'description' => 'Indicates whether the AccessKey ID is attached to threat analysis. Valid values:'."\n"
                                             ."\n"
-                                            .'*   0: The rule is in the initial state.'."\n"
-                                            .'*   10: The simulation data is tested.'."\n"
-                                            .'*   15: The business data is being tested.'."\n"
-                                            .'*   20: The business data test ends.'."\n"
-                                            .'*   100: The rule takes effect.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '0',
-                                    ],
-                                    'SimulateData' => [
-                                        'title' => '模拟测试历史用例数据。',
-                                        'description' => 'The historical data that is used in the simulation test.'."\n",
-                                        'type' => 'string',
-                                        'example' => '[{"key1":"value1","key2":"value2","key3":"value3","key4":"value4","key5":"value5"}]',
+                                            .'- 0: Not attached.'."\n"
+                                            ."\n"
+                                            .'- 1: Attached.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'],
+                                        'AccessId' => ['title' => '', 'description' => 'The attached AccessKey ID.', 'type' => 'string', 'example' => 'ABCXXXXXXXX'],
+                                        'AccountId' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account.', 'type' => 'string', 'example' => '123xxxxxxx'],
+                                        'CloudCode' => [
+                                            'title' => '',
+                                            'description' => 'The code for the multicloud environment.',
+                                            'type' => 'string',
+                                            'enum' => ['qcloud', 'hcloud'],
+                                            'example' => 'hcloud',
+                                        ],
                                     ],
+                                    'title' => '',
+                                    'example' => '',
                                 ],
-                                'example' => '123456',
-                            ],
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true：成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
+                                'example' => '',
                             ],
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The request was successful.'."\n"
+                                ."\n"
+                                .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The HTTP status code.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The returned message.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'title' => 'ListAccountAccessId',
+            'summary' => 'Lists the AccessKey IDs for attached multicloud accounts.',
+            'changeSet' => [
+                ['createdAt' => '2024-07-18T01:29:00.000Z', 'description' => 'Request parameters changed'],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"Id\\": 123456789,\\n    \\"Status\\": 0,\\n    \\"SimulateData\\": \\"[{\\\\\\"key1\\\\\\":\\\\\\"value1\\\\\\",\\\\\\"key2\\\\\\":\\\\\\"value2\\\\\\",\\\\\\"key3\\\\\\":\\\\\\"value3\\\\\\",\\\\\\"key4\\\\\\":\\\\\\"value4\\\\\\",\\\\\\"key5\\\\\\":\\\\\\"value5\\\\\\"}]\\"\\n  },\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
-            'title' => 'DescribeCustomizeRuleTest',
-        ],
-        'DescribeCustomizeRuleTestHistogram' => [
-            'summary' => 'Queries the chart that displays the test results of business data for a custom rule.',
-            'methods' => [
-                'get',
-                'post',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListAccountAccessId'],
+                ],
             ],
-            'schemes' => [
-                'https',
-                'http',
+            'ramActions' => [
+                [
+                    'operationType' => 'list',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ListAccountAccessId',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"SubUserId\\": 0,\\n      \\"AccessIdMd5\\": \\"abcXXXXXXXX\\",\\n      \\"AccountStr\\": \\"123xxxxxx|xxxx|ABCXXXXX\\",\\n      \\"Bound\\": 1,\\n      \\"AccessId\\": \\"ABCXXXXXXXX\\",\\n      \\"AccountId\\": \\"123xxxxxxx\\",\\n      \\"CloudCode\\": \\"hcloud\\"\\n    }\\n  ],\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+        ],
+        'ListAccountsByLog' => [
+            'summary' => 'Queries the accounts associated with a log.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
+            'operationType' => 'read',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'get',
+                'operationType' => 'list',
                 'riskType' => 'none',
                 'chargeType' => 'free',
+                'abilityTreeCode' => '196080',
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
-                    'name' => 'Id',
+                    'name' => 'ProdCode',
                     'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The code of the product.', 'type' => 'string', 'required' => true, 'example' => 'qcloud_waf'],
+                ],
+                [
+                    'name' => 'LogCodes',
+                    'in' => 'formData',
+                    'style' => 'repeatList',
                     'schema' => [
-                        'title' => '自定义规则ID。',
-                        'description' => 'The ID of the rule.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '123456789',
+                        'title' => '',
+                        'description' => 'The list of log codes. The value must be a JSON array.',
+                        'type' => 'array',
+                        'items' => ['description' => 'The list of log codes. The value must be a JSON array.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => '["cloud_siem_hcloud_waf_alert_log"]'],
+                        'required' => true,
+                        'example' => '["cloud_siem_hcloud_waf_alert_log"]',
+                        'maxItems' => 100,
                     ],
                 ],
                 [
-                    'name' => 'RoleType',
+                    'name' => 'CloudCode',
                     'in' => 'formData',
                     'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
+                        'title' => '',
+                        'description' => 'The code of the multicloud environment.',
+                        'type' => 'string',
+                        'required' => true,
+                        'enum' => ['qcloud', 'hcloud', 'aliyun', 'idc'],
+                        'example' => 'hcloud',
                     ],
                 ],
                 [
+                    'name' => 'RoleType',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The view type.'."\n"
+                        ."\n"
+                        .'- 0: The view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: The view of all accounts that belong to the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
+                ],
+                [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member. This parameter allows an administrator to switch to the perspective of a member account.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region where the Data Management center of Threat Analysis is located. Select the region based on the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'BaseResponse<List<CustomizeRuleAlertHistogram>>',
-                        'description' => 'BaseResponse\\<List>'."\n",
+                        'title' => 'CloudSiemSuccessResponse<List<ListAccountsByLogResult>>',
+                        'description' => 'CloudSiemSuccessResponse\\<List>',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The return value for the request.'."\n",
+                                'title' => '',
+                                'description' => 'The return value of the request.',
                                 'type' => 'array',
                                 'items' => [
+                                    'description' => 'The return value of the request.',
                                     'type' => 'object',
                                     'properties' => [
-                                        'From' => [
-                                            'title' => '告警时间区间的开始时间戳 单位：秒。',
-                                            'description' => 'The start of the time range for querying alerts. The value is a UNIX timestamp. Unit: seconds.'."\n",
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '1599897188',
-                                        ],
-                                        'To' => [
-                                            'title' => '告警时间区间的结束时间戳 单位：秒。',
-                                            'description' => 'The end of the time range for querying alerts. The value is a UNIX timestamp. Unit: seconds.'."\n",
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '1599997188',
-                                        ],
-                                        'Count' => [
-                                            'title' => '当前查询结果在该子时间区间内产生的告警数。',
-                                            'description' => 'The number of alerts that are generated in the query time range.'."\n",
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '125',
-                                        ],
-                                    ],
+                                        'SubUserId' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account that is used for Threat Analysis.', 'type' => 'integer', 'format' => 'int64', 'example' => '123XXXXXXXX'],
+                                        'MainUserId' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account that is used to purchase Threat Analysis.', 'type' => 'integer', 'format' => 'int64', 'example' => '123XXXXXXXXX'],
+                                        'AccountId' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account.', 'type' => 'string', 'example' => '123xxxxxxx'],
+                                        'AccountName' => ['title' => '', 'description' => 'The name of the Alibaba Cloud account.', 'type' => 'string', 'example' => 'sas_account_xxx'],
+                                        'Imported' => ['title' => '', 'description' => 'Indicates whether the account has been added. Valid values:'."\n"
+                                            .'-1: The account has been added.'."\n"
+                                            .'-0: The account has not been added.', 'type' => 'integer', 'format' => 'int32', 'example' => '123xxxxxxx'],
+                                        'LogCode' => ['title' => '', 'description' => 'The log code.', 'type' => 'string', 'example' => 'cloud_siem_waf_xxxxx'],
+                                        'ProdCode' => ['title' => '', 'description' => 'The code of the product that corresponds to the log.', 'type' => 'string', 'example' => 'qcloud_waf'],
+                                    ],
+                                    'title' => '',
+                                    'example' => '',
                                 ],
-                                'example' => '123456',
-                            ],
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true：成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
+                                'example' => '',
                             ],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'ListAccountsByLog',
+            'changeSet' => [
+                ['createdAt' => '2024-08-13T11:50:56.000Z', 'description' => 'Request parameters changed'],
+                ['createdAt' => '2024-04-17T12:47:28.000Z', 'description' => 'Request parameters changed'],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"From\\": 1599897188,\\n      \\"To\\": 1599997188,\\n      \\"Count\\": 125\\n    }\\n  ],\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
-            'title' => 'DescribeCustomizeRuleTestHistogram',
-        ],
-        'DescribeLogFields' => [
-            'summary' => 'Queries the fields that can be configured for a custom rule.',
-            'methods' => [
-                'get',
-                'post',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListAccountsByLog'],
+                ],
             ],
-            'schemes' => [
-                'https',
-                'http',
+            'ramActions' => [
+                [
+                    'operationType' => 'list',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ListAccountsByLog',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"SubUserId\\": 0,\\n      \\"MainUserId\\": 0,\\n      \\"AccountId\\": \\"123xxxxxxx\\",\\n      \\"AccountName\\": \\"sas_account_xxx\\",\\n      \\"Imported\\": 0,\\n      \\"LogCode\\": \\"cloud_siem_waf_xxxxx\\",\\n      \\"ProdCode\\": \\"qcloud_waf\\"\\n    }\\n  ],\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+        ],
+        'ListAllProds' => [
+            'summary' => 'Lists the cloud products supported by Threat Analysis for data ingestion.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
+            'operationType' => 'read',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'get',
+                'operationType' => 'list',
                 'riskType' => 'none',
                 'chargeType' => 'free',
+                'abilityTreeCode' => '195975',
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
-                    'name' => 'LogType',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '规则对应的日志源。',
-                        'description' => 'The log type of the rule.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cloud_siem_aegis_sas_alert',
-                    ],
-                ],
-                [
-                    'name' => 'LogSource',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '规则对应的日志源。',
-                        'description' => 'The log source of the rule.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cloud_siem_aegis_sas_alert',
-                    ],
-                ],
-                [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['description' => 'The view type.'."\n"
+                        ."\n"
+                        .'- 0: The view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: The view of all accounts that belong to the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The user ID of a member. An administrator can specify this parameter to switch to the member\'s view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region of the Data Management hub for Threat Analysis. Select the region that corresponds to the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'PlainResponse<List<CustomizeRuleField>>',
-                        'description' => 'PlainResponse\\<List>'."\n",
+                        'title' => 'CloudSiemSuccessResponse<ListAllProdsResult>',
+                        'description' => 'CloudSiemSuccessResponse',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'array',
-                                'items' => [
-                                    'type' => 'object',
-                                    'properties' => [
-                                        'FieldName' => [
-                                            'title' => '规则字段名称。',
-                                            'description' => 'The name of the field.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'activity_name',
-                                        ],
-                                        'FieldDesc' => [
-                                            'title' => '字段描述美杜莎code。',
-                                            'description' => 'The internal code of the field description.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'sas.cloudsiem.prod.activity_name',
-                                        ],
-                                        'LogCode' => [
-                                            'title' => '字段所属日志源。',
-                                            'description' => 'The log source to which the field belongs.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'cloud_siem_aegis_sas_alert',
-                                        ],
-                                        'ActivityName' => [
-                                            'title' => '字段所属日志类型。',
-                                            'description' => 'The type of the log to which the field belongs.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'HTTP_ACTIVITY',
-                                        ],
-                                        'FieldType' => [
-                                            'title' => '字段数据类型。 取值：'."\n"
-                                                .'- varchar：字符串'."\n"
-                                                .'- bigint：数字',
-                                            'description' => 'The data type of the field. Valid values:'."\n"
-                                                ."\n"
-                                                .'*   varchar'."\n"
-                                                .'*   bigint'."\n",
-                                            'type' => 'string',
-                                            'example' => 'varchar',
+                                'title' => '',
+                                'description' => 'The data returned.',
+                                'type' => 'object',
+                                'properties' => [
+                                    'TotalCount' => ['title' => '', 'description' => 'The total number of logs.', 'type' => 'integer', 'format' => 'int32', 'example' => '19'],
+                                    'PageSize' => ['title' => '', 'description' => 'The number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10'],
+                                    'CurrentPage' => ['title' => '', 'description' => 'The current page number.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'],
+                                    'ProdList' => [
+                                        'title' => '',
+                                        'description' => 'The list of products.',
+                                        'type' => 'array',
+                                        'items' => [
+                                            'type' => 'object',
+                                            'properties' => [
+                                                'ProdCode' => ['title' => '', 'description' => 'The code of the cloud product.', 'type' => 'string', 'example' => 'sas'],
+                                                'TotalLogCount' => ['title' => '', 'description' => 'The total number of logs for the product.', 'type' => 'integer', 'format' => 'int32', 'example' => '19'],
+                                                'ImportedLogCount' => ['title' => '', 'description' => 'The number of ingested logs for the product.', 'type' => 'integer', 'format' => 'int32', 'example' => '10'],
+                                                'ModifyTime' => ['title' => '', 'description' => 'The time when logs were last ingested for the product.', 'type' => 'string', 'example' => '2023-11-23 12:12:12'],
+                                                'CloudCode' => [
+                                                    'title' => '',
+                                                    'description' => 'The multicloud code. Valid values:'."\n"
+                                                        ."\n"
+                                                        .'- qcloud: Tencent Cloud.'."\n"
+                                                        ."\n"
+                                                        .'- aliyun: Alibaba Cloud.'."\n"
+                                                        ."\n"
+                                                        .'- hcloud: Huawei Cloud.',
+                                                    'type' => 'string',
+                                                    'enum' => ['qcloud', 'hcloud', 'aliyun'],
+                                                    'example' => 'hcloud',
+                                                ],
+                                            ],
+                                            'description' => '',
+                                            'title' => '',
+                                            'example' => '',
                                         ],
+                                        'example' => '1',
                                     ],
                                 ],
-                                'example' => '123456',
-                            ],
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true：成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
+                                'example' => '',
                             ],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'ListAllProds',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:47:28.000Z', 'description' => 'Request parameters changed'],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"FieldName\\": \\"activity_name\\",\\n      \\"FieldDesc\\": \\"sas.cloudsiem.prod.activity_name\\",\\n      \\"LogCode\\": \\"cloud_siem_aegis_sas_alert\\",\\n      \\"ActivityName\\": \\"HTTP_ACTIVITY\\",\\n      \\"FieldType\\": \\"varchar\\"\\n    }\\n  ],\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
-            'title' => 'DescribeLogFields',
-        ],
-        'DescribeLogSource' => [
-            'summary' => 'Queries the log sources that can be configured for a custom rule.',
-            'methods' => [
-                'get',
-                'post',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListAllProds'],
+                ],
             ],
-            'schemes' => [
-                'https',
-                'http',
+            'ramActions' => [
+                [
+                    'operationType' => 'list',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DescribeProdCount',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"TotalCount\\": 19,\\n    \\"PageSize\\": 10,\\n    \\"CurrentPage\\": 1,\\n    \\"ProdList\\": [\\n      {\\n        \\"ProdCode\\": \\"sas\\",\\n        \\"TotalLogCount\\": 19,\\n        \\"ImportedLogCount\\": 10,\\n        \\"ModifyTime\\": \\"2023-11-23 12:12:12\\",\\n        \\"CloudCode\\": \\"hcloud\\"\\n      }\\n    ]\\n  },\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+        ],
+        'ListAutomateResponseConfigs' => [
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
+            'operationType' => 'read',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'get',
+                'operationType' => 'list',
                 'riskType' => 'none',
                 'chargeType' => 'free',
+                'abilityTreeNodes' => ['FEATUREsas104PTS'],
             ],
             'parameters' => [
                 [
-                    'name' => 'LogType',
+                    'name' => 'Id',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '规则对应的日志类型。',
-                        'description' => 'The log type of the rule.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'HTTP_ACTIVITY',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The ID of the automated response rule.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '123'],
+                ],
+                [
+                    'name' => 'SubUserId',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The ID of the user who created the rule.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '17108579417****'],
+                ],
+                [
+                    'name' => 'PlaybookUuid',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The unique identifier of the playbook.', 'type' => 'string', 'required' => false, 'example' => 'system_aliyun_aegis_kill_quara_book'],
+                ],
+                [
+                    'name' => 'RuleName',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The name of the automated response rule.', 'type' => 'string', 'required' => false, 'example' => 'cfw kill quara book'],
+                ],
+                [
+                    'name' => 'AutoResponseType',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The type of the automated response. Valid values:'."\n"
+                        ."\n"
+                        .'- **event**'."\n"
+                        ."\n"
+                        .'- **alert**', 'type' => 'string', 'required' => false, 'example' => 'event'],
+                ],
+                [
+                    'name' => 'ActionType',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The type of the handling action. Valid values:'."\n"
+                        ."\n"
+                        .'- **doPlaybook**: executes a playbook.'."\n"
+                        ."\n"
+                        .'- **changeEventStatus**: changes the status of an event.'."\n"
+                        ."\n"
+                        .'- **changeThreatLevel**: changes the threat level of an event.', 'type' => 'string', 'required' => false, 'example' => 'doPlaybook'],
+                ],
+                [
+                    'name' => 'Status',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The status of the rule. Valid values:'."\n"
+                        ."\n"
+                        .'- **0**: disabled'."\n"
+                        ."\n"
+                        .'- **100**: enabled', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '0'],
+                ],
+                [
+                    'name' => 'CurrentPage',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The page number. The value must be 1 or greater.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'minimum' => '1', 'example' => '1'],
+                ],
+                [
+                    'name' => 'PageSize',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The number of entries per page. The maximum value is 100.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'maximum' => '100', 'minimum' => '1', 'example' => '10'],
                 ],
                 [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['description' => 'The view type.'."\n"
+                        ."\n"
+                        .'- 0: the view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: the view of all accounts that belong to the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The ID of the member to which the administrator switches.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region of the Data Management center. Select a region based on the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- **cn-hangzhou**: your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- **ap-southeast-1**: your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
+                ],
+                [
+                    'name' => 'ResponseRuleType',
+                    'in' => 'formData',
+                    'schema' => ['type' => 'string', 'description' => 'The type of the response rule.'."\n"
+                        ."\n"
+                        .'- preset: predefined'."\n"
+                        ."\n"
+                        .'- custom: custom', 'required' => false, 'title' => '', 'example' => 'custom'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'PlainResponse<List<LogSource>>',
-                        'description' => 'PlainResponse\\<List>'."\n",
+                        'title' => 'PageResponse<List<CloudSiemAutomateResponseConfig>>',
+                        'description' => 'PageResponse\\<List>',
                         'type' => 'object',
                         'properties' => [
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- **true**: The request was successful.'."\n"
+                                ."\n"
+                                .'- **false**: The request failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The request status code.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The returned message.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'array',
-                                'items' => [
-                                    'type' => 'object',
-                                    'properties' => [
-                                        'LogSource' => [
-                                            'title' => '规则对应的日志源。',
-                                            'description' => 'The log source of the rule.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'cloud_siem_aegis_sas_alert',
+                                'title' => '',
+                                'description' => 'The data returned.',
+                                'type' => 'object',
+                                'properties' => [
+                                    'PageInfo' => [
+                                        'title' => '',
+                                        'description' => 'The pagination information.',
+                                        'type' => 'object',
+                                        'properties' => [
+                                            'CurrentPage' => ['title' => '', 'description' => 'The page number of the returned page.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'],
+                                            'PageSize' => ['title' => '', 'description' => 'The number of entries returned per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10'],
+                                            'TotalCount' => ['title' => '', 'description' => 'The total number of entries.', 'type' => 'integer', 'format' => 'int64', 'example' => '100'],
                                         ],
-                                        'LogSourceName' => [
-                                            'title' => '规则对应的日志源美杜莎code。',
-                                            'description' => 'The internal code of the log source.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'sas.cloudsiem.prod.cloud_siem_aegis_sas_alert',
+                                        'example' => '',
+                                    ],
+                                    'ResponseData' => [
+                                        'title' => '',
+                                        'description' => 'The detailed data.',
+                                        'type' => 'array',
+                                        'items' => [
+                                            'type' => 'object',
+                                            'properties' => [
+                                                'Id' => ['title' => '', 'description' => 'The ID of the automated response rule.', 'type' => 'integer', 'format' => 'int64', 'example' => '123'],
+                                                'GmtCreate' => ['title' => '', 'description' => 'The time when the rule was created.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'],
+                                                'GmtModified' => ['title' => '', 'description' => 'The time when the rule was last modified.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'],
+                                                'Aliuid' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account that is associated with the rule.', 'type' => 'integer', 'format' => 'int64', 'example' => '127608589417****'],
+                                                'SubUserId' => ['title' => '', 'description' => 'The ID of the user who created the rule.', 'type' => 'integer', 'format' => 'int64', 'example' => '17108579417****'],
+                                                'RuleName' => ['title' => '', 'description' => 'The name of the automated response rule.', 'type' => 'string', 'example' => 'cfw kill quara book'],
+                                                'AutoResponseType' => ['title' => '', 'description' => 'The type of the automated response. Valid values:'."\n"
+                                                    ."\n"
+                                                    .'- **event**'."\n"
+                                                    ."\n"
+                                                    .'- **alert**', 'type' => 'string', 'example' => 'event'],
+                                                'ExecutionCondition' => ['title' => '', 'description' => 'The trigger condition of the automated response rule. The value is in the JSON format.', 'type' => 'string', 'example' => '[{"left":{"value":"alert_name"},"operator":"containsString","right":{"value":"webshell_online"}}]'],
+                                                'ActionType' => ['title' => '', 'description' => 'The handling action. Multiple values are separated by commas. Valid values:'."\n"
+                                                    ."\n"
+                                                    .'- **doPlaybook**: executes a playbook.'."\n"
+                                                    ."\n"
+                                                    .'- **changeEventStatus**: changes the status of an event.'."\n"
+                                                    ."\n"
+                                                    .'- **changeThreatLevel**: changes the threat level of an event.', 'type' => 'string', 'example' => 'doPlaybook,changeEventStatus'],
+                                                'ActionConfig' => ['title' => '', 'description' => 'The action configuration of the automated response rule. The value is a JSON array.', 'type' => 'string', 'example' => '['."\n"
+                                                    .'      {'."\n"
+                                                    .'            "actionType": "doPlaybook",'."\n"
+                                                    .'            "playbookName": "WafBlockIP",'."\n"
+                                                    .'            "playbookUuid": "bdad6220-6584-41b2-9704-fc6584568758"'."\n"
+                                                    .'      }'."\n"
+                                                    .']'],
+                                                'Status' => ['title' => '', 'description' => 'The status of the rule. Valid values:'."\n"
+                                                    ."\n"
+                                                    .'- **0**: disabled'."\n"
+                                                    ."\n"
+                                                    .'- **100**: enabled', 'type' => 'integer', 'format' => 'int32', 'example' => '0'],
+                                                'DataType' => ['description' => 'The data type of the condition field in the automated response rule.', 'type' => 'integer', 'format' => 'int32', 'title' => '', 'example' => 'varchar'],
+                                                'ResponseRuleType' => ['type' => 'string', 'description' => 'The type of the response rule.'."\n"
+                                                    ."\n"
+                                                    .'- preset: predefined'."\n"
+                                                    ."\n"
+                                                    .'- custom: custom', 'title' => '', 'example' => 'custom'],
+                                            ],
+                                            'description' => '',
+                                            'title' => '',
+                                            'example' => '',
                                         ],
+                                        'example' => '',
                                     ],
                                 ],
                                 'example' => '123456',
                             ],
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true：成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
-                            ],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'ListAutomateResponseConfigs',
+            'summary' => 'Retrieves a list of automated response rules.',
+            'changeSet' => [
+                ['createdAt' => '2025-06-05T12:36:47.000Z', 'description' => 'Request parameters changed, Response parameters changed'],
+                ['createdAt' => '2024-04-17T12:43:23.000Z', 'description' => 'Error codes changed, Request parameters changed, Response parameters changed'],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"LogSource\\": \\"cloud_siem_aegis_sas_alert\\",\\n      \\"LogSourceName\\": \\"sas.cloudsiem.prod.cloud_siem_aegis_sas_alert\\"\\n    }\\n  ],\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
-            'title' => 'DescribeLogSource',
-        ],
-        'DescribeLogType' => [
-            'summary' => 'Queries the log types that can be configured for a custom rule.',
-            'methods' => [
-                'get',
-                'post',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListAutomateResponseConfigs'],
+                ],
             ],
-            'schemes' => [
-                'https',
-                'http',
+            'ramActions' => [
+                [
+                    'operationType' => 'list',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ListAutomateResponseConfigs',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n  \\"Data\\": {\\n    \\"PageInfo\\": {\\n      \\"CurrentPage\\": 1,\\n      \\"PageSize\\": 10,\\n      \\"TotalCount\\": 100\\n    },\\n    \\"ResponseData\\": [\\n      {\\n        \\"Id\\": 123,\\n        \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n        \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n        \\"Aliuid\\": 0,\\n        \\"SubUserId\\": 0,\\n        \\"RuleName\\": \\"cfw kill quara book\\",\\n        \\"AutoResponseType\\": \\"event\\",\\n        \\"ExecutionCondition\\": \\"[{\\\\\\"left\\\\\\":{\\\\\\"value\\\\\\":\\\\\\"alert_name\\\\\\"},\\\\\\"operator\\\\\\":\\\\\\"containsString\\\\\\",\\\\\\"right\\\\\\":{\\\\\\"value\\\\\\":\\\\\\"webshell_online\\\\\\"}}]\\",\\n        \\"ActionType\\": \\"doPlaybook,changeEventStatus\\",\\n        \\"ActionConfig\\": \\"[\\\\n      {\\\\n            \\\\\\"actionType\\\\\\": \\\\\\"doPlaybook\\\\\\",\\\\n            \\\\\\"playbookName\\\\\\": \\\\\\"WafBlockIP\\\\\\",\\\\n            \\\\\\"playbookUuid\\\\\\": \\\\\\"bdad6220-6584-41b2-9704-fc6584568758\\\\\\"\\\\n      }\\\\n]\\",\\n        \\"Status\\": 0,\\n        \\"DataType\\": 0,\\n        \\"ResponseRuleType\\": \\"custom\\"\\n      }\\n    ]\\n  }\\n}","type":"json"}]',
+        ],
+        'ListBindAccount' => [
+            'summary' => 'Lists multicloud accounts bound to Threat Analysis.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
+            'operationType' => 'read',
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'get',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-            ],
+            'systemTags' => ['operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
-                    'name' => 'RoleType',
+                    'name' => 'CloudCode',
                     'in' => 'formData',
                     'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
+                        'title' => '',
+                        'description' => 'The code of the cloud service provider. Valid values:'."\n"
+                            ."\n"
+                            .'- qcloud: Tencent Cloud.'."\n"
+                            ."\n"
+                            .'- aliyun: Alibaba Cloud.'."\n"
+                            ."\n"
+                            .'- hcloud: Huawei Cloud.',
+                        'type' => 'string',
+                        'required' => true,
+                        'enumValueTitles' => [],
+                        'enum' => ['qcloud', 'hcloud'],
+                        'example' => 'hcloud',
                     ],
                 ],
                 [
+                    'name' => 'RegionId',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The region where the data management center of Threat Analysis is deployed. Select the region of the data management center based on the region of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
+                ],
+                [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member whose perspective the administrator wants to switch to.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
-                    'name' => 'RegionId',
+                    'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['description' => 'The view type.'."\n"
+                        ."\n"
+                        .'- 0: The view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: The view of all accounts that are managed by the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'PlainResponse<List<LogType>>',
-                        'description' => 'PlainResponse\\<List>'."\n",
+                        'title' => '',
+                        'description' => 'The information about the bound accounts.',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
+                                'title' => '',
+                                'description' => 'The result set.',
                                 'type' => 'array',
                                 'items' => [
                                     'type' => 'object',
                                     'properties' => [
-                                        'LogType' => [
-                                            'title' => '规则对应的日志类型。',
-                                            'description' => 'The log type of the rule.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'HTTP_ACTIVITY',
-                                        ],
-                                        'LogTypeName' => [
-                                            'title' => '日志类型名称美杜莎code。',
-                                            'description' => 'The internal code of the log type.'."\n",
+                                        'AccountName' => ['title' => '', 'description' => 'The name of the account.', 'type' => 'string', 'example' => 'XXXX Company'],
+                                        'AccessId' => ['title' => '', 'description' => 'The AccessKey ID of the account.', 'type' => 'string', 'example' => 'ABCXXXXXXXX'],
+                                        'DataSourceCount' => ['title' => '', 'description' => 'The number of data sources that are bound to the account.', 'type' => 'integer', 'format' => 'int64', 'example' => '2'],
+                                        'ModifyTime' => ['title' => '', 'description' => 'The time when the binding was modified.', 'type' => 'string', 'example' => '2023-11-10 12:20:35'],
+                                        'CreateUser' => ['title' => '', 'description' => 'The user who bound the account.', 'type' => 'string', 'example' => '123xxxxxxx'],
+                                        'BindId' => ['title' => '', 'description' => 'The binding ID.', 'type' => 'integer', 'format' => 'int64', 'example' => '123xxxxxxx'],
+                                        'AccountId' => ['title' => '', 'description' => 'The ID of the cloud account.', 'type' => 'string', 'example' => '123xxxxxxx'],
+                                        'CloudCode' => [
+                                            'title' => '',
+                                            'description' => 'The code of the cloud service provider. Valid values:'."\n"
+                                                ."\n"
+                                                .'- qcloud: Tencent Cloud.'."\n"
+                                                ."\n"
+                                                .'- aliyun: Alibaba Cloud.'."\n"
+                                                ."\n"
+                                                .'- hcloud: Huawei Cloud.',
                                             'type' => 'string',
-                                            'example' => 'sas.cloudsiem.prod.http_activity',
+                                            'enumValueTitles' => [],
+                                            'enum' => ['qcloud', 'hcloud'],
+                                            'example' => 'hcloud',
                                         ],
                                     ],
+                                    'description' => '',
+                                    'title' => '',
+                                    'example' => '',
                                 ],
-                                'example' => '123456',
-                            ],
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true：成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
+                                'example' => '',
                             ],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"AccountName\\": \\"XXXX Company\\",\\n      \\"AccessId\\": \\"ABCXXXXXXXX\\",\\n      \\"DataSourceCount\\": 2,\\n      \\"ModifyTime\\": \\"2023-11-10 12:20:35\\",\\n      \\"CreateUser\\": \\"123xxxxxxx\\",\\n      \\"BindId\\": 0,\\n      \\"AccountId\\": \\"123xxxxxxx\\",\\n      \\"CloudCode\\": \\"hcloud\\"\\n    }\\n  ],\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+            'title' => 'ListBindAccount',
+            'changeSet' => [
+                ['createdAt' => '2024-07-18T01:29:01.000Z', 'description' => 'Request parameters changed'],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"LogType\\": \\"HTTP_ACTIVITY\\",\\n      \\"LogTypeName\\": \\"sas.cloudsiem.prod.http_activity\\"\\n    }\\n  ],\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
-            'title' => 'DescribeLogType',
-        ],
-        'DescribeOperators' => [
-            'summary' => 'Queries the operator of a custom rule.',
-            'methods' => [
-                'get',
-                'post',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListBindAccount'],
+                ],
             ],
-            'schemes' => [
-                'https',
-                'http',
+            'ramActions' => [
+                [
+                    'operationType' => 'list',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ListBindAccount',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'translator' => 'machine',
+        ],
+        'ListBindDataSources' => [
+            'summary' => 'Queries all bound data sources.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
+            'operationType' => 'read',
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'get',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-            ],
+            'systemTags' => ['operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
-                    'name' => 'SceneType',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '操作符使用场景类型。 取值：'."\n"
-                            .'- 不传：默认场景'."\n"
-                            .'- AGGREGATE：聚合函数场景',
-                        'description' => 'The type of the scenario in which the operator is used. Valid values:'."\n"
-                            ."\n"
-                            .'*   If you do not specify this parameter, the default scenario is used.'."\n"
-                            .'*   AGGREGATE: AGGREGATE scenario.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'AGGREGATE',
-                    ],
-                ],
-                [
-                    'name' => 'RoleType',
+                    'name' => 'AccountId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account.', 'type' => 'string', 'required' => true, 'example' => '123xxxxxxx'],
                 ],
                 [
-                    'name' => 'RoleFor',
+                    'name' => 'CloudCode',
                     'in' => 'formData',
                     'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
+                        'title' => '',
+                        'description' => 'The code of the multicloud environment.',
+                        'type' => 'string',
+                        'required' => true,
+                        'enum' => ['qcloud', 'hcloud', 'aliyun'],
+                        'example' => 'hcloud',
                     ],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region where the Data Management center of Threat Analysis is located. Select a region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'PlainResponse<List<CustomizeRuleOperator>>',
-                        'description' => 'PlainResponse\\<List>'."\n",
+                        'title' => 'CloudSiemSuccessResponse<List<ListBindDataSourcesResult>>',
+                        'description' => 'CloudSiemSuccessResponse\\<List>',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
+                                'title' => '',
+                                'description' => 'The data returned.',
                                 'type' => 'array',
                                 'items' => [
                                     'type' => 'object',
                                     'properties' => [
-                                        'Operator' => [
-                                            'title' => '操作符。',
-                                            'description' => 'The operator.'."\n",
-                                            'type' => 'string',
-                                            'example' => '<=',
-                                        ],
-                                        'OperatorName' => [
-                                            'title' => '操作符显示名称。',
-                                            'description' => 'The name of the operator.'."\n",
-                                            'type' => 'string',
-                                            'example' => '<=',
-                                        ],
-                                        'OperatorDescCn' => [
-                                            'title' => '操作符中文描述。',
-                                            'description' => 'The description of the operator in Chinese.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'arger than or equal to',
-                                        ],
-                                        'OperatorDescEn' => [
-                                            'title' => '操作符英文描述。',
-                                            'description' => 'The description of the operator in English.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'larger than or equal to',
-                                        ],
-                                        'SupportDataType' => [
-                                            'title' => '当前操作符可以支持的数据类型 以逗号分隔。',
-                                            'description' => 'The data types that are supported by the operator. The data types are separated by commas (,).'."\n",
+                                        'AccountName' => ['title' => '', 'description' => 'The name of the multicloud account.', 'type' => 'string', 'example' => 'sas_tq_account_xxxx'],
+                                        'DataSourceInstanceId' => ['title' => '', 'description' => 'The ID of the data source. This ID is an MD5 hash value that is calculated by Threat Analysis based on specific parameters.', 'type' => 'string', 'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea'],
+                                        'DataSourceType' => ['title' => '', 'description' => 'The type of the data source. Valid values:'."\n"
+                                            ."\n"
+                                            .'- obs: Huawei Cloud OBS.'."\n"
+                                            ."\n"
+                                            .'- wafApi: Tencent Cloud WAF download API.'."\n"
+                                            ."\n"
+                                            .'- ckafka: Tencent Cloud CKafka.', 'type' => 'string', 'example' => 'obs'],
+                                        'DataSourceName' => ['title' => '', 'description' => 'The name of the data source.', 'type' => 'string', 'example' => 'waf_kafka'],
+                                        'DataSourceRemark' => ['title' => '', 'description' => 'The remarks of the data source.', 'type' => 'string', 'example' => 'waf_kafka'],
+                                        'LogCount' => ['title' => '', 'description' => 'The number of logs added to the data source.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'],
+                                        'TaskCount' => ['title' => '', 'description' => 'The number of log collection tasks created for the data source.', 'type' => 'integer', 'format' => 'int32', 'example' => '0'],
+                                        'AccountId' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account.', 'type' => 'string', 'example' => '123xxxxxxx'],
+                                        'CloudCode' => [
+                                            'title' => '',
+                                            'description' => 'The code of the multicloud environment. Valid values:'."\n"
+                                                ."\n"
+                                                .'- qcloud: Tencent Cloud.'."\n"
+                                                ."\n"
+                                                .'- aliyun: Alibaba Cloud.'."\n"
+                                                ."\n"
+                                                .'- hcloud: Huawei Cloud.',
                                             'type' => 'string',
-                                            'example' => 'varchar',
-                                        ],
-                                        'SupportTag' => [
-                                            'title' => '操作符支持场景 多个场景以逗号分隔 如聚合（AGGREGATE）等 默认为空。',
-                                            'description' => 'The scenarios that are supported by the operator. Multiple scenarios are separated by commas (,), such as AGGREGATE scenarios. By default, this parameter is empty.'."\n",
-                                            'type' => 'array',
-                                            'items' => [
-                                                'description' => 'The scenario that is supported by the operator. Multiple scenarios are separated by commas (,), such as AGGREGATE scenarios. By default, this parameter is empty.'."\n",
-                                                'type' => 'string',
-                                                'example' => '[AGGREGATE]',
-                                            ],
-                                            'example' => '[AGGREGATE]',
-                                        ],
-                                        'Index' => [
-                                            'title' => '操作符所处操作符列表位置。',
-                                            'description' => 'The position of the operator in the operator list.'."\n",
-                                            'type' => 'integer',
-                                            'format' => 'int32',
-                                            'example' => '3',
+                                            'enum' => ['qcloud', 'hcloud'],
+                                            'example' => 'hcloud',
                                         ],
                                     ],
+                                    'description' => '',
+                                    'title' => '',
+                                    'example' => '',
                                 ],
-                                'example' => '123456',
-                            ],
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true：成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
+                                'example' => '',
                             ],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'title' => 'ListBindDataSources',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListBindDataSources'],
+                ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"Operator\\": \\"<=\\",\\n      \\"OperatorName\\": \\"<=\\",\\n      \\"OperatorDescCn\\": \\"arger than or equal to\\",\\n      \\"OperatorDescEn\\": \\"larger than or equal to\\",\\n      \\"SupportDataType\\": \\"varchar\\",\\n      \\"SupportTag\\": [\\n        \\"[AGGREGATE]\\"\\n      ],\\n      \\"Index\\": 3\\n    }\\n  ],\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
-            'title' => 'DescribeOperators',
+            'ramActions' => [
+                [
+                    'operationType' => 'list',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ListBindDataSources',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
+            ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"AccountName\\": \\"sas_tq_account_xxxx\\",\\n      \\"DataSourceInstanceId\\": \\"220ba97c9d1fdb0b9c7e8c7ca328d7ea\\",\\n      \\"DataSourceType\\": \\"obs\\",\\n      \\"DataSourceName\\": \\"waf_kafka\\",\\n      \\"DataSourceRemark\\": \\"waf_kafka\\",\\n      \\"LogCount\\": 1,\\n      \\"TaskCount\\": 0,\\n      \\"AccountId\\": \\"123xxxxxxx\\",\\n      \\"CloudCode\\": \\"hcloud\\"\\n    }\\n  ],\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
         ],
         'ListCloudSiemCustomizeRules' => [
-            'summary' => 'Queries custom rules.',
-            'methods' => [
-                'get',
-                'post',
-            ],
-            'schemes' => [
-                'https',
-                'http',
-            ],
+            'methods' => ['get', 'post'],
+            'schemes' => ['https', 'http'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'list',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-            ],
+            'systemTags' => ['operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
                     'name' => 'Id',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '规则ID。',
-                        'description' => 'The ID of the custom rule.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '10223',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The ID of the custom rule.', 'type' => 'string', 'required' => false, 'example' => '10223'],
                 ],
                 [
                     'name' => 'StartTime',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '查询开始时间, 单位毫秒。',
-                        'description' => 'The beginning of the time range to query. Unit: milliseconds.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '1577808000000',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The start time of the query. The value is a UNIX timestamp. Unit: milliseconds.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '1577808000000'],
                 ],
                 [
                     'name' => 'EndTime',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '查询结束时间, 单位毫秒。',
-                        'description' => 'The end of the time range to query. Unit: milliseconds.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '1577808000000',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The end time of the query. The value is a UNIX timestamp. Unit: milliseconds.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '1577808000000'],
                 ],
                 [
                     'name' => 'ThreatLevel',
                     'in' => 'formData',
                     'style' => 'repeatList',
                     'schema' => [
-                        'title' => '威胁等级，格式为json数组。取值：'."\n"
-                            .'- serious：高危'."\n"
-                            .'- suspicious：中危'."\n"
-                            .'- remind：低危',
-                        'description' => 'The threat level. The value must be a JSON array. Valid values:'."\n"
+                        'title' => '',
+                        'description' => 'The threat level. The value is a JSON array. Valid values:'."\n"
                             ."\n"
-                            .'*   **serious**: high-risk.'."\n"
-                            .'*   **suspicious**: medium-risk.'."\n"
-                            .'*   **remind**: low-risk.'."\n",
+                            .'- **serious**: high'."\n"
+                            ."\n"
+                            .'- **suspicious**: medium'."\n"
+                            ."\n"
+                            .'- **remind**: low',
                         'type' => 'array',
-                        'items' => [
-                            'description' => 'The threat level. The value must be a JSON array. Valid values:'."\n"
-                                ."\n"
-                                .'*   **serious**: high-risk.'."\n"
-                                .'*   **suspicious**: medium-risk.'."\n"
-                                .'*   **remind**: low-risk.'."\n",
-                            'type' => 'string',
-                            'required' => false,
-                            'example' => '["remind","serious"]'."\n",
-                        ],
+                        'items' => ['description' => 'The threat level. The value is a JSON array. Valid values:'."\n"
+                            ."\n"
+                            .'- **serious**: high'."\n"
+                            ."\n"
+                            .'- **suspicious**: medium'."\n"
+                            ."\n"
+                            .'- **remind**: low', 'type' => 'string', 'required' => false, 'title' => '', 'example' => '["remind","serious"]'."\n"],
                         'required' => false,
                         'example' => '["serious","suspicious","remind"]',
                         'maxItems' => 100,
@@ -12395,533 +8482,277 @@
                 [
                     'name' => 'AlertType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '告警类型。',
-                        'description' => 'The alert type.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'scan',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The alert type.', 'type' => 'string', 'required' => false, 'example' => 'scan'],
                 ],
                 [
                     'name' => 'RuleName',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '规则名称, 仅支持字母、数字、下划线、点。',
-                        'description' => 'The name of the rule. The name can contain letters, digits, underscores (\\_), and periods (.).'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'waf_scan',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The name of the rule. The name can contain letters, digits, underscores (\\_), and periods (.).', 'type' => 'string', 'required' => false, 'example' => 'waf_scan'],
                 ],
                 [
                     'name' => 'RuleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '规则类型。 取值：'."\n"
-                            .'- predefine：预定义'."\n"
-                            .'- customize：自定义',
-                        'description' => 'The type of the rule. Valid values:'."\n"
-                            ."\n"
-                            .'*   **predefine**'."\n"
-                            .'*   **customize**'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'customize',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The type of the rule. Valid values:'."\n"
+                        ."\n"
+                        .'- **predefine**: predefined'."\n"
+                        ."\n"
+                        .'- **customize**: custom', 'type' => 'string', 'required' => false, 'example' => 'customize'],
                 ],
                 [
                     'name' => 'Status',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '规则状态。 取值：'."\n"
-                            .'- 0：初始状态'."\n"
-                            .'- 10：模拟数据测试'."\n"
-                            .'- 15：业务数据测试中'."\n"
-                            .'- 20：业务数据测试结束'."\n"
-                            .'- 100：规则上线',
-                        'description' => 'The status of the rule. Valid values:'."\n"
-                            ."\n"
-                            .'*   **0**: The rule is in the initial state.'."\n"
-                            .'*   **10**: The simulation data is tested.'."\n"
-                            .'*   **15**: The business data is being tested.'."\n"
-                            .'*   **20**: The business data test is complete.'."\n"
-                            .'*   **100**: The rule is in effect.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '0',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The status of the rule. Valid values:'."\n"
+                        ."\n"
+                        .'- **0**: initial'."\n"
+                        ."\n"
+                        .'- **10**: testing with simulated data'."\n"
+                        ."\n"
+                        .'- **15**: testing with business data'."\n"
+                        ."\n"
+                        .'- **20**: testing with business data is complete'."\n"
+                        ."\n"
+                        .'- **100**: published', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '0'],
                 ],
                 [
                     'name' => 'OrderField',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '规则列表排列字段。 取值：'."\n"
-                            .'- GmtModified：基于修改时间排序'."\n"
-                            .'- Id：基于规则id排序（默认）',
-                        'description' => 'The field that is used to sort the rules. Valid values:'."\n"
-                            ."\n"
-                            .'*   GmtModified: The rules are sorted based on the modification time.'."\n"
-                            .'*   Id (default): The rules are sorted based on the rule ID.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'Id',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The field that you use to sort the custom rules. Valid values:'."\n"
+                        ."\n"
+                        .'- GmtModified: sorts the rules by modification time.'."\n"
+                        ."\n"
+                        .'- Id: sorts the rules by rule ID. This is the default value.', 'type' => 'string', 'required' => false, 'example' => 'Id'],
                 ],
                 [
                     'name' => 'Order',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '事件列表排列方向。 取值：'."\n"
-                            .'- desc：降序排列'."\n"
-                            .'- asc：升序排列。',
-                        'description' => 'The sort method. Valid values:'."\n"
-                            ."\n"
-                            .'*   desc: descending order.'."\n"
-                            .'*   asc: ascending order.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'desc',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The order in which you want to sort the custom rules. Valid values:'."\n"
+                        ."\n"
+                        .'- desc: descending order'."\n"
+                        ."\n"
+                        .'- asc: ascending order', 'type' => 'string', 'required' => false, 'example' => 'desc'],
                 ],
                 [
                     'name' => 'CurrentPage',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '列表当前页号， 大于等于1。',
-                        'description' => 'The page number. Pages start from page 1.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => true,
-                        'minimum' => '1',
-                        'example' => '1',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The page number. Pages start from page 1.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'minimum' => '1', 'example' => '1'],
                 ],
                 [
                     'name' => 'PageSize',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '列表每页条数， 最大不超过100。',
-                        'description' => 'The number of entries per page. The value can be up to 100.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => true,
-                        'maximum' => '100',
-                        'minimum' => '1',
-                        'example' => '10',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The number of entries per page. Maximum value: 100.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'maximum' => '100', 'minimum' => '1', 'example' => '10'],
                 ],
                 [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            ."\n"
-                            .'*   0: view of the current Alibaba Cloud account.'."\n"
-                            .'*   1: view of all accounts for the enterprise.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '0',
-                    ],
+                    'schema' => ['description' => 'The view type.'."\n"
+                        ."\n"
+                        .'- 0: the view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: the view of all members in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the destination account to which you switch the view from the management account.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The user ID that is used to switch the administrator\'s view to the view of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The data management center of the threat analysis feature. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   **cn-hangzhou**: Your assets reside in regions in China.'."\n"
-                            .'*   **ap-southeast-1**: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region where the data management center of Threat Analysis is deployed. You must select the region where your assets reside. Valid values:'."\n"
+                        ."\n"
+                        .'- **cn-hangzhou**: your assets are in the Chinese mainland or Hong Kong (China).'."\n"
+                        ."\n"
+                        .'- **ap-southeast-1**: your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'PageResponse<List<CloudSiemCustomizeRule>>',
-                        'description' => 'PageResponse\\<List>'."\n",
+                        'description' => 'PageResponse\\<List\\<CloudSiemCustomizeRule>>',
                         'type' => 'object',
                         'properties' => [
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true:成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   **true**'."\n"
-                                    .'*   **false**'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
-                            ],
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- **true**: The request was successful.'."\n"
+                                ."\n"
+                                .'- **false**: The request failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The HTTP status code.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The returned message.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
+                                'title' => '',
+                                'description' => 'The data returned.',
                                 'type' => 'object',
                                 'properties' => [
                                     'PageInfo' => [
-                                        'title' => '分页记录。',
-                                        'description' => 'The pagination information.'."\n",
+                                        'title' => '',
+                                        'description' => 'The pagination information.',
                                         'type' => 'object',
                                         'properties' => [
-                                            'CurrentPage' => [
-                                                'title' => '列表当前页号。',
-                                                'description' => 'The current page number.'."\n",
-                                                'type' => 'integer',
-                                                'format' => 'int32',
-                                                'example' => '1',
-                                            ],
-                                            'PageSize' => [
-                                                'title' => '每页返回记录数。',
-                                                'description' => 'The number of entries per page.'."\n",
-                                                'type' => 'integer',
-                                                'format' => 'int32',
-                                                'example' => '10',
-                                            ],
-                                            'TotalCount' => [
-                                                'title' => '记录总数。',
-                                                'description' => 'The total number of entries returned.'."\n",
-                                                'type' => 'integer',
-                                                'format' => 'int64',
-                                                'example' => '100',
-                                            ],
+                                            'CurrentPage' => ['title' => '', 'description' => 'The page number.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'],
+                                            'PageSize' => ['title' => '', 'description' => 'The number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10'],
+                                            'TotalCount' => ['title' => '', 'description' => 'The total number of entries.', 'type' => 'integer', 'format' => 'int64', 'example' => '100'],
                                         ],
+                                        'example' => '',
                                     ],
                                     'ResponseData' => [
-                                        'title' => '详细数据。',
-                                        'description' => 'The detailed data.'."\n",
+                                        'title' => '',
+                                        'description' => 'The detailed data.',
                                         'type' => 'array',
                                         'items' => [
                                             'type' => 'object',
                                             'properties' => [
-                                                'Id' => [
-                                                    'title' => '自定义规则ID。',
-                                                    'description' => 'The ID of the custom rule.'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int64',
-                                                    'example' => '123456789',
-                                                ],
-                                                'GmtCreate' => [
-                                                    'title' => '自定义规则创建时间。',
-                                                    'description' => 'The time when the custom rule was created.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '2021-01-06 16:37:29',
-                                                ],
-                                                'GmtModified' => [
-                                                    'title' => '自定义规则最后更新时间。',
-                                                    'description' => 'The time when the custom rule was last updated.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '2021-01-06 16:37:29',
-                                                ],
-                                                'Aliuid' => [
-                                                    'title' => 'siem主账号ID。',
-                                                    'description' => 'The ID of the Alibaba Cloud account in SIEM.'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int64',
-                                                    'example' => '127608589417****',
-                                                ],
-                                                'RuleName' => [
-                                                    'title' => '规则名称。',
-                                                    'description' => 'The name of the rule.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'waf_scan',
-                                                ],
-                                                'RuleDesc' => [
-                                                    'title' => '规则描述。',
-                                                    'description' => 'The description of the rule.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'this rule is for waf scan',
-                                                ],
-                                                'RuleType' => [
-                                                    'title' => '规则类型。 取值：'."\n"
-                                                        .'- predefine：预定义'."\n"
-                                                        .'- customize：自定义',
-                                                    'description' => 'The type of the rule. Valid values:'."\n"
-                                                        ."\n"
-                                                        .'*   **predefine**'."\n"
-                                                        .'*   **customize**'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'customize',
-                                                ],
-                                                'ThreatLevel' => [
-                                                    'title' => '威胁等级。取值：'."\n"
-                                                        .'- serious：高危'."\n"
-                                                        .'- suspicious：中危'."\n"
-                                                        .'- remind：低危',
-                                                    'description' => 'The risk level. Valid values:'."\n"
-                                                        ."\n"
-                                                        .'*   **serious**: high-risk.'."\n"
-                                                        .'*   **suspicious**: medium-risk.'."\n"
-                                                        .'*   **remind**: low-risk.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'remind',
-                                                ],
-                                                'AlertType' => [
-                                                    'title' => '威胁类型。',
-                                                    'description' => 'The type of the risk.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'WEBSHELL',
-                                                ],
-                                                'AlertTypeMds' => [
-                                                    'title' => '威胁类型美杜莎code。',
-                                                    'description' => 'The internal code of the risk type.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '${siem_rule_type_process_abnormal_command}',
-                                                ],
-                                                'LogType' => [
-                                                    'title' => '规则对应的日志类型。',
-                                                    'description' => 'The log type of the rule.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'ALERT_ACTIVITY',
-                                                ],
-                                                'LogTypeMds' => [
-                                                    'title' => '规则对应的日志类型美杜莎code。',
-                                                    'description' => 'The internal code of the log type.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '${sas.cloudsiem.prod.alert_activity}',
-                                                ],
-                                                'LogSource' => [
-                                                    'title' => '规则对应的日志源。',
-                                                    'description' => 'The log source of the rule.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'cloud_siem_aegis_sas_alert',
-                                                ],
-                                                'LogSourceMds' => [
-                                                    'title' => '规则对应的日志源美杜莎code。',
-                                                    'description' => 'The internal code of the log source.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '${sas.cloudsiem.prod.cloud_siem_aegis_sas_alert}',
-                                                ],
-                                                'RuleCondition' => [
-                                                    'title' => '规则查询条件json(需要对html转义字符进行反向转义)。',
-                                                    'description' => 'The query condition of the rule. The value is in the JSON format. The HTML escape characters are reversed.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '[[{&quot;not&quot;:false,&quot;left&quot;:&quot;alert_name&quot;,&quot;operator&quot;:&quot;=&quot;,&quot;right&quot;:&quot;WEBSHELL&quot;}]]',
-                                                ],
-                                                'RuleGroup' => [
-                                                    'title' => '日志聚合字段,json数组格式(需要对html转义字符进行反向转义)。',
-                                                    'description' => 'The log aggregation field. The value is in the JSON format. The HTML escape characters are reversed.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '[&quot;asset_id&quot;]',
-                                                ],
-                                                'RuleThreshold' => [
-                                                    'title' => '规则阈值配置json(需要对html转义字符进行反向转义)。',
-                                                    'description' => 'The threshold configurations of the rule in the JSON format. The HTML escape characters are reversed.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '{&quot;aggregateFunction&quot;:&quot;count&quot;,&quot;aggregateFunctionName&quot;:&quot;count&quot;,&quot;field&quot;:&quot;activity_name&quot;,&quot;operator&quot;:&quot;&lt;=&quot;,&quot;value&quot;:1}',
-                                                ],
-                                                'QueryCycle' => [
-                                                    'title' => '规则窗口长度(需要对html转义字符进行反向转义)。',
-                                                    'description' => 'The window length of the rule. The HTML escape characters are reversed.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '{&quot;time&quot;:&quot;1&quot;,&quot;unit&quot;:&quot;HOUR&quot;}',
-                                                ],
-                                                'AttCk' => [
-                                                    'title' => '告警附加字段attck',
-                                                    'description' => 'The alert additional field for ATT\\&CK.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'T1595.002 Vulnerability Scanning',
-                                                ],
-                                                'EventTransferSwitch' => [
-                                                    'title' => '告警是否转换事件开关。 取值：'."\n"
-                                                        .'- 0：不转换'."\n"
-                                                        .'- 1：转换',
-                                                    'description' => 'Indicates whether the system generates an event for the alert. Valid values:'."\n"
-                                                        ."\n"
-                                                        .'*   **0**: no.'."\n"
-                                                        .'*   **1**: yes.'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int32',
-                                                    'example' => '1',
-                                                ],
-                                                'EventTransferType' => [
-                                                    'title' => '事件生成方式。 取值：'."\n"
-                                                        .'- default:默认内置方式'."\n"
-                                                        .'- singleToSingle：每个告警生成一个事件'."\n"
-                                                        .'- allToSingle：周期内告警生成一个事件',
-                                                    'description' => 'The method that is used to generate an event. Valid values:'."\n"
-                                                        ."\n"
-                                                        .'*   **default**: built-in method.'."\n"
-                                                        .'*   **singleToSingle**: The system generates an event for each alert.'."\n"
-                                                        .'*   **allToSingle**: The system generates an event for alerts within a period of time.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'allToSingle',
-                                                ],
-                                                'EventTransferExt' => [
-                                                    'title' => '事件生成扩展信息 当eventTransferType值为allToSingle该字段有值 表示告警聚合窗口的周期长度以及周期单位(需要对html转义字符进行反向转义)。',
-                                                    'description' => 'The extended information about event generation. If the value of **eventTransferType** is **allToSingle**, the value of this parameter indicates the length and unit of the alert aggregation window. The HTML escape characters are reversed.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '{&quot;time&quot;:&quot;1&quot;,&quot;unit&quot;:&quot;MINUTE&quot;}',
-                                                ],
-                                                'Status' => [
-                                                    'title' => '规则状态。 取值：'."\n"
-                                                        .'- 0：初始状态'."\n"
-                                                        .'- 10：模拟数据测试'."\n"
-                                                        .'- 15：业务数据测试中'."\n"
-                                                        .'- 20：业务数据测试结束'."\n"
-                                                        .'- 100：规则上线',
-                                                    'description' => 'The status of the rule. Valid values:'."\n"
-                                                        ."\n"
-                                                        .'*   **0**: The rule is in the initial state.'."\n"
-                                                        .'*   **10**: The simulation data is tested.'."\n"
-                                                        .'*   **15**: The business data is being tested.'."\n"
-                                                        .'*   **20**: The business data test is complete.'."\n"
-                                                        .'*   **100**: The rule is in effect.'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int32',
-                                                    'example' => '0',
-                                                ],
-                                                'DataType' => [
-                                                    'description' => 'The type of the view. Valid values:'."\n"
-                                                        ."\n"
-                                                        .'0: view of the current Alibaba Cloud account. 1: view of all accounts for the enterprise.'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int32',
-                                                    'example' => '1',
-                                                ],
+                                                'Id' => ['title' => '', 'description' => 'The ID of the custom rule.', 'type' => 'integer', 'format' => 'int64', 'example' => '123456789'],
+                                                'GmtCreate' => ['title' => '', 'description' => 'The time when the custom rule was created.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'],
+                                                'GmtModified' => ['title' => '', 'description' => 'The time when the custom rule was last updated.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'],
+                                                'Aliuid' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account.', 'type' => 'integer', 'format' => 'int64', 'example' => '127608589417****'],
+                                                'RuleName' => ['title' => '', 'description' => 'The name of the rule.', 'type' => 'string', 'example' => 'waf_scan'],
+                                                'RuleDesc' => ['title' => '', 'description' => 'The description of the rule.', 'type' => 'string', 'example' => 'this rule is for waf scan'],
+                                                'RuleType' => ['title' => '', 'description' => 'The type of the rule. Valid values:'."\n"
+                                                    ."\n"
+                                                    .'- **predefine**: predefined'."\n"
+                                                    ."\n"
+                                                    .'- **customize**: custom', 'type' => 'string', 'example' => 'customize'],
+                                                'ThreatLevel' => ['title' => '', 'description' => 'The threat level. Valid values:'."\n"
+                                                    ."\n"
+                                                    .'- **serious**: high'."\n"
+                                                    ."\n"
+                                                    .'- **suspicious**: medium'."\n"
+                                                    ."\n"
+                                                    .'- **remind**: low', 'type' => 'string', 'example' => 'remind'],
+                                                'AlertType' => ['title' => '', 'description' => 'The threat type.', 'type' => 'string', 'example' => 'WEBSHELL'],
+                                                'AlertTypeMds' => ['title' => '', 'description' => 'The Medusa code of the threat type.', 'type' => 'string', 'example' => '${siem_rule_type_process_abnormal_command}'],
+                                                'LogType' => ['title' => '', 'description' => 'The log type that is associated with the rule.', 'type' => 'string', 'example' => 'ALERT_ACTIVITY'],
+                                                'LogTypeMds' => ['title' => '', 'description' => 'The Medusa code of the log type that is associated with the rule.', 'type' => 'string', 'example' => '${sas.cloudsiem.prod.alert_activity}'],
+                                                'LogSource' => ['title' => '', 'description' => 'The log source that is associated with the rule.', 'type' => 'string', 'example' => 'cloud_siem_aegis_sas_alert'],
+                                                'LogSourceMds' => ['title' => '', 'description' => 'The Medusa code of the log source that is associated with the rule.', 'type' => 'string', 'example' => '${sas.cloudsiem.prod.cloud_siem_aegis_sas_alert}'],
+                                                'RuleCondition' => ['title' => '', 'description' => 'The query condition of the rule, which is a JSON-formatted string that represents an array. You must unescape the HTML escape characters in the string.', 'type' => 'string', 'example' => '[[{&quot;not&quot;:false,&quot;left&quot;:&quot;alert_name&quot;,&quot;operator&quot;:&quot;=&quot;,&quot;right&quot;:&quot;WEBSHELL&quot;}]]'],
+                                                'RuleGroup' => ['title' => '', 'description' => 'The aggregation field of the log, which is a JSON-formatted string that represents an array. You must unescape the HTML escape characters in the string.', 'type' => 'string', 'example' => '[&quot;asset_id&quot;]'],
+                                                'RuleThreshold' => ['title' => '', 'description' => 'The threshold of the rule, which is a JSON-formatted string. You must unescape the HTML escape characters in the string.', 'type' => 'string', 'example' => '{&quot;aggregateFunction&quot;:&quot;count&quot;,&quot;aggregateFunctionName&quot;:&quot;count&quot;,&quot;field&quot;:&quot;activity_name&quot;,&quot;operator&quot;:&quot;&lt;=&quot;,&quot;value&quot;:1}'],
+                                                'QueryCycle' => ['title' => '', 'description' => 'The window length of the rule, which is a JSON-formatted string. You must unescape the HTML escape characters in the string.', 'type' => 'string', 'example' => '{&quot;time&quot;:&quot;1&quot;,&quot;unit&quot;:&quot;HOUR&quot;}'],
+                                                'AttCk' => ['title' => '', 'description' => 'The ATT\\&CK attack technique.', 'type' => 'string', 'example' => 'T1595.002 Vulnerability Scanning'],
+                                                'EventTransferSwitch' => ['title' => '', 'description' => 'Indicates whether to convert alerts into events. Valid values:'."\n"
+                                                    ."\n"
+                                                    .'- **0**: no'."\n"
+                                                    ."\n"
+                                                    .'- **1**: yes', 'type' => 'integer', 'format' => 'int32', 'example' => '1'],
+                                                'EventTransferType' => ['title' => '', 'description' => 'The event generation method. Valid values:'."\n"
+                                                    ."\n"
+                                                    .'- **default**: the default method'."\n"
+                                                    ."\n"
+                                                    .'- **singleToSingle**: An event is generated for each alert.'."\n"
+                                                    ."\n"
+                                                    .'- **allToSingle**: An event is generated for all alerts within a period.', 'type' => 'string', 'example' => 'allToSingle'],
+                                                'EventTransferExt' => ['title' => '', 'description' => 'The extended information for event generation. This parameter is returned only when **EventTransferType** is set to **allToSingle**. The value is a JSON-formatted string that indicates the window length and unit for alert aggregation. You must unescape the HTML escape characters in the string.', 'type' => 'string', 'example' => '{&quot;time&quot;:&quot;1&quot;,&quot;unit&quot;:&quot;MINUTE&quot;}'],
+                                                'Status' => ['title' => '', 'description' => 'The status of the rule. Valid values:'."\n"
+                                                    ."\n"
+                                                    .'- **0**: initial'."\n"
+                                                    ."\n"
+                                                    .'- **10**: testing with simulated data'."\n"
+                                                    ."\n"
+                                                    .'- **15**: testing with business data'."\n"
+                                                    ."\n"
+                                                    .'- **20**: testing with business data is complete'."\n"
+                                                    ."\n"
+                                                    .'- **100**: published', 'type' => 'integer', 'format' => 'int32', 'example' => '0'],
+                                                'DataType' => ['description' => 'The view type.'."\n"
+                                                    ."\n"
+                                                    .'0: the view of the current Alibaba Cloud account.'."\n"
+                                                    .'1: the view of all members in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'title' => '', 'example' => '1'],
                                             ],
+                                            'description' => '',
+                                            'title' => '',
+                                            'example' => '',
                                         ],
+                                        'example' => '',
                                     ],
                                 ],
                                 'example' => '123456',
                             ],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'ListCloudSiemCustomizeRules',
+            'summary' => 'Retrieves a list of custom rules.',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:43:23.000Z', 'description' => 'Error codes changed, Request parameters changed, Response parameters changed'],
+            ],
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListCloudSiemCustomizeRules'],
+                ],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'list',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ListCloudSiemCustomizeRules',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
             'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n  \\"Data\\": {\\n    \\"PageInfo\\": {\\n      \\"CurrentPage\\": 1,\\n      \\"PageSize\\": 10,\\n      \\"TotalCount\\": 100\\n    },\\n    \\"ResponseData\\": [\\n      {\\n        \\"Id\\": 123456789,\\n        \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n        \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n        \\"Aliuid\\": 0,\\n        \\"RuleName\\": \\"waf_scan\\",\\n        \\"RuleDesc\\": \\"this rule is for waf scan\\",\\n        \\"RuleType\\": \\"customize\\",\\n        \\"ThreatLevel\\": \\"remind\\",\\n        \\"AlertType\\": \\"WEBSHELL\\",\\n        \\"AlertTypeMds\\": \\"${siem_rule_type_process_abnormal_command}\\",\\n        \\"LogType\\": \\"ALERT_ACTIVITY\\",\\n        \\"LogTypeMds\\": \\"${sas.cloudsiem.prod.alert_activity}\\",\\n        \\"LogSource\\": \\"cloud_siem_aegis_sas_alert\\",\\n        \\"LogSourceMds\\": \\"${sas.cloudsiem.prod.cloud_siem_aegis_sas_alert}\\",\\n        \\"RuleCondition\\": \\"[[{&quot;not&quot;:false,&quot;left&quot;:&quot;alert_name&quot;,&quot;operator&quot;:&quot;=&quot;,&quot;right&quot;:&quot;WEBSHELL&quot;}]]\\",\\n        \\"RuleGroup\\": \\"[&quot;asset_id&quot;]\\",\\n        \\"RuleThreshold\\": \\"{&quot;aggregateFunction&quot;:&quot;count&quot;,&quot;aggregateFunctionName&quot;:&quot;count&quot;,&quot;field&quot;:&quot;activity_name&quot;,&quot;operator&quot;:&quot;&lt;=&quot;,&quot;value&quot;:1}\\",\\n        \\"QueryCycle\\": \\"{&quot;time&quot;:&quot;1&quot;,&quot;unit&quot;:&quot;HOUR&quot;}\\",\\n        \\"AttCk\\": \\"T1595.002 Vulnerability Scanning\\",\\n        \\"EventTransferSwitch\\": 1,\\n        \\"EventTransferType\\": \\"allToSingle\\",\\n        \\"EventTransferExt\\": \\"{&quot;time&quot;:&quot;1&quot;,&quot;unit&quot;:&quot;MINUTE&quot;}\\",\\n        \\"Status\\": 0,\\n        \\"DataType\\": 1\\n      }\\n    ]\\n  }\\n}","type":"json"}]',
-            'title' => 'ListCloudSiemCustomizeRules',
         ],
         'ListCloudSiemPredefinedRules' => [
-            'summary' => 'Queries predefined rules.',
-            'methods' => [
-                'get',
-                'post',
-            ],
-            'schemes' => [
-                'https',
-                'http',
-            ],
+            'methods' => ['get', 'post'],
+            'schemes' => ['https', 'http'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'list',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-            ],
+            'systemTags' => ['operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
                     'name' => 'Id',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '规则ID。',
-                        'description' => 'The ID of the rule.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '10223',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The rule ID.', 'type' => 'string', 'required' => false, 'example' => '10223'],
                 ],
                 [
                     'name' => 'StartTime',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '查询开始时间, 单位毫秒。',
-                        'description' => 'The beginning of the time range to query. Unit: milliseconds.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '1577808000000',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The start of the time range to query. This value is a UNIX timestamp in milliseconds.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '1577808000000'],
                 ],
                 [
                     'name' => 'EndTime',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '查询结束时间, 单位毫秒。',
-                        'description' => 'The end of the time range to query. Unit: milliseconds.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '1577808000000',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The end of the time range to query. This value is a UNIX timestamp in milliseconds.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '1577808000000'],
                 ],
                 [
                     'name' => 'ThreatLevel',
                     'in' => 'formData',
                     'style' => 'repeatList',
                     'schema' => [
-                        'title' => '威胁等级，格式为json数组。取值：'."\n"
-                            .'- serious：高危'."\n"
-                            .'- suspicious：中危'."\n"
-                            .'- remind：低危',
-                        'description' => 'The risk level. The value is a JSON array. Valid values:'."\n"
+                        'title' => '',
+                        'description' => 'The threat level. The value is a JSON array. Valid values:'."\n"
+                            ."\n"
+                            .'- serious: high'."\n"
+                            ."\n"
+                            .'- suspicious: medium'."\n"
                             ."\n"
-                            .'*   serious: high'."\n"
-                            .'*   suspicious: medium'."\n"
-                            .'*   remind: low'."\n",
+                            .'- remind: low',
                         'type' => 'array',
-                        'items' => [
-                            'description' => 'The risk level. The value is a JSON string. Valid values:'."\n"
-                                ."\n"
-                                .'*   serious: high'."\n"
-                                .'*   suspicious: medium'."\n"
-                                .'*   remind: low'."\n",
-                            'type' => 'string',
-                            'required' => false,
-                            'example' => '["remind","serious"]'."\n",
-                        ],
+                        'items' => ['description' => 'The threat level. The value is a JSON array. Valid values:'."\n"
+                            ."\n"
+                            .'- serious: high'."\n"
+                            ."\n"
+                            .'- suspicious: medium'."\n"
+                            ."\n"
+                            .'- remind: low', 'type' => 'string', 'required' => false, 'title' => '', 'example' => '["remind","serious"]'."\n"],
                         'required' => false,
                         'example' => '["serious","suspicious","remind"]',
                         'maxItems' => 100,
@@ -12930,421 +8761,228 @@
                 [
                     'name' => 'AlertType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '告警类型。',
-                        'description' => 'The alert type.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'scan',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The alert type.', 'type' => 'string', 'required' => false, 'example' => 'scan'],
                 ],
                 [
                     'name' => 'RuleName',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '规则名称, 仅支持字母、数字、下划线、点。',
-                        'description' => 'The name of the rule. The name can contain letters, digits, underscores (\\_), and periods (.).'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'waf_scan',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The rule name. The name can contain only letters, digits, underscores (\\_), and periods (.).', 'type' => 'string', 'required' => false, 'example' => 'waf_scan'],
                 ],
                 [
                     'name' => 'RuleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '规则类型。 取值：'."\n"
-                            .'- predefine：预定义'."\n"
-                            .'- customize：自定义',
-                        'description' => 'The type of the rule. Valid values:'."\n"
-                            ."\n"
-                            .'*   predefine'."\n"
-                            .'*   customize'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'customize',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The rule type. Valid values:'."\n"
+                        ."\n"
+                        .'- predefine: predefined'."\n"
+                        ."\n"
+                        .'- customize: custom', 'type' => 'string', 'required' => false, 'example' => 'customize'],
                 ],
                 [
                     'name' => 'EventTransferType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '事件生成方式。 取值：'."\n"
-                            .'- default:默认内置方式'."\n"
-                            .'- singleToSingle：每个告警生成一个事件'."\n"
-                            .'- allToSingle：周期内告警生成一个事件',
-                        'description' => 'The method that is used to generate an event. Valid values:'."\n"
-                            ."\n"
-                            .'*   default: built-in method.'."\n"
-                            .'*   singleToSingle: The system generates an event for each alert.'."\n"
-                            .'*   allToSingle: The system generates an event for alerts within a period of time.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'allToSingle',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The event generation method. Valid values:'."\n"
+                        ."\n"
+                        .'- default: the default built-in method'."\n"
+                        ."\n"
+                        .'- singleToSingle: An event is generated for each alert.'."\n"
+                        ."\n"
+                        .'- allToSingle: An event is generated for all alerts in an epoch.', 'type' => 'string', 'required' => false, 'example' => 'allToSingle'],
                 ],
                 [
                     'name' => 'AttCk',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => 'att&ck。',
-                        'description' => 'The ATT\\&CK information.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'T1595.002 Vulnerability Scanning',
-                    ],
+                    'schema' => ['title' => 'att&ck。', 'description' => 'The ATT\\&CK technique.', 'type' => 'string', 'required' => false, 'example' => 'T1595.002 Vulnerability Scanning'],
                 ],
                 [
                     'name' => 'LogSource',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '日志源。',
-                        'description' => 'The log source.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cloud_siem_aegis_sas_alert',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The log source.', 'type' => 'string', 'required' => false, 'example' => 'cloud_siem_alb_flow_log'],
                 ],
                 [
                     'name' => 'Status',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '规则状态。 取值：'."\n"
-                            .'- 0：初始状态'."\n"
-                            .'- 10：模拟数据测试'."\n"
-                            .'- 15：业务数据测试中'."\n"
-                            .'- 20：业务数据测试结束'."\n"
-                            .'- 100：规则上线',
-                        'description' => 'The status of the rule. Valid values:'."\n"
-                            ."\n"
-                            .'*   0: The rule is in the initial state.'."\n"
-                            .'*   10: The simulation data is tested.'."\n"
-                            .'*   15: The business data is being tested.'."\n"
-                            .'*   20: The business data test ends.'."\n"
-                            .'*   100: The rule takes effect.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '0',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The rule status. Valid values:'."\n"
+                        ."\n"
+                        .'- 0: initial'."\n"
+                        ."\n"
+                        .'- 10: testing with simulated data'."\n"
+                        ."\n"
+                        .'- 15: testing with production data'."\n"
+                        ."\n"
+                        .'- 20: testing with production data is complete'."\n"
+                        ."\n"
+                        .'- 100: published', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '0'],
                 ],
                 [
                     'name' => 'OrderField',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '规则列表排列字段。 取值：'."\n"
-                            .'- GmtModified：基于修改时间排序'."\n"
-                            .'- Id：基于规则id排序（默认）',
-                        'description' => 'The field that is used to sort the rules. Valid values:'."\n"
-                            ."\n"
-                            .'*   GmtModified: The rules are sorted based on the modification time.'."\n"
-                            .'*   Id (default): The rules are sorted based on the rule ID.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'Id',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The field to sort the rules by. Valid values:'."\n"
+                        ."\n"
+                        .'- GmtModified: Sorts by modification time.'."\n"
+                        ."\n"
+                        .'- Id: Sorts by rule ID. This is the default value.', 'type' => 'string', 'required' => false, 'example' => 'Id'],
                 ],
                 [
                     'name' => 'Order',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '事件列表排列方向。 取值：'."\n"
-                            .'- desc：降序排列'."\n"
-                            .'- asc：升序排列。',
-                        'description' => 'The sort method. Valid values:'."\n"
-                            ."\n"
-                            .'*   desc: descending order.'."\n"
-                            .'*   asc: ascending order.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'desc',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The sort order. Valid values:'."\n"
+                        ."\n"
+                        .'- desc: descending'."\n"
+                        ."\n"
+                        .'- asc: ascending', 'type' => 'string', 'required' => false, 'example' => 'desc'],
                 ],
                 [
                     'name' => 'CurrentPage',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '列表当前页号， 大于等于1。',
-                        'description' => 'The page number. Pages start from page 1.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => true,
-                        'minimum' => '1',
-                        'example' => '1',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The page number. The value must be greater than or equal to 1.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'minimum' => '1', 'example' => '1'],
                 ],
                 [
                     'name' => 'PageSize',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '列表每页条数， 最大不超过100。',
-                        'description' => 'The number of entries per page. Maximum value: 100.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => true,
-                        'maximum' => '100',
-                        'minimum' => '1',
-                        'example' => '10',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The number of entries per page. The maximum value is 100.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'maximum' => '100', 'minimum' => '1', 'example' => '10'],
                 ],
                 [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view.'."\n"
-                            ."\n"
-                            .'*   0: view of the current Alibaba Cloud account.'."\n"
-                            .'*   1: view of all accounts for the enterprise.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['description' => 'The view type.'."\n"
+                        ."\n"
+                        .'- 0: the view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: the view of all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the destination account to which you switch the view from the management account.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The user ID that the administrator uses to switch to the perspective of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region where the Data Management center of the threat analysis feature is located. Select the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: assets in the Chinese mainland or China (Hong Kong)'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: assets outside China', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'PageResponse<List<CloudSiemPredefinedRule>>',
-                        'description' => 'PageResponse\\<List>'."\n",
+                        'description' => 'PageResponse\\<List>',
                         'type' => 'object',
                         'properties' => [
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true:成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
-                            ],
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The request was successful.'."\n"
+                                ."\n"
+                                .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The HTTP status code.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The returned message.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
+                                'title' => '',
+                                'description' => 'The data returned.',
                                 'type' => 'object',
                                 'properties' => [
                                     'PageInfo' => [
-                                        'title' => '分页记录。',
-                                        'description' => 'The pagination information.'."\n",
+                                        'title' => '',
+                                        'description' => 'The pagination information.',
                                         'type' => 'object',
                                         'properties' => [
-                                            'CurrentPage' => [
-                                                'title' => '列表当前页号。',
-                                                'description' => 'The current page number.'."\n",
-                                                'type' => 'integer',
-                                                'format' => 'int32',
-                                                'example' => '1',
-                                            ],
-                                            'PageSize' => [
-                                                'title' => '每页返回记录数。',
-                                                'description' => 'The number of entries per page.'."\n",
-                                                'type' => 'integer',
-                                                'format' => 'int32',
-                                                'example' => '10',
-                                            ],
-                                            'TotalCount' => [
-                                                'title' => '记录总数。',
-                                                'description' => 'The total number of entries returned.'."\n",
-                                                'type' => 'integer',
-                                                'format' => 'int64',
-                                                'example' => '100',
-                                            ],
+                                            'CurrentPage' => ['title' => '', 'description' => 'The page number.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'],
+                                            'PageSize' => ['title' => '', 'description' => 'The number of entries returned per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10'],
+                                            'TotalCount' => ['title' => '', 'description' => 'The total number of entries.', 'type' => 'integer', 'format' => 'int64', 'example' => '100'],
                                         ],
+                                        'example' => '',
                                     ],
                                     'ResponseData' => [
-                                        'title' => '详细数据。',
-                                        'description' => 'The detailed data.'."\n",
+                                        'title' => '',
+                                        'description' => 'The detailed data.',
                                         'type' => 'array',
                                         'items' => [
                                             'type' => 'object',
                                             'properties' => [
-                                                'Id' => [
-                                                    'title' => '预定义规则ID。',
-                                                    'description' => 'The ID of the predefined rule.'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int64',
-                                                    'example' => '123456789',
-                                                ],
-                                                'GmtCreate' => [
-                                                    'title' => '规则创建时间。',
-                                                    'description' => 'The time when the rule was created.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '2021-01-06 16:37:29',
-                                                ],
-                                                'GmtModified' => [
-                                                    'title' => '规则修改时间。',
-                                                    'description' => 'The time when the rule was modified.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '2021-01-06 16:37:29',
-                                                ],
-                                                'RuleName' => [
-                                                    'title' => '规则名称。',
-                                                    'description' => 'The name of the rule.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'siem_base64-command-exec_aegis-proc',
-                                                ],
-                                                'RuleNameCn' => [
-                                                    'title' => '规则中文名称。',
-                                                    'description' => 'The rule name in Chinese.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'siem_base64-command-exec_aegis-proc',
-                                                ],
-                                                'RuleNameEn' => [
-                                                    'title' => '规则英文名称。',
-                                                    'description' => 'The rule name in English.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'siem_base64-command-exec_aegis-proc',
-                                                ],
-                                                'RuleNameMds' => [
-                                                    'title' => '规则名称美杜莎code。',
-                                                    'description' => 'The internal code of the rule name.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '${siem_rule_name_siem_cfw-attack-count-level-up_cfw-attack}',
-                                                ],
-                                                'RuleDescMds' => [
-                                                    'title' => '规则描述美杜莎code。',
-                                                    'description' => 'The internal code of the rule description.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '${siem_rule_description_siem_cfw-attack-count-level-up_cfw-attack}',
-                                                ],
-                                                'ThreatLevel' => [
-                                                    'title' => '威胁等级。取值：'."\n"
-                                                        .'- serious：高危'."\n"
-                                                        .'- suspicious：中危'."\n"
-                                                        .'- remind：低危',
-                                                    'description' => 'The risk level. Valid values:'."\n"
-                                                        ."\n"
-                                                        .'*   serious: high.'."\n"
-                                                        .'*   suspicious: medium.'."\n"
-                                                        .'*   remind: low.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'remind',
-                                                ],
-                                                'AlertType' => [
-                                                    'title' => '威胁类型。',
-                                                    'description' => 'The type of the risk.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'WEBSHELL',
-                                                ],
-                                                'Source' => [
-                                                    'title' => '规则对应的日志源。',
-                                                    'description' => 'The log source of the rule.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'cloud_siem_aegis_proc',
-                                                ],
-                                                'EventTransferType' => [
-                                                    'title' => '事件生成方式。 取值：'."\n"
-                                                        .'- default:默认内置方式'."\n"
-                                                        .'- singleToSingle：每个告警生成一个事件'."\n"
-                                                        .'- allToSingle：周期内告警生成一个事件',
-                                                    'description' => 'The method that is used to generate an event. Valid values:'."\n"
-                                                        ."\n"
-                                                        .'*   default: built-in method.'."\n"
-                                                        .'*   singleToSingle: The system generates an event for each alert.'."\n"
-                                                        .'*   allToSingle: The system generates an event for alerts within a period of time.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'allToSingle',
-                                                ],
-                                                'AttCk' => [
-                                                    'title' => '告警附加字段attck',
-                                                    'description' => 'The alert additional field for ATT\\&CK.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'T1595.002 Vulnerability Scanning',
-                                                ],
-                                                'Status' => [
-                                                    'title' => '预定义规则启用状态。 取值：'."\n"
-                                                        .'- 0：初始状态'."\n"
-                                                        .'- 100：规则上线',
-                                                    'description' => 'The status of the predefined rule. Valid values:'."\n"
-                                                        ."\n"
-                                                        .'*   0: The rule is in the initial state.'."\n"
-                                                        .'*   100: The rule takes effect.'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int32',
-                                                    'example' => '0',
-                                                ],
+                                                'Id' => ['title' => '', 'description' => 'The ID of the predefined rule.', 'type' => 'integer', 'format' => 'int64', 'example' => '123456789'],
+                                                'GmtCreate' => ['title' => '', 'description' => 'The time when the rule was created.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'],
+                                                'GmtModified' => ['title' => '', 'description' => 'The time when the rule was last modified.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'],
+                                                'RuleName' => ['title' => '', 'description' => 'The rule name.', 'type' => 'string', 'example' => 'siem_base64-command-exec_aegis-proc'],
+                                                'RuleNameCn' => ['title' => '', 'description' => 'The Chinese name of the rule.', 'type' => 'string', 'example' => 'siem_base64-command-exec_aegis-proc'],
+                                                'RuleNameEn' => ['title' => '', 'description' => 'The English name of the rule.', 'type' => 'string', 'example' => 'siem_base64-command-exec_aegis-proc'],
+                                                'RuleNameMds' => ['title' => '', 'description' => 'The Medusa code of the rule name.', 'type' => 'string', 'example' => '${siem_rule_name_siem_cfw-attack-count-level-up_cfw-attack}'],
+                                                'RuleDescMds' => ['title' => '', 'description' => 'The Medusa code of the rule description.', 'type' => 'string', 'example' => '${siem_rule_description_siem_cfw-attack-count-level-up_cfw-attack}'],
+                                                'ThreatLevel' => ['title' => '', 'description' => 'The threat level. Valid values:'."\n"
+                                                    ."\n"
+                                                    .'- serious: high'."\n"
+                                                    ."\n"
+                                                    .'- suspicious: medium'."\n"
+                                                    ."\n"
+                                                    .'- remind: low', 'type' => 'string', 'example' => 'remind'],
+                                                'AlertType' => ['title' => '', 'description' => 'The threat type.', 'type' => 'string', 'example' => 'WEBSHELL'],
+                                                'Source' => ['title' => '', 'description' => 'The log source of the rule.', 'type' => 'string', 'example' => 'cloud_siem_aegis_proc'],
+                                                'EventTransferType' => ['title' => '', 'description' => 'The event generation method. Valid values:'."\n"
+                                                    ."\n"
+                                                    .'- default: the default built-in method'."\n"
+                                                    ."\n"
+                                                    .'- singleToSingle: An event is generated for each alert.'."\n"
+                                                    ."\n"
+                                                    .'- allToSingle: An event is generated for all alerts in an epoch.', 'type' => 'string', 'example' => 'allToSingle'],
+                                                'AttCk' => ['title' => '', 'description' => 'The ATT\\&CK technique.', 'type' => 'string', 'example' => 'T1595.002 Vulnerability Scanning'],
+                                                'Status' => ['title' => '', 'description' => 'The status of the predefined rule. Valid values:'."\n"
+                                                    ."\n"
+                                                    .'- 0: initial'."\n"
+                                                    ."\n"
+                                                    .'- 100: published', 'type' => 'integer', 'format' => 'int32', 'example' => '0'],
                                             ],
+                                            'description' => '',
+                                            'title' => '',
+                                            'example' => '',
                                         ],
+                                        'example' => '',
                                     ],
                                 ],
                                 'example' => '123456',
                             ],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'ListCloudSiemPredefinedRules',
+            'summary' => 'Retrieves a list of predefined rules.',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:43:23.000Z', 'description' => 'Error codes changed, Request parameters changed, Response parameters changed'],
+            ],
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListCloudSiemPredefinedRules'],
+                ],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'list',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ListCloudSiemPredefinedRules',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
             'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n  \\"Data\\": {\\n    \\"PageInfo\\": {\\n      \\"CurrentPage\\": 1,\\n      \\"PageSize\\": 10,\\n      \\"TotalCount\\": 100\\n    },\\n    \\"ResponseData\\": [\\n      {\\n        \\"Id\\": 123456789,\\n        \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n        \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n        \\"RuleName\\": \\"siem_base64-command-exec_aegis-proc\\",\\n        \\"RuleNameCn\\": \\"siem_base64-command-exec_aegis-proc\\",\\n        \\"RuleNameEn\\": \\"siem_base64-command-exec_aegis-proc\\",\\n        \\"RuleNameMds\\": \\"${siem_rule_name_siem_cfw-attack-count-level-up_cfw-attack}\\",\\n        \\"RuleDescMds\\": \\"${siem_rule_description_siem_cfw-attack-count-level-up_cfw-attack}\\",\\n        \\"ThreatLevel\\": \\"remind\\",\\n        \\"AlertType\\": \\"WEBSHELL\\",\\n        \\"Source\\": \\"cloud_siem_aegis_proc\\",\\n        \\"EventTransferType\\": \\"allToSingle\\",\\n        \\"AttCk\\": \\"T1595.002 Vulnerability Scanning\\",\\n        \\"Status\\": 0\\n      }\\n    ]\\n  }\\n}","type":"json"}]',
-            'title' => 'ListCloudSiemPredefinedRules',
         ],
         'ListCustomizeRuleTestResult' => [
-            'summary' => 'Queries the test results of a custom rule.',
-            'methods' => [
-                'get',
-                'post',
-            ],
-            'schemes' => [
-                'http',
-                'https',
-            ],
+            'summary' => 'Retrieves the list of test results for a custom rule.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
@@ -13356,1047 +8994,454 @@
                 'operationType' => 'list',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsasASHGE7',
-                ],
+                'abilityTreeNodes' => ['FEATUREsasASHGE7'],
             ],
             'parameters' => [
                 [
                     'name' => 'Id',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '自定义规则ID。',
-                        'description' => 'The ID of the rule.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '123456789',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The ID of the custom rule.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '123456789'],
                 ],
                 [
                     'name' => 'CurrentPage',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '列表当前页号， 大于等于1。',
-                        'description' => 'The page number. Pages start from page 1.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => true,
-                        'minimum' => '1',
-                        'example' => '1',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The page number. The value must be greater than or equal to 1.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'minimum' => '1', 'example' => '1'],
                 ],
                 [
                     'name' => 'PageSize',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '列表每页条数， 最大不超过100。',
-                        'description' => 'The number of entries per page. Valid values: 1 to 100.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => true,
-                        'maximum' => '100',
-                        'minimum' => '1',
-                        'example' => '10',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The number of entries per page. The maximum value is 100.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'maximum' => '100', 'minimum' => '1', 'example' => '10'],
                 ],
                 [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['description' => 'The type of the view.'."\n"
+                        ."\n"
+                        .'- 0: the view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: the view of all accounts that belong to the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The user ID of a member. This parameter is used by an administrator to switch to the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region where the Data Management center of Threat Analysis is located. Select a region based on the region where your assets are deployed. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: assets in the Chinese mainland and China (Hong Kong)'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: assets outside China', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
                 [
                     'name' => 'DetectionRuleId',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'string',
-                    ],
+                    'schema' => ['description' => 'The ID of the custom rule. You can obtain the rule ID from the rule list.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'dr-53np4nguf5jmh1vc****'],
                 ],
                 [
                     'name' => 'VerifyType',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'string',
-                    ],
+                    'schema' => ['description' => 'The verification result for the accuracy of alert fields based on the alert template.'."\n"
+                        ."\n"
+                        .'- true: The verification is passed. Alerts that are generated for enabled rules can be synchronized to the product.'."\n"
+                        ."\n"
+                        .'- false: The verification failed. Alerts cannot be synchronized to the product.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'true'],
                 ],
                 [
                     'name' => 'StartTime',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'integer',
-                        'format' => 'int64',
-                    ],
+                    'schema' => ['description' => 'The start time.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '1723057091000'],
                 ],
                 [
                     'name' => 'EndTime',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'integer',
-                        'format' => 'int64',
-                    ],
+                    'schema' => ['description' => 'The end time.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '1731797891000'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'PageResponse<List<CustomizeRuleAlert>>',
-                        'description' => 'PageResponse\\<List>'."\n",
+                        'description' => 'PageResponse\\<List>',
                         'type' => 'object',
                         'properties' => [
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true:成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
-                            ],
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The request was successful.'."\n"
+                                ."\n"
+                                .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The message returned for the request.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
+                                'title' => '',
+                                'description' => 'The data returned.',
                                 'type' => 'object',
                                 'properties' => [
                                     'PageInfo' => [
-                                        'title' => '分页记录。',
-                                        'description' => 'The pagination information.'."\n",
+                                        'title' => '',
+                                        'description' => 'The pagination information.',
                                         'type' => 'object',
                                         'properties' => [
-                                            'CurrentPage' => [
-                                                'title' => '列表当前页号。',
-                                                'description' => 'The current page number.'."\n",
-                                                'type' => 'integer',
-                                                'format' => 'int32',
-                                                'example' => '1',
-                                            ],
-                                            'PageSize' => [
-                                                'title' => '每页返回记录数。',
-                                                'description' => 'The number of entries per page.'."\n",
-                                                'type' => 'integer',
-                                                'format' => 'int32',
-                                                'example' => '10',
-                                            ],
-                                            'TotalCount' => [
-                                                'title' => '记录总数。',
-                                                'description' => 'The total number of entries returned.'."\n",
-                                                'type' => 'integer',
-                                                'format' => 'int64',
-                                                'example' => '100',
-                                            ],
-                                            'VerifiedCount' => [
-                                                'type' => 'integer',
-                                                'format' => 'int64',
-                                            ],
+                                            'CurrentPage' => ['title' => '', 'description' => 'The current page number.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'],
+                                            'PageSize' => ['title' => '', 'description' => 'The number of entries returned per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10'],
+                                            'TotalCount' => ['title' => '', 'description' => 'The total number of entries.', 'type' => 'integer', 'format' => 'int64', 'example' => '100'],
+                                            'VerifiedCount' => ['description' => 'The number of alerts that passed the verification.', 'type' => 'integer', 'format' => 'int64', 'title' => '', 'example' => '30'],
                                         ],
+                                        'example' => '',
                                     ],
                                     'ResponseData' => [
-                                        'title' => '详细数据。',
-                                        'description' => 'The detailed data.'."\n",
+                                        'title' => '',
+                                        'description' => 'The detailed data.',
                                         'type' => 'array',
                                         'items' => [
                                             'type' => 'object',
                                             'properties' => [
-                                                'Uuid' => [
-                                                    'title' => '告警id。',
-                                                    'description' => 'The UUID of the alert.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'sas_71e24437d2797ce8fc59692905a4****',
-                                                ],
-                                                'MainUserId' => [
-                                                    'title' => '告警关联siem主账号id。',
-                                                    'description' => 'The ID of the Alibaba Cloud account that is associated with the alert in SIEM.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '127608589417****',
-                                                ],
-                                                'SubUserId' => [
-                                                    'title' => '告警史记关联阿里账号ID。',
-                                                    'description' => 'The ID of the Alibaba Cloud account within which the alert is generated.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '176555323***',
-                                                ],
-                                                'LogType' => [
-                                                    'title' => '规则对应的日志类型。',
-                                                    'description' => 'The log type of the rule.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'ALERT_ACTIVITY',
-                                                ],
-                                                'LogSource' => [
-                                                    'title' => '规则对应的日志源。',
-                                                    'description' => 'The log source of the rule.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'cloud_siem_aegis_sas_alert',
-                                                ],
-                                                'AlertSrcProd' => [
-                                                    'title' => '事件关联告警来源产品。',
-                                                    'description' => 'The source of the alert.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'sas',
-                                                ],
-                                                'AlertSrcProdModule' => [
-                                                    'title' => '事件关联告警来源产品子模块。',
-                                                    'description' => 'The sub-module of the source.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'waf',
-                                                ],
-                                                'AttCk' => [
-                                                    'title' => 'ATTCT&攻击技术标签。',
-                                                    'description' => 'The tag of the ATT\\&CK attack.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'T1595.002 Vulnerability Scanning',
-                                                ],
-                                                'AlertDesc' => [
-                                                    'title' => '告警描述。',
-                                                    'description' => 'The description of the alert.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'The account you logged in this time is not in the legal account category defined by you. Please confirm the legality of the login behavior.',
-                                                ],
-                                                'OnlineStatus' => [
-                                                    'title' => '告警数据状态。  取值：'."\n"
-                                                        .'- test：业务测试'."\n"
-                                                        .'- online：上线',
-                                                    'description' => 'The status of the alert data. Valid values:'."\n"
-                                                        ."\n"
-                                                        .'*   test: business test data.'."\n"
-                                                        .'*   online: online data.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'test',
-                                                ],
-                                                'EventName' => [
-                                                    'title' => '告警名称，对应自定义规则名称。',
-                                                    'description' => 'The name of the alert, which corresponds to the name of the custom rule.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'waf_scan',
-                                                ],
-                                                'Level' => [
-                                                    'title' => '威胁等级。取值：'."\n"
-                                                        .'- serious：高危'."\n"
-                                                        .'- suspicious：中危'."\n"
-                                                        .'- remind：低危',
-                                                    'description' => 'The threat level. Valid values:'."\n"
-                                                        ."\n"
-                                                        .'*   serious: high.'."\n"
-                                                        .'*   suspicious: medium.'."\n"
-                                                        .'*   remind: low.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'remind',
-                                                ],
-                                                'EventType' => [
-                                                    'title' => '威胁类型 即告警类型。',
-                                                    'description' => 'The threat type, which indicates the alert type.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'WEBSHELL',
-                                                ],
-                                                'AlertDetail' => [
-                                                    'title' => '告警详情 json格式。',
-                                                    'description' => 'The alert details in the JSON format.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '{"main_user_id": "165295629792****";"log_uuid_count": "99";"attack_ip": "218.92.XX.XX"}',
-                                                ],
-                                                'LogTime' => [
-                                                    'title' => '告警记录时间。',
-                                                    'description' => 'The time when the alert was recorded.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '2021-01-06 16:37:29',
-                                                ],
-                                                'VerifyType' => [
-                                                    'type' => 'string',
-                                                ],
+                                                'Uuid' => ['title' => '', 'description' => 'The UUID of the alert.', 'type' => 'string', 'example' => 'sas_71e24437d2797ce8fc59692905a4****'],
+                                                'MainUserId' => ['title' => '', 'description' => 'The ID of the main Alibaba Cloud account for Security Information and Event Management (SIEM) that is associated with the alert.', 'type' => 'string', 'example' => '127608589417****'],
+                                                'SubUserId' => ['title' => '', 'description' => 'The ID of the member account that is associated with the alert.', 'type' => 'string', 'example' => '176555323***'],
+                                                'LogType' => ['title' => '', 'description' => 'The log type that corresponds to the rule.', 'type' => 'string', 'example' => 'ALERT_ACTIVITY'],
+                                                'LogSource' => ['title' => '', 'description' => 'The log source that corresponds to the rule.', 'type' => 'string', 'example' => 'cloud_siem_aegis_sas_alert'],
+                                                'AlertSrcProd' => ['title' => '', 'description' => 'The source product of the alert that is associated with the event.', 'type' => 'string', 'example' => 'sas'],
+                                                'AlertSrcProdModule' => ['title' => '', 'description' => 'The sub-module of the source product of the alert that is associated with the event.', 'type' => 'string', 'example' => 'waf'],
+                                                'AttCk' => ['title' => '', 'description' => 'The ATT\\&CK attack technique tag.', 'type' => 'string', 'example' => 'T1595.002 Vulnerability Scanning'],
+                                                'AlertDesc' => ['title' => '', 'description' => 'The description of the alert.', 'type' => 'string', 'example' => 'The account you logged in this time is not in the legal account category defined by you. Please confirm the legality of the login behavior。'],
+                                                'OnlineStatus' => ['title' => '', 'description' => 'The status of the alert data. Valid values:'."\n"
+                                                    ."\n"
+                                                    .'- test: business test'."\n"
+                                                    ."\n"
+                                                    .'- online: published', 'type' => 'string', 'example' => 'test'],
+                                                'EventName' => ['title' => '', 'description' => 'The name of the alert. This value corresponds to the name of the custom rule.', 'type' => 'string', 'example' => 'waf_scan'],
+                                                'Level' => ['title' => '', 'description' => 'The threat level. Valid values:'."\n"
+                                                    ."\n"
+                                                    .'- serious: high'."\n"
+                                                    ."\n"
+                                                    .'- suspicious: medium'."\n"
+                                                    ."\n"
+                                                    .'- remind: low', 'type' => 'string', 'example' => 'remind'],
+                                                'EventType' => ['title' => '', 'description' => 'The threat type. This parameter is equivalent to the alert type.', 'type' => 'string', 'example' => 'WEBSHELL'],
+                                                'AlertDetail' => ['title' => '', 'description' => 'The details of the alert, in JSON format.', 'type' => 'string', 'example' => '{"main_user_id": "165295629792****";"log_uuid_count": "99";"attack_ip": "218.92.XX.XX"}'],
+                                                'LogTime' => ['title' => '', 'description' => 'The time when the alert was recorded.', 'type' => 'string', 'example' => '2023-01-06 16:37:29'],
+                                                'VerifyType' => ['description' => 'The result of verifying the alert based on the alert template.'."\n"
+                                                    ."\n"
+                                                    .'- true: The verification is passed.'."\n"
+                                                    ."\n"
+                                                    .'- false: The verification failed.', 'type' => 'string', 'title' => '', 'example' => 'true'],
                                             ],
+                                            'description' => '',
+                                            'title' => '',
+                                            'example' => '',
                                         ],
+                                        'example' => '',
                                     ],
                                 ],
                                 'example' => '123456',
                             ],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n  \\"Data\\": {\\n    \\"PageInfo\\": {\\n      \\"CurrentPage\\": 1,\\n      \\"PageSize\\": 10,\\n      \\"TotalCount\\": 100,\\n      \\"VerifiedCount\\": 30\\n    },\\n    \\"ResponseData\\": [\\n      {\\n        \\"Uuid\\": \\"sas_71e24437d2797ce8fc59692905a4****\\",\\n        \\"MainUserId\\": \\"127608589417****\\",\\n        \\"SubUserId\\": \\"176555323***\\",\\n        \\"LogType\\": \\"ALERT_ACTIVITY\\",\\n        \\"LogSource\\": \\"cloud_siem_aegis_sas_alert\\",\\n        \\"AlertSrcProd\\": \\"sas\\",\\n        \\"AlertSrcProdModule\\": \\"waf\\",\\n        \\"AttCk\\": \\"T1595.002 Vulnerability Scanning\\",\\n        \\"AlertDesc\\": \\"The account you logged in this time is not in the legal account category defined by you. Please confirm the legality of the login behavior。\\",\\n        \\"OnlineStatus\\": \\"test\\",\\n        \\"EventName\\": \\"waf_scan\\",\\n        \\"Level\\": \\"remind\\",\\n        \\"EventType\\": \\"WEBSHELL\\",\\n        \\"AlertDetail\\": \\"{\\\\\\"main_user_id\\\\\\": \\\\\\"165295629792****\\\\\\";\\\\\\"log_uuid_count\\\\\\": \\\\\\"99\\\\\\";\\\\\\"attack_ip\\\\\\": \\\\\\"218.92.XX.XX\\\\\\"}\\",\\n        \\"LogTime\\": \\"2023-01-06 16:37:29\\",\\n        \\"VerifyType\\": \\"true\\"\\n      }\\n    ]\\n  }\\n}","type":"json"}]',
+            'staticInfo' => ['returnType' => 'synchronous'],
             'title' => 'ListCustomizeRuleTestResult',
-        ],
-        'PostCustomizeRule' => [
-            'summary' => 'Creates or updates a custom rule.',
-            'methods' => [
-                'get',
-                'post',
+            'changeSet' => [
+                ['createdAt' => '2025-03-27T06:13:13.000Z', 'description' => 'Request parameters changed, Response parameters changed'],
+                ['createdAt' => '2024-04-17T12:43:23.000Z', 'description' => 'Error codes changed, Request parameters changed'],
             ],
-            'schemes' => [
-                'https',
-                'http',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListCustomizeRuleTestResult'],
+                ],
             ],
+            'ramActions' => [
+                [
+                    'operationType' => 'list',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ListCustomizeRuleTestResult',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
+            ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n  \\"Data\\": {\\n    \\"PageInfo\\": {\\n      \\"CurrentPage\\": 1,\\n      \\"PageSize\\": 10,\\n      \\"TotalCount\\": 100,\\n      \\"VerifiedCount\\": 30\\n    },\\n    \\"ResponseData\\": [\\n      {\\n        \\"Uuid\\": \\"sas_71e24437d2797ce8fc59692905a4****\\",\\n        \\"MainUserId\\": \\"127608589417****\\",\\n        \\"SubUserId\\": \\"176555323***\\",\\n        \\"LogType\\": \\"ALERT_ACTIVITY\\",\\n        \\"LogSource\\": \\"cloud_siem_aegis_sas_alert\\",\\n        \\"AlertSrcProd\\": \\"sas\\",\\n        \\"AlertSrcProdModule\\": \\"waf\\",\\n        \\"AttCk\\": \\"T1595.002 Vulnerability Scanning\\",\\n        \\"AlertDesc\\": \\"The account you logged in this time is not in the legal account category defined by you. Please confirm the legality of the login behavior。\\",\\n        \\"OnlineStatus\\": \\"test\\",\\n        \\"EventName\\": \\"waf_scan\\",\\n        \\"Level\\": \\"remind\\",\\n        \\"EventType\\": \\"WEBSHELL\\",\\n        \\"AlertDetail\\": \\"{\\\\\\"main_user_id\\\\\\": \\\\\\"165295629792****\\\\\\";\\\\\\"log_uuid_count\\\\\\": \\\\\\"99\\\\\\";\\\\\\"attack_ip\\\\\\": \\\\\\"218.92.XX.XX\\\\\\"}\\",\\n        \\"LogTime\\": \\"2023-01-06 16:37:29\\",\\n        \\"VerifyType\\": \\"true\\"\\n      }\\n    ]\\n  }\\n}","type":"json"}]',
+        ],
+        'ListDataSourceLogs' => [
+            'summary' => 'Lists the logs for a data source.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
+            'operationType' => 'read',
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'create',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-            ],
+            'systemTags' => ['operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
-                    'name' => 'Id',
+                    'name' => 'DataSourceInstanceId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '自定义规则ID。',
-                        'description' => 'The ID of the rule.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '123456789',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The ID of the data source. This ID is an MD5 hash value that is calculated by threat analysis based on specific parameters.', 'type' => 'string', 'required' => true, 'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea'],
                 ],
                 [
-                    'name' => 'RuleName',
+                    'name' => 'AccountId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '规则名称。',
-                        'description' => 'The name of the rule.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'waf_scan',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account.', 'type' => 'string', 'required' => true, 'example' => '123xxxxxx'],
                 ],
                 [
-                    'name' => 'RuleDesc',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '规则描述。',
-                        'description' => 'The description of the rule.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'this rule is for waf scan',
-                    ],
-                ],
-                [
-                    'name' => 'ThreatLevel',
+                    'name' => 'CloudCode',
                     'in' => 'formData',
                     'schema' => [
-                        'title' => '威胁等级。取值：'."\n"
-                            .'- serious：高危'."\n"
-                            .'- suspicious：中危'."\n"
-                            .'- remind：低危',
-                        'description' => 'The risk level. Valid values:'."\n"
+                        'title' => '',
+                        'description' => 'The code for the cloud service provider. Valid values:'."\n"
                             ."\n"
-                            .'*   serious: high'."\n"
-                            .'*   suspicious: medium'."\n"
-                            .'*   remind: low'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'remind',
-                    ],
-                ],
-                [
-                    'name' => 'AttCk',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => 'att&ck。',
-                        'description' => 'att&ck.',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'T1595.002 Vulnerability Scanning'."\n",
-                    ],
-                ],
-                [
-                    'name' => 'AlertType',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁类型。',
-                        'description' => 'The risk type.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'WEBSHELL',
-                    ],
-                ],
-                [
-                    'name' => 'AlertTypeMds',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁类型美杜莎code。',
-                        'description' => 'The internal code of the risk type.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '${siem_rule_type_process_abnormal_command}',
-                    ],
-                ],
-                [
-                    'name' => 'LogType',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '规则对应的日志类型。',
-                        'description' => 'The log type of the rule.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'ALERT_ACTIVITY',
-                    ],
-                ],
-                [
-                    'name' => 'LogTypeMds',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '规则对应的日志类型美杜莎code。',
-                        'description' => 'The internal code of the log type.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '${security_event_config.event_name.webshellName_clientav}',
-                    ],
-                ],
-                [
-                    'name' => 'LogSource',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '规则对应的日志源。',
-                        'description' => 'The log source of the rule.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cloud_siem_aegis_sas_alert',
-                    ],
-                ],
-                [
-                    'name' => 'LogSourceMds',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '规则对应的日志源美杜莎code。',
-                        'description' => 'The internal code of the log source.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '${sas.cloudsiem.prod.cloud_siem_aegis_sas_alert}',
-                    ],
-                ],
-                [
-                    'name' => 'RuleCondition',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '规则查询条件json。',
-                        'description' => 'The query condition of the rule. The value is in the JSON format.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '[[{"not":false,"left":"alert_name","operator":"=","right":"WEBSHELL"}]]',
-                    ],
-                ],
-                [
-                    'name' => 'RuleGroup',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '日志聚合字段,json数组格式。',
-                        'description' => 'The log aggregation field of the rule. The value is a JSON string.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '["asset_id"]',
-                    ],
-                ],
-                [
-                    'name' => 'RuleThreshold',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '规则阈值配置json。',
-                        'description' => 'The threshold configuration of the rule. The value is in the JSON format.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '{"aggregateFunction":"count","aggregateFunctionName":"count","field":"activity_name","operator":"&lt;=","value":1}',
-                    ],
-                ],
-                [
-                    'name' => 'QueryCycle',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '规则窗口长度。',
-                        'description' => 'The window length of the rule.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '{"time":"1","unit":"HOUR"}',
-                    ],
-                ],
-                [
-                    'name' => 'EventTransferSwitch',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '告警是否转换事件开关。 取值：'."\n"
-                            .'- 0：不转换'."\n"
-                            .'- 1：转换',
-                        'description' => 'Specifies whether to convert an alert to an event. Valid values:'."\n"
+                            .'- qcloud: Tencent Cloud.'."\n"
                             ."\n"
-                            .'*   0: no'."\n"
-                            .'*   1: yes'."\n",
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
-                ],
-                [
-                    'name' => 'EventTransferType',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '事件生成方式。 取值：'."\n"
-                            .'- default:默认内置方式'."\n"
-                            .'- singleToSingle：每个告警生成一个事件'."\n"
-                            .'- allToSingle：周期内告警生成一个事件',
-                        'description' => 'The event generation method. Valid values:'."\n"
+                            .'- aliyun: Alibaba Cloud.'."\n"
                             ."\n"
-                            .'*   default: The default method is used.'."\n"
-                            .'*   singleToSingle: The system generates an event for each alert.'."\n"
-                            .'*   allToSingle: The system generates an event for alerts within a period of time.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'allToSingle',
-                    ],
-                ],
-                [
-                    'name' => 'EventTransferExt',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '事件生成扩展信息 当eventTransferType值为allToSingle该字段有值 表示告警聚合窗口的周期长度以及周期单位。',
-                        'description' => 'The extended information about event generation. If eventTransferType is set to allToSingle, the value of this parameter indicates the length and unit of the alert aggregation window.'."\n",
+                            .'- hcloud: Huawei Cloud.',
                         'type' => 'string',
-                        'required' => false,
-                        'example' => '{"time":"1","unit":"MINUTE"}',
-                    ],
-                ],
-                [
-                    'name' => 'RoleType',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
-                ],
-                [
-                    'name' => 'RoleFor',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
+                        'required' => true,
+                        'enumValueTitles' => [],
+                        'enum' => ['qcloud', 'hcloud', 'aliyun'],
+                        'example' => 'hcloud',
                     ],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region where the Data Management hub of threat analysis is deployed. Select a region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or Hong Kong (China).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'BaseResponse<CloudSiemCustomizeRule>',
-                        'description' => 'BaseResponse'."\n",
+                        'title' => 'CloudSiemSuccessResponse<ListDataSourceLogsResult>',
+                        'description' => 'CloudSiemSuccessResponse',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
+                                'title' => '',
+                                'description' => 'The data returned.',
                                 'type' => 'object',
                                 'properties' => [
-                                    'Id' => [
-                                        'title' => '自定义规则ID。',
-                                        'description' => 'The ID of the custom rule.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int64',
-                                        'example' => '123456789',
-                                    ],
-                                    'GmtCreate' => [
-                                        'title' => '自定义规则创建时间。',
-                                        'description' => 'The time when the custom rule was created.'."\n",
-                                        'type' => 'string',
-                                        'example' => '2021-01-06 16:37:29',
-                                    ],
-                                    'GmtModified' => [
-                                        'title' => '自定义规则最后更新时间。',
-                                        'description' => 'The time when the custom rule was last updated.'."\n",
-                                        'type' => 'string',
-                                        'example' => '2021-01-06 16:37:29',
-                                    ],
-                                    'Aliuid' => [
-                                        'title' => 'siem主账号ID。',
-                                        'description' => 'The ID of the Alibaba Cloud account that is used to purchase the threat analysis feature.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int64',
-                                        'example' => '127608589417****',
-                                    ],
-                                    'RuleName' => [
-                                        'title' => '规则名称。',
-                                        'description' => 'The name of the rule.'."\n",
-                                        'type' => 'string',
-                                        'example' => 'waf_scan',
-                                    ],
-                                    'RuleDesc' => [
-                                        'title' => '规则描述。',
-                                        'description' => 'The description of the rule.'."\n",
-                                        'type' => 'string',
-                                        'example' => 'this rule is for waf scan',
-                                    ],
-                                    'RuleType' => [
-                                        'title' => '规则类型。 取值：'."\n"
-                                            .'- predefine：预定义'."\n"
-                                            .'- customize：自定义',
-                                        'description' => 'The type of the rule. Valid values:'."\n"
-                                            ."\n"
-                                            .'*   predefine'."\n"
-                                            .'*   customize'."\n",
-                                        'type' => 'string',
-                                        'example' => 'customize',
+                                    'SubUserId' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account to which the log belongs.', 'type' => 'integer', 'format' => 'int64', 'example' => '123XXXXXXXX'],
+                                    'DataSourceInstanceId' => ['title' => '', 'description' => 'The ID of the data source. This ID is an MD5 hash value that is calculated by threat analysis based on specific parameters.', 'type' => 'string', 'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea'],
+                                    'DataSourceInstanceName' => ['title' => '', 'description' => 'The name of the data source.', 'type' => 'string', 'example' => 'waf kafka'],
+                                    'DataSourceInstanceRemark' => ['title' => '', 'description' => 'The remarks on the data source.', 'type' => 'string', 'example' => 'waf kafka'],
+                                    'DataSourceInstanceLogs' => [
+                                        'title' => '',
+                                        'description' => 'The list of logs for the data source.',
+                                        'type' => 'array',
+                                        'items' => [
+                                            'type' => 'object',
+                                            'properties' => [
+                                                'LogInstanceId' => ['title' => '', 'description' => 'The ID of the log. This ID is an MD5 hash value that is calculated by threat analysis based on specific parameters.', 'type' => 'string', 'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea'],
+                                                'LogCode' => ['title' => '', 'description' => 'The code of the log.', 'type' => 'string', 'example' => 'cloud_siem_waf_xxxxx'],
+                                                'LogMdsCode' => ['title' => '', 'description' => 'The display code of the log.', 'type' => 'string', 'example' => '${siem.prod.cloud_siem_waf_xxxxx}'],
+                                                'LogParams' => [
+                                                    'title' => '',
+                                                    'description' => 'The detailed parameters for the log.',
+                                                    'type' => 'array',
+                                                    'items' => [
+                                                        'description' => 'The log parameter.',
+                                                        'type' => 'object',
+                                                        'properties' => [
+                                                            'ParaCode' => ['title' => '', 'description' => 'The code of the log parameter.', 'type' => 'string', 'example' => 'region_code'],
+                                                            'ParaValue' => ['title' => '', 'description' => 'The value of the log parameter.', 'type' => 'string', 'example' => 'ap-guangzhou'],
+                                                        ],
+                                                        'title' => '',
+                                                        'example' => '',
+                                                    ],
+                                                    'example' => '',
+                                                ],
+                                                'TaskStatus' => ['title' => '', 'description' => 'The status of the log collection task. Valid values:'."\n"
+                                                    ."\n"
+                                                    .'- 1: collected.'."\n"
+                                                    ."\n"
+                                                    .'- 0: not collected.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'],
+                                            ],
+                                            'description' => '',
+                                            'title' => '',
+                                            'example' => '',
+                                        ],
+                                        'example' => '',
                                     ],
-                                    'ThreatLevel' => [
-                                        'title' => '威胁等级。取值：'."\n"
-                                            .'- serious：高危'."\n"
-                                            .'- suspicious：中危'."\n"
-                                            .'- remind：低危',
-                                        'description' => 'The risk level. Valid values:'."\n"
+                                    'AccountId' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account.', 'type' => 'string', 'example' => '123xxxxxxx'],
+                                    'CloudCode' => [
+                                        'title' => '',
+                                        'description' => 'The code for the cloud service provider. Valid values:'."\n"
                                             ."\n"
-                                            .'*   serious: high'."\n"
-                                            .'*   suspicious: medium'."\n"
-                                            .'*   remind: low'."\n",
-                                        'type' => 'string',
-                                        'example' => 'remind',
-                                    ],
-                                    'AlertType' => [
-                                        'title' => '威胁类型。',
-                                        'description' => 'The risk type.'."\n",
-                                        'type' => 'string',
-                                        'example' => 'WEBSHELL',
-                                    ],
-                                    'AlertTypeMds' => [
-                                        'title' => '威胁类型美杜莎code。',
-                                        'description' => 'The internal code of the risk type.'."\n",
-                                        'type' => 'string',
-                                        'example' => '${siem_rule_type_process_abnormal_command}',
-                                    ],
-                                    'LogType' => [
-                                        'title' => '规则对应的日志类型。',
-                                        'description' => 'The log type of the rule.'."\n",
-                                        'type' => 'string',
-                                        'example' => 'ALERT_ACTIVITY',
-                                    ],
-                                    'LogTypeMds' => [
-                                        'title' => '规则对应的日志类型美杜莎code。',
-                                        'description' => 'The internal code of the log type.'."\n",
-                                        'type' => 'string',
-                                        'example' => '${security_event_config.event_name.webshellName_clientav}',
-                                    ],
-                                    'LogSource' => [
-                                        'title' => '规则对应的日志源。',
-                                        'description' => 'The log source of the rule.'."\n",
-                                        'type' => 'string',
-                                        'example' => 'cloud_siem_aegis_sas_alert',
-                                    ],
-                                    'LogSourceMds' => [
-                                        'title' => '规则对应的日志源美杜莎code。',
-                                        'description' => 'The internal code of the log source.'."\n",
-                                        'type' => 'string',
-                                        'example' => '${sas.cloudsiem.prod.cloud_siem_aegis_sas_alert}',
-                                    ],
-                                    'RuleCondition' => [
-                                        'title' => '规则查询条件json(需要对html转义字符进行反向转义)。',
-                                        'description' => 'The query condition of the rule. The value is in the JSON format. The HTML escape characters are reversed.'."\n",
-                                        'type' => 'string',
-                                        'example' => '[[{&quot;not&quot;:false,&quot;left&quot;:&quot;alert_name&quot;,&quot;operator&quot;:&quot;=&quot;,&quot;right&quot;:&quot;WEBSHELL&quot;}]]',
-                                    ],
-                                    'RuleGroup' => [
-                                        'title' => '日志聚合字段,json数组格式(需要对html转义字符进行反向转义)。',
-                                        'description' => 'The log aggregation field of the rule. The value is a JSON string. The HTML escape characters are reversed.'."\n",
-                                        'type' => 'string',
-                                        'example' => '[&quot;asset_id&quot;]',
-                                    ],
-                                    'RuleThreshold' => [
-                                        'title' => '规则阈值配置json(需要对html转义字符进行反向转义)。',
-                                        'description' => 'The threshold configuration of the rule. The value is in the JSON format. The HTML escape characters are reversed.'."\n",
-                                        'type' => 'string',
-                                        'example' => '{&quot;aggregateFunction&quot;:&quot;count&quot;,&quot;aggregateFunctionName&quot;:&quot;count&quot;,&quot;field&quot;:&quot;activity_name&quot;,&quot;operator&quot;:&quot;&lt;=&quot;,&quot;value&quot;:1}',
-                                    ],
-                                    'QueryCycle' => [
-                                        'title' => '规则窗口长度(需要对html转义字符进行反向转义)。',
-                                        'description' => 'The window length of the rule. The HTML escape characters are reversed.'."\n",
-                                        'type' => 'string',
-                                        'example' => '{&quot;time&quot;:&quot;1&quot;,&quot;unit&quot;:&quot;HOUR&quot;}',
-                                    ],
-                                    'AttCk' => [
-                                        'title' => '告警附加字段attck',
-                                        'description' => '告警附加字段attck',
-                                        'type' => 'string',
-                                        'example' => 'T1595.002 Vulnerability Scanning',
-                                    ],
-                                    'EventTransferSwitch' => [
-                                        'title' => '告警是否转换事件开关。 取值：'."\n"
-                                            .'- 0：不转换'."\n"
-                                            .'- 1：转换',
-                                        'description' => 'Indicates whether the system generates an event for the alert. Valid values:'."\n"
+                                            .'- qcloud: Tencent Cloud.'."\n"
                                             ."\n"
-                                            .'*   0: no'."\n"
-                                            .'*   1: yes'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '1',
-                                    ],
-                                    'EventTransferType' => [
-                                        'title' => '事件生成方式。 取值：'."\n"
-                                            .'- default:默认内置方式'."\n"
-                                            .'- singleToSingle：每个告警生成一个事件'."\n"
-                                            .'- allToSingle：周期内告警生成一个事件',
-                                        'description' => 'The event generation method. Valid values:'."\n"
+                                            .'- aliyun: Alibaba Cloud.'."\n"
                                             ."\n"
-                                            .'*   default: The default method is used.'."\n"
-                                            .'*   singleToSingle: The system generates an event for each alert.'."\n"
-                                            .'*   allToSingle: The system generates an event for alerts within a period of time.'."\n",
-                                        'type' => 'string',
-                                        'example' => 'allToSingle',
-                                    ],
-                                    'EventTransferExt' => [
-                                        'title' => '事件生成扩展信息 当eventTransferType值为allToSingle该字段有值 表示告警聚合窗口的周期长度以及周期单位(需要对html转义字符进行反向转义)。',
-                                        'description' => 'The extended information about event generation. If eventTransferType is set to allToSingle, the value of this parameter indicates the length and unit of the alert aggregation window. The HTML escape characters are reversed.'."\n",
+                                            .'- hcloud: Huawei Cloud',
                                         'type' => 'string',
-                                        'example' => '{&quot;time&quot;:&quot;1&quot;,&quot;unit&quot;:&quot;MINUTE&quot;}',
-                                    ],
-                                    'Status' => [
-                                        'title' => '规则状态。 取值：'."\n"
-                                            .'- 0：初始状态'."\n"
-                                            .'- 10：模拟数据测试'."\n"
-                                            .'- 15：业务数据测试中'."\n"
-                                            .'- 20：业务数据测试结束'."\n"
-                                            .'- 100：规则上线',
-                                        'description' => 'The rule status. Valid values:'."\n"
-                                            ."\n"
-                                            .'*   0: The rule is in the initial state.'."\n"
-                                            .'*   10: The simulation data is tested.'."\n"
-                                            .'*   15: The business data is being tested.'."\n"
-                                            .'*   20: The business data test ends.'."\n"
-                                            .'*   100: The rule takes effect.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '0',
-                                    ],
-                                    'DataType' => [
-                                        'description' => '自动化响应规则条件字段数据类型。',
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => 'varchar',
+                                        'enum' => ['qcloud', 'hcloud'],
+                                        'example' => 'hcloud',
                                     ],
                                 ],
-                                'example' => '123456',
-                            ],
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true：成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
+                                'example' => '',
                             ],
+                            'RequestId' => ['title' => '', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
-                400 => [
-                    [
-                        'errorCode' => 'CloudSiemCustomizeRuleUpdateExcepiton',
-                        'errorMessage' => 'this customize rule can only update in init status.',
-                    ],
-                    [
-                        'errorCode' => 'CloudSiemCustomizeRuleConditionExceedExcepiton',
-                        'errorMessage' => 'the number of rule conditions cannot exceed 100.',
-                    ],
-                    [
-                        'errorCode' => 'CloudSiemCustomizeRuleDuplicateRuleNameExcepiton',
-                        'errorMessage' => 'the rule name is duplicated.',
-                    ],
-                ],
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"Id\\": 123456789,\\n    \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n    \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n    \\"Aliuid\\": 0,\\n    \\"RuleName\\": \\"waf_scan\\",\\n    \\"RuleDesc\\": \\"this rule is for waf scan\\",\\n    \\"RuleType\\": \\"customize\\",\\n    \\"ThreatLevel\\": \\"remind\\",\\n    \\"AlertType\\": \\"WEBSHELL\\",\\n    \\"AlertTypeMds\\": \\"${siem_rule_type_process_abnormal_command}\\",\\n    \\"LogType\\": \\"ALERT_ACTIVITY\\",\\n    \\"LogTypeMds\\": \\"${security_event_config.event_name.webshellName_clientav}\\",\\n    \\"LogSource\\": \\"cloud_siem_aegis_sas_alert\\",\\n    \\"LogSourceMds\\": \\"${sas.cloudsiem.prod.cloud_siem_aegis_sas_alert}\\",\\n    \\"RuleCondition\\": \\"[[{&quot;not&quot;:false,&quot;left&quot;:&quot;alert_name&quot;,&quot;operator&quot;:&quot;=&quot;,&quot;right&quot;:&quot;WEBSHELL&quot;}]]\\",\\n    \\"RuleGroup\\": \\"[&quot;asset_id&quot;]\\",\\n    \\"RuleThreshold\\": \\"{&quot;aggregateFunction&quot;:&quot;count&quot;,&quot;aggregateFunctionName&quot;:&quot;count&quot;,&quot;field&quot;:&quot;activity_name&quot;,&quot;operator&quot;:&quot;&lt;=&quot;,&quot;value&quot;:1}\\",\\n    \\"QueryCycle\\": \\"{&quot;time&quot;:&quot;1&quot;,&quot;unit&quot;:&quot;HOUR&quot;}\\",\\n    \\"AttCk\\": \\"T1595.002 Vulnerability Scanning\\",\\n    \\"EventTransferSwitch\\": 1,\\n    \\"EventTransferType\\": \\"allToSingle\\",\\n    \\"EventTransferExt\\": \\"{&quot;time&quot;:&quot;1&quot;,&quot;unit&quot;:&quot;MINUTE&quot;}\\",\\n    \\"Status\\": 0,\\n    \\"DataType\\": 0\\n  },\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
-            'title' => 'PostCustomizeRule',
-        ],
-        'PostCustomizeRuleTest' => [
-            'summary' => 'Submits a custom rule for testing.',
-            'methods' => [
-                'get',
-                'post',
+            'title' => 'ListDataSourceLogs',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListDataSourceLogs'],
+                ],
             ],
-            'schemes' => [
-                'https',
-                'http',
+            'ramActions' => [
+                [
+                    'operationType' => 'list',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ListDataSourceLogs',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"SubUserId\\": 0,\\n    \\"DataSourceInstanceId\\": \\"220ba97c9d1fdb0b9c7e8c7ca328d7ea\\",\\n    \\"DataSourceInstanceName\\": \\"waf kafka\\",\\n    \\"DataSourceInstanceRemark\\": \\"waf kafka\\",\\n    \\"DataSourceInstanceLogs\\": [\\n      {\\n        \\"LogInstanceId\\": \\"220ba97c9d1fdb0b9c7e8c7ca328d7ea\\",\\n        \\"LogCode\\": \\"cloud_siem_waf_xxxxx\\",\\n        \\"LogMdsCode\\": \\"${siem.prod.cloud_siem_waf_xxxxx}\\",\\n        \\"LogParams\\": [\\n          {\\n            \\"ParaCode\\": \\"region_code\\",\\n            \\"ParaValue\\": \\"ap-guangzhou\\"\\n          }\\n        ],\\n        \\"TaskStatus\\": 1\\n      }\\n    ],\\n    \\"AccountId\\": \\"123xxxxxxx\\",\\n    \\"CloudCode\\": \\"hcloud\\"\\n  },\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+        ],
+        'ListDataSourceTypes' => [
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
+            'operationType' => 'read',
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'create',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-            ],
+            'systemTags' => ['operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
-                    'name' => 'Id',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '自定义规则ID。',
-                        'description' => 'The ID of the rule.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '123456789',
-                    ],
-                ],
-                [
-                    'name' => 'TestType',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '测试类型。 取值：'."\n"
-                            .'- simulate：模拟数据测试'."\n"
-                            .'- business：业务数据测试'."\n"
-                            .'- 15：业务数据测试中',
-                        'description' => 'The test type. Valid values:'."\n"
-                            ."\n"
-                            .'*   simulate: simulation data test'."\n"
-                            .'*   business: business data test'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'simulate',
-                    ],
-                ],
-                [
-                    'name' => 'SimulatedData',
+                    'name' => 'CloudCode',
                     'in' => 'formData',
                     'schema' => [
-                        'title' => '模拟测试数据 只有在测试类型为simulate情况下赋值。',
-                        'description' => 'The simulation data for the test. This parameter is available only when TestType is set to simulate.'."\n",
+                        'title' => '',
+                        'description' => 'The code of the multicloud service.',
                         'type' => 'string',
-                        'required' => false,
-                        'example' => '[{"key1":"value1","key2":"value2","key3":"value3","key4":"value4","key5":"value5"}]',
-                    ],
-                ],
-                [
-                    'name' => 'RoleType',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
-                ],
-                [
-                    'name' => 'RoleFor',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
+                        'required' => true,
+                        'enum' => ['qcloud', 'hcloud'],
+                        'example' => 'hcloud',
                     ],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The data management center of the threat analysis feature. Specify this parameter based on the region in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions inside China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region where the Data Management center of Threat Analysis is located. Select the region of the management center based on the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'BaseResponse',
-                        'description' => 'BaseResponse'."\n",
+                        'title' => 'CloudSiemSuccessResponse<List<ListDataSourceTypesResult>>',
+                        'description' => 'CloudSiemSuccessResponse\\<List>',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'any',
-                                'example' => '123456',
-                            ],
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true：成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code that is returned.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
+                                'title' => '',
+                                'description' => 'The data returned.',
+                                'type' => 'array',
+                                'items' => [
+                                    'type' => 'object',
+                                    'properties' => [
+                                        'DataSourceType' => ['title' => '', 'description' => 'The type of the data source. Valid values:'."\n"
+                                            ."\n"
+                                            .'- obs: Huawei Cloud OBS.'."\n"
+                                            ."\n"
+                                            .'- wafApi: Tencent Cloud WAF download API.'."\n"
+                                            ."\n"
+                                            .'- ckafka: Tencent Cloud CKafka.', 'type' => 'string', 'example' => 'obs'],
+                                        'CloudCode' => [
+                                            'title' => '',
+                                            'description' => 'The code of the multicloud service.',
+                                            'type' => 'string',
+                                            'enum' => ['qcloud', 'hcloud'],
+                                            'example' => 'hcloud',
+                                        ],
+                                    ],
+                                    'description' => '',
+                                    'title' => '',
+                                    'example' => '',
+                                ],
+                                'example' => '',
                             ],
+                            'RequestId' => ['title' => '', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
+                400 => [
+                    ['errorCode' => 'IllegalParameter', 'errorMessage' => 'The specified parameter %s is not valid, only support %s', 'description' => ''],
+                ],
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'ListDataSourceTypes',
+            'summary' => 'Lists the types of multicloud data sources that Threat Analysis supports.',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListDataSourceTypes'],
+                ],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'list',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ListDataSourceTypes',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": \\"123456\\",\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
-            'title' => 'PostCustomizeRuleTest',
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"DataSourceType\\": \\"obs\\",\\n      \\"CloudCode\\": \\"hcloud\\"\\n    }\\n  ],\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
         ],
-        'PostFinishCustomizeRuleTest' => [
-            'summary' => 'Ends the test of a custom rule.',
-            'methods' => [
-                'get',
-                'post',
-            ],
-            'schemes' => [
-                'https',
-                'http',
-            ],
+        'ListDelivery' => [
+            'summary' => 'Lists the products and logs that are connected to threat analysis for an enterprise or a member, and the data shipping status of these logs.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
@@ -14404,3905 +9449,2723 @@
             ],
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'update',
-                'riskType' => 'none',
-                'chargeType' => 'free',
+                'operationType' => 'list',
+                'abilityTreeCode' => '155305',
+                'abilityTreeNodes' => ['FEATUREsasRXJ9SY'],
             ],
             'parameters' => [
                 [
-                    'name' => 'Id',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '自定义规则ID。',
-                        'description' => 'The ID of the rule.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '123456789',
-                    ],
-                ],
-                [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['description' => 'The type of view. Valid values:'."\n"
+                        ."\n"
+                        .'- 0: The view for the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: The view for all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The Alibaba Cloud account ID of a member. An administrator can use this parameter to view data from the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region of the data management center for threat analysis. Select the region based on where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Select this value if your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Select this value if your assets are in regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'BaseResponse',
-                        'description' => 'BaseResponse'."\n",
+                        'title' => 'CloudSiemResponse<CloudSiemAnalyzeResponse>',
+                        'description' => 'BaseResponse',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'any',
-                                'example' => '123456',
-                            ],
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true：成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
+                                'title' => '',
+                                'description' => 'The returned data.',
+                                'type' => 'object',
+                                'properties' => [
+                                    'ProjectName' => ['title' => '', 'description' => 'The name of your Simple Log Service (SLS) project for threat analysis. The format is \\`aliyun-cloudsiem-data-${aliUid}-${region}\\`.', 'type' => 'string', 'example' => 'aliyun-cloudsiem-data-127608589417****-cn-shanghai'],
+                                    'LogStoreName' => ['title' => '', 'description' => 'The name of your LogStore for threat analysis. The format is \\`cloud\\_siem\\`.', 'type' => 'string', 'example' => 'cloud-siem'],
+                                    'SearchUrl' => ['title' => '', 'description' => 'The URL of the Search & Analysis page in the SLS console.', 'type' => 'string', 'example' => 'https://sls4service.console.aliyun.com/lognext/project/aliyun-cloudsiem-data-127608589417****-cn-shanghai'."\n"
+                                        .'/logsearch/cloud-siem?isShare=true&hideTopbar=true&hideSidebar=true&ignoreTabLocalStorage=true'],
+                                    'DashboardUrl' => ['title' => '', 'description' => 'The URL of the dashboard on the log analysis page.', 'type' => 'string', 'example' => 'https://sls4service.console.aliyun.com/lognext/project/aliyun-cloudsiem-data-127608589417****-cn-shanghai'."\n"
+                                        .'/dashboard/cloud-siem?isShare=true&hideTopbar=true&hideSidebar=true&ignoreTabLocalStorage=true'],
+                                    'DisplaySwitchOrNot' => ['title' => '', 'description' => 'Indicates whether to display the delivery switch. The default value is true. Valid values:'."\n"
+                                        ."\n"
+                                        .'- true: The delivery switch is displayed.'."\n"
+                                        ."\n"
+                                        .'- false: The delivery switch is hidden.', 'type' => 'boolean', 'example' => 'true'],
+                                    'ProductList' => [
+                                        'title' => '',
+                                        'description' => 'A list of products.',
+                                        'type' => 'array',
+                                        'items' => [
+                                            'description' => 'The products that are connected.',
+                                            'type' => 'object',
+                                            'properties' => [
+                                                'ProductCode' => ['title' => '', 'description' => 'The code of the cloud product. Valid values:'."\n"
+                                                    ."\n"
+                                                    .'- qcloud\\_waf'."\n"
+                                                    ."\n"
+                                                    .'- qcloud\\_cfw'."\n"
+                                                    ."\n"
+                                                    .'- hcloud\\_waf'."\n"
+                                                    ."\n"
+                                                    .'- hcloud\\_cfw'."\n"
+                                                    ."\n"
+                                                    .'- ddos'."\n"
+                                                    ."\n"
+                                                    .'- sas'."\n"
+                                                    ."\n"
+                                                    .'- cfw'."\n"
+                                                    ."\n"
+                                                    .'- config'."\n"
+                                                    ."\n"
+                                                    .'- csk'."\n"
+                                                    ."\n"
+                                                    .'- fc'."\n"
+                                                    ."\n"
+                                                    .'- rds'."\n"
+                                                    ."\n"
+                                                    .'- nas'."\n"
+                                                    ."\n"
+                                                    .'- apigateway'."\n"
+                                                    ."\n"
+                                                    .'- cdn'."\n"
+                                                    ."\n"
+                                                    .'- mongodb'."\n"
+                                                    ."\n"
+                                                    .'- eip'."\n"
+                                                    ."\n"
+                                                    .'- slb'."\n"
+                                                    ."\n"
+                                                    .'- vpc'."\n"
+                                                    ."\n"
+                                                    .'- actiontrail'."\n"
+                                                    ."\n"
+                                                    .'- waf'."\n"
+                                                    ."\n"
+                                                    .'- bastionhost'."\n"
+                                                    ."\n"
+                                                    .'- oss'."\n"
+                                                    ."\n"
+                                                    .'- polardb', 'type' => 'string', 'example' => 'sas'],
+                                                'ProductName' => ['title' => '', 'description' => 'This parameter is deprecated. You can ignore it.', 'type' => 'string', 'example' => 'Security Center'],
+                                                'LogMap' => [
+                                                    'title' => '',
+                                                    'description' => 'A list of logs that are categorized. For example, Security Center logs are categorized into groups such as Host and Network. The group is the key, and the logs in the group are the value.',
+                                                    'type' => 'object',
+                                                    'additionalProperties' => [
+                                                        'type' => 'array',
+                                                        'items' => [
+                                                            'type' => 'object',
+                                                            'properties' => [
+                                                                'LogCode' => ['title' => '', 'type' => 'string', 'description' => 'The code of the log.'."\n", 'example' => 'cloud_siem_config_log'],
+                                                                'LogName' => ['title' => '', 'type' => 'string', 'description' => 'This parameter is deprecated.'."\n", 'example' => 'audit log'],
+                                                                'LogNameEn' => ['title' => '', 'type' => 'string', 'description' => 'This parameter is deprecated.'."\n", 'example' => 'audit log'],
+                                                                'LogNameKey' => ['title' => '', 'type' => 'string', 'description' => 'The language code of the log that is used to indicate the language in which the log is displayed.'."\n", 'example' => '${sas.cloudsiem.prod.cloud_siem_aegis_crack_from_beaver}'],
+                                                                'Status' => ['title' => '', 'type' => 'boolean', 'description' => 'The status of the log delivery. Valid values:'."\n"
+                                                                    ."\n"
+                                                                    .'*   true: The logs are being delivered.'."\n"
+                                                                    .'*   false: The log delivery feature is disabled.'."\n", 'example' => 'true'],
+                                                                'CanOperateOrNot' => ['title' => '', 'type' => 'boolean', 'description' => 'Indicates whether the log delivery feature can be enabled or disabled. The feature can be enabled or disabled only by the administrator of the threat analysis feature. Valid values:'."\n"
+                                                                    ."\n"
+                                                                    .'*   true'."\n"
+                                                                    .'*   false'."\n", 'example' => 'true'],
+                                                                'Topic' => ['title' => '', 'type' => 'string', 'description' => 'The topic of the log in the Logstore. The value is an index field in the Logstore that can be used to distinguish different logs.'."\n", 'example' => 'sas_login_event'],
+                                                                'ExtraParameters' => [
+                                                                    'title' => '',
+                                                                    'type' => 'array',
+                                                                    'items' => [
+                                                                        'type' => 'object',
+                                                                        'properties' => [
+                                                                            'Key' => ['type' => 'string', 'description' => 'The ID of the extended parameter.'."\n", 'title' => '', 'example' => 'flag'],
+                                                                            'Value' => ['type' => 'string', 'description' => 'The value of the extended parameter.'."\n", 'title' => '', 'example' => 'value'],
+                                                                        ],
+                                                                        'description' => '',
+                                                                        'title' => '',
+                                                                        'example' => '',
+                                                                    ],
+                                                                    'description' => 'The extended parameter.'."\n",
+                                                                    'example' => '',
+                                                                ],
+                                                            ],
+                                                            'description' => '',
+                                                            'title' => '',
+                                                            'example' => '',
+                                                        ],
+                                                        'description' => 'A list of logs in the group.',
+                                                        'title' => '',
+                                                        'example' => '',
+                                                    ],
+                                                    'example' => '',
+                                                ],
+                                                'LogList' => [
+                                                    'title' => '',
+                                                    'description' => 'A list of logs for cloud products that do not have subcategories.',
+                                                    'type' => 'array',
+                                                    'items' => [
+                                                        'description' => 'The details of the log.',
+                                                        'type' => 'object',
+                                                        'properties' => [
+                                                            'LogCode' => ['title' => '', 'description' => 'The log code.', 'type' => 'string', 'example' => 'cloud_siem_config_log'],
+                                                            'LogName' => ['title' => '', 'description' => 'This parameter is deprecated. You can ignore it.', 'type' => 'string', 'example' => 'audit log'],
+                                                            'LogNameEn' => ['title' => '', 'description' => 'This parameter is deprecated. You can ignore it.', 'type' => 'string', 'example' => 'audit log'."\n"],
+                                                            'LogNameKey' => ['title' => '', 'description' => 'The language key of the log name. This key is used to display the log name in different languages.', 'type' => 'string', 'example' => '${sas.cloudsiem.prod.cloud_siem_aegis_crack_from_beaver}'],
+                                                            'Status' => ['title' => '', 'description' => 'The log delivery status. Valid values:'."\n"
+                                                                ."\n"
+                                                                .'- true: Delivery is in progress.'."\n"
+                                                                ."\n"
+                                                                .'- false: Delivery is disabled.', 'type' => 'boolean', 'example' => 'true'],
+                                                            'CanOperateOrNot' => ['title' => '', 'description' => 'Indicates whether the log delivery switch can be operated. Only the delegated administrator for threat analysis can operate the switch. Valid values:'."\n"
+                                                                ."\n"
+                                                                .'- true: The switch can be operated.'."\n"
+                                                                ."\n"
+                                                                .'- false: The switch cannot be operated.', 'type' => 'boolean', 'example' => 'true'],
+                                                            'Topic' => ['title' => '', 'description' => 'The topic of the log in the LogStore. This parameter is an index field in the LogStore and is used to differentiate logs.', 'type' => 'string', 'example' => 'sas_login_event'],
+                                                            'ExtraParameters' => [
+                                                                'title' => '',
+                                                                'description' => 'Additional parameters.',
+                                                                'type' => 'array',
+                                                                'items' => [
+                                                                    'description' => 'The additional parameters for the log description.',
+                                                                    'type' => 'object',
+                                                                    'properties' => [
+                                                                        'Key' => ['description' => 'The key of the additional parameter.', 'type' => 'string', 'title' => '', 'example' => 'flag'],
+                                                                        'Value' => ['description' => 'The value of the additional parameter.', 'type' => 'string', 'title' => '', 'example' => 'value'],
+                                                                    ],
+                                                                    'title' => '',
+                                                                    'example' => '',
+                                                                ],
+                                                                'example' => '',
+                                                            ],
+                                                        ],
+                                                        'title' => '',
+                                                        'example' => '',
+                                                    ],
+                                                    'example' => '',
+                                                ],
+                                            ],
+                                            'title' => '',
+                                            'example' => '',
+                                        ],
+                                        'example' => '',
+                                    ],
+                                ],
+                                'example' => '',
                             ],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-58D4-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''],
+                    ['errorCode' => 'SLS.Sls4Service.Error', 'errorMessage' => 'The Simple Log Service about embedding console pages is unavailable.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'title' => 'ListDelivery',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:44:02.000Z', 'description' => 'Request parameters changed'],
+                ['createdAt' => '2023-12-13T09:49:23.000Z', 'description' => 'Error codes changed, Request parameters changed, Response parameters changed'],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": \\"123456\\",\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
-            'title' => 'PostFinishCustomizeRuleTest',
-        ],
-        'PostRuleStatusChange' => [
-            'summary' => 'Updates the status of a custom rule.',
-            'methods' => [
-                'get',
-                'post',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListDelivery'],
+                ],
             ],
-            'schemes' => [
-                'https',
-                'http',
+            'ramActions' => [
+                [
+                    'operationType' => 'list',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ListDelivery',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"ProjectName\\": \\"aliyun-cloudsiem-data-127608589417****-cn-shanghai\\",\\n    \\"LogStoreName\\": \\"cloud-siem\\",\\n    \\"SearchUrl\\": \\"https://sls4service.console.aliyun.com/lognext/project/aliyun-cloudsiem-data-127608589417****-cn-shanghai\\\\n/logsearch/cloud-siem?isShare=true&hideTopbar=true&hideSidebar=true&ignoreTabLocalStorage=true\\",\\n    \\"DashboardUrl\\": \\"https://sls4service.console.aliyun.com/lognext/project/aliyun-cloudsiem-data-127608589417****-cn-shanghai\\\\n/dashboard/cloud-siem?isShare=true&hideTopbar=true&hideSidebar=true&ignoreTabLocalStorage=true\\",\\n    \\"DisplaySwitchOrNot\\": true,\\n    \\"ProductList\\": [\\n      {\\n        \\"ProductCode\\": \\"sas\\",\\n        \\"ProductName\\": \\"Security Center\\",\\n        \\"LogMap\\": {\\n          \\"key\\": [\\n            {\\n              \\"LogCode\\": \\"cloud_siem_config_log\\",\\n              \\"LogName\\": \\"audit log\\",\\n              \\"LogNameEn\\": \\"audit log\\",\\n              \\"LogNameKey\\": \\"${sas.cloudsiem.prod.cloud_siem_aegis_crack_from_beaver}\\",\\n              \\"Status\\": true,\\n              \\"CanOperateOrNot\\": true,\\n              \\"Topic\\": \\"sas_login_event\\",\\n              \\"ExtraParameters\\": [\\n                {\\n                  \\"Key\\": \\"flag\\",\\n                  \\"Value\\": \\"value\\"\\n                }\\n              ]\\n            }\\n          ]\\n        },\\n        \\"LogList\\": [\\n          {\\n            \\"LogCode\\": \\"cloud_siem_config_log\\",\\n            \\"LogName\\": \\"audit log\\",\\n            \\"LogNameEn\\": \\"audit log\\\\n\\",\\n            \\"LogNameKey\\": \\"${sas.cloudsiem.prod.cloud_siem_aegis_crack_from_beaver}\\",\\n            \\"Status\\": true,\\n            \\"CanOperateOrNot\\": true,\\n            \\"Topic\\": \\"sas_login_event\\",\\n            \\"ExtraParameters\\": [\\n              {\\n                \\"Key\\": \\"flag\\",\\n                \\"Value\\": \\"value\\"\\n              }\\n            ]\\n          }\\n        ]\\n      }\\n    ]\\n  },\\n  \\"RequestId\\": \\"6276D891-58D4-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+        ],
+        'ListDisposeStrategy' => [
+            'summary' => 'Retrieve a list of system-recommended disposal strategies.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
+            'operationType' => 'read',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'update',
+                'operationType' => 'list',
                 'riskType' => 'none',
                 'chargeType' => 'free',
+                'abilityTreeNodes' => ['FEATUREsasAFG0OH'],
             ],
             'parameters' => [
                 [
-                    'name' => 'Ids',
+                    'name' => 'SophonTaskId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '规则id列表 json数组格式。',
-                        'description' => 'The rule IDs. The value is a JSON array.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '[123,345]',
-                    ],
+                    'schema' => ['description' => 'ID of the security orchestration and automated response disposal strategy.', 'type' => 'string', 'example' => 'a50a49b7-6044-4593-ab15-2b46567c****', 'title' => '', 'required' => false],
                 ],
                 [
-                    'name' => 'RuleType',
+                    'name' => 'EntityIdentity',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '规则类型。 取值：'."\n"
-                            .'- predefine：预定义'."\n"
-                            .'- customize：自定义',
-                        'description' => 'The type of the rule. Valid values:'."\n"
-                            ."\n"
-                            .'*   predefine'."\n"
-                            .'*   customize'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'customize',
-                    ],
+                    'schema' => ['description' => 'Entity feature value. Use this to perform a fuzzy search on entities.', 'type' => 'string', 'example' => 'test22.php', 'title' => '', 'required' => false],
                 ],
                 [
-                    'name' => 'InUse',
+                    'name' => 'EntityType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '规则开启状态。 取值：'."\n"
-                            .'- true：开启'."\n"
-                            .'- false：关闭',
-                        'description' => 'Specifies whether to enable the rule. Valid values:'."\n"
-                            ."\n"
-                            .'*   true'."\n"
-                            .'*   false'."\n",
-                        'type' => 'boolean',
-                        'required' => false,
-                        'example' => 'true',
-                    ],
+                    'schema' => ['description' => 'Entity type. Valid values:'."\n"
+                        ."\n"
+                        .'- ip'."\n"
+                        ."\n"
+                        .'- process'."\n"
+                        ."\n"
+                        .'- file', 'type' => 'string', 'example' => 'ip', 'title' => '', 'required' => false],
+                ],
+                [
+                    'name' => 'PlaybookName',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'Unique name of the playbook.', 'type' => 'string', 'example' => 'WafBlockIP', 'title' => '', 'required' => false],
+                ],
+                [
+                    'name' => 'PlaybookUuid',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'UUID of the playbook.', 'type' => 'string', 'example' => 'system_aliyun_clb_process_book', 'title' => '', 'required' => false],
+                ],
+                [
+                    'name' => 'PlaybookTypes',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'Playbook type. Valid values:'."\n"
+                        ."\n"
+                        .'- system: manual disposal'."\n"
+                        ."\n"
+                        .'- custom: event-triggered playbook'."\n"
+                        ."\n"
+                        .'- custom\\_alert: alert-triggered playbook'."\n"
+                        ."\n"
+                        .'- soar-manual: manually run playbook'."\n"
+                        ."\n"
+                        .'- soar-mdr: MDR-run playbook', 'type' => 'string', 'example' => 'system', 'title' => '', 'required' => false],
+                ],
+                [
+                    'name' => 'EffectiveStatus',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'Strategy status. Valid values:'."\n"
+                        ."\n"
+                        .'- 0: disabled'."\n"
+                        ."\n"
+                        .'- 1: enabled', 'type' => 'integer', 'format' => 'int32', 'example' => '0', 'title' => '', 'required' => false],
+                ],
+                [
+                    'name' => 'OrderField',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'Sort field. Valid values:'."\n"
+                        ."\n"
+                        .'- GmtModified: sort by last modified time'."\n"
+                        ."\n"
+                        .'- GmtCreate: sort by creation time'."\n"
+                        ."\n"
+                        .'- FinishTime: sort by strategy end time', 'type' => 'string', 'example' => 'GmtModified', 'title' => '', 'required' => false],
+                ],
+                [
+                    'name' => 'Order',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'Sort order. Valid values:'."\n"
+                        ."\n"
+                        .'- desc: descending'."\n"
+                        ."\n"
+                        .'- asc: ascending', 'type' => 'string', 'example' => 'desc', 'title' => '', 'required' => false],
+                ],
+                [
+                    'name' => 'StartTime',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'Start time of the query, in milliseconds.', 'type' => 'integer', 'format' => 'int64', 'required' => true, 'example' => '1577808000000', 'title' => ''],
+                ],
+                [
+                    'name' => 'EndTime',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'End time of the query, in milliseconds.', 'type' => 'integer', 'format' => 'int64', 'required' => true, 'example' => '1577808000000', 'title' => ''],
+                ],
+                [
+                    'name' => 'Status',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'Disposal strategy status.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '200', 'title' => ''],
+                ],
+                [
+                    'name' => 'CurrentPage',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'Current page number. Must be greater than or equal to 1.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'minimum' => '1', 'example' => '1', 'title' => ''],
+                ],
+                [
+                    'name' => 'PageSize',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'Number of entries per page. Maximum value is 100.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'maximum' => '100', 'minimum' => '1', 'example' => '10', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['description' => 'View type. Valid values:'."\n"
+                        ."\n"
+                        .'- 0: view for the current Alibaba Cloud account'."\n"
+                        ."\n"
+                        .'- 1: view for all accounts under the enterprise', 'type' => 'integer', 'format' => 'int32', 'title' => '', 'required' => false, 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'Alibaba Cloud account ID when an administrator switches to another member\'s perspective.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['description' => 'Location of the Data Management center for Threat Analysis and Response. Select the location based on where your assets are deployed. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: assets in the Chinese mainland or Hong Kong (China)'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: assets outside China', 'type' => 'string', 'example' => 'cn-hangzhou', 'title' => '', 'required' => false],
+                ],
+                [
+                    'name' => 'IncidentUuid',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'Event ID.', 'type' => 'string', 'required' => false, 'example' => '49670d3bbf7aa9556a2fff3dbaa9****', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'BaseResponse',
-                        'description' => 'BaseResponse'."\n",
+                        'title' => 'PageResponse<List<DisposeStrategy>>',
+                        'description' => 'PageResponse\\<List\\<disposestrategy>>',
                         'type' => 'object',
                         'properties' => [
+                            'Success' => ['description' => 'Indicates whether the request succeeded. Valid values:'."\n"
+                                ."\n"
+                                .'- true'."\n"
+                                ."\n"
+                                .'- false', 'type' => 'boolean', 'example' => 'true', 'title' => ''],
+                            'Code' => ['description' => 'HTTP status code.', 'type' => 'integer', 'format' => 'int32', 'example' => '200', 'title' => ''],
+                            'Message' => ['description' => 'Response message.', 'type' => 'string', 'example' => 'success', 'title' => ''],
+                            'RequestId' => ['description' => 'Request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', 'title' => ''],
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'any',
+                                'title' => '',
+                                'description' => 'Response data.',
+                                'type' => 'object',
+                                'properties' => [
+                                    'PageInfo' => [
+                                        'title' => '',
+                                        'description' => 'Paging information.',
+                                        'type' => 'object',
+                                        'properties' => [
+                                            'CurrentPage' => ['description' => 'Current page number.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''],
+                                            'PageSize' => ['description' => 'Number of entries returned per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10', 'title' => ''],
+                                            'TotalCount' => ['description' => 'Total number of entries.', 'type' => 'integer', 'format' => 'int64', 'example' => '100', 'title' => ''],
+                                        ],
+                                        'example' => '',
+                                    ],
+                                    'ResponseData' => [
+                                        'title' => '',
+                                        'description' => 'Detailed data.',
+                                        'type' => 'array',
+                                        'items' => [
+                                            'type' => 'object',
+                                            'properties' => [
+                                                'Id' => ['description' => 'Strategy ID.', 'type' => 'integer', 'format' => 'int64', 'example' => '123', 'title' => ''],
+                                                'GmtCreate' => ['description' => 'Creation time.', 'type' => 'string', 'example' => '2021-01-06 16:37:29', 'title' => ''],
+                                                'GmtModified' => ['description' => 'Last modified time.', 'type' => 'string', 'example' => '2021-01-06 16:37:29', 'title' => ''],
+                                                'Aliuid' => ['description' => 'SIEM root account ID associated with the strategy.', 'type' => 'integer', 'format' => 'int64', 'example' => '127608589417****', 'title' => ''],
+                                                'SubAliuid' => ['description' => 'The Alibaba Cloud account ID associated with the configuration policy.', 'type' => 'integer', 'format' => 'int64', 'example' => '176555323***', 'title' => ''],
+                                                'IncidentName' => ['description' => 'Event name.', 'type' => 'string', 'example' => 'Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc', 'title' => ''],
+                                                'Scope' => [
+                                                    'title' => '',
+                                                    'description' => 'Disposal scope.',
+                                                    'type' => 'array',
+                                                    'items' => ['description' => 'Disposal scope.', 'type' => 'any', 'example' => '[{ aliUid: 176618589410**** }]', 'title' => ''],
+                                                    'example' => '[{ aliUid: 1766185894104675 }]',
+                                                ],
+                                                'IncidentUuid' => ['description' => 'Global unique UUID of the event.', 'type' => 'string', 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', 'title' => ''],
+                                                'AlertUuid' => ['description' => 'Alert UUID.', 'type' => 'string', 'example' => 'sas_71e24437d2797ce8fc59692905a4****', 'title' => ''],
+                                                'SophonTaskId' => ['description' => 'ID of the security orchestration and automated response disposal strategy.', 'type' => 'string', 'example' => '577bbf90-a770-44a7-8154-586aa2d3****', 'title' => ''],
+                                                'PlaybookName' => ['description' => 'Unique name of the playbook.', 'type' => 'string', 'example' => 'WafBlockIP', 'title' => ''],
+                                                'PlaybookUuid' => ['description' => 'UUID of the playbook.', 'type' => 'string', 'example' => 'system_aliyun_clb_process_book', 'title' => ''],
+                                                'PlaybookType' => ['description' => 'Playbook type. Valid values:'."\n"
+                                                    ."\n"
+                                                    .'- system: manual disposal'."\n"
+                                                    ."\n"
+                                                    .'- custom: event-triggered playbook'."\n"
+                                                    ."\n"
+                                                    .'- custom\\_alert: alert-triggered playbook'."\n"
+                                                    ."\n"
+                                                    .'- soar-manual: manually run playbook'."\n"
+                                                    ."\n"
+                                                    .'- soar-mdr: MDR-run playbook', 'type' => 'string', 'example' => 'system', 'title' => ''],
+                                                'TaskUrl' => ['description' => 'Playbook URL.', 'type' => 'string', 'title' => '', 'example' => '{"playbookUuid":"system_aliyun_aegis_stop_container_book","requestUuid":"e8924356-448b-4301-aee9-*******"}'],
+                                                'EntityId' => ['description' => 'Entity ID.', 'type' => 'integer', 'format' => 'int64', 'example' => '123456789', 'title' => ''],
+                                                'Entity' => [
+                                                    'title' => '',
+                                                    'description' => 'Entity details in JSON array format.',
+                                                    'type' => 'array',
+                                                    'items' => ['description' => 'Entity details in JSON array format.', 'type' => 'any', 'example' => '[{"ip":"1.1.XX.XX"}]', 'title' => ''],
+                                                    'example' => '[{"ip":"1.1.1.1"}]',
+                                                ],
+                                                'EntityType' => ['description' => 'Entity type. Valid values:'."\n"
+                                                    ."\n"
+                                                    .'- ip'."\n"
+                                                    ."\n"
+                                                    .'- process'."\n"
+                                                    ."\n"
+                                                    .'- file', 'type' => 'string', 'example' => 'ip', 'title' => ''],
+                                                'TaskParam' => ['description' => 'Parameters used to trigger the playbook, in JSON format.', 'type' => 'string', 'example' => '{'."\n"
+                                                    .'      "file": {'."\n"
+                                                    .'            "op_code": "2",'."\n"
+                                                    .'            "file_path": "/root/alert0913/a886.jsp",'."\n"
+                                                    .'            "entity_type": "file",'."\n"
+                                                    .'            "entity_name": "a886.jsp",'."\n"
+                                                    .'            "file_name": "a886.jsp",'."\n"
+                                                    .'            "file_owner": "USER:,GROUP:",'."\n"
+                                                    .'            "hash_value": "5def10c9a4287d0920d86b42420b20b0",'."\n"
+                                                    .'            "op_level": "2",'."\n"
+                                                    .'            "entity_id": "/root/alert0913/a886.jsp",'."\n"
+                                                    .'            "host_uuid": {'."\n"
+                                                    .'                  "entity_type": "host",'."\n"
+                                                    .'                  "entity_name": "N/A",'."\n"
+                                                    .'                  "is_comprised": "1",'."\n"
+                                                    .'                  "os_type": "linux",'."\n"
+                                                    .'                  "entity_id": "5f58ef67-8803-4314-8d67-c87dc92b****",'."\n"
+                                                    .'                  "host_uuid": "5f58ef67-8803-4314-8d67-c87dc92b****",'."\n"
+                                                    .'                  "host_name": "N/A"'."\n"
+                                                    .'            },'."\n"
+                                                    .'            "malware_type": "${aliyun.siem.sas.alert_tag.webshell}"'."\n"
+                                                    .'      },'."\n"
+                                                    .'      "_sys_siem": {'."\n"
+                                                    .'            "cloudCode": "aliyun",'."\n"
+                                                    .'            "alertId": "89416745494****"'."\n"
+                                                    .'      },'."\n"
+                                                    .'      "scope": ['."\n"
+                                                    .'            {'."\n"
+                                                    .'                  "aliUid": 1766185894104****'."\n"
+                                                    .'            }'."\n"
+                                                    .'      ]'."\n"
+                                                    .'}', 'title' => ''],
+                                                'ErrorMessage' => ['description' => 'Summary of task failure.', 'type' => 'string', 'example' => 'DisposalEntity failed which description is Aegis Quarantine File , return_info failed which description is Check Aegis Process Result , [ERROR DETAIL] *******.php:file not found', 'title' => ''],
+                                                'FinishTime' => ['description' => 'Task completion time.', 'type' => 'string', 'example' => '2021-08-10 21:34:07', 'title' => ''],
+                                                'EffectiveStatus' => ['description' => 'Strategy status. Valid values:'."\n"
+                                                    ."\n"
+                                                    .'- 0: disabled'."\n"
+                                                    ."\n"
+                                                    .'- 1: enabled', 'type' => 'integer', 'format' => 'int32', 'example' => '0', 'title' => ''],
+                                                'Status' => ['description' => 'Playbook invocation status. Valid values:'."\n"
+                                                    ."\n"
+                                                    .'- 200: succeeded'."\n"
+                                                    ."\n"
+                                                    .'- 10: deleted'."\n"
+                                                    ."\n"
+                                                    .'- 5: failed'."\n"
+                                                    ."\n"
+                                                    .'- 0: initial state', 'type' => 'integer', 'format' => 'int32', 'example' => '10', 'title' => ''],
+                                            ],
+                                            'description' => '',
+                                            'title' => '',
+                                            'example' => '',
+                                        ],
+                                        'example' => '',
+                                    ],
+                                ],
                                 'example' => '123456',
                             ],
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true：成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
-                            ],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n  \\"Data\\": {\\n    \\"PageInfo\\": {\\n      \\"CurrentPage\\": 1,\\n      \\"PageSize\\": 10,\\n      \\"TotalCount\\": 100\\n    },\\n    \\"ResponseData\\": [\\n      {\\n        \\"Id\\": 123,\\n        \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n        \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n        \\"Aliuid\\": 0,\\n        \\"SubAliuid\\": 0,\\n        \\"IncidentName\\": \\"Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc\\",\\n        \\"Scope\\": [\\n          \\"[{ aliUid: 176618589410**** }]\\"\\n        ],\\n        \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n        \\"AlertUuid\\": \\"sas_71e24437d2797ce8fc59692905a4****\\",\\n        \\"SophonTaskId\\": \\"577bbf90-a770-44a7-8154-586aa2d3****\\",\\n        \\"PlaybookName\\": \\"WafBlockIP\\",\\n        \\"PlaybookUuid\\": \\"system_aliyun_clb_process_book\\",\\n        \\"PlaybookType\\": \\"system\\",\\n        \\"TaskUrl\\": \\"{\\\\\\"playbookUuid\\\\\\":\\\\\\"system_aliyun_aegis_stop_container_book\\\\\\",\\\\\\"requestUuid\\\\\\":\\\\\\"e8924356-448b-4301-aee9-*******\\\\\\"}\\",\\n        \\"EntityId\\": 123456789,\\n        \\"Entity\\": [\\n          \\"[{\\\\\\"ip\\\\\\":\\\\\\"1.1.XX.XX\\\\\\"}]\\"\\n        ],\\n        \\"EntityType\\": \\"ip\\",\\n        \\"TaskParam\\": \\"{\\\\n      \\\\\\"file\\\\\\": {\\\\n            \\\\\\"op_code\\\\\\": \\\\\\"2\\\\\\",\\\\n            \\\\\\"file_path\\\\\\": \\\\\\"/root/alert0913/a886.jsp\\\\\\",\\\\n            \\\\\\"entity_type\\\\\\": \\\\\\"file\\\\\\",\\\\n            \\\\\\"entity_name\\\\\\": \\\\\\"a886.jsp\\\\\\",\\\\n            \\\\\\"file_name\\\\\\": \\\\\\"a886.jsp\\\\\\",\\\\n            \\\\\\"file_owner\\\\\\": \\\\\\"USER:,GROUP:\\\\\\",\\\\n            \\\\\\"hash_value\\\\\\": \\\\\\"5def10c9a4287d0920d86b42420b20b0\\\\\\",\\\\n            \\\\\\"op_level\\\\\\": \\\\\\"2\\\\\\",\\\\n            \\\\\\"entity_id\\\\\\": \\\\\\"/root/alert0913/a886.jsp\\\\\\",\\\\n            \\\\\\"host_uuid\\\\\\": {\\\\n                  \\\\\\"entity_type\\\\\\": \\\\\\"host\\\\\\",\\\\n                  \\\\\\"entity_name\\\\\\": \\\\\\"N/A\\\\\\",\\\\n                  \\\\\\"is_comprised\\\\\\": \\\\\\"1\\\\\\",\\\\n                  \\\\\\"os_type\\\\\\": \\\\\\"linux\\\\\\",\\\\n                  \\\\\\"entity_id\\\\\\": \\\\\\"5f58ef67-8803-4314-8d67-c87dc92b****\\\\\\",\\\\n                  \\\\\\"host_uuid\\\\\\": \\\\\\"5f58ef67-8803-4314-8d67-c87dc92b****\\\\\\",\\\\n                  \\\\\\"host_name\\\\\\": \\\\\\"N/A\\\\\\"\\\\n            },\\\\n            \\\\\\"malware_type\\\\\\": \\\\\\"${aliyun.siem.sas.alert_tag.webshell}\\\\\\"\\\\n      },\\\\n      \\\\\\"_sys_siem\\\\\\": {\\\\n            \\\\\\"cloudCode\\\\\\": \\\\\\"aliyun\\\\\\",\\\\n            \\\\\\"alertId\\\\\\": \\\\\\"89416745494****\\\\\\"\\\\n      },\\\\n      \\\\\\"scope\\\\\\": [\\\\n            {\\\\n                  \\\\\\"aliUid\\\\\\": 1766185894104****\\\\n            }\\\\n      ]\\\\n}\\",\\n        \\"ErrorMessage\\": \\"DisposalEntity failed which description is Aegis Quarantine File , return_info failed which description is Check Aegis Process Result , [ERROR DETAIL] *******.php:file not found\\",\\n        \\"FinishTime\\": \\"2021-08-10 21:34:07\\",\\n        \\"EffectiveStatus\\": 0,\\n        \\"Status\\": 10\\n      }\\n    ]\\n  }\\n}","type":"json"}]',
+            'title' => 'ListDisposeStrategy',
+            'changeSet' => [
+                ['createdAt' => '2024-12-23T09:00:54.000Z', 'description' => 'Request parameters changed'],
+                ['createdAt' => '2024-09-26T11:11:01.000Z', 'description' => 'Request parameters changed, Response parameters changed'],
+                ['createdAt' => '2024-04-17T12:43:22.000Z', 'description' => 'Error codes changed, Request parameters changed'],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": \\"123456\\",\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
-            'title' => 'PostRuleStatusChange',
-        ],
-        'DescribeScopeUsers' => [
-            'summary' => 'Queries the list of users in the playbook scope.',
-            'methods' => [
-                'get',
-                'post',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListDisposeStrategy'],
+                ],
             ],
-            'schemes' => [
-                'https',
-                'http',
+            'ramActions' => [
+                [
+                    'operationType' => 'list',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ListDisposeStrategy',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+        ],
+        'ListEntities' => [
+            'methods' => ['get', 'post'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
+            'operationType' => 'read',
             'deprecated' => false,
             'systemTags' => [
                 'operationType' => 'get',
                 'riskType' => 'none',
                 'chargeType' => 'free',
+                'abilityTreeNodes' => ['FEATUREsasAFG0OH'],
             ],
             'parameters' => [
                 [
+                    'name' => 'IncidentUuid',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The incident ID.', 'type' => 'string', 'required' => true, 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'],
+                ],
+                [
+                    'name' => 'EntityType',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The entity type. Valid values:'."\n"
+                        .'- ip: IP address'."\n"
+                        .'- domain: domain name'."\n"
+                        .'- url: URL'."\n"
+                        .'- process: process'."\n"
+                        .'- file: file'."\n"
+                        .'- host: host'."\n"
+                        .'- cloud_account: cloud account'."\n"
+                        .'- container: container'."\n"
+                        .'- bucket: Object Storage Service (OSS) bucket.', 'type' => 'string', 'example' => 'ip', 'required' => false],
+                ],
+                [
+                    'name' => 'EntityName',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The entity name.', 'type' => 'string', 'example' => 'host1****', 'required' => false],
+                ],
+                [
+                    'name' => 'EntityUuid',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The entity UUID.', 'type' => 'string', 'example' => '6c740667-80b2-476d-8924-2e706feb****', 'required' => false],
+                ],
+                [
+                    'name' => 'EntityUuids',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The list of entity UUIDs.', 'type' => 'string', 'required' => false, 'example' => '6c740667-80b2-476d-8924-2e706feb****,6c740667-80b2-476d-8924-2e706feb****', 'title' => ''],
+                ],
+                [
+                    'name' => 'MalwareType',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The malicious entity type.', 'type' => 'string', 'example' => 'aliyun.siem.sas.alert_tag.miner_software', 'required' => false],
+                ],
+                [
+                    'name' => 'IsMalwareEntity',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'Specifies whether the entity is malicious. Valid values:'."\n"
+                        .'- 0: No.'."\n"
+                        .'- 1: Yes.', 'type' => 'string', 'example' => '1', 'required' => false],
+                ],
+                [
+                    'name' => 'Tags',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The entity tags. The value is a JSON array string:'."\n"
+                        ."\n"
+                        .'`"[{"tagKey1":"tagValue1"},{"tagKey2":"tagValue2"}]"`.', 'type' => 'string', 'required' => false, 'example' => '[{"tagKey1":"tagValue1"},{"tagKey2":"tagValue2"}]'],
+                ],
+                [
+                    'name' => 'CurrentPage',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The page number of the current page. The value must be greater than or equal to 1.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'minimum' => '1', 'example' => '1'],
+                ],
+                [
+                    'name' => 'PageSize',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The number of entries per page. Maximum value: 100.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'maximum' => '100', 'minimum' => '1', 'example' => '10'],
+                ],
+                [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The view type. Valid values:'."\n"
+                        ."\n"
+                        .'- 0: the view of the current Alibaba Cloud account.'."\n"
+                        .'- 1: the view of all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The ID of the member to which the administrator switches the view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The data management center of the threat analysis feature. Specify this parameter based on the region in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions inside China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region in which the data management center of the threat analysis feature resides. Select the region based on the region where your assets reside. Valid values:'."\n"
+                        .'- cn-hangzhou: the assets reside in the Chinese mainland or Hong Kong (China).'."\n"
+                        .'- ap-southeast-1: the assets reside in regions outside China.', 'type' => 'string', 'example' => 'cn-hangzhou', 'required' => false],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'BaseResponse<List<SoarScope>>',
-                        'description' => 'BaseResponse\\<List>'."\n",
+                        'title' => '',
+                        'description' => 'PageResponse<List<EntityInfo>>',
                         'type' => 'object',
                         'properties' => [
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                .'- true: successful.'."\n"
+                                .'- false: failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The HTTP status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The response message.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'array',
-                                'items' => [
-                                    'type' => 'object',
-                                    'properties' => [
-                                        'AliUid' => [
-                                            'title' => 'siem用户ID。',
-                                            'description' => 'The ID of the security information and event management (SIEM) user.'."\n",
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '123456789****',
-                                        ],
-                                        'UserName' => [
-                                            'title' => '用户名。',
-                                            'description' => 'The username.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'test001',
-                                        ],
-                                        'UserId' => [
-                                            'title' => '多云用户ID。',
-                                            'description' => '多云用户ID。',
-                                            'type' => 'string',
-                                            'example' => '123456789****',
-                                        ],
-                                        'CloudCode' => [
-                                            'title' => '云code。  取值：'."\n"
-                                                .'- qcloud：腾讯云'."\n"
-                                                .'- hcloud：华为云',
-                                            'description' => '云code。  取值：'."\n"
-                                                .'- qcloud：腾讯云'."\n"
-                                                .'- hcloud：华为云',
-                                            'type' => 'string',
-                                            'example' => 'qcloud',
-                                        ],
-                                        'InstanceId' => [
-                                            'title' => 'waf实例ID。',
-                                            'description' => 'The ID of the Web Application Firewall (WAF) instance.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'waf-cn-tl123ast****',
+                                'title' => '',
+                                'description' => 'The response data.',
+                                'type' => 'object',
+                                'properties' => [
+                                    'PageInfo' => [
+                                        'title' => '',
+                                        'description' => 'The pagination information.',
+                                        'type' => 'object',
+                                        'properties' => [
+                                            'CurrentPage' => ['title' => '', 'description' => 'The page number of the current page.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'],
+                                            'PageSize' => ['title' => '', 'description' => 'The number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10'],
+                                            'TotalCount' => ['title' => '', 'description' => 'The total number of entries.', 'type' => 'integer', 'format' => 'int64', 'example' => '100'],
                                         ],
-                                        'Domains' => [
-                                            'title' => 'waf实例下的防护的域名列表。',
-                                            'description' => 'An array consisting of the domain names that are protected by the WAF instance.'."\n",
-                                            'type' => 'array',
-                                            'items' => [
-                                                'description' => 'The domain name that is protected by the WAF instance.'."\n",
-                                                'type' => 'string',
-                                                'example' => '[123***.com, 456***.com]',
+                                        'example' => '',
+                                    ],
+                                    'ResponseData' => [
+                                        'title' => '',
+                                        'description' => 'The detailed data.',
+                                        'type' => 'array',
+                                        'items' => [
+                                            'type' => 'object',
+                                            'properties' => [
+                                                'Id' => ['title' => '', 'description' => 'The entity ID.', 'type' => 'integer', 'format' => 'int64', 'example' => '123456789***'],
+                                                'GmtCreate' => ['title' => '', 'description' => 'The time when the entity was collected.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'],
+                                                'GmtModified' => ['title' => '', 'description' => 'The time when the entity was last updated.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'],
+                                                'Aliuid' => ['title' => '', 'description' => 'The Alibaba Cloud account ID.', 'type' => 'integer', 'format' => 'int64', 'example' => '123456789****'],
+                                                'IncidentUuid' => ['title' => '', 'description' => 'The incident UUID. You can obtain this value from the incident list operation.', 'type' => 'string', 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'],
+                                                'AlertUuid' => ['title' => '', 'description' => 'The alert UUID.', 'type' => 'string', 'example' => 'sas_71e24437d2797ce8fc59692905a4****'],
+                                                'AlertNum' => ['title' => '', 'description' => 'The number of alerts associated with the entity.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'],
+                                                'EventNum' => ['title' => '', 'description' => 'The number of events associated with the entity.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'],
+                                                'CloudCode' => ['title' => '', 'description' => 'The code of the cloud service provider from which the entity originates. Valid values:'."\n"
+                                                    .'- aliyun: Alibaba Cloud'."\n"
+                                                    .'- qcloud: Tencent Cloud'."\n"
+                                                    .'- hcloud: Huawei Cloud.', 'type' => 'string', 'example' => 'aliyun'],
+                                                'EntityType' => ['title' => '', 'description' => 'The entity type. Valid values:'."\n"
+                                                    .'- ip: IP address'."\n"
+                                                    .'- domain: domain name'."\n"
+                                                    .'- url: URL'."\n"
+                                                    .'- process: process'."\n"
+                                                    .'- file: file'."\n"
+                                                    .'- host: host'."\n"
+                                                    .'- cloud_account: cloud account'."\n"
+                                                    .'- container: container'."\n"
+                                                    .'- bucket: Object Storage Service (OSS) bucket.', 'type' => 'string', 'example' => 'ip'],
+                                                'EntityName' => ['title' => '', 'description' => 'The entity name.', 'type' => 'string', 'example' => '123.123.123.123'],
+                                                'EntityInfo' => ['title' => '', 'description' => 'The display information of the entity in JSON format.', 'type' => 'string', 'example' => '{"file_path": "c:/www/leixi.jsp","file_hash": "aa0ca926ad948cd820e0a3d9a18c****","host_uuid": "efed2cf7-0b77-45d9-a97b-d2cf246b****","malware_type": "${aliyun.siem.sas.alert_tag.webshell}","host_name": "launch-advisor-2023****"}'],
+                                                'SubUserId' => ['title' => '', 'description' => 'The linked account ID associated with the entity.', 'type' => 'integer', 'format' => 'int64', 'example' => '113091674488****'],
+                                                'EntityId' => ['title' => '', 'description' => 'The logical ID of the entity.', 'type' => 'string', 'example' => '12345****'],
+                                                'EntityUuid' => ['title' => '', 'description' => 'The entity UUID.', 'type' => 'string', 'example' => '8087b3e4aa6862852c100c8738cf****'],
+                                                'MalwareType' => ['title' => '', 'description' => 'The malware type of the entity.', 'type' => 'string', 'example' => 'aliyun.siem.sas.alert_tag.webshell'],
+                                                'IsAsset' => ['description' => 'Indicates whether the entity is an asset. Valid values:'."\n"
+                                                    .'+ 0: No.'."\n"
+                                                    .'+ 1: Yes.', 'type' => 'string', 'example' => '1', 'title' => ''],
+                                                'IsMalware' => ['description' => 'Indicates whether the entity is malicious. Valid values:'."\n"
+                                                    .'+ 0: No.'."\n"
+                                                    .'+ 1: Yes.', 'type' => 'string', 'example' => '0', 'title' => ''],
+                                                'Tags' => ['description' => 'The entity tags. The value is a JSON array string:'."\n"
+                                                    ."\n"
+                                                    .'`"[{"tagKey1":"tagValue1"},{"tagKey2":"tagValue2"}]"`.', 'type' => 'string', 'example' => '[{"tagKey1":"tagValue1"},{"tagKey2":"tagValue2"}]', 'title' => ''],
+                                                'AgentDisposalMethod' => ['description' => 'The disposal method recommended by the agent.', 'type' => 'string', 'example' => 'delete_file', 'title' => ''],
+                                                'AgentDisposalPlaybookUuid' => ['description' => 'The UUID of the playbook recommended by the agent for disposal.', 'type' => 'string', 'example' => '12XAD-SFQ-WAF-2ca2', 'title' => ''],
+                                                'AgentDisposalSuggestion' => ['description' => 'The disposal suggestion recommended by the agent.', 'type' => 'string', 'example' => '{}', 'title' => ''],
+                                                'AgentConfidence' => ['description' => 'The confidence level of the entity as determined by the agent.', 'type' => 'string', 'example' => '85', 'title' => ''],
+                                                'AgentAnalysisReason' => ['type' => 'string', 'description' => '', 'title' => '', 'example' => ''],
+                                                'AgentDisposes' => [
+                                                    'description' => 'The list of disposal suggestions recommended by the agent.',
+                                                    'type' => 'array',
+                                                    'items' => [
+                                                        'description' => 'The recommended disposal suggestion.',
+                                                        'type' => 'object',
+                                                        'properties' => [
+                                                            'AgentDisposalPlaybookUuid' => ['description' => 'The UUID of the playbook recommended by the agent for disposal.', 'type' => 'string', 'example' => '12XAD-SFQ-WAF-2ca2', 'title' => ''],
+                                                            'AgentDisposalMethod' => ['description' => 'The disposal suggestion recommended by the agent.', 'type' => 'string', 'example' => '{}', 'title' => ''],
+                                                            'AgentDisposalReason' => ['type' => 'string', 'description' => '', 'title' => '', 'example' => ''],
+                                                        ],
+                                                        'title' => '',
+                                                        'example' => '',
+                                                    ],
+                                                    'title' => '',
+                                                    'example' => '',
+                                                ],
+                                                'AgentDisposalReason' => ['type' => 'string', 'description' => '', 'title' => '', 'example' => ''],
                                             ],
-                                            'example' => '[123.com, 456.com]',
+                                            'description' => '',
+                                            'title' => '',
+                                            'example' => '',
                                         ],
+                                        'example' => '',
                                     ],
                                 ],
                                 'example' => '123456',
                             ],
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true：成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code that is returned.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
-                            ],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'Query entity list',
+            'summary' => 'Queries a list of entities.',
+            'changeSet' => [
+                ['createdAt' => '2025-06-18T03:32:30.000Z', 'description' => 'Request parameters changed, Response parameters changed'],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"AliUid\\": 0,\\n      \\"UserName\\": \\"test001\\",\\n      \\"UserId\\": \\"123456789****\\",\\n      \\"CloudCode\\": \\"qcloud\\",\\n      \\"InstanceId\\": \\"waf-cn-tl123ast****\\",\\n      \\"Domains\\": [\\n        \\"[123***.com, 456***.com]\\"\\n      ]\\n    }\\n  ],\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
-            'title' => 'DescribeScopeUsers',
-        ],
-        'DeleteAutomateResponseConfig' => [
-            'summary' => 'Deletes the automated response rule with a specified ID.',
-            'methods' => [
-                'get',
-                'post',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListEntities'],
+                ],
             ],
-            'schemes' => [
-                'https',
-                'http',
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ListEntities',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n  \\"Data\\": {\\n    \\"PageInfo\\": {\\n      \\"CurrentPage\\": 1,\\n      \\"PageSize\\": 10,\\n      \\"TotalCount\\": 100\\n    },\\n    \\"ResponseData\\": [\\n      {\\n        \\"Id\\": 0,\\n        \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n        \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n        \\"Aliuid\\": 0,\\n        \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n        \\"AlertUuid\\": \\"sas_71e24437d2797ce8fc59692905a4****\\",\\n        \\"AlertNum\\": 1,\\n        \\"EventNum\\": 1,\\n        \\"CloudCode\\": \\"aliyun\\",\\n        \\"EntityType\\": \\"ip\\",\\n        \\"EntityName\\": \\"123.123.123.123\\",\\n        \\"EntityInfo\\": \\"{\\\\\\"file_path\\\\\\": \\\\\\"c:/www/leixi.jsp\\\\\\",\\\\\\"file_hash\\\\\\": \\\\\\"aa0ca926ad948cd820e0a3d9a18c****\\\\\\",\\\\\\"host_uuid\\\\\\": \\\\\\"efed2cf7-0b77-45d9-a97b-d2cf246b****\\\\\\",\\\\\\"malware_type\\\\\\": \\\\\\"${aliyun.siem.sas.alert_tag.webshell}\\\\\\",\\\\\\"host_name\\\\\\": \\\\\\"launch-advisor-2023****\\\\\\"}\\",\\n        \\"SubUserId\\": 0,\\n        \\"EntityId\\": \\"12345****\\",\\n        \\"EntityUuid\\": \\"8087b3e4aa6862852c100c8738cf****\\",\\n        \\"MalwareType\\": \\"aliyun.siem.sas.alert_tag.webshell\\",\\n        \\"IsAsset\\": \\"1\\",\\n        \\"IsMalware\\": \\"0\\",\\n        \\"Tags\\": \\"[{\\\\\\"tagKey1\\\\\\":\\\\\\"tagValue1\\\\\\"},{\\\\\\"tagKey2\\\\\\":\\\\\\"tagValue2\\\\\\"}]\\",\\n        \\"AgentDisposalMethod\\": \\"delete_file\\",\\n        \\"AgentDisposalPlaybookUuid\\": \\"12XAD-SFQ-WAF-2ca2\\",\\n        \\"AgentDisposalSuggestion\\": \\"{}\\",\\n        \\"AgentConfidence\\": \\"85\\",\\n        \\"AgentAnalysisReason\\": \\"\\",\\n        \\"AgentDisposes\\": [\\n          {\\n            \\"AgentDisposalPlaybookUuid\\": \\"12XAD-SFQ-WAF-2ca2\\",\\n            \\"AgentDisposalMethod\\": \\"{}\\",\\n            \\"AgentDisposalReason\\": \\"\\"\\n          }\\n        ],\\n        \\"AgentDisposalReason\\": \\"\\"\\n      }\\n    ]\\n  }\\n}","type":"json"}]',
+        ],
+        'ListImportedLogsByProd' => [
+            'summary' => 'Queries the log ingestion details for a specific product.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
+            'operationType' => 'read',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'delete',
+                'operationType' => 'list',
                 'riskType' => 'none',
                 'chargeType' => 'free',
+                'abilityTreeCode' => '195548',
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
-                    'name' => 'Id',
+                    'name' => 'ProdCode',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The code of the product.', 'type' => 'string', 'required' => true, 'example' => 'qcloud_waf'],
+                ],
+                [
+                    'name' => 'CloudCode',
                     'in' => 'formData',
                     'schema' => [
-                        'title' => '自动化响应配置规则ID。',
-                        'description' => 'The ID of the rule.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '123',
+                        'title' => '',
+                        'description' => 'The multicloud code. Valid values:'."\n"
+                            ."\n"
+                            .'- qcloud: Tencent Cloud.'."\n"
+                            ."\n"
+                            .'- aliyun: Alibaba Cloud.'."\n"
+                            ."\n"
+                            .'- hcloud: Huawei Cloud.',
+                        'type' => 'string',
+                        'required' => true,
+                        'enumValueTitles' => [],
+                        'enum' => ['qcloud', 'hcloud', 'aliyun', 'idc'],
+                        'example' => 'hcloud',
                     ],
                 ],
                 [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['description' => 'The view type.'."\n"
+                        ."\n"
+                        .'- 0: The view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: The view of all accounts within the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The user ID that the administrator uses to switch to the perspective of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region where the Data Management hub of threat analysis is deployed. Select the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'BaseResponse<String>',
-                        'description' => 'BaseResponse'."\n",
+                        'title' => 'CloudSiemSuccessResponse<List<ListImportedLogsByProdResult>>',
+                        'description' => 'CloudSiemSuccessResponse\\<List>',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'string',
-                                'example' => '123456',
-                            ],
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true：成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
+                                'title' => '',
+                                'description' => 'The data returned.',
+                                'type' => 'array',
+                                'items' => [
+                                    'description' => 'The data returned.',
+                                    'type' => 'object',
+                                    'properties' => [
+                                        'ProdCode' => ['title' => '', 'description' => 'The code of the product to which the log belongs.', 'type' => 'string', 'example' => 'qcloud_waf'],
+                                        'LogCode' => ['title' => '', 'description' => 'The code of the log.', 'type' => 'string', 'example' => 'cloud_siem_waf_xxxxx'],
+                                        'LogMdsCode' => ['title' => '', 'description' => 'The display code of the log.', 'type' => 'string', 'example' => '${siem.prod. cloud_siem_waf_xxxxx}'],
+                                        'ImportedUserCount' => ['title' => '', 'description' => 'The number of users who have ingested the log.', 'type' => 'integer', 'format' => 'int32', 'example' => '2'],
+                                        'UnImportedUserCount' => ['title' => '', 'description' => 'The number of users who have not ingested the log.', 'type' => 'integer', 'format' => 'int32', 'example' => '3'],
+                                        'TotalUserCount' => ['title' => '', 'description' => 'The total number of users for the log.', 'type' => 'integer', 'format' => 'int32', 'example' => '5'],
+                                        'ModifyTime' => ['title' => '', 'description' => 'The time when the log was last ingested.', 'type' => 'string', 'example' => '2023-11-23 12:30:00'],
+                                        'Imported' => ['title' => '', 'description' => 'Indicates whether the log is ingested. Valid values:'."\n"
+                                            ."\n"
+                                            .'- 1: The log is ingested.'."\n"
+                                            ."\n"
+                                            .'- 0: The log is not ingested.', 'type' => 'integer', 'format' => 'int32', 'example' => '2023-11-23 12:30:00'],
+                                        'AutoImported' => ['title' => '', 'description' => 'Indicates whether logs are automatically ingested for new accounts. Valid values:'."\n"
+                                            ."\n"
+                                            .'- 1: Logs are automatically ingested.'."\n"
+                                            ."\n"
+                                            .'- 0: Logs are not automatically ingested.', 'type' => 'integer', 'format' => 'int32', 'example' => '2023-11-23 12:30:00'],
+                                        'LogType' => ['title' => '日志类型。取值：'."\n"
+                                            .' - 1：中心侧接入。 '."\n"
+                                            .' - 2：预定义日志服务。 '."\n"
+                                            .' -3：自定义日志服务', 'description' => 'The log type. Valid values:'."\n"
+                                            ."\n"
+                                            .'- 1: Ingested on the threat analysis side.'."\n"
+                                            ."\n"
+                                            .'- 2: Predefined Simple Log Service log. -3: Custom Simple Log Service log.', 'type' => 'integer', 'format' => 'int32', 'example' => '2023-11-23 12:30:00'],
+                                        'CloudCode' => [
+                                            'title' => '',
+                                            'description' => 'The multicloud code. Valid values:'."\n"
+                                                ."\n"
+                                                .'- qcloud: Tencent Cloud.'."\n"
+                                                ."\n"
+                                                .'- aliyun: Alibaba Cloud.'."\n"
+                                                ."\n"
+                                                .'- hcloud: Huawei Cloud.',
+                                            'type' => 'string',
+                                            'enum' => ['qcloud', 'hcloud', 'aliyun'],
+                                            'example' => 'hcloud',
+                                        ],
+                                    ],
+                                    'title' => '',
+                                    'example' => '',
+                                ],
+                                'example' => '',
                             ],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'ListImportedLogsByProd',
+            'changeSet' => [
+                ['createdAt' => '2024-08-13T11:50:56.000Z', 'description' => 'Request parameters changed'],
+                ['createdAt' => '2024-04-17T12:47:28.000Z', 'description' => 'Request parameters changed, Response parameters changed'],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": \\"123456\\",\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
-            'title' => 'DeleteAutomateResponseConfig',
-        ],
-        'DescribeAutomateResponseConfigCounter' => [
-            'summary' => 'Queries the number of automated response rules.',
-            'methods' => [
-                'get',
-                'post',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListImportedLogsByProd'],
+                ],
             ],
-            'schemes' => [
-                'https',
-                'http',
+            'ramActions' => [
+                [
+                    'operationType' => 'list',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ListImportedLogsByProd',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"ProdCode\\": \\"qcloud_waf\\",\\n      \\"LogCode\\": \\"cloud_siem_waf_xxxxx\\",\\n      \\"LogMdsCode\\": \\"${siem.prod. cloud_siem_waf_xxxxx}\\",\\n      \\"ImportedUserCount\\": 2,\\n      \\"UnImportedUserCount\\": 3,\\n      \\"TotalUserCount\\": 5,\\n      \\"ModifyTime\\": \\"2023-11-23 12:30:00\\",\\n      \\"Imported\\": 0,\\n      \\"AutoImported\\": 0,\\n      \\"LogType\\": 0,\\n      \\"CloudCode\\": \\"hcloud\\"\\n    }\\n  ],\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+        ],
+        'ListProjectLogStores' => [
+            'summary' => 'Queries projects and Logstores based on the name patterns of the default SLS project and Logstore for an Alibaba Cloud service.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
+            'operationType' => 'read',
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'get',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-            ],
+            'systemTags' => ['operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
-                    'name' => 'RoleType',
+                    'name' => 'SourceProdCode',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The code of the product to query.', 'type' => 'string', 'required' => true, 'example' => 'sas'],
                 ],
                 [
-                    'name' => 'RoleFor',
+                    'name' => 'SourceLogCode',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The code of the log to query.', 'type' => 'string', 'required' => true, 'example' => 'cloud_siem_aegis_proc'],
+                ],
+                [
+                    'name' => 'SubUserId',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account to query.', 'type' => 'integer', 'format' => 'int64', 'required' => true, 'example' => '123XXXXXXXX'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region of the Data Management center for threat analysis. Specify the region based on where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Assets are in regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'BaseResponse<AutomateResponseCounter>',
-                        'description' => 'BaseResponse'."\n",
+                        'title' => 'CloudSiemSuccessResponse<List<ListProjectLogStoreResult>>',
+                        'description' => 'CloudSiemSuccessResponse\\<List>',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'object',
-                                'properties' => [
-                                    'All' => [
-                                        'title' => '总规则数。',
-                                        'description' => 'The total number of rules.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int64',
-                                        'example' => '20',
-                                    ],
-                                    'Online' => [
-                                        'title' => '启动规则数。',
-                                        'description' => 'The number of enabled rules.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int64',
-                                        'example' => '10',
-                                    ],
+                                'title' => '',
+                                'description' => 'The data returned.',
+                                'type' => 'array',
+                                'items' => [
+                                    'description' => 'The data returned.',
+                                    'type' => 'object',
+                                    'properties' => [
+                                        'Project' => ['title' => '', 'description' => 'The name of the SLS project.', 'type' => 'string', 'example' => 'cloud-siem-project'],
+                                        'LogStore' => ['title' => '', 'description' => 'The name of the SLS Logstore.', 'type' => 'string', 'example' => 'cloud-siem-logstore'],
+                                        'EndPoint' => ['title' => '', 'description' => 'The endpoint of the SLS project.', 'type' => 'string', 'example' => 'cn-hangzhou.log.aliyuncs.com'],
+                                        'RegionId' => ['title' => '', 'description' => 'The region where the SLS project resides.', 'type' => 'string', 'example' => 'cn-hangzhou'],
+                                        'LocalName' => ['title' => '', 'description' => 'The name of the region where the SLS project resides.', 'type' => 'string', 'example' => 'hangzhou'],
+                                        'MainUserId' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account that is used to purchase Threat Analysis.', 'type' => 'integer', 'format' => 'int64', 'example' => '123XXXXXXXXX'],
+                                        'SubUserId' => ['title' => '', 'description' => 'The ID of the member account for which threat analysis is performed.', 'type' => 'integer', 'format' => 'int64', 'example' => '123XXXXXXXX'],
+                                        'SubUserName' => ['title' => '', 'description' => 'The name of the member account.', 'type' => 'string', 'example' => 'sas_account_xxxx'],
+                                    ],
+                                    'title' => '',
+                                    'example' => '',
                                 ],
-                                'example' => '123456',
-                            ],
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true：成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
+                                'example' => '',
                             ],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"All\\": 20,\\n    \\"Online\\": 10\\n  },\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
-            'title' => 'DescribeAutomateResponseConfigCounter',
-        ],
-        'DescribeAutomateResponseConfigFeature' => [
-            'summary' => 'Queries the configurable fields and operators of an automated response rule.',
-            'methods' => [
-                'get',
-                'post',
+            'title' => 'ListProjectLogStores',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListProjectLogStores'],
+                ],
             ],
-            'schemes' => [
-                'https',
-                'http',
+            'ramActions' => [
+                [
+                    'operationType' => 'list',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ListProjectLogStores',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"Project\\": \\"cloud-siem-project\\",\\n      \\"LogStore\\": \\"cloud-siem-logstore\\",\\n      \\"EndPoint\\": \\"cn-hangzhou.log.aliyuncs.com\\",\\n      \\"RegionId\\": \\"cn-hangzhou\\",\\n      \\"LocalName\\": \\"hangzhou\\",\\n      \\"MainUserId\\": 0,\\n      \\"SubUserId\\": 0,\\n      \\"SubUserName\\": \\"sas_account_xxxx\\"\\n    }\\n  ],\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+        ],
+        'ListRdUsers' => [
+            'summary' => 'Lists the Alibaba Cloud accounts that are managed by the multi-account control feature of Threat Analysis. An account must be managed to use features such as log collection and event handling.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
+            'operationType' => 'read',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'get',
+                'operationType' => 'list',
                 'riskType' => 'none',
                 'chargeType' => 'free',
+                'abilityTreeCode' => '154081',
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
-                    'name' => 'AutoResponseType',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '自动化响应类型。 取值：'."\n"
-                            .'- event：事件'."\n"
-                            .'- alert：告警',
-                        'description' => 'The type of the automated response rule. Valid values:'."\n"
-                            ."\n"
-                            .'*   event'."\n"
-                            .'*   alert'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'event',
-                    ],
-                ],
-                [
-                    'name' => 'RoleType',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
-                ],
-                [
-                    'name' => 'RoleFor',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
-                ],
-                [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region where the Data Management center of Threat Analysis is located. Select the region of the Management Center based on the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'BaseResponse<List<AutomateResponseConfigFeature>>',
-                        'description' => 'BaseResponse\\<List>'."\n",
+                        'title' => 'CloudSiemSuccessResponse<List<ListRdUsersResult>>',
+                        'description' => 'CloudSiemSuccessResponse\\<List>',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
+                                'title' => '',
+                                'description' => 'The data returned.',
                                 'type' => 'array',
                                 'items' => [
+                                    'description' => 'Data Overview.',
                                     'type' => 'object',
                                     'properties' => [
-                                        'Feature' => [
-                                            'title' => '自动化响应规则条件字段名称。',
-                                            'description' => 'The name of the condition field in the automated response rule.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'alert_desc',
-                                        ],
-                                        'DataType' => [
-                                            'title' => '自动化响应规则条件字段数据类型。',
-                                            'description' => 'The data type of the condition field in the automated response rule.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'varchar',
-                                        ],
-                                        'SupportOperators' => [
-                                            'title' => '该字段支持的操作符列表',
-                                            'description' => 'The operators that are supported for the condition field.'."\n",
-                                            'type' => 'array',
-                                            'items' => [
-                                                'type' => 'object',
-                                                'properties' => [
-                                                    'HasRightValue' => [
-                                                        'title' => '是否需要右值 取值:'."\n"
-                                                            .'- 需要：'."\n"
-                                                            .'- false：不需要。',
-                                                        'description' => 'Indicates whether the right operand is required. Valid values:'."\n"
-                                                            ."\n"
-                                                            .'*   true'."\n"
-                                                            .'*   false'."\n",
-                                                        'type' => 'boolean',
-                                                        'example' => 'false',
-                                                    ],
-                                                    'Operator' => [
-                                                        'title' => '操作符。',
-                                                        'description' => 'The operator.'."\n",
-                                                        'type' => 'string',
-                                                        'example' => '<=',
-                                                    ],
-                                                    'OperatorName' => [
-                                                        'title' => '操作符显示名称。',
-                                                        'description' => 'The name of the operator.'."\n",
-                                                        'type' => 'string',
-                                                        'example' => '<=',
-                                                    ],
-                                                    'OperatorDescCn' => [
-                                                        'title' => '操作符中文描述。',
-                                                        'description' => 'The description of the operator in Chinese.'."\n",
-                                                        'type' => 'string',
-                                                        'example' => 'larger than or equal to',
-                                                    ],
-                                                    'OperatorDescEn' => [
-                                                        'title' => '操作符英文描述。',
-                                                        'description' => 'The description of the operator in English.'."\n",
-                                                        'type' => 'string',
-                                                        'example' => 'larger than or equal to',
-                                                    ],
-                                                    'SupportDataType' => [
-                                                        'title' => '当前操作符可以支持的数据类型 以逗号分隔。',
-                                                        'description' => 'The data types that are supported by the operator. The data types are separated by commas (,).'."\n",
-                                                        'type' => 'string',
-                                                        'example' => 'varchar',
-                                                    ],
-                                                    'SupportTag' => [
-                                                        'title' => '操作符支持场景 多个场景以逗号分隔 如聚合（AGGREGATE）等 默认为空。',
-                                                        'description' => 'The scenarios that are supported by the operator. Multiple scenarios are separated by commas (,), such as aggregation scenarios. By default, this parameter is empty.'."\n",
-                                                        'type' => 'array',
-                                                        'items' => [
-                                                            'description' => 'The supported scenario.'."\n",
-                                                            'type' => 'string',
-                                                            'example' => '[AGGREGATE]',
-                                                        ],
-                                                        'example' => '[AGGREGATE]',
-                                                    ],
-                                                    'Index' => [
-                                                        'title' => '操作符所处操作符列表位置。',
-                                                        'description' => 'The position of the operator in the operator list.'."\n",
-                                                        'type' => 'integer',
-                                                        'format' => 'int32',
-                                                        'example' => '3',
-                                                    ],
-                                                ],
-                                            ],
-                                        ],
-                                        'RightValueEnums' => [
-                                            'title' => '该字段对应的右值枚举值',
-                                            'description' => 'The enumerated values of the right operand for the field.'."\n",
-                                            'type' => 'array',
-                                            'items' => [
-                                                'type' => 'object',
-                                                'properties' => [
-                                                    'Value' => [
-                                                        'title' => '右值枚举值。',
-                                                        'description' => 'The enumerated value of the right operand.'."\n",
-                                                        'type' => 'string',
-                                                        'example' => 'serious',
-                                                    ],
-                                                    'ValueMds' => [
-                                                        'title' => '右值枚举值美杜莎code。',
-                                                        'description' => 'The internal code of the enumerated value.'."\n",
-                                                        'type' => 'string',
-                                                        'example' => 'aliyun.siem.automate.feature.alert_level.serious',
-                                                    ],
-                                                ],
-                                            ],
-                                        ],
-                                    ],
+                                        'Joined' => ['title' => '', 'description' => 'Indicates whether the account is managed by the multi-account control feature of Threat Analysis. Valid values:'."\n"
+                                            ."\n"
+                                            .'- true: The account is managed.'."\n"
+                                            ."\n"
+                                            .'- false: The account is not managed.', 'type' => 'boolean', 'example' => 'true'],
+                                        'JoinedTime' => ['description' => 'The time when the account was added.', 'type' => 'string', 'title' => '', 'example' => '2013-10-01 00:00:00'],
+                                        'DelegatedOrNot' => ['title' => '', 'description' => 'Indicates whether the account is delegated to view its own resources.', 'type' => 'boolean', 'example' => 'true'],
+                                        'MainUserId' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account that purchased Threat Analysis.', 'type' => 'integer', 'format' => 'int64', 'example' => '123XXXXXXXXX'],
+                                        'SubUserId' => ['title' => '', 'description' => 'The ID of the member Alibaba Cloud account.', 'type' => 'integer', 'format' => 'int64', 'example' => '123XXXXXXXX'],
+                                        'SubUserName' => ['title' => '', 'description' => 'The name of the member Alibaba Cloud account.', 'type' => 'string', 'example' => 'sas_account_xxx'],
+                                    ],
+                                    'title' => '',
+                                    'example' => '',
                                 ],
-                                'example' => '123456',
-                            ],
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true：成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
+                                'example' => '',
                             ],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"Feature\\": \\"alert_desc\\",\\n      \\"DataType\\": \\"varchar\\",\\n      \\"SupportOperators\\": [\\n        {\\n          \\"HasRightValue\\": false,\\n          \\"Operator\\": \\"<=\\",\\n          \\"OperatorName\\": \\"<=\\",\\n          \\"OperatorDescCn\\": \\"larger than or equal to\\",\\n          \\"OperatorDescEn\\": \\"larger than or equal to\\",\\n          \\"SupportDataType\\": \\"varchar\\",\\n          \\"SupportTag\\": [\\n            \\"[AGGREGATE]\\"\\n          ],\\n          \\"Index\\": 3\\n        }\\n      ],\\n      \\"RightValueEnums\\": [\\n        {\\n          \\"Value\\": \\"serious\\",\\n          \\"ValueMds\\": \\"aliyun.siem.automate.feature.alert_level.serious\\"\\n        }\\n      ]\\n    }\\n  ],\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
-            'title' => 'DescribeAutomateResponseConfigFeature',
-        ],
-        'ListAutomateResponseConfigs' => [
-            'summary' => 'Queries automated response rules.',
-            'methods' => [
-                'get',
-                'post',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'ListRdUsers',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListRdUsers'],
+                ],
             ],
-            'schemes' => [
-                'http',
-                'https',
+            'ramActions' => [
+                [
+                    'operationType' => 'list',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ListRdUsers',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"Joined\\": true,\\n      \\"JoinedTime\\": \\"2013-10-01 00:00:00\\",\\n      \\"DelegatedOrNot\\": true,\\n      \\"MainUserId\\": 0,\\n      \\"SubUserId\\": 0,\\n      \\"SubUserName\\": \\"sas_account_xxx\\"\\n    }\\n  ],\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+        ],
+        'ModifyBindAccount' => [
+            'summary' => 'Modifies a bound Alibaba Cloud account.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'read',
+            'operationType' => 'write',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'list',
+                'operationType' => 'update',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas104PTS',
-                ],
+                'abilityTreeCode' => '194689',
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
-                    'name' => 'Id',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '自动化响应配置规则ID。',
-                        'description' => 'The ID of the automated response rule.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '123',
-                    ],
-                ],
-                [
-                    'name' => 'SubUserId',
+                    'name' => 'AccessId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '规则创建用户ID。',
-                        'description' => 'The ID of the user who created the rule.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '17108579417****',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The AccessKey ID of the Alibaba Cloud account.', 'type' => 'string', 'required' => false, 'example' => 'ABCXXXXXXXXX'],
                 ],
                 [
-                    'name' => 'PlaybookUuid',
+                    'name' => 'AccountName',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '剧本唯一标识。',
-                        'description' => 'The UUID of the playbook.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'system_aliyun_aegis_kill_quara_book',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The name of the multicloud account.', 'type' => 'string', 'required' => false, 'example' => 'sas_account_xxx'],
                 ],
                 [
-                    'name' => 'RuleName',
+                    'name' => 'BindId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '自动化响应配置规则名称。',
-                        'description' => 'The name of the automated response rule.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cfw kill quara book',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The ID of the binding record. This is the BindId value returned by the ListBindAccount operation.', 'type' => 'integer', 'format' => 'int64', 'required' => true, 'example' => '123'],
                 ],
                 [
-                    'name' => 'AutoResponseType',
+                    'name' => 'AccountId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '自动化响应类型。 取值：'."\n"
-                            .'- event：事件'."\n"
-                            .'- alert：告警',
-                        'description' => 'The type of the automated response rule. Valid values:'."\n"
-                            ."\n"
-                            .'*   event'."\n"
-                            .'*   alert'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'event',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account.', 'type' => 'string', 'required' => true, 'example' => '123xxxxxxx'],
                 ],
                 [
-                    'name' => 'ActionType',
+                    'name' => 'CloudCode',
                     'in' => 'formData',
                     'schema' => [
-                        'title' => '处置动作类型。 取值：'."\n"
-                            .'- doPlaybook：执行剧本'."\n"
-                            .'- changeEventStatus：更改事件状态'."\n"
-                            .'- changeThreatLevel：更改事件威胁等级',
-                        'description' => 'The type of the handling action. Valid values:'."\n"
-                            ."\n"
-                            .'*   doPlaybook: runs a playbook.'."\n"
-                            .'*   changeEventStatus: changes the status of an event.'."\n"
-                            .'*   changeThreatLevel: changes the risk level of an event.'."\n",
+                        'title' => '',
+                        'description' => 'The code of the multicloud service.',
                         'type' => 'string',
-                        'required' => false,
-                        'example' => 'doPlaybook',
-                    ],
-                ],
-                [
-                    'name' => 'Status',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '规则状态。 取值：'."\n"
-                            .'- 0：未启用'."\n"
-                            .'- 100：启用',
-                        'description' => 'The status of the rule. Valid values:'."\n"
-                            ."\n"
-                            .'*   0: disabled'."\n"
-                            .'*   100: enabled'."\n",
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '0',
-                    ],
-                ],
-                [
-                    'name' => 'CurrentPage',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '列表当前页号， 大于等于1。',
-                        'description' => 'The page number. Pages start from page 1.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => true,
-                        'minimum' => '1',
-                        'example' => '1',
-                    ],
-                ],
-                [
-                    'name' => 'PageSize',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '列表每页条数， 最大不超过100。',
-                        'description' => 'The number of entries per page. Maximum value: 100.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int32',
                         'required' => true,
-                        'maximum' => '100',
-                        'minimum' => '1',
-                        'example' => '10',
+                        'enum' => ['qcloud', 'hcloud'],
+                        'example' => 'hcloud',
                     ],
                 ],
                 [
-                    'name' => 'RoleType',
+                    'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region where the Data Management center for threat analysis is located. Select a region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member. An administrator can specify this parameter to switch to the member\'s view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
-                    'name' => 'RegionId',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
-                ],
-                [
-                    'name' => 'ResponseRuleType',
+                    'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'string',
-                    ],
+                    'schema' => ['description' => 'The view type.'."\n"
+                        ."\n"
+                        .'- 0: The view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: The view of all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'PageResponse<List<CloudSiemAutomateResponseConfig>>',
-                        'description' => 'PageResponse\\<List>'."\n",
+                        'title' => 'CloudSiemSuccessResponse<ModifyBindAccountResult>',
+                        'description' => 'CloudSiemSuccessResponse',
                         'type' => 'object',
                         'properties' => [
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true:成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
-                            ],
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
+                                'title' => '',
+                                'description' => 'The return value of the request.',
                                 'type' => 'object',
                                 'properties' => [
-                                    'PageInfo' => [
-                                        'title' => '分页记录。',
-                                        'description' => 'The pagination information.'."\n",
-                                        'type' => 'object',
-                                        'properties' => [
-                                            'CurrentPage' => [
-                                                'title' => '列表当前页号。',
-                                                'description' => 'The current page number.'."\n",
-                                                'type' => 'integer',
-                                                'format' => 'int32',
-                                                'example' => '1',
-                                            ],
-                                            'PageSize' => [
-                                                'title' => '每页返回记录数。',
-                                                'description' => 'The number of entries per page.'."\n",
-                                                'type' => 'integer',
-                                                'format' => 'int32',
-                                                'example' => '10',
-                                            ],
-                                            'TotalCount' => [
-                                                'title' => '记录总数。',
-                                                'description' => 'The total number of entries returned.'."\n",
-                                                'type' => 'integer',
-                                                'format' => 'int64',
-                                                'example' => '100',
-                                            ],
-                                        ],
-                                    ],
-                                    'ResponseData' => [
-                                        'title' => '详细数据。',
-                                        'description' => 'The detailed data.'."\n",
-                                        'type' => 'array',
-                                        'items' => [
-                                            'type' => 'object',
-                                            'properties' => [
-                                                'Id' => [
-                                                    'title' => '自动化响应配置规则ID。',
-                                                    'description' => 'The ID of the automated response rule.'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int64',
-                                                    'example' => '123',
-                                                ],
-                                                'GmtCreate' => [
-                                                    'title' => '创建时间。',
-                                                    'description' => 'The creation time.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '2021-01-06 16:37:29',
-                                                ],
-                                                'GmtModified' => [
-                                                    'title' => '修改时间。',
-                                                    'description' => 'The update time.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '2021-01-06 16:37:29',
-                                                ],
-                                                'Aliuid' => [
-                                                    'title' => '规则关联siem主账号ID。',
-                                                    'description' => 'The ID of the Alibaba Cloud account that is associated with the rule in SIEM.'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int64',
-                                                    'example' => '127608589417****',
-                                                ],
-                                                'SubUserId' => [
-                                                    'title' => '规则创建用户ID。',
-                                                    'description' => 'The ID of the user who created the rule.'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int64',
-                                                    'example' => '17108579417****',
-                                                ],
-                                                'RuleName' => [
-                                                    'title' => '自动化响应配置规则名称。',
-                                                    'description' => 'The name of the automated response rule.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'cfw kill quara book',
-                                                ],
-                                                'AutoResponseType' => [
-                                                    'title' => '自动化响应类型。 取值：'."\n"
-                                                        .'- event：事件'."\n"
-                                                        .'- alert：告警',
-                                                    'description' => 'The type of the automated response rule. Valid values:'."\n"
-                                                        ."\n"
-                                                        .'*   **event**'."\n"
-                                                        .'*   **alert**'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'event',
-                                                ],
-                                                'ExecutionCondition' => [
-                                                    'title' => '自动化响应规则触发条件 json格式。',
-                                                    'description' => 'The trigger condition of the automated response rule. The value is in the JSON format.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '[{"left":{"value":"alert_name"},"operator":"containsString","right":{"value":"webshell_online"}}]',
-                                                ],
-                                                'ActionType' => [
-                                                    'title' => '处置动作类型 多个值以逗号分隔。 取值：'."\n"
-                                                        .'- doPlaybook：执行剧本'."\n"
-                                                        .'- changeEventStatus：更改事件状态'."\n"
-                                                        .'- changeThreatLevel：更改事件威胁等级',
-                                                    'description' => 'The type of the handling action. Multiple types are separated by commas (,). Valid values:'."\n"
-                                                        ."\n"
-                                                        .'*   **doPlaybook**: runs the playbook.'."\n"
-                                                        .'*   **changeEventStatus**: changes the event status.'."\n"
-                                                        .'*   **changeThreatLevel**: changes the risk level of the event.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'doPlaybook,changeEventStatus',
-                                                ],
-                                                'ActionConfig' => [
-                                                    'title' => '自动化响应规则动作配置 json数组格式。',
-                                                    'description' => 'The configuration of the action that is performed after the automated response rule is hit. The value is in the JSON format.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '['."\n"
-                                                        .'      {'."\n"
-                                                        .'            "actionType": "doPlaybook",'."\n"
-                                                        .'            "playbookName": "WafBlockIP",'."\n"
-                                                        .'            "playbookUuid": "bdad6220-6584-41b2-9704-fc6584568758"'."\n"
-                                                        .'      }'."\n"
-                                                        .']',
-                                                ],
-                                                'Status' => [
-                                                    'title' => '规则状态。 取值：'."\n"
-                                                        .'- 0：未启用'."\n"
-                                                        .'- 100：启用',
-                                                    'description' => 'The status of the rule. Valid values:'."\n"
-                                                        ."\n"
-                                                        .'*   **0**: disabled.'."\n"
-                                                        .'*   **100**: enabled.'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int32',
-                                                    'example' => '0',
-                                                ],
-                                                'DataType' => [
-                                                    'description' => 'The type of the view. Valid values:'."\n"
-                                                        ."\n"
-                                                        .'0: the current Alibaba Cloud account'."\n"
-                                                        .'1: the global account',
-                                                    'type' => 'integer',
-                                                    'format' => 'int32',
-                                                    'example' => '1',
-                                                ],
-                                                'ResponseRuleType' => [
-                                                    'type' => 'string',
-                                                ],
-                                            ],
-                                        ],
-                                    ],
+                                    'Count' => ['title' => '', 'description' => 'The number of account bindings that are modified. A value of 1 indicates that the operation is successful. A value of 0 or less indicates that the operation failed.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'],
                                 ],
-                                'example' => '123456',
+                                'example' => '',
                             ],
+                            'RequestId' => ['title' => '', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'title' => 'ModifyBindAccount',
+            'changeSet' => [
+                ['createdAt' => '2024-07-18T01:29:01.000Z', 'description' => 'Request parameters changed'],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n  \\"Data\\": {\\n    \\"PageInfo\\": {\\n      \\"CurrentPage\\": 1,\\n      \\"PageSize\\": 10,\\n      \\"TotalCount\\": 100\\n    },\\n    \\"ResponseData\\": [\\n      {\\n        \\"Id\\": 123,\\n        \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n        \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n        \\"Aliuid\\": 0,\\n        \\"SubUserId\\": 0,\\n        \\"RuleName\\": \\"cfw kill quara book\\",\\n        \\"AutoResponseType\\": \\"event\\",\\n        \\"ExecutionCondition\\": \\"[{\\\\\\"left\\\\\\":{\\\\\\"value\\\\\\":\\\\\\"alert_name\\\\\\"},\\\\\\"operator\\\\\\":\\\\\\"containsString\\\\\\",\\\\\\"right\\\\\\":{\\\\\\"value\\\\\\":\\\\\\"webshell_online\\\\\\"}}]\\",\\n        \\"ActionType\\": \\"doPlaybook,changeEventStatus\\",\\n        \\"ActionConfig\\": \\"[\\\\n      {\\\\n            \\\\\\"actionType\\\\\\": \\\\\\"doPlaybook\\\\\\",\\\\n            \\\\\\"playbookName\\\\\\": \\\\\\"WafBlockIP\\\\\\",\\\\n            \\\\\\"playbookUuid\\\\\\": \\\\\\"bdad6220-6584-41b2-9704-fc6584568758\\\\\\"\\\\n      }\\\\n]\\",\\n        \\"Status\\": 0,\\n        \\"DataType\\": 0,\\n        \\"ResponseRuleType\\": \\"custom\\"\\n      }\\n    ]\\n  }\\n}","type":"json"}]',
-            'title' => 'ListAutomateResponseConfigs',
-        ],
-        'PostAutomateResponseConfig' => [
-            'summary' => 'Creates or updates an automatic response rule.',
-            'methods' => [
-                'get',
-                'post',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ModifyBindAccount'],
+                ],
             ],
-            'schemes' => [
-                'https',
-                'http',
+            'ramActions' => [
+                [
+                    'operationType' => 'update',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ModifyBindAccount',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"Count\\": 1\\n  },\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+        ],
+        'ModifyDataSource' => [
+            'summary' => 'Modifies the description of an existing data source.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
+            'operationType' => 'write',
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'create',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-            ],
+            'systemTags' => ['operationType' => 'update', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
-                    'name' => 'Id',
+                    'name' => 'AccountId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '自动化响应配置规则ID。',
-                        'description' => 'The rule ID.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '123',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account.', 'type' => 'string', 'required' => false, 'example' => '123xxxxxx'],
                 ],
                 [
-                    'name' => 'SubUserId',
+                    'name' => 'DataSourceType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '规则创建用户ID。',
-                        'description' => 'The ID of the user who created the rule.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '17108579417****',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The type of the data source. Valid values:'."\n"
+                        ."\n"
+                        .'- ckafka: Tencent Cloud CKafka.'."\n"
+                        ."\n"
+                        .'- obs: Huawei Cloud Object Storage Service (OBS).'."\n"
+                        ."\n"
+                        .'- wafApi: the API used to download attack logs from Tencent Cloud Web Application Firewall (WAF).', 'type' => 'string', 'required' => true, 'example' => 'obs'],
                 ],
                 [
-                    'name' => 'RuleName',
+                    'name' => 'DataSourceInstanceId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '自动化响应配置规则名称。',
-                        'description' => 'The rule name.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cfw kill quara book',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The ID of the data source. The ID is an MD5 hash that is calculated based on the values of other parameters. You can call the [DescribeDataSourceInstance](https://api.aliyun-inc.com/#/publishment/document/cloud-siem/863fdf54478f4cc5877e27c2a5fe9e44?tenantUuid=f382fccd88b94c5c8c864def6815b854\\&activeTabKey=api%7CDescribeDataSourceInstance) operation to obtain the data source ID.', 'type' => 'string', 'required' => true, 'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea'],
                 ],
                 [
-                    'name' => 'AutoResponseType',
+                    'name' => 'DataSourceInstanceName',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '自动化响应类型。 取值：'."\n"
-                            .'- event：事件'."\n"
-                            .'- alert：告警',
-                        'description' => 'The type of the automated response rule. Valid values:'."\n"
-                            ."\n"
-                            .'*   **event**'."\n"
-                            .'*   **alert**'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'event',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The name of the data source.', 'type' => 'string', 'required' => false, 'example' => 'beijing_waf_kafka'],
                 ],
                 [
-                    'name' => 'ExecutionCondition',
+                    'name' => 'DataSourceInstanceRemark',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '自动化响应规则触发条件 json格式。',
-                        'description' => 'The trigger condition of the automated response rule. The value is in the JSON format.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '[{"left":{"value":"alert_name"},"operator":"containsString","right":{"value":"webshell_online"}}]',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The description of the data source.', 'type' => 'string', 'required' => false, 'example' => 'waf_alert_log'],
                 ],
                 [
-                    'name' => 'ActionType',
+                    'name' => 'DataSourceInstanceParams',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '处置动作类型 多个值以逗号分隔。 取值：'."\n"
-                            .'- doPlaybook：执行剧本'."\n"
-                            .'- changeEventStatus：更改事件状态'."\n"
-                            .'- changeThreatLevel：更改事件威胁等级',
-                        'description' => 'The type of the handling action. Multiple types are separated by commas (,). Valid values:'."\n"
-                            ."\n"
-                            .'*   **doPlaybook**: runs the playbook.'."\n"
-                            .'*   **changeEventStatus**: changes the event status.'."\n"
-                            .'*   **changeThreatLevel**: changes the threat level of the event.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'doPlaybook,changeEventStatus',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The parameters of the data source, in a JSON array format.', 'type' => 'string', 'required' => false, 'example' => '[{"paraCode":"region_code","paraValue":"ap-guangzhou"}]'],
                 ],
                 [
-                    'name' => 'ActionConfig',
+                    'name' => 'CloudCode',
                     'in' => 'formData',
                     'schema' => [
-                        'title' => '自动化响应规则动作配置 json数组格式。',
-                        'description' => 'The action configuration of the automated response rule. The value is in the JSON format.'."\n",
+                        'title' => '',
+                        'description' => 'The code of the cloud service provider. Valid values:'."\n"
+                            ."\n"
+                            .'- qcloud: Tencent Cloud.'."\n"
+                            ."\n"
+                            .'- aliyun: Alibaba Cloud.'."\n"
+                            ."\n"
+                            .'- hcloud: Huawei Cloud.',
                         'type' => 'string',
-                        'required' => false,
-                        'example' => '['."\n"
-                            .'      {'."\n"
-                            .'            "actionType": "doPlaybook",'."\n"
-                            .'            "playbookName": "WafBlockIP",'."\n"
-                            .'            "playbookUuid": "bdad6220-6584-41b2-9704-fc6584568758"'."\n"
-                            .'      }'."\n"
-                            .']',
-                    ],
-                ],
-                [
-                    'name' => 'RoleType',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
-                ],
-                [
-                    'name' => 'RoleFor',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
+                        'required' => true,
+                        'enum' => ['qcloud', 'hcloud', 'aliyun'],
+                        'example' => 'hcloud',
                     ],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The data management center of the threat analysis feature. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   **cn-hangzhou**: Your assets reside in regions in China.'."\n"
-                            .'*   **ap-southeast-1**: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region where the Data Management center of the threat analysis feature is located. Select a region based on the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'BaseResponse<String>',
-                        'description' => 'BaseResponse'."\n",
+                        'title' => 'CloudSiemSuccessResponse<ModifyDataSourceResult>',
+                        'description' => 'CloudSiemSuccessResponse',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'string',
-                                'example' => '123456',
-                            ],
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true：成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   **true**'."\n"
-                                    .'*   **false**'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code that is returned.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
+                                'title' => '',
+                                'description' => 'The data returned.',
+                                'type' => 'object',
+                                'properties' => [
+                                    'Count' => ['title' => '', 'description' => 'The number of modified data sources. A value of 1 indicates success. A value of 0 or less indicates failure.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'],
+                                    'DataSourceInstanceId' => ['title' => '', 'description' => 'The ID of the data source. The ID is an MD5 hash that is calculated based on the values of other parameters.', 'type' => 'string', 'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea'],
+                                ],
+                                'example' => '',
                             ],
+                            'RequestId' => ['title' => '', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": \\"123456\\",\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
-            'title' => 'PostAutomateResponseConfig',
-        ],
-        'UpdateAutomateResponseConfigStatus' => [
-            'summary' => 'Updates the status of an automatic response rule.',
-            'methods' => [
-                'get',
-                'post',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'ModifyDataSource',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ModifyDataSource'],
+                ],
             ],
-            'schemes' => [
-                'https',
-                'http',
+            'ramActions' => [
+                [
+                    'operationType' => 'update',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ModifyDataSource',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"Count\\": 1,\\n    \\"DataSourceInstanceId\\": \\"220ba97c9d1fdb0b9c7e8c7ca328d7ea\\"\\n  },\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+        ],
+        'ModifyDataSourceLog' => [
+            'summary' => 'Modifies the description of a data source log.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
+            'operationType' => 'write',
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'update',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-            ],
+            'systemTags' => ['operationType' => 'update', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
-                    'name' => 'Ids',
+                    'name' => 'LogCode',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '自动响应规则id列表，json数组。',
-                        'description' => 'The IDs of the automatic response rules. The value is a JSON array.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '[123,345]',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The code of the log.', 'type' => 'string', 'required' => false, 'example' => 'cloud_siem_waf_xxxxx'],
                 ],
                 [
-                    'name' => 'InUse',
+                    'name' => 'AccountId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '规则开启状态。 取值：'."\n"
-                            .'- true：开启'."\n"
-                            .'- false：关闭',
-                        'description' => 'Specifies whether the rule is enabled. Valid values:'."\n"
-                            ."\n"
-                            .'*   true'."\n"
-                            .'*   false'."\n",
-                        'type' => 'boolean',
-                        'required' => false,
-                        'example' => 'true',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account.', 'type' => 'string', 'required' => false, 'example' => '123xxxxxxx'],
                 ],
                 [
-                    'name' => 'RoleType',
+                    'name' => 'DataSourceType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The type of the data source. Valid values:'."\n"
+                        ."\n"
+                        .'- obs: Huawei Cloud Object Storage Service (OBS).'."\n"
+                        ."\n"
+                        .'- wafApi: Tencent Cloud Web Application Firewall (WAF) download API.'."\n"
+                        ."\n"
+                        .'- ckafka: Tencent Cloud CKafka.', 'type' => 'string', 'required' => false, 'example' => 'obs'],
                 ],
                 [
-                    'name' => 'RoleFor',
+                    'name' => 'DataSourceInstanceId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The ID of the data source. The threat analysis feature generates this ID by calculating an MD5 hash of the parameters.'."\n"
+                        .'Call the [DescribeDataSourceInstance](~~2639736~~) operation to obtain the data source ID.', 'type' => 'string', 'required' => true, 'example' => 'ef33097c9d1fdb0b9c7e8c7ca320pkl1'],
                 ],
                 [
-                    'name' => 'RegionId',
+                    'name' => 'DataSourceInstanceLogs',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The details of the data source parameters, in a JSON array format.', 'type' => 'string', 'required' => true, 'example' => '[{"LogCode":"cloud_siem_qcloud_waf_alert_log","LogParas":"[{\\"ParaCode\\":\\"api_name\\",\\"ParaValue\\":\\"GetAttackDownloadRecords\\"}]"}]'],
+                ],
+                [
+                    'name' => 'LogInstanceId',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The ID of the log. The threat analysis feature generates this ID by calculating an MD5 hash of the parameters. Call the [ListDataSourceLogs](~~2639707~~) operation to obtain the log ID.', 'type' => 'string', 'required' => true, 'example' => 'ef33097c9d1fdb0b9c7e8c7ca320pkl1'],
+                ],
+                [
+                    'name' => 'CloudCode',
                     'in' => 'formData',
                     'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The data management center of the threat analysis feature. Specify this parameter based on the region in which your assets reside. Valid values:'."\n"
+                        'title' => '',
+                        'description' => 'The code for the multicloud environment. Valid values:'."\n"
+                            ."\n"
+                            .'- qcloud: Tencent Cloud.'."\n"
                             ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions inside China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
+                            .'- aliyun: Alibaba Cloud.'."\n"
+                            ."\n"
+                            .'- hcloud: Huawei Cloud.',
                         'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
+                        'required' => true,
+                        'enum' => ['qcloud', 'hcloud', 'aliyun'],
+                        'example' => 'hcloud',
                     ],
                 ],
+                [
+                    'name' => 'RegionId',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The region where the Data Management hub is located. Select a region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
+                ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'BaseResponse<String>',
-                        'description' => 'BaseResponse'."\n",
+                        'title' => 'CloudSiemSuccessResponse<ModifyDataSourceLogResult>',
+                        'description' => 'CloudSiemSuccessResponse',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'string',
-                                'example' => '123456',
-                            ],
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true：成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code that is returned.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
+                                'title' => '',
+                                'description' => 'The data returned.',
+                                'type' => 'object',
+                                'properties' => [
+                                    'Count' => ['title' => '', 'description' => 'The number of modified logs. A value of 1 indicates success. A value of 0 or less indicates failure.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'],
+                                    'LogInstanceId' => ['title' => '', 'description' => 'The ID of the log. The threat analysis feature generates this ID by calculating an MD5 hash of the parameters.', 'type' => 'string', 'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea'],
+                                ],
+                                'example' => '',
                             ],
+                            'RequestId' => ['title' => '', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": \\"123456\\",\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
-            'title' => 'UpdateAutomateResponseConfigStatus',
-        ],
-        'ListDisposeStrategy' => [
-            'summary' => 'Queries handling policies.',
-            'methods' => [
-                'get',
-                'post',
+            'title' => 'ModifyDataSourceLog',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ModifyDataSourceLog'],
+                ],
             ],
-            'schemes' => [
-                'http',
-                'https',
+            'ramActions' => [
+                [
+                    'operationType' => 'update',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ModifyDataSourceLog',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"Count\\": 1,\\n    \\"LogInstanceId\\": \\"220ba97c9d1fdb0b9c7e8c7ca328d7ea\\"\\n  },\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+        ],
+        'OpenDelivery' => [
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'read',
+            'operationType' => 'write',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'list',
+                'operationType' => 'create',
                 'riskType' => 'none',
-                'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsasAFG0OH',
-                ],
+                'chargeType' => 'paid',
+                'abilityTreeCode' => '154876',
+                'abilityTreeNodes' => ['FEATUREsasRXJ9SY'],
             ],
             'parameters' => [
                 [
-                    'name' => 'SophonTaskId',
+                    'name' => 'ProductCode',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '处置策略ID。',
-                        'description' => 'The ID of the SOAR handling policy.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'a50a49b7-6044-4593-ab15-2b46567caadd',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The code of the cloud service. Valid values:'."\n"
+                        ."\n"
+                        .'- qcloud\\_waf'."\n"
+                        ."\n"
+                        .'- qcloud\\_cfw'."\n"
+                        ."\n"
+                        .'- hcloud\\_waf'."\n"
+                        ."\n"
+                        .'- hcloud\\_cfw'."\n"
+                        ."\n"
+                        .'- ddos'."\n"
+                        ."\n"
+                        .'- sas'."\n"
+                        ."\n"
+                        .'- cfw'."\n"
+                        ."\n"
+                        .'- config'."\n"
+                        ."\n"
+                        .'- csk'."\n"
+                        ."\n"
+                        .'- fc'."\n"
+                        ."\n"
+                        .'- rds'."\n"
+                        ."\n"
+                        .'- nas'."\n"
+                        ."\n"
+                        .'- apigateway'."\n"
+                        ."\n"
+                        .'- cdn'."\n"
+                        ."\n"
+                        .'- mongodb'."\n"
+                        ."\n"
+                        .'- eip'."\n"
+                        ."\n"
+                        .'- slb'."\n"
+                        ."\n"
+                        .'- vpc'."\n"
+                        ."\n"
+                        .'- actiontrail'."\n"
+                        ."\n"
+                        .'- waf'."\n"
+                        ."\n"
+                        .'- bastionhost'."\n"
+                        ."\n"
+                        .'- oss'."\n"
+                        ."\n"
+                        .'- polardb', 'type' => 'string', 'required' => true, 'example' => 'cfw'],
                 ],
                 [
-                    'name' => 'EntityIdentity',
+                    'name' => 'LogCode',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '实体特征值，可以对处置实体进行模糊搜索。',
-                        'description' => 'The feature value of the entity. Fuzzy match is supported.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'test22.php',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The code for a specific log of the cloud service, such as the process log of Security Center. This parameter is optional. If you do not specify this parameter, the operation applies to all logs of the service.', 'type' => 'string', 'required' => false, 'example' => 'cloud_siem_cfw_flow'],
                 ],
                 [
-                    'name' => 'EntityType',
+                    'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '剧本支持的实体类型。取值：'."\n"
-                            .'- ip:ip'."\n"
-                            .'- process：进程'."\n"
-                            .'- file：文件',
-                        'description' => 'The entity type of the playbook. Valid values:'."\n"
-                            ."\n"
-                            .'*   ip'."\n"
-                            .'*   process'."\n"
-                            .'*   file'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'ip',
-                    ],
+                    'schema' => ['description' => 'The type of the view. Valid values:'."\n"
+                        ."\n"
+                        .'- 0: The view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: The view of all accounts within the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
-                    'name' => 'PlaybookName',
+                    'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '剧本唯一标识名称。',
-                        'description' => 'The name of the playbook, which is the unique identifier of the playbook.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'WafBlockIP',
-                    ],
+                    'schema' => ['description' => 'The ID of the member account that the administrator wants to access.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
-                    'name' => 'PlaybookUuid',
+                    'name' => 'RegionId',
                     'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The region where the Data Management center of threat analysis is located. Select a region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Select this value if your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Select this value if your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
+                ],
+            ],
+            'responses' => [
+                200 => [
                     'schema' => [
-                        'title' => '剧本UUID。',
-                        'description' => 'The UUID of the playbook.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'system_aliyun_clb_process_book',
+                        'title' => 'CloudSiemResponse<Boolean>',
+                        'description' => 'CloudSiemResponse',
+                        'type' => 'object',
+                        'properties' => [
+                            'Data' => ['title' => '', 'description' => 'Indicates whether log delivery is enabled. Valid values:'."\n"
+                                ."\n"
+                                .'- true: Enabled'."\n"
+                                ."\n"
+                                .'- false: Failed', 'type' => 'boolean', 'example' => 'true'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '15FD134E-D69B-51E8-B052-73F97BD8****'],
+                        ],
+                        'example' => '',
                     ],
                 ],
+            ],
+            'errorCodes' => [
+                400 => [
+                    ['errorCode' => 'Siem.Delivery.MissingProductCode', 'errorMessage' => 'ProductCode is mandatory for this action.', 'description' => ''],
+                ],
+                500 => [
+                    ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''],
+                    ['errorCode' => 'Siem.Delivery.ErrorMapping', 'errorMessage' => 'The Mapping between productCode and logCode is error.', 'description' => ''],
+                    ['errorCode' => 'Siem.Delivery.ErrorProductCode', 'errorMessage' => 'ProductCode is error for this action.', 'description' => ''],
+                    ['errorCode' => 'SLS.Ship.Error', 'errorMessage' => 'The Simple Log Service about data shipping is unavailable.', 'description' => ''],
+                ],
+            ],
+            'title' => 'OpenDelivery',
+            'summary' => 'Enables log delivery for integrated cloud services.',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:44:02.000Z', 'description' => 'Request parameters changed'],
+                ['createdAt' => '2023-12-13T09:49:23.000Z', 'description' => 'Error codes changed, Request parameters changed, Response parameters changed'],
+            ],
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'OpenDelivery'],
+                ],
+            ],
+            'ramActions' => [
                 [
-                    'name' => 'PlaybookTypes',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '剧本类型。 取值：'."\n"
-                            .'- system:手动处置'."\n"
-                            .'- custom：事件触发剧本'."\n"
-                            .'- custom_alert：告警触发剧本'."\n"
-                            .'- soar-manual：手动运行剧本'."\n"
-                            .'- soar-mdr：MDR运行剧本',
-                        'description' => 'The type of the playbook. Valid values:'."\n"
-                            ."\n"
-                            .'*   system: user-triggered playbook'."\n"
-                            .'*   custom: event-triggered playbook'."\n"
-                            .'*   custom_alert: alert-triggered playbook'."\n"
-                            .'*   soar-manual: user-run playbook'."\n"
-                            .'*   soar-mdr: MDR-run playbook'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'system',
+                    'operationType' => 'create',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:OpenDelivery',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
                     ],
                 ],
+            ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": true,\\n  \\"RequestId\\": \\"15FD134E-D69B-51E8-B052-73F97BD8****\\"\\n}","type":"json"}]',
+        ],
+        'PostAutomateResponseConfig' => [
+            'summary' => 'Adds or updates an automated response rule.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['https', 'http'],
+            'security' => [
                 [
-                    'name' => 'EffectiveStatus',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '策略状态。 取值：'."\n"
-                            .'- 0：失效'."\n"
-                            .'- 1：有效',
-                        'description' => 'The status of the policy. Valid values:'."\n"
-                            ."\n"
-                            .'*   0: invalid'."\n"
-                            .'*   1: valid'."\n",
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '0',
-                    ],
+                    'AK' => [],
                 ],
+            ],
+            'deprecated' => false,
+            'systemTags' => ['operationType' => 'create', 'riskType' => 'none', 'chargeType' => 'free'],
+            'parameters' => [
                 [
-                    'name' => 'OrderField',
+                    'name' => 'Id',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '排序字段。 取值：'."\n"
-                            .'- GmtModified：按更新时间排序'."\n"
-                            .'- GmtCreate：按创建时间排序'."\n"
-                            .'- FinishTime：按策略结束时间排序',
-                        'description' => 'The sort field. Valid values:'."\n"
-                            ."\n"
-                            .'*   GmtModified: sorts the policies by update time.'."\n"
-                            .'*   GmtCreate: sorts the policies by creation time.'."\n"
-                            .'*   FinishTime: sorts the policies by end time.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'GmtModified',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The ID of the automated response rule.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '123'],
                 ],
                 [
-                    'name' => 'Order',
+                    'name' => 'SubUserId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '排序方向。 取值：'."\n"
-                            .'- desc：降序排列'."\n"
-                            .'- asc：升序排列',
-                        'description' => 'The sort order. Valid values:'."\n"
-                            ."\n"
-                            .'*   desc: descending order.'."\n"
-                            .'*   asc: ascending order.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'desc',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The ID of the user who created the rule.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '17108579417****'],
                 ],
                 [
-                    'name' => 'StartTime',
+                    'name' => 'RuleName',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '查询开始时间, 单位毫秒。',
-                        'description' => 'The beginning of the time range to query. Unit: milliseconds.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => true,
-                        'example' => '1577808000000',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The name of the automated response rule.', 'type' => 'string', 'required' => false, 'example' => 'cfw kill quara book'],
                 ],
                 [
-                    'name' => 'EndTime',
+                    'name' => 'AutoResponseType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '查询结束时间, 单位毫秒。',
-                        'description' => 'The end of the time range to query. Unit: milliseconds.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => true,
-                        'example' => '1577808000000',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The type of the automated response. Valid values:'."\n"
+                        ."\n"
+                        .'- **event**: event'."\n"
+                        ."\n"
+                        .'- **alert**: alert', 'type' => 'string', 'required' => false, 'example' => 'event'],
                 ],
                 [
-                    'name' => 'Status',
+                    'name' => 'ExecutionCondition',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'integer',
-                        'format' => 'int32',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The trigger condition of the automated response rule. The value is in the JSON format.', 'type' => 'string', 'required' => false, 'example' => '[{"left":{"value":"alert_name"},"operator":"containsString","right":{"value":"webshell_online"}}]'],
                 ],
                 [
-                    'name' => 'CurrentPage',
+                    'name' => 'ActionType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '列表当前页号， 大于等于1。',
-                        'description' => 'The page number. Pages start from page 1.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => true,
-                        'minimum' => '1',
-                        'example' => '1',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The type of the action. Separate multiple values with commas. Valid values:'."\n"
+                        ."\n"
+                        .'- **doPlaybook**: runs a playbook'."\n"
+                        ."\n"
+                        .'- **changeEventStatus**: changes the status of the event'."\n"
+                        ."\n"
+                        .'- **changeThreatLevel**: changes the threat level of the event', 'type' => 'string', 'required' => false, 'example' => 'doPlaybook,changeEventStatus'],
                 ],
                 [
-                    'name' => 'PageSize',
+                    'name' => 'ActionConfig',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '列表每页条数， 最大不超过100。',
-                        'description' => 'The number of entries per page. Maximum value: 100.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => true,
-                        'maximum' => '100',
-                        'minimum' => '1',
-                        'example' => '10',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The configuration of the action that is specified in the automated response rule. The value is a JSON array.', 'type' => 'string', 'required' => false, 'example' => '['."\n"
+                        .'      {'."\n"
+                        .'            "actionType": "doPlaybook",'."\n"
+                        .'            "playbookName": "WafBlockIP",'."\n"
+                        .'            "playbookUuid": "bdad6220-6584-41b2-9704-fc6584568758"'."\n"
+                        .'      }'."\n"
+                        .']'],
                 ],
                 [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                        'title' => '0，单账号登录；1，全局视图；2，切换视图；3，局部视图',
-                    ],
+                    'schema' => ['description' => 'The view type.'."\n"
+                        ."\n"
+                        .'- 0: the view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: the view of all accounts that are managed by the administrator.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The ID of the user that the administrator uses to switch the view. This parameter is used when an administrator switches to the perspective of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
-                ],
-                [
-                    'name' => 'IncidentUuid',
-                    'in' => 'formData',
-                    'schema' => [
-                        'type' => 'string',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region where the Data Management center of Threat Analysis is located. Select a region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- **cn-hangzhou**: your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- **ap-southeast-1**: your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'PageResponse<List<DisposeStrategy>>',
-                        'description' => 'PageResponse\\<List>'."\n",
+                        'title' => 'BaseResponse<String>',
+                        'description' => 'BaseResponse',
                         'type' => 'object',
                         'properties' => [
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true:成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
-                            ],
-                            'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'object',
-                                'properties' => [
-                                    'PageInfo' => [
-                                        'title' => '分页记录。',
-                                        'description' => 'The pagination information.'."\n",
-                                        'type' => 'object',
-                                        'properties' => [
-                                            'CurrentPage' => [
-                                                'title' => '列表当前页号。',
-                                                'description' => 'The current page number.'."\n",
-                                                'type' => 'integer',
-                                                'format' => 'int32',
-                                                'example' => '1',
-                                            ],
-                                            'PageSize' => [
-                                                'title' => '每页返回记录数。',
-                                                'description' => 'The number of entries per page.'."\n",
-                                                'type' => 'integer',
-                                                'format' => 'int32',
-                                                'example' => '10',
-                                            ],
-                                            'TotalCount' => [
-                                                'title' => '记录总数。',
-                                                'description' => 'The total number of entries returned.'."\n",
-                                                'type' => 'integer',
-                                                'format' => 'int64',
-                                                'example' => '100',
-                                            ],
-                                        ],
-                                    ],
-                                    'ResponseData' => [
-                                        'title' => '详细数据。',
-                                        'description' => 'The detailed data.'."\n",
-                                        'type' => 'array',
-                                        'items' => [
-                                            'type' => 'object',
-                                            'properties' => [
-                                                'Id' => [
-                                                    'title' => '策略ID。',
-                                                    'description' => 'The ID of the policy.'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int64',
-                                                    'example' => '123',
-                                                ],
-                                                'GmtCreate' => [
-                                                    'title' => '创建时间。',
-                                                    'description' => 'The creation time.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '2021-01-06 16:37:29',
-                                                ],
-                                                'GmtModified' => [
-                                                    'title' => '修改时间。',
-                                                    'description' => 'The update time.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '2021-01-06 16:37:29',
-                                                ],
-                                                'Aliuid' => [
-                                                    'title' => '策略关联siem主账号ID。',
-                                                    'description' => 'The ID of the Alibaba Cloud account that is associated with the policy in SIEM.'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int64',
-                                                    'example' => '127608589417****',
-                                                ],
-                                                'SubAliuid' => [
-                                                    'title' => '配置策略阿里账号ID。',
-                                                    'description' => 'The ID of the Alibaba account that is used to configure the policy.'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int64',
-                                                    'example' => '176555323***',
-                                                ],
-                                                'IncidentName' => [
-                                                    'title' => '事件名称。',
-                                                    'description' => 'The name of the event.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc',
-                                                ],
-                                                'Scope' => [
-                                                    'title' => '处置作用域。',
-                                                    'description' => 'The scope of the policy.'."\n",
-                                                    'type' => 'array',
-                                                    'items' => [
-                                                        'description' => 'The scope of the policy.'."\n",
-                                                        'type' => 'any',
-                                                        'example' => '[{ aliUid: 1766185894104675 }]',
-                                                    ],
-                                                    'example' => '[{ aliUid: 1766185894104675 }]',
-                                                ],
-                                                'IncidentUuid' => [
-                                                    'title' => '事件全局唯一ID。',
-                                                    'description' => 'The UUID of the event.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '85ea4241-798f-4684-a876-65d4f0c3****',
-                                                ],
-                                                'AlertUuid' => [
-                                                    'title' => '告警ID。',
-                                                    'description' => 'The UUID of the alert.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'sas_71e24437d2797ce8fc59692905a4****',
-                                                ],
-                                                'SophonTaskId' => [
-                                                    'title' => 'soar处置策略ID。',
-                                                    'description' => 'The ID of the SOAR handling policy.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '577bbf90-a770-44a7-8154-586aa2d318fa',
-                                                ],
-                                                'PlaybookName' => [
-                                                    'title' => '剧本唯一标识名称。',
-                                                    'description' => 'The name of the playbook, which is the unique identifier of the playbook.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'WafBlockIP',
-                                                ],
-                                                'PlaybookUuid' => [
-                                                    'title' => '剧本UUID。',
-                                                    'description' => 'The UUID of the playbook.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'system_aliyun_clb_process_book',
-                                                ],
-                                                'PlaybookType' => [
-                                                    'title' => '剧本类型。 取值：'."\n"
-                                                        .'- system:手动处置'."\n"
-                                                        .'- custom：事件触发剧本'."\n"
-                                                        .'- custom_alert：告警触发剧本'."\n"
-                                                        .'- soar-manual：手动运行剧本'."\n"
-                                                        .'- soar-mdr：MDR运行剧本',
-                                                    'description' => 'The type of the playbook. Valid values:'."\n"
-                                                        ."\n"
-                                                        .'*   system: user-triggered playbook'."\n"
-                                                        .'*   custom: event-triggered playbook'."\n"
-                                                        .'*   custom_alert: alert-triggered playbook'."\n"
-                                                        .'*   soar-manual: user-run playbook'."\n"
-                                                        .'*   soar-mdr: MDR-run playbook'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'system',
-                                                ],
-                                                'TaskUrl' => [
-                                                    'title' => '剧本url',
-                                                    'type' => 'string',
-                                                ],
-                                                'EntityId' => [
-                                                    'title' => '实体ID。',
-                                                    'description' => 'The ID of the entity.'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int64',
-                                                    'example' => '123456789',
-                                                ],
-                                                'Entity' => [
-                                                    'title' => '实体详情, json数组格式。',
-                                                    'description' => 'The details of the entity. The value is a JSON array.'."\n",
-                                                    'type' => 'array',
-                                                    'items' => [
-                                                        'description' => 'The item. The value is a JSON string.'."\n",
-                                                        'type' => 'any',
-                                                        'example' => '[{"ip":"1.1.1.1"}]',
-                                                    ],
-                                                    'example' => '[{"ip":"1.1.1.1"}]',
-                                                ],
-                                                'EntityType' => [
-                                                    'title' => '实体类型。取值：'."\n"
-                                                        .'- ip:ip'."\n"
-                                                        .'- process：进程'."\n"
-                                                        .'- file：文件',
-                                                    'description' => 'The type of the entity. Valid values:'."\n"
-                                                        ."\n"
-                                                        .'*   ip'."\n"
-                                                        .'*   process'."\n"
-                                                        .'*   file'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'ip',
-                                                ],
-                                                'TaskParam' => [
-                                                    'title' => '触发剧本参数， json格式。',
-                                                    'description' => 'The parameters that are used to trigger the playbook. The value is in the JSON format.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '{'."\n"
-                                                        .'      "file": {'."\n"
-                                                        .'            "op_code": "2",'."\n"
-                                                        .'            "file_path": "/root/alert0913/a886.jsp",'."\n"
-                                                        .'            "entity_type": "file",'."\n"
-                                                        .'            "entity_name": "a886.jsp",'."\n"
-                                                        .'            "file_name": "a886.jsp",'."\n"
-                                                        .'            "file_owner": "USER:,GROUP:",'."\n"
-                                                        .'            "hash_value": "5def10c9a4287d0920d86b42420b20b0",'."\n"
-                                                        .'            "op_level": "2",'."\n"
-                                                        .'            "entity_id": "/root/alert0913/a886.jsp",'."\n"
-                                                        .'            "host_uuid": {'."\n"
-                                                        .'                  "entity_type": "host",'."\n"
-                                                        .'                  "entity_name": "N/A",'."\n"
-                                                        .'                  "is_comprised": "1",'."\n"
-                                                        .'                  "os_type": "linux",'."\n"
-                                                        .'                  "entity_id": "5f58ef67-8803-4314-8d67-c87dc92b****",'."\n"
-                                                        .'                  "host_uuid": "5f58ef67-8803-4314-8d67-c87dc92b****",'."\n"
-                                                        .'                  "host_name": "N/A"'."\n"
-                                                        .'            },'."\n"
-                                                        .'            "malware_type": "${aliyun.siem.sas.alert_tag.webshell}"'."\n"
-                                                        .'      },'."\n"
-                                                        .'      "_sys_siem": {'."\n"
-                                                        .'            "cloudCode": "aliyun",'."\n"
-                                                        .'            "alertId": "89416745494****"'."\n"
-                                                        .'      },'."\n"
-                                                        .'      "scope": ['."\n"
-                                                        .'            {'."\n"
-                                                        .'                  "aliUid": 1766185894104****'."\n"
-                                                        .'            }'."\n"
-                                                        .'      ]'."\n"
-                                                        .'}',
-                                                ],
-                                                'ErrorMessage' => [
-                                                    'title' => '任务的失败摘要信息。',
-                                                    'description' => 'The summary information about the failed task.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'DisposalEntity failed which description is Aegis Quarantine File , return_info failed which description is Check Aegis Process Result , [ERROR DETAIL] *******.php:file not found',
-                                                ],
-                                                'FinishTime' => [
-                                                    'title' => '任务的结束时间。',
-                                                    'description' => 'The end time of the task.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '2021-08-10 21:34:07',
-                                                ],
-                                                'EffectiveStatus' => [
-                                                    'title' => '策略状态。 取值：'."\n"
-                                                        .'- 0：失效'."\n"
-                                                        .'- 1：有效',
-                                                    'description' => 'The status of the policy. Valid values:'."\n"
-                                                        ."\n"
-                                                        .'*   0: invalid'."\n"
-                                                        .'*   1: valid'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int32',
-                                                    'example' => '0',
-                                                ],
-                                                'Status' => [
-                                                    'title' => '剧本调用状态。 取值：'."\n"
-                                                        .'- 200：成功'."\n"
-                                                        .'- 10：删除'."\n"
-                                                        .'- 5：失败'."\n"
-                                                        .'- 0：初始状态',
-                                                    'description' => 'The running status of the playbook. Valid values:'."\n"
-                                                        ."\n"
-                                                        .'*   200: successful'."\n"
-                                                        .'*   10: deleted'."\n"
-                                                        .'*   5: failed'."\n"
-                                                        .'*   0: initial'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int32',
-                                                    'example' => '10',
-                                                ],
-                                            ],
-                                        ],
-                                    ],
-                                ],
-                                'example' => '123456',
-                            ],
+                            'Data' => ['title' => '', 'description' => 'The return value of the request.', 'type' => 'string', 'example' => '123456'],
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- **true**: The request was successful.'."\n"
+                                ."\n"
+                                .'- **false**: The request failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The message returned for the request.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'PostAutomateResponseConfig',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:43:23.000Z', 'description' => 'Error codes changed, Request parameters changed'],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n  \\"Data\\": {\\n    \\"PageInfo\\": {\\n      \\"CurrentPage\\": 1,\\n      \\"PageSize\\": 10,\\n      \\"TotalCount\\": 100\\n    },\\n    \\"ResponseData\\": [\\n      {\\n        \\"Id\\": 123,\\n        \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n        \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n        \\"Aliuid\\": 0,\\n        \\"SubAliuid\\": 0,\\n        \\"IncidentName\\": \\"Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc\\",\\n        \\"Scope\\": [\\n          \\"[{ aliUid: 176618589410**** }]\\"\\n        ],\\n        \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n        \\"AlertUuid\\": \\"sas_71e24437d2797ce8fc59692905a4****\\",\\n        \\"SophonTaskId\\": \\"577bbf90-a770-44a7-8154-586aa2d3****\\",\\n        \\"PlaybookName\\": \\"WafBlockIP\\",\\n        \\"PlaybookUuid\\": \\"system_aliyun_clb_process_book\\",\\n        \\"PlaybookType\\": \\"system\\",\\n        \\"TaskUrl\\": \\"{\\\\\\"playbookUuid\\\\\\":\\\\\\"system_aliyun_aegis_stop_container_book\\\\\\",\\\\\\"requestUuid\\\\\\":\\\\\\"e8924356-448b-4301-aee9-*******\\\\\\"}\\",\\n        \\"EntityId\\": 123456789,\\n        \\"Entity\\": [\\n          \\"[{\\\\\\"ip\\\\\\":\\\\\\"1.1.XX.XX\\\\\\"}]\\"\\n        ],\\n        \\"EntityType\\": \\"ip\\",\\n        \\"TaskParam\\": \\"{\\\\n      \\\\\\"file\\\\\\": {\\\\n            \\\\\\"op_code\\\\\\": \\\\\\"2\\\\\\",\\\\n            \\\\\\"file_path\\\\\\": \\\\\\"/root/alert0913/a886.jsp\\\\\\",\\\\n            \\\\\\"entity_type\\\\\\": \\\\\\"file\\\\\\",\\\\n            \\\\\\"entity_name\\\\\\": \\\\\\"a886.jsp\\\\\\",\\\\n            \\\\\\"file_name\\\\\\": \\\\\\"a886.jsp\\\\\\",\\\\n            \\\\\\"file_owner\\\\\\": \\\\\\"USER:,GROUP:\\\\\\",\\\\n            \\\\\\"hash_value\\\\\\": \\\\\\"5def10c9a4287d0920d86b42420b20b0\\\\\\",\\\\n            \\\\\\"op_level\\\\\\": \\\\\\"2\\\\\\",\\\\n            \\\\\\"entity_id\\\\\\": \\\\\\"/root/alert0913/a886.jsp\\\\\\",\\\\n            \\\\\\"host_uuid\\\\\\": {\\\\n                  \\\\\\"entity_type\\\\\\": \\\\\\"host\\\\\\",\\\\n                  \\\\\\"entity_name\\\\\\": \\\\\\"N/A\\\\\\",\\\\n                  \\\\\\"is_comprised\\\\\\": \\\\\\"1\\\\\\",\\\\n                  \\\\\\"os_type\\\\\\": \\\\\\"linux\\\\\\",\\\\n                  \\\\\\"entity_id\\\\\\": \\\\\\"5f58ef67-8803-4314-8d67-c87dc92b****\\\\\\",\\\\n                  \\\\\\"host_uuid\\\\\\": \\\\\\"5f58ef67-8803-4314-8d67-c87dc92b****\\\\\\",\\\\n                  \\\\\\"host_name\\\\\\": \\\\\\"N/A\\\\\\"\\\\n            },\\\\n            \\\\\\"malware_type\\\\\\": \\\\\\"${aliyun.siem.sas.alert_tag.webshell}\\\\\\"\\\\n      },\\\\n      \\\\\\"_sys_siem\\\\\\": {\\\\n            \\\\\\"cloudCode\\\\\\": \\\\\\"aliyun\\\\\\",\\\\n            \\\\\\"alertId\\\\\\": \\\\\\"89416745494****\\\\\\"\\\\n      },\\\\n      \\\\\\"scope\\\\\\": [\\\\n            {\\\\n                  \\\\\\"aliUid\\\\\\": 1766185894104****\\\\n            }\\\\n      ]\\\\n}\\",\\n        \\"ErrorMessage\\": \\"DisposalEntity failed which description is Aegis Quarantine File , return_info failed which description is Check Aegis Process Result , [ERROR DETAIL] *******.php:file not found\\",\\n        \\"FinishTime\\": \\"2021-08-10 21:34:07\\",\\n        \\"EffectiveStatus\\": 0,\\n        \\"Status\\": 10\\n      }\\n    ]\\n  }\\n}","type":"json"}]',
-            'title' => 'ListDisposeStrategy',
-        ],
-        'DescribeDisposeStrategyPlaybook' => [
-            'summary' => 'Queries the list of playbooks that are used by a handling policy.',
-            'methods' => [
-                'get',
-                'post',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'PostAutomateResponseConfig'],
+                ],
             ],
-            'schemes' => [
-                'https',
-                'http',
+            'ramActions' => [
+                [
+                    'operationType' => 'create',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:PostAutomateResponseConfig',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": \\"123456\\",\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
+        ],
+        'PostCustomizeRule' => [
+            'summary' => 'Adds or updates a custom rule.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['https', 'http'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'get',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-            ],
+            'systemTags' => ['operationType' => 'create', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
-                    'name' => 'StartTime',
+                    'name' => 'Id',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '查询开始时间, 单位毫秒。',
-                        'description' => 'The beginning of the time range to query. Unit: milliseconds.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => true,
-                        'example' => '1577808000000',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The ID of the custom rule.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '123456789'],
                 ],
                 [
-                    'name' => 'EndTime',
+                    'name' => 'RuleName',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '查询结束时间, 单位毫秒。',
-                        'description' => 'The end of the time range to query. Unit: milliseconds.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => true,
-                        'example' => '1577808000000',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The name of the rule.', 'type' => 'string', 'required' => false, 'example' => 'waf_scan'],
                 ],
                 [
-                    'name' => 'RoleType',
+                    'name' => 'RuleDesc',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The description of the rule.', 'type' => 'string', 'required' => false, 'example' => 'this rule is for waf scan'],
                 ],
                 [
-                    'name' => 'RoleFor',
+                    'name' => 'ThreatLevel',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The threat level. Valid values:'."\n"
+                        ."\n"
+                        .'- serious: high'."\n"
+                        ."\n"
+                        .'- suspicious: medium'."\n"
+                        ."\n"
+                        .'- remind: low', 'type' => 'string', 'required' => false, 'example' => 'remind'],
                 ],
                 [
-                    'name' => 'RegionId',
+                    'name' => 'AttCk',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The data management center of the threat analysis feature. Specify this parameter based on the region in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions inside China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => 'att&ck。', 'description' => 'The ATT\\&CK technique.', 'type' => 'string', 'required' => false, 'example' => 'T1595.002 Vulnerability Scanning'."\n"],
                 ],
-            ],
-            'responses' => [
-                200 => [
-                    'schema' => [
-                        'title' => 'BaseResponse<List<StrategyPlaybookList>>',
-                        'description' => 'BaseResponse\\<List>'."\n",
-                        'type' => 'object',
-                        'properties' => [
-                            'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'array',
-                                'items' => [
-                                    'type' => 'object',
-                                    'properties' => [
-                                        'PlaybookName' => [
-                                            'title' => '剧本唯一标识名称。',
-                                            'description' => 'The playbook name, which is the unique identifier of the playbook.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'WafBlockIP',
-                                        ],
-                                        'PlaybookUuid' => [
-                                            'title' => '剧本UUID。',
-                                            'description' => 'The UUID of the playbook.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'system_aliyun_clb_process_book',
-                                        ],
-                                    ],
-                                ],
-                                'example' => '123456',
-                            ],
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true：成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code that is returned.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
-                            ],
-                        ],
-                    ],
+                [
+                    'name' => 'AlertType',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The threat type.', 'type' => 'string', 'required' => false, 'example' => 'WEBSHELL'],
                 ],
-            ],
-            'errorCodes' => [
-                500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                [
+                    'name' => 'AlertTypeMds',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The Medusa code of the threat type.', 'type' => 'string', 'required' => false, 'example' => '${siem_rule_type_process_abnormal_command}'],
                 ],
-            ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"PlaybookName\\": \\"WafBlockIP\\",\\n      \\"PlaybookUuid\\": \\"system_aliyun_clb_process_book\\"\\n    }\\n  ],\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
-            'title' => 'DescribeDisposeStrategyPlaybook',
-        ],
-        'RestoreCapacity' => [
-            'summary' => 'Releases storage to reduce the storage usage. The release operation is irreversible and may cause data loss. Proceed with caution.',
-            'methods' => [
-                'get',
-                'post',
-            ],
-            'schemes' => [
-                'http',
-                'https',
-            ],
-            'security' => [
                 [
-                    'AK' => [],
+                    'name' => 'LogType',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The log type of the rule.', 'type' => 'string', 'required' => false, 'example' => 'ALERT_ACTIVITY'],
                 ],
-            ],
-            'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'update',
-                'abilityTreeCode' => '173446',
-                'abilityTreeNodes' => [
-                    'FEATUREsasRXJ9SY',
+                [
+                    'name' => 'LogTypeMds',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The Medusa code of the log type.', 'type' => 'string', 'required' => false, 'example' => '${security_event_config.event_name.webshellName_clientav}'],
                 ],
-            ],
-            'parameters' => [
                 [
-                    'name' => 'RoleType',
+                    'name' => 'LogSource',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The log source of the rule.', 'type' => 'string', 'required' => false, 'example' => 'cloud_siem_aegis_sas_alert'],
                 ],
                 [
-                    'name' => 'RoleFor',
+                    'name' => 'LogSourceMds',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The Medusa code of the log source.', 'type' => 'string', 'required' => false, 'example' => '${sas.cloudsiem.prod.cloud_siem_aegis_sas_alert}'],
                 ],
                 [
-                    'name' => 'RegionId',
+                    'name' => 'RuleCondition',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The query condition of the rule. The value is a JSON string.', 'type' => 'string', 'required' => false, 'example' => '[[{"not":false,"left":"alert_name","operator":"=","right":"WEBSHELL"}]]'],
                 ],
-            ],
-            'responses' => [
-                200 => [
-                    'schema' => [
-                        'title' => 'CloudSiemSuccessResponse<Boolean>',
-                        'description' => 'CloudSiemResponse'."\n",
-                        'type' => 'object',
-                        'properties' => [
-                            'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'Indicates whether the release command has been sent. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true: The command has been sent and the storage space is being released.'."\n"
-                                    .'*   false: The command failed to be sent.'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求消息ID。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '6276D891-58D4-55B2-87B9-74D413F7****',
-                            ],
-                        ],
-                    ],
+                [
+                    'name' => 'RuleGroup',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The fields that are used to group logs. The value is a JSON array.', 'type' => 'string', 'required' => false, 'example' => '["asset_id"]'],
                 ],
-            ],
-            'errorCodes' => [
-                500 => [
-                    [
-                        'errorCode' => 'InternalError',
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                    ],
+                [
+                    'name' => 'RuleThreshold',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The threshold configuration of the rule. The value is a JSON string.', 'type' => 'string', 'required' => false, 'example' => '{"aggregateFunction":"count","aggregateFunctionName":"count","field":"activity_name","operator":"&lt;=","value":1}'],
                 ],
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": true,\\n  \\"RequestId\\": \\"6276D891-58D4-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
-            'title' => 'RestoreCapacity',
-        ],
-        'GetCapacity' => [
-            'summary' => 'Queries the storage capacity usage of the threat analysis feature and the purchased storage capacity',
-            'methods' => [
-                'get',
-                'post',
-            ],
-            'schemes' => [
-                'http',
-                'https',
-            ],
-            'security' => [
                 [
-                    'AK' => [],
+                    'name' => 'QueryCycle',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The length of the rule window.', 'type' => 'string', 'required' => false, 'example' => '{"time":"1","unit":"HOUR"}'],
                 ],
-            ],
-            'operationType' => 'read',
-            'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'get',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-                'abilityTreeCode' => '155452',
-                'abilityTreeNodes' => [
-                    'FEATUREsasRXJ9SY',
+                [
+                    'name' => 'EventTransferSwitch',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'Specifies whether to convert alerts into events. Valid values:'."\n"
+                        ."\n"
+                        .'- 0: no'."\n"
+                        ."\n"
+                        .'- 1: yes', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1'],
+                ],
+                [
+                    'name' => 'EventTransferType',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The event generation method. Valid values:'."\n"
+                        ."\n"
+                        .'- default: the default method'."\n"
+                        ."\n"
+                        .'- singleToSingle: An event is generated for each alert.'."\n"
+                        ."\n"
+                        .'- allToSingle: An event is generated for all alerts in a period.', 'type' => 'string', 'required' => false, 'example' => 'allToSingle'],
+                ],
+                [
+                    'name' => 'EventTransferExt',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The extended information for event generation. This parameter is returned only when EventTransferType is set to allToSingle. The value indicates the length and unit of the alert aggregation window.', 'type' => 'string', 'required' => false, 'example' => '{"time":"1","unit":"MINUTE"}'],
                 ],
-            ],
-            'parameters' => [
                 [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['description' => 'The view type.'."\n"
+                        ."\n"
+                        .'- 0: the view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: the view of all accounts that are managed by the administrator.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The user ID that is used to switch the administrator\'s perspective to a member\'s perspective.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region where the data management center of Threat Analysis is located. Select the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: assets in the Chinese mainland and China (Hong Kong)'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: assets outside China', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'CloudSiemSuccessResponse<CloudSiemCapacityResponse>',
-                        'description' => 'CloudSiemResponse'."\n",
+                        'title' => 'BaseResponse<CloudSiemCustomizeRule>',
+                        'description' => 'BaseResponse',
                         'type' => 'object',
                         'properties' => [
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The information about the storage capacity.'."\n",
+                                'title' => '',
+                                'description' => 'The data returned.',
                                 'type' => 'object',
                                 'properties' => [
-                                    'UsedCapacity' => [
-                                        'title' => '威胁分析当前计费容量。',
-                                        'description' => 'The billable storage capacity of the threat analysis feature. Unit: GB.'."\n",
-                                        'type' => 'number',
-                                        'format' => 'double',
-                                        'example' => '10',
-                                    ],
-                                    'PreservedCapacity' => [
-                                        'title' => '威胁分析用户购买容量。',
-                                        'description' => 'The purchased storage capacity of the threat analysis feature. Unit: GB.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int64',
-                                        'example' => '9000',
-                                    ],
-                                    'ExistLogStore' => [
-                                        'title' => '威胁分析用户侧LogStore是否存在，默认true。取值：'."\n"
-                                            .'- true：当前日志正常，日志分析可用'."\n"
-                                            .'- false：当前正在清理日志，日志分析不可用',
-                                        'description' => 'Indicates whether the Logstores for the threat analysis feature exist on the user side. Valid values:'."\n"
-                                            ."\n"
-                                            .'*   true: The logs are in the normal state. The log analysis feature is available.'."\n"
-                                            .'*   false: The logs are being cleared. The log analysis feature is unavailable.'."\n",
-                                        'type' => 'boolean',
-                                        'example' => 'true',
-                                    ],
-                                    'AgentManagedAssetQuota' => [
-                                        'title' => 'Agent调用实例量已购额度',
-                                        'type' => 'integer',
-                                        'format' => 'int64',
-                                        'example' => '1',
-                                    ],
-                                    'AgentManagedAssetUsed' => [
-                                        'title' => 'Agent调用实例量已用量',
-                                        'type' => 'integer',
-                                        'format' => 'int64',
-                                        'example' => '1',
-                                    ],
+                                    'Id' => ['title' => '', 'description' => 'The ID of the custom rule.', 'type' => 'integer', 'format' => 'int64', 'example' => '123456789'],
+                                    'GmtCreate' => ['title' => '', 'description' => 'The time when the custom rule was created.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'],
+                                    'GmtModified' => ['title' => '', 'description' => 'The time when the custom rule was last updated.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'],
+                                    'Aliuid' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account that is used to purchase Threat Analysis.', 'type' => 'integer', 'format' => 'int64', 'example' => '127608589417****'],
+                                    'RuleName' => ['title' => '', 'description' => 'The name of the rule.', 'type' => 'string', 'example' => 'waf_scan'],
+                                    'RuleDesc' => ['title' => '', 'description' => 'The description of the rule.', 'type' => 'string', 'example' => 'this rule is for waf scan'],
+                                    'RuleType' => ['title' => '', 'description' => 'The rule type. Valid values:'."\n"
+                                        ."\n"
+                                        .'- predefine: predefined'."\n"
+                                        ."\n"
+                                        .'- customize: custom', 'type' => 'string', 'example' => 'customize'],
+                                    'ThreatLevel' => ['title' => '', 'description' => 'The threat level. Valid values:'."\n"
+                                        ."\n"
+                                        .'- serious: high'."\n"
+                                        ."\n"
+                                        .'- suspicious: medium'."\n"
+                                        ."\n"
+                                        .'- remind: low', 'type' => 'string', 'example' => 'remind'],
+                                    'AlertType' => ['title' => '', 'description' => 'The threat type.', 'type' => 'string', 'example' => 'WEBSHELL'],
+                                    'AlertTypeMds' => ['title' => '', 'description' => 'The Medusa code of the threat type.', 'type' => 'string', 'example' => '${siem_rule_type_process_abnormal_command}'],
+                                    'LogType' => ['title' => '', 'description' => 'The log type of the rule.', 'type' => 'string', 'example' => 'ALERT_ACTIVITY'],
+                                    'LogTypeMds' => ['title' => '', 'description' => 'The Medusa code of the log type.', 'type' => 'string', 'example' => '${security_event_config.event_name.webshellName_clientav}'],
+                                    'LogSource' => ['title' => '', 'description' => 'The log source of the rule.', 'type' => 'string', 'example' => 'cloud_siem_aegis_sas_alert'],
+                                    'LogSourceMds' => ['title' => '', 'description' => 'The Medusa code of the log source.', 'type' => 'string', 'example' => '${sas.cloudsiem.prod.cloud_siem_aegis_sas_alert}'],
+                                    'RuleCondition' => ['title' => '', 'description' => 'The query condition of the rule in the JSON format. You must unescape the HTML escape characters.', 'type' => 'string', 'example' => '[[{&quot;not&quot;:false,&quot;left&quot;:&quot;alert_name&quot;,&quot;operator&quot;:&quot;=&quot;,&quot;right&quot;:&quot;WEBSHELL&quot;}]]'],
+                                    'RuleGroup' => ['title' => '', 'description' => 'The fields that are used to group logs. The value is a JSON array. You must unescape the HTML escape characters.', 'type' => 'string', 'example' => '[&quot;asset_id&quot;]'],
+                                    'RuleThreshold' => ['title' => '', 'description' => 'The threshold configuration of the rule in the JSON format. You must unescape the HTML escape characters.', 'type' => 'string', 'example' => '{&quot;aggregateFunction&quot;:&quot;count&quot;,&quot;aggregateFunctionName&quot;:&quot;count&quot;,&quot;field&quot;:&quot;activity_name&quot;,&quot;operator&quot;:&quot;&lt;=&quot;,&quot;value&quot;:1}'],
+                                    'QueryCycle' => ['title' => '', 'description' => 'The length of the rule window. You must unescape the HTML escape characters.', 'type' => 'string', 'example' => '{&quot;time&quot;:&quot;1&quot;,&quot;unit&quot;:&quot;HOUR&quot;}'],
+                                    'AttCk' => ['title' => '告警附加字段attck', 'description' => 'The ATT\\&CK attack technique.', 'type' => 'string', 'example' => 'T1595.002 Vulnerability Scanning'],
+                                    'EventTransferSwitch' => ['title' => '', 'description' => 'Indicates whether alerts are converted into events. Valid values:'."\n"
+                                        ."\n"
+                                        .'- 0: no'."\n"
+                                        ."\n"
+                                        .'- 1: yes', 'type' => 'integer', 'format' => 'int32', 'example' => '1'],
+                                    'EventTransferType' => ['title' => '', 'description' => 'The event generation method. Valid values:'."\n"
+                                        ."\n"
+                                        .'- default: the default method'."\n"
+                                        ."\n"
+                                        .'- singleToSingle: An event is generated for each alert.'."\n"
+                                        ."\n"
+                                        .'- allToSingle: An event is generated for all alerts in a period.', 'type' => 'string', 'example' => 'allToSingle'],
+                                    'EventTransferExt' => ['title' => '', 'description' => 'The extended information for event generation. This parameter is returned only when EventTransferType is set to allToSingle. The value indicates the length and unit of the alert aggregation window. You must unescape the HTML escape characters.', 'type' => 'string', 'example' => '{&quot;time&quot;:&quot;1&quot;,&quot;unit&quot;:&quot;MINUTE&quot;}'],
+                                    'Status' => ['title' => '', 'description' => 'The status of the rule. Valid values:'."\n"
+                                        ."\n"
+                                        .'- 0: initial'."\n"
+                                        ."\n"
+                                        .'- 10: testing with simulated data'."\n"
+                                        ."\n"
+                                        .'- 15: testing with business data'."\n"
+                                        ."\n"
+                                        .'- 20: test with business data ends'."\n"
+                                        ."\n"
+                                        .'- 100: published', 'type' => 'integer', 'format' => 'int32', 'example' => '0'],
+                                    'DataType' => ['description' => 'The data type of the condition field in the automated response rule.', 'type' => 'integer', 'format' => 'int32', 'title' => '', 'example' => 'varchar'],
                                 ],
+                                'example' => '123456',
                             ],
-                            'RequestId' => [
-                                'title' => '请求消息ID。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '27D27DCB-D76B-5064-8B3B-0900DEF7****',
-                            ],
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The request was successful.'."\n"
+                                ."\n"
+                                .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The HTTP status code.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The returned message.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
+                400 => [
+                    ['errorCode' => 'CloudSiemCustomizeRuleUpdateExcepiton', 'errorMessage' => 'this customize rule can only update in init status.', 'description' => ''],
+                    ['errorCode' => 'CloudSiemCustomizeRuleConditionExceedExcepiton', 'errorMessage' => 'the number of rule conditions cannot exceed 100.', 'description' => ''],
+                    ['errorCode' => 'CloudSiemCustomizeRuleDuplicateRuleNameExcepiton', 'errorMessage' => 'the rule name is duplicated.', 'description' => ''],
+                ],
                 500 => [
-                    [
-                        'errorCode' => 'InternalError',
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                    ],
-                    [
-                        'errorCode' => 'Siem.Storage.Exception',
-                        'errorMessage' => 'The request timed out, try again.',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"UsedCapacity\\": 10,\\n    \\"PreservedCapacity\\": 9000,\\n    \\"ExistLogStore\\": true,\\n    \\"AgentManagedAssetQuota\\": 1,\\n    \\"AgentManagedAssetUsed\\": 1\\n  },\\n  \\"RequestId\\": \\"27D27DCB-D76B-5064-8B3B-0900DEF7****\\"\\n}","type":"json"}]',
-            'title' => 'GetCapacity',
-        ],
-        'SetStorage' => [
-            'summary' => 'Configures the settings of log storage, such as the storage duration and storage region.',
-            'methods' => [
-                'get',
-                'post',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'PostCustomizeRule',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:43:23.000Z', 'description' => 'Error codes changed, Request parameters changed, Response parameters changed'],
             ],
-            'schemes' => [
-                'http',
-                'https',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'PostCustomizeRule'],
+                ],
             ],
+            'ramActions' => [
+                [
+                    'operationType' => 'create',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:PostCustomizeRule',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
+            ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"Id\\": 123456789,\\n    \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n    \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n    \\"Aliuid\\": 0,\\n    \\"RuleName\\": \\"waf_scan\\",\\n    \\"RuleDesc\\": \\"this rule is for waf scan\\",\\n    \\"RuleType\\": \\"customize\\",\\n    \\"ThreatLevel\\": \\"remind\\",\\n    \\"AlertType\\": \\"WEBSHELL\\",\\n    \\"AlertTypeMds\\": \\"${siem_rule_type_process_abnormal_command}\\",\\n    \\"LogType\\": \\"ALERT_ACTIVITY\\",\\n    \\"LogTypeMds\\": \\"${security_event_config.event_name.webshellName_clientav}\\",\\n    \\"LogSource\\": \\"cloud_siem_aegis_sas_alert\\",\\n    \\"LogSourceMds\\": \\"${sas.cloudsiem.prod.cloud_siem_aegis_sas_alert}\\",\\n    \\"RuleCondition\\": \\"[[{&quot;not&quot;:false,&quot;left&quot;:&quot;alert_name&quot;,&quot;operator&quot;:&quot;=&quot;,&quot;right&quot;:&quot;WEBSHELL&quot;}]]\\",\\n    \\"RuleGroup\\": \\"[&quot;asset_id&quot;]\\",\\n    \\"RuleThreshold\\": \\"{&quot;aggregateFunction&quot;:&quot;count&quot;,&quot;aggregateFunctionName&quot;:&quot;count&quot;,&quot;field&quot;:&quot;activity_name&quot;,&quot;operator&quot;:&quot;&lt;=&quot;,&quot;value&quot;:1}\\",\\n    \\"QueryCycle\\": \\"{&quot;time&quot;:&quot;1&quot;,&quot;unit&quot;:&quot;HOUR&quot;}\\",\\n    \\"AttCk\\": \\"T1595.002 Vulnerability Scanning\\",\\n    \\"EventTransferSwitch\\": 1,\\n    \\"EventTransferType\\": \\"allToSingle\\",\\n    \\"EventTransferExt\\": \\"{&quot;time&quot;:&quot;1&quot;,&quot;unit&quot;:&quot;MINUTE&quot;}\\",\\n    \\"Status\\": 0,\\n    \\"DataType\\": 0\\n  },\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
+        ],
+        'PostCustomizeRuleTest' => [
+            'summary' => 'Submits a custom rule for testing.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['https', 'http'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'update',
-                'abilityTreeCode' => '179221',
-                'abilityTreeNodes' => [
-                    'FEATUREsasRXJ9SY',
-                ],
-            ],
+            'systemTags' => ['operationType' => 'create', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
-                    'name' => 'Ttl',
+                    'name' => 'Id',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '日志存储天数，默认180天。该值最小设置为30天，最大不能超过3000天。',
-                        'description' => 'The storage duration of logs. Default value: 180. Minimum value: 30. Maximum value: 3000. Unit: days.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => true,
-                        'example' => '180',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The ID of the custom rule.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '123456789'],
                 ],
                 [
-                    'name' => 'Region',
+                    'name' => 'TestType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '日志存储地域。',
-                        'description' => 'The storage region of logs.'."\n"
-                            ."\n"
-                            .'If the data management center is **cn-hangzhou**, the default value of **Region** is cn-shanghai, which specifies the China (Shanghai) region. If the data management center is **ap-southeast-1**, the default value of **Region** is ap-southeast-1, which specifies the Singapore region.'."\n"
-                            ."\n"
-                            .'The region for log storage cannot be changed. To change the region, contact the technical support of threat analysis.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-shanghai',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The test type. Valid values:'."\n"
+                        ."\n"
+                        .'- simulate: tests the rule with simulated data'."\n"
+                        ."\n"
+                        .'- business: tests the rule with business data', 'type' => 'string', 'required' => false, 'example' => 'simulate'],
+                ],
+                [
+                    'name' => 'SimulatedData',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The simulated data for the test. This parameter is required only when TestType is set to simulate.', 'type' => 'string', 'required' => false, 'example' => '[{"key1":"value1","key2":"value2","key3":"value3","key4":"value4","key5":"value5"}]'],
                 ],
                 [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['description' => 'The view type.'."\n"
+                        ."\n"
+                        .'- 0: the view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: the view of all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member that the administrator wants to impersonate to view data.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The data management center of the threat analysis feature. Specify this parameter based on the region where your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region where the Data Management center of threat analysis is located. Select the region based on the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'CloudSiemSuccessResponse<Boolean>',
-                        'description' => 'CloudSiemResponse'."\n",
+                        'title' => 'BaseResponse',
+                        'description' => 'BaseResponse',
                         'type' => 'object',
                         'properties' => [
-                            'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'Indicates whether the settings are saved. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true:'."\n"
-                                    .'*   false:'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求消息ID。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '6276D891-58D4-55B2-87B9-74D413F7****',
-                            ],
+                            'Data' => ['title' => '', 'description' => 'The return value of the request.', 'type' => 'any', 'example' => '123456'],
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The request was successful.'."\n"
+                                ."\n"
+                                .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The message returned for the request.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
-                400 => [
-                    [
-                        'errorCode' => 'Siem.TTL.Limit',
-                        'errorMessage' => 'TTL should be set 30 days at least',
-                    ],
-                ],
                 500 => [
-                    [
-                        'errorCode' => 'InternalError',
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": true,\\n  \\"RequestId\\": \\"6276D891-58D4-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
-            'title' => 'SetStorage',
-        ],
-        'DescribeStorage' => [
-            'summary' => 'Queries the status of the Logstores for the threat analysis feature in Simple Log Service on the user side.',
-            'methods' => [
-                'get',
-                'post',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'PostCustomizeRuleTest',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:43:22.000Z', 'description' => 'Error codes changed, Request parameters changed'],
             ],
-            'schemes' => [
-                'http',
-                'https',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'PostCustomizeRuleTest'],
+                ],
             ],
+            'ramActions' => [
+                [
+                    'operationType' => 'create',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:PostCustomizeRuleTest',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
+            ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": \\"123456\\",\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
+        ],
+        'PostEventDisposeAndWhiteruleList' => [
+            'summary' => 'Submit incident response information to update the incident status and severity level.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
+            'operationType' => 'write',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'get',
-                'abilityTreeCode' => '190429',
-                'abilityTreeNodes' => [
-                    'FEATUREsasRXJ9SY',
-                ],
+                'operationType' => 'create',
+                'riskType' => 'none',
+                'chargeType' => 'free',
+                'abilityTreeNodes' => ['FEATUREsasAFG0OH'],
             ],
             'parameters' => [
                 [
-                    'name' => 'RoleType',
+                    'name' => 'IncidentUuid',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['description' => 'The globally unique UUID of the incident.', 'type' => 'string', 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', 'title' => '', 'required' => false],
                 ],
                 [
-                    'name' => 'RoleFor',
+                    'name' => 'Status',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '137820528780****',
-                    ],
+                    'schema' => ['description' => 'The incident status. Valid values:'."\n"
+                        ."\n"
+                        .'- 0: Not handled'."\n"
+                        ."\n"
+                        .'- 1: Handling'."\n"
+                        ."\n"
+                        .'- 5: Failed'."\n"
+                        ."\n"
+                        .'- 10: Handled', 'type' => 'integer', 'format' => 'int32', 'example' => '0', 'title' => '', 'required' => false],
                 ],
                 [
-                    'name' => 'RegionId',
+                    'name' => 'Remark',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['description' => 'A note about the incident.', 'type' => 'string', 'example' => 'dealed', 'title' => '', 'required' => false],
                 ],
-            ],
-            'responses' => [
-                200 => [
-                    'schema' => [
-                        'title' => 'CloudSiemSuccessResponse<Boolean>',
-                        'description' => 'CloudSiemResponse'."\n",
-                        'type' => 'object',
-                        'properties' => [
-                            'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'Indicates whether the projects and Logstores that are created for the threat analysis feature exist in Simple Log Service. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求消息ID。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => 'CCEEE128-6607-503E-AAA6-C5E57D94****',
-                            ],
-                        ],
-                    ],
-                ],
-            ],
-            'errorCodes' => [
-                500 => [
-                    [
-                        'errorCode' => 'InternalError',
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                    ],
-                    [
-                        'errorCode' => 'SLS.Operation.Error',
-                        'errorMessage' => 'SLS service is unavailable!',
-                    ],
-                ],
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": true,\\n  \\"RequestId\\": \\"CCEEE128-6607-503E-AAA6-C5E57D94****\\"\\n}","type":"json"}]',
-            'title' => 'DescribeStorage',
-        ],
-        'GetStorage' => [
-            'summary' => 'Queries the storage configurations for the threat analysis feature on the user side.',
-            'methods' => [
-                'get',
-                'post',
-            ],
-            'schemes' => [
-                'http',
-                'https',
-            ],
-            'security' => [
                 [
-                    'AK' => [],
+                    'name' => 'EventDispose',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'A JSON object that defines the incident response configuration.', 'type' => 'string', 'example' => '['."\n"
+                        .'      {'."\n"
+                        .'            "playbookName": "WafBlockIP",'."\n"
+                        .'            "entityId": "104466118",'."\n"
+                        .'            "scope": ['."\n"
+                        .'                  "176618589410****"'."\n"
+                        .'            ],'."\n"
+                        .'            "startTime": 1604168946281,'."\n"
+                        .'            "endTime": 1614168946281'."\n"
+                        .'      },'."\n"
+                        .'      {'."\n"
+                        .'            "playbookName": "WafBlockIP",'."\n"
+                        .'            "entityId": "104466118",'."\n"
+                        .'            "scope": ['."\n"
+                        .'                  {'."\n"
+                        .'                        "instanceId": "waf-cn-n6w1oy1****",'."\n"
+                        .'                        "domains": ['."\n"
+                        .'                              "lmfip.wafqax.***"'."\n"
+                        .'                        ]'."\n"
+                        .'                  }'."\n"
+                        .'            ],'."\n"
+                        .'            "startTime": 1604168946281,'."\n"
+                        .'            "endTime": 1614168946281'."\n"
+                        .'      }'."\n"
+                        .']', 'title' => '', 'required' => false],
                 ],
-            ],
-            'operationType' => 'read',
-            'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'get',
-                'abilityTreeCode' => '179222',
-                'abilityTreeNodes' => [
-                    'FEATUREsasRXJ9SY',
+                [
+                    'name' => 'ReceiverInfo',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'A JSON object that defines the alert recipient configuration.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => '{'."\n"
+                        .'      "messageTitle": "test",'."\n"
+                        .'      "receiver": "xiaowang",'."\n"
+                        .'      "channel": "message"'."\n"
+                        .'}'],
                 ],
-            ],
-            'parameters' => [
                 [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['description' => 'The view type. Valid values:'."\n"
+                        ."\n"
+                        .'- 0: Current Alibaba Cloud account view'."\n"
+                        ."\n"
+                        .'- 1: View for all accounts in your enterprise', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '127XXXX',
-                    ],
+                    'schema' => ['description' => 'The UID of the member whose perspective an administrator switches to.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The data management center of the threat analysis feature. Specify this parameter based on the region where your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['description' => 'The region where the Data Management service for threat analysis is deployed. Select a region based on where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Assets in the Chinese mainland or Hong Kong (China)'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Assets outside China', 'type' => 'string', 'example' => 'cn-hangzhou', 'title' => '', 'required' => false],
+                ],
+                [
+                    'name' => 'ThreatLevel',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The threat level. Valid values:'."\n"
+                        ."\n"
+                        .'- serious: Important'."\n"
+                        ."\n"
+                        .'- suspicious: Medium'."\n"
+                        ."\n"
+                        .'- remind: Low', 'type' => 'string', 'required' => false, 'example' => 'remind', 'title' => ''],
+                ],
+                [
+                    'name' => 'Owner',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The UID of the incident owner.', 'type' => 'string', 'example' => '1234567890xxxxxx', 'title' => '', 'required' => false],
+                ],
+                [
+                    'name' => 'ResponseSource',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The source of the response policy.', 'type' => 'string', 'required' => false, 'example' => 'system', 'title' => ''],
+                ],
+                [
+                    'name' => 'DisposeStrategyIds',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'A comma-separated list of response strategy IDs.', 'type' => 'string', 'required' => false, 'example' => '12,13,14', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'CloudSiemSuccessResponse<CloudSiemStorageResponse>',
-                        'description' => 'CloudSiemResponse'."\n",
+                        'title' => 'BaseResponse<String>',
+                        'description' => 'BaseResponse\\<string>',
                         'type' => 'object',
                         'properties' => [
-                            'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The information about the storage.'."\n",
-                                'type' => 'object',
-                                'properties' => [
-                                    'Ttl' => [
-                                        'title' => '存储天数。',
-                                        'description' => 'The storage period of logs. Unit: day. Default value: 180. Valid values: 30 to 3000.'."\n",
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '180',
-                                    ],
-                                    'Region' => [
-                                        'title' => '存储地域（region）。',
-                                        'description' => 'The region where the data is stored.'."\n"
-                                            ."\n"
-                                            .'If the data management center is **cn-hangzhou**, the default value of **Region** is cn-shanghai, which specifies the China (Shanghai) region. If the data management center is **ap-southeast-1**, the default value of **Region** is ap-southeast-1, which specifies the Singapore region.'."\n",
-                                        'type' => 'string',
-                                        'example' => 'cn-shanghai',
-                                    ],
-                                    'DisplayRegion' => [
-                                        'title' => '是否拥有修改存储地域的权限，默认值false。取值：'."\n"
-                                            .'- true：拥有修改存储地域的权限'."\n"
-                                            .'- false：不拥有修改存储地域的权限',
-                                        'description' => 'Indicates whether the storage region can be changed. Default value: false Valid values:'."\n"
-                                            ."\n"
-                                            .'*   true'."\n"
-                                            .'*   false'."\n",
-                                        'type' => 'boolean',
-                                        'example' => 'false',
-                                    ],
-                                    'CanOperate' => [
-                                        'title' => '当前是否可以操作存储地域（存储地域仅能操作一次），默认值false。取值：'."\n"
-                                            .'- true：可以修改存储地域'."\n"
-                                            .'- false：不可以修改存储地域',
-                                        'description' => 'Indicates whether the storage region can be changed for once. Default value: false Valid values:'."\n"
-                                            ."\n"
-                                            .'*   true'."\n"
-                                            .'*   false'."\n",
-                                        'type' => 'boolean',
-                                        'example' => 'false',
-                                    ],
-                                ],
-                            ],
-                            'RequestId' => [
-                                'title' => '请求消息ID。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '97A31C3A-3F9F-5866-8979-5159E3DC****',
-                            ],
+                            'Data' => ['description' => 'The response value.', 'type' => 'string', 'example' => '123456', 'title' => ''],
+                            'Success' => ['description' => 'Indicates whether the request succeeded. Valid values:'."\n"
+                                ."\n"
+                                .'- true: succeeded'."\n"
+                                ."\n"
+                                .'- false: failed', 'type' => 'boolean', 'example' => 'true', 'title' => ''],
+                            'Code' => ['description' => 'The HTTP status code.', 'type' => 'integer', 'format' => 'int32', 'example' => '200', 'title' => ''],
+                            'Message' => ['description' => 'The response message.', 'type' => 'string', 'example' => 'success', 'title' => ''],
+                            'RequestId' => ['description' => 'The ID of the request.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', 'title' => ''],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorCode' => 'InternalError',
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"Ttl\\": 180,\\n    \\"Region\\": \\"cn-shanghai\\",\\n    \\"DisplayRegion\\": false,\\n    \\"CanOperate\\": false\\n  },\\n  \\"RequestId\\": \\"97A31C3A-3F9F-5866-8979-5159E3DC****\\"\\n}","type":"json"}]',
-            'title' => 'GetStorage',
-        ],
-        'ListDelivery' => [
-            'summary' => 'Queries the information about the cloud services that are integrated with the threat analysis feature, the logs of the cloud services, and the delivery of the logs.',
-            'methods' => [
-                'get',
-                'post',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": \\"123456\\",\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
+            'title' => 'PostEventDisposeAndWhiteruleList',
+            'changeSet' => [
+                ['createdAt' => '2024-12-23T09:00:54.000Z', 'description' => 'Request parameters changed'],
+                ['createdAt' => '2024-04-17T12:43:24.000Z', 'description' => 'Error codes changed, Request parameters changed'],
             ],
-            'schemes' => [
-                'http',
-                'https',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'PostEventDisposeAndWhiteruleList'],
+                ],
             ],
+            'ramActions' => [
+                [
+                    'operationType' => 'create',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:PostEventDisposeAndWhiteruleList',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
+            ],
+        ],
+        'PostEventWhiteruleList' => [
+            'summary' => 'Submits alert whitelisting rules.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['https', 'http'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'list',
-                'abilityTreeCode' => '155305',
-                'abilityTreeNodes' => [
-                    'FEATUREsasRXJ9SY',
-                ],
-            ],
+            'systemTags' => ['operationType' => 'create', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
+                    'name' => 'IncidentUuid',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The globally unique ID of the event.', 'type' => 'string', 'required' => false, 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'],
+                ],
+                [
+                    'name' => 'WhiteruleList',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The alert whitelisting rule, which is a JSON object.', 'type' => 'string', 'required' => true, 'example' => '['."\n"
+                        .'      {'."\n"
+                        .'            "alertName": "webshell",'."\n"
+                        .'            "alertNameId": "webshell",'."\n"
+                        .'            "alertType": "command",'."\n"
+                        .'            "alertTypeId": "command",'."\n"
+                        .'            "expression": {'."\n"
+                        .'                  "status": 1,'."\n"
+                        .'                  "conditions": ['."\n"
+                        .'                        {'."\n"
+                        .'                              "isNot": false,'."\n"
+                        .'                              "left": {'."\n"
+                        .'                                    "value": "file_path"'."\n"
+                        .'                              },'."\n"
+                        .'                              "operator": "gt",'."\n"
+                        .'                              "right": {'."\n"
+                        .'                                    "value": "cp"'."\n"
+                        .'                              }'."\n"
+                        .'                        }'."\n"
+                        .'                  ]'."\n"
+                        .'            }'."\n"
+                        .'      }'."\n"
+                        .']'],
+                ],
+                [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['description' => 'The account scope to which the rule applies. Valid values:'."\n"
+                        ."\n"
+                        .'- 0: The current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: All accounts within the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The ID of a member account. An administrator can use this parameter to switch to the perspective of the member account.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region where the threat analysis feature is deployed. Select the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: For assets in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: For assets in regions outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'CloudSiemSuccessResponse<CloudSiemAnalyzeResponse>',
-                        'description' => 'BaseResponse'."\n",
+                        'title' => 'BaseResponse<String>',
+                        'description' => 'BaseResponse',
                         'type' => 'object',
                         'properties' => [
-                            'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The response parameters.'."\n",
-                                'type' => 'object',
-                                'properties' => [
-                                    'ProjectName' => [
-                                        'title' => '威胁分析用户侧日志服务Project名字，格式：aliyun-cloudsiem-data-${aliUid}-${region}。',
-                                        'description' => 'The name of the project for the threat analysis feature in Simple Log service on the user side. The value is in the aliyun-cloudsiem-data-${aliUid}-${region} format.'."\n",
-                                        'type' => 'string',
-                                        'example' => 'aliyun-cloudsiem-data-127608589417****-cn-shanghai',
-                                    ],
-                                    'LogStoreName' => [
-                                        'title' => '威胁分析用户侧LogStore的名字，格式：cloud_siem。',
-                                        'description' => 'The name of the Logstore for the threat analysis feature on the user side. The value is in the cloud_siem format.'."\n",
-                                        'type' => 'string',
-                                        'example' => 'cloud-siem',
-                                    ],
-                                    'SearchUrl' => [
-                                        'title' => '日志分析页面中查询分析的URL。',
-                                        'description' => 'The URL that is used for log analysis.'."\n",
-                                        'type' => 'string',
-                                        'example' => 'https://sls4service.console.aliyun.com/lognext/project/aliyun-cloudsiem-data-127608589417****-cn-shanghai'."\n"
-                                            .'/logsearch/cloud-siem?isShare=true&hideTopbar=true&hideSidebar=true&ignoreTabLocalStorage=true',
-                                    ],
-                                    'DashboardUrl' => [
-                                        'title' => '日志分析页面中报表展示的URL。',
-                                        'description' => 'The URL that is displayed in charts.'."\n",
-                                        'type' => 'string',
-                                        'example' => 'https://sls4service.console.aliyun.com/lognext/project/aliyun-cloudsiem-data-127608589417****-cn-shanghai'."\n"
-                                            .'/dashboard/cloud-siem?isShare=true&hideTopbar=true&hideSidebar=true&ignoreTabLocalStorage=true',
-                                    ],
-                                    'DisplaySwitchOrNot' => [
-                                        'title' => '是否展示投递开关，默认true，取值：'."\n"
-                                            .'- true：显示投递开关'."\n"
-                                            .'- false：隐藏投递开关',
-                                        'description' => 'Indicates whether the log delivery switch is displayed. Default value: true. Valid values:'."\n"
-                                            ."\n"
-                                            .'*   true'."\n"
-                                            .'*   false'."\n",
-                                        'type' => 'boolean',
-                                        'example' => 'true',
-                                    ],
-                                    'ProductList' => [
-                                        'title' => '接入的产品列表。',
-                                        'description' => 'The cloud services.'."\n",
-                                        'type' => 'array',
-                                        'items' => [
-                                            'description' => '',
-                                            'type' => 'object',
-                                            'properties' => [
-                                                'ProductCode' => [
-                                                    'title' => '云产品编码。取值：'."\n"
-                                                        .'- qcloud_waf'."\n"
-                                                        .'- qlcoud_cfw'."\n"
-                                                        .'- hcloud_waf'."\n"
-                                                        .'- hcloud_cfw'."\n"
-                                                        .'- ddos'."\n"
-                                                        .'- sas'."\n"
-                                                        .'- cfw'."\n"
-                                                        .'- config'."\n"
-                                                        .'- csk'."\n"
-                                                        .'- fc'."\n"
-                                                        .'- rds'."\n"
-                                                        .'- nas'."\n"
-                                                        .'- apigateway'."\n"
-                                                        .'- cdn'."\n"
-                                                        .'- mongodb'."\n"
-                                                        .'- eip'."\n"
-                                                        .'- slb'."\n"
-                                                        .'- vpc'."\n"
-                                                        .'- actiontrail'."\n"
-                                                        .'- waf'."\n"
-                                                        .'- bastionhost'."\n"
-                                                        .'- oss'."\n"
-                                                        .'- polardb',
-                                                    'description' => 'The code of the cloud service. Valid values:'."\n"
-                                                        ."\n"
-                                                        .'*   qcloud_waf'."\n"
-                                                        .'*   qlcoud_cfw'."\n"
-                                                        .'*   hcloud_waf'."\n"
-                                                        .'*   hcloud_cfw'."\n"
-                                                        .'*   ddos'."\n"
-                                                        .'*   sas'."\n"
-                                                        .'*   cfw'."\n"
-                                                        .'*   config'."\n"
-                                                        .'*   csk'."\n"
-                                                        .'*   fc'."\n"
-                                                        .'*   rds'."\n"
-                                                        .'*   nas'."\n"
-                                                        .'*   apigateway'."\n"
-                                                        .'*   cdn'."\n"
-                                                        .'*   mongodb'."\n"
-                                                        .'*   eip'."\n"
-                                                        .'*   slb'."\n"
-                                                        .'*   vpc'."\n"
-                                                        .'*   actiontrail'."\n"
-                                                        .'*   waf'."\n"
-                                                        .'*   bastionhost'."\n"
-                                                        .'*   oss'."\n"
-                                                        .'*   polardb'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'sas',
-                                                ],
-                                                'ProductName' => [
-                                                    'title' => '所属厂商名称',
-                                                    'description' => 'This parameter is deprecated.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'Security Center',
-                                                ],
-                                                'LogMap' => [
-                                                    'title' => '存在日志分类的日志列表',
-                                                    'description' => 'The log group. For example, in Security Center, the logs of hosts and networks are stored in different groups. Key indicates the group information, and value indicates the logs in the group.'."\n",
-                                                    'type' => 'object',
-                                                    'additionalProperties' => [
-                                                        'type' => 'array',
-                                                        'items' => [
-                                                            'type' => 'object',
-                                                            'properties' => [
-                                                                'LogCode' => [
-                                                                    'title' => '日志编码。',
-                                                                    'type' => 'string',
-                                                                    'example' => 'cloud_siem_config_log',
-                                                                    'description' => 'The code of the log.'."\n",
-                                                                ],
-                                                                'LogName' => [
-                                                                    'title' => '日志中文名字。',
-                                                                    'type' => 'string',
-                                                                    'description' => 'This parameter is deprecated.'."\n",
-                                                                    'example' => 'audit log',
-                                                                ],
-                                                                'LogNameEn' => [
-                                                                    'title' => '日志英文名字。',
-                                                                    'type' => 'string',
-                                                                    'example' => 'audit log',
-                                                                    'description' => 'This parameter is deprecated.'."\n",
-                                                                ],
-                                                                'LogNameKey' => [
-                                                                    'title' => '日志语言编码，用于进行多语言名字的展示。',
-                                                                    'type' => 'string',
-                                                                    'example' => '${sas.cloudsiem.prod.cloud_siem_aegis_crack_from_beaver}',
-                                                                    'description' => 'The language code of the log that is used to indicate the language in which the log is displayed.'."\n",
-                                                                ],
-                                                                'Status' => [
-                                                                    'title' => '日志投递状态。',
-                                                                    'type' => 'boolean',
-                                                                    'description' => 'The status of the log delivery. Valid values:'."\n"
-                                                                        ."\n"
-                                                                        .'*   true: The logs are being delivered.'."\n"
-                                                                        .'*   false: The log delivery feature is disabled.'."\n",
-                                                                    'example' => 'true',
-                                                                ],
-                                                                'CanOperateOrNot' => [
-                                                                    'title' => '是否可以操作投递开关。',
-                                                                    'type' => 'boolean',
-                                                                    'example' => 'true',
-                                                                    'description' => 'Indicates whether the log delivery feature can be enabled or disabled. The feature can be enabled or disabled only by the administrator of the threat analysis feature. Valid values:'."\n"
-                                                                        ."\n"
-                                                                        .'*   true'."\n"
-                                                                        .'*   false'."\n",
-                                                                ],
-                                                                'Topic' => [
-                                                                    'title' => '日志在用户侧存储的Topic。',
-                                                                    'type' => 'string',
-                                                                    'description' => 'The topic of the log in the Logstore. The value is an index field in the Logstore that can be used to distinguish different logs.'."\n",
-                                                                    'example' => 'sas_login_event',
-                                                                ],
-                                                                'ExtraParameters' => [
-                                                                    'title' => '扩展参数。',
-                                                                    'type' => 'array',
-                                                                    'items' => [
-                                                                        'type' => 'object',
-                                                                        'properties' => [
-                                                                            'Key' => [
-                                                                                'type' => 'string',
-                                                                                'example' => 'flag',
-                                                                                'description' => 'The ID of the extended parameter.'."\n",
-                                                                            ],
-                                                                            'Value' => [
-                                                                                'type' => 'string',
-                                                                                'example' => 'value',
-                                                                                'description' => 'The value of the extended parameter.'."\n",
-                                                                            ],
-                                                                        ],
-                                                                        'description' => '',
-                                                                    ],
-                                                                    'description' => 'The extended parameter.'."\n",
-                                                                ],
-                                                            ],
-                                                            'description' => '',
-                                                        ],
-                                                        'description' => 'The logs in a log group.'."\n",
-                                                    ],
-                                                ],
-                                                'LogList' => [
-                                                    'title' => '不存在日志分类的日志列表',
-                                                    'description' => 'The logs of the cloud services.'."\n",
-                                                    'type' => 'array',
-                                                    'items' => [
-                                                        'description' => '',
-                                                        'type' => 'object',
-                                                        'properties' => [
-                                                            'LogCode' => [
-                                                                'title' => '日志编码。',
-                                                                'description' => 'The code of the log.'."\n",
-                                                                'type' => 'string',
-                                                                'example' => 'cloud_siem_config_log',
-                                                            ],
-                                                            'LogName' => [
-                                                                'title' => '日志中文名字。',
-                                                                'description' => 'This parameter is deprecated.'."\n",
-                                                                'type' => 'string',
-                                                                'example' => 'audit log',
-                                                            ],
-                                                            'LogNameEn' => [
-                                                                'title' => '日志英文名字。',
-                                                                'description' => 'This parameter is deprecated.'."\n",
-                                                                'type' => 'string',
-                                                                'example' => 'audit log'."\n",
-                                                            ],
-                                                            'LogNameKey' => [
-                                                                'title' => '日志语言编码，用于进行多语言名字的展示。',
-                                                                'description' => 'The language code of the log that is used to indicate the language in which the log is displayed.'."\n",
-                                                                'type' => 'string',
-                                                                'example' => '${sas.cloudsiem.prod.cloud_siem_aegis_crack_from_beaver}',
-                                                            ],
-                                                            'Status' => [
-                                                                'title' => '日志投递状态。',
-                                                                'description' => 'The status of the log delivery. Valid values:'."\n"
-                                                                    ."\n"
-                                                                    .'*   true: The logs are being delivered.'."\n"
-                                                                    .'*   false: The log delivery feature is disabled.'."\n",
-                                                                'type' => 'boolean',
-                                                                'example' => 'true',
-                                                            ],
-                                                            'CanOperateOrNot' => [
-                                                                'title' => '是否可以操作投递开关。',
-                                                                'description' => 'Indicates whether the log delivery feature can be enabled or disabled. The feature can be enabled or disabled only by the administrator of the threat analysis feature. Valid values:'."\n"
-                                                                    ."\n"
-                                                                    .'*   true'."\n"
-                                                                    .'*   false'."\n",
-                                                                'type' => 'boolean',
-                                                                'example' => 'true',
-                                                            ],
-                                                            'Topic' => [
-                                                                'title' => '日志在用户侧存储的Topic。',
-                                                                'description' => 'The topic of the log in the Logstore. The value is an index field in the Logstore that can be used to distinguish different logs.'."\n",
-                                                                'type' => 'string',
-                                                                'example' => 'sas_login_event',
-                                                            ],
-                                                            'ExtraParameters' => [
-                                                                'title' => '扩展参数。',
-                                                                'description' => 'The extended parameter.'."\n",
-                                                                'type' => 'array',
-                                                                'items' => [
-                                                                    'description' => '',
-                                                                    'type' => 'object',
-                                                                    'properties' => [
-                                                                        'Key' => [
-                                                                            'description' => 'The ID of the extended parameter.'."\n",
-                                                                            'type' => 'string',
-                                                                            'example' => 'flag',
-                                                                        ],
-                                                                        'Value' => [
-                                                                            'description' => 'The value of the extended parameter.'."\n",
-                                                                            'type' => 'string',
-                                                                            'example' => 'value',
-                                                                        ],
-                                                                    ],
-                                                                ],
-                                                            ],
-                                                        ],
-                                                    ],
-                                                ],
-                                            ],
-                                        ],
-                                    ],
-                                ],
-                            ],
-                            'RequestId' => [
-                                'title' => '请求消息ID。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '6276D891-58D4-55B2-87B9-74D413F7****',
-                            ],
+                            'Data' => ['title' => '', 'description' => 'The data returned.', 'type' => 'string', 'example' => '123456'],
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The request was successful.'."\n"
+                                ."\n"
+                                .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The returned message.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorCode' => 'InternalError',
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                    ],
-                    [
-                        'errorCode' => 'SLS.Sls4Service.Error',
-                        'errorMessage' => 'The Simple Log Service about embedding console pages is unavailable.',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"ProjectName\\": \\"aliyun-cloudsiem-data-127608589417****-cn-shanghai\\",\\n    \\"LogStoreName\\": \\"cloud-siem\\",\\n    \\"SearchUrl\\": \\"https://sls4service.console.aliyun.com/lognext/project/aliyun-cloudsiem-data-127608589417****-cn-shanghai\\\\n/logsearch/cloud-siem?isShare=true&hideTopbar=true&hideSidebar=true&ignoreTabLocalStorage=true\\",\\n    \\"DashboardUrl\\": \\"https://sls4service.console.aliyun.com/lognext/project/aliyun-cloudsiem-data-127608589417****-cn-shanghai\\\\n/dashboard/cloud-siem?isShare=true&hideTopbar=true&hideSidebar=true&ignoreTabLocalStorage=true\\",\\n    \\"DisplaySwitchOrNot\\": true,\\n    \\"ProductList\\": [\\n      {\\n        \\"ProductCode\\": \\"sas\\",\\n        \\"ProductName\\": \\"Security Center\\",\\n        \\"LogMap\\": {\\n          \\"key\\": [\\n            {\\n              \\"LogCode\\": \\"cloud_siem_config_log\\",\\n              \\"LogName\\": \\"audit log\\",\\n              \\"LogNameEn\\": \\"audit log\\",\\n              \\"LogNameKey\\": \\"${sas.cloudsiem.prod.cloud_siem_aegis_crack_from_beaver}\\",\\n              \\"Status\\": true,\\n              \\"CanOperateOrNot\\": true,\\n              \\"Topic\\": \\"sas_login_event\\",\\n              \\"ExtraParameters\\": [\\n                {\\n                  \\"Key\\": \\"flag\\",\\n                  \\"Value\\": \\"value\\"\\n                }\\n              ]\\n            }\\n          ]\\n        },\\n        \\"LogList\\": [\\n          {\\n            \\"LogCode\\": \\"cloud_siem_config_log\\",\\n            \\"LogName\\": \\"audit log\\",\\n            \\"LogNameEn\\": \\"audit log\\\\n\\",\\n            \\"LogNameKey\\": \\"${sas.cloudsiem.prod.cloud_siem_aegis_crack_from_beaver}\\",\\n            \\"Status\\": true,\\n            \\"CanOperateOrNot\\": true,\\n            \\"Topic\\": \\"sas_login_event\\",\\n            \\"ExtraParameters\\": [\\n              {\\n                \\"Key\\": \\"flag\\",\\n                \\"Value\\": \\"value\\"\\n              }\\n            ]\\n          }\\n        ]\\n      }\\n    ]\\n  },\\n  \\"RequestId\\": \\"6276D891-58D4-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
-            'title' => 'ListDelivery',
-        ],
-        'OpenDelivery' => [
-            'summary' => 'Enables the log delivery feature for a cloud service that is integrated with Simple Log Service.',
-            'methods' => [
-                'get',
-                'post',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'PostEventWhiteruleList',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:43:22.000Z', 'description' => 'Error codes changed, Request parameters changed'],
             ],
-            'schemes' => [
-                'http',
-                'https',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'PostEventWhiteruleList'],
+                ],
             ],
+            'ramActions' => [
+                [
+                    'operationType' => 'create',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:PostEventWhiteruleList',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
+            ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": \\"123456\\",\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
+        ],
+        'PostFinishCustomizeRuleTest' => [
+            'methods' => ['get', 'post'],
+            'schemes' => ['https', 'http'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'write',
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'create',
-                'riskType' => 'none',
-                'chargeType' => 'paid',
-                'abilityTreeCode' => '154876',
-                'abilityTreeNodes' => [
-                    'FEATUREsasRXJ9SY',
-                ],
-            ],
+            'systemTags' => ['operationType' => 'update', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
-                    'name' => 'ProductCode',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '云产品的编码。取值：'."\n"
-                            .'- qcloud_waf'."\n"
-                            .'- qlcoud_cfw'."\n"
-                            .'- hcloud_waf'."\n"
-                            .'- hcloud_cfw'."\n"
-                            .'- ddos'."\n"
-                            .'- sas'."\n"
-                            .'- cfw'."\n"
-                            .'- config'."\n"
-                            .'- csk'."\n"
-                            .'- fc'."\n"
-                            .'- rds'."\n"
-                            .'- nas'."\n"
-                            .'- apigateway'."\n"
-                            .'- cdn'."\n"
-                            .'- mongodb'."\n"
-                            .'- eip'."\n"
-                            .'- slb'."\n"
-                            .'- vpc'."\n"
-                            .'- actiontrail'."\n"
-                            .'- waf'."\n"
-                            .'- bastionhost'."\n"
-                            .'- oss'."\n"
-                            .'- polardb',
-                        'description' => 'The code of the cloud service. Valid values:'."\n"
-                            ."\n"
-                            .'*   qcloud_waf'."\n"
-                            .'*   qlcoud_cfw'."\n"
-                            .'*   hcloud_waf'."\n"
-                            .'*   hcloud_cfw'."\n"
-                            .'*   ddos'."\n"
-                            .'*   sas'."\n"
-                            .'*   cfw'."\n"
-                            .'*   config'."\n"
-                            .'*   csk'."\n"
-                            .'*   fc'."\n"
-                            .'*   rds'."\n"
-                            .'*   nas'."\n"
-                            .'*   apigateway'."\n"
-                            .'*   cdn'."\n"
-                            .'*   mongodb'."\n"
-                            .'*   eip'."\n"
-                            .'*   slb'."\n"
-                            .'*   vpc'."\n"
-                            .'*   actiontrail'."\n"
-                            .'*   waf'."\n"
-                            .'*   bastionhost'."\n"
-                            .'*   oss'."\n"
-                            .'*   polardb'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'cfw',
-                    ],
-                ],
-                [
-                    'name' => 'LogCode',
+                    'name' => 'Id',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '云产品下的日志code，比如云安全中心的进程日志，取值参考ListDelivery的返回值。',
-                        'description' => 'The log code of the cloud service, such as the code of the process log for Security Center. This parameter is optional. If you leave this parameter empty, operations are performed on all logs of the cloud service.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cloud_siem_cfw_flow',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The ID of the custom rule.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '123456789'],
                 ],
                 [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['description' => 'The type of the view.'."\n"
+                        ."\n"
+                        .'- 0: The view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: The view of all accounts within the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member. This parameter is used when an administrator switches to a member\'s view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the region where your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region of the Data Management center for threat analysis. Select the region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: The assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: The assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'CloudSiemSuccessResponse<Boolean>',
-                        'description' => 'CloudSiemResponse'."\n",
+                        'title' => 'BaseResponse',
+                        'description' => 'BaseResponse',
                         'type' => 'object',
                         'properties' => [
-                            'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'Indicates whether the log delivery feature is enabled. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求消息ID。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '15FD134E-D69B-51E8-B052-73F97BD8****',
-                            ],
+                            'Data' => ['title' => '', 'description' => 'The data returned.', 'type' => 'any', 'example' => '123456'],
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request is successful. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The request is successful.'."\n"
+                                ."\n"
+                                .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The message returned.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
-                400 => [
-                    [
-                        'errorCode' => 'Siem.Delivery.MissingProductCode',
-                        'errorMessage' => 'ProductCode is mandatory for this action.',
-                    ],
-                ],
                 500 => [
-                    [
-                        'errorCode' => 'InternalError',
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                    ],
-                    [
-                        'errorCode' => 'Siem.Delivery.ErrorMapping',
-                        'errorMessage' => 'The Mapping between productCode and logCode is error.',
-                    ],
-                    [
-                        'errorCode' => 'Siem.Delivery.ErrorProductCode',
-                        'errorMessage' => 'ProductCode is error for this action.',
-                    ],
-                    [
-                        'errorCode' => 'SLS.Ship.Error',
-                        'errorMessage' => 'The Simple Log Service about data shipping is unavailable.',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": true,\\n  \\"RequestId\\": \\"15FD134E-D69B-51E8-B052-73F97BD8****\\"\\n}","type":"json"}]',
-            'title' => 'OpenDelivery',
-        ],
-        'CloseDelivery' => [
-            'summary' => 'Disables the log delivery feature for a cloud service.',
-            'methods' => [
-                'get',
-                'post',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'PostFinishCustomizeRuleTest',
+            'summary' => 'Finishes the test for a custom rule.',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:43:23.000Z', 'description' => 'Error codes changed, Request parameters changed'],
             ],
-            'schemes' => [
-                'http',
-                'https',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'PostFinishCustomizeRuleTest'],
+                ],
             ],
+            'ramActions' => [
+                [
+                    'operationType' => 'update',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:PostFinishCustomizeRuleTest',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
+            ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": \\"123456\\",\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
+        ],
+        'PostRuleStatusChange' => [
+            'summary' => 'Updates the statuses of custom rules.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['https', 'http'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'readAndWrite',
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'update',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-                'abilityTreeCode' => '154877',
-                'abilityTreeNodes' => [
-                    'FEATUREsasRXJ9SY',
-                ],
-            ],
+            'systemTags' => ['operationType' => 'update', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
-                    'name' => 'ProductCode',
+                    'name' => 'Ids',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '云产品的编码。取值：'."\n"
-                            .'- qcloud_waf'."\n"
-                            .'- qlcoud_cfw'."\n"
-                            .'- hcloud_waf'."\n"
-                            .'- hcloud_cfw'."\n"
-                            .'- ddos'."\n"
-                            .'- sas'."\n"
-                            .'- cfw'."\n"
-                            .'- config'."\n"
-                            .'- csk'."\n"
-                            .'- fc'."\n"
-                            .'- rds'."\n"
-                            .'- nas'."\n"
-                            .'- apigateway'."\n"
-                            .'- cdn'."\n"
-                            .'- mongodb'."\n"
-                            .'- eip'."\n"
-                            .'- slb'."\n"
-                            .'- vpc'."\n"
-                            .'- actiontrail'."\n"
-                            .'- waf'."\n"
-                            .'- bastionhost'."\n"
-                            .'- oss'."\n"
-                            .'- polardb',
-                        'description' => 'The code of the cloud service. Valid values:'."\n"
-                            ."\n"
-                            .'*   qcloud_waf'."\n"
-                            .'*   qlcoud_cfw'."\n"
-                            .'*   hcloud_waf'."\n"
-                            .'*   hcloud_cfw'."\n"
-                            .'*   ddos'."\n"
-                            .'*   sas'."\n"
-                            .'*   cfw'."\n"
-                            .'*   config'."\n"
-                            .'*   csk'."\n"
-                            .'*   fc'."\n"
-                            .'*   rds'."\n"
-                            .'*   nas'."\n"
-                            .'*   apigateway'."\n"
-                            .'*   cdn'."\n"
-                            .'*   mongodb'."\n"
-                            .'*   eip'."\n"
-                            .'*   slb'."\n"
-                            .'*   vpc'."\n"
-                            .'*   actiontrail'."\n"
-                            .'*   waf'."\n"
-                            .'*   bastionhost'."\n"
-                            .'*   oss'."\n"
-                            .'*   polardb'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'sas',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'A JSON array of rule IDs.', 'type' => 'string', 'required' => false, 'example' => '[123,345]'],
                 ],
                 [
-                    'name' => 'LogCode',
+                    'name' => 'RuleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '云产品下的日志code，比如云安全中心的进程日志，取值参考ListDelivery的返回值。',
-                        'description' => 'The log code of the cloud service, such as the code of the process log for Security Center. You can obtain the log code from the response of the ListDelivery operation.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cloud_siem_aegis_proc',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The type of the rule. Valid values:'."\n"
+                        ."\n"
+                        .'- predefine: predefined rule'."\n"
+                        ."\n"
+                        .'- customize: custom rule', 'type' => 'string', 'required' => false, 'example' => 'customize'],
+                ],
+                [
+                    'name' => 'InUse',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The status of the rule. Valid values:'."\n"
+                        ."\n"
+                        .'- true: enabled'."\n"
+                        ."\n"
+                        .'- false: disabled', 'type' => 'boolean', 'required' => false, 'example' => 'true'],
                 ],
                 [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['description' => 'The type of the view.'."\n"
+                        ."\n"
+                        .'- 0: the view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: the view of all accounts that belong to the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The user ID of a member. An administrator can specify this parameter to switch to the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the region where your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region where the Data Management center of threat analysis is located. Select a region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'CloudSiemSuccessResponse<Boolean>',
-                        'description' => 'CloudSiemResponse'."\n",
+                        'title' => 'BaseResponse',
+                        'description' => 'BaseResponse',
                         'type' => 'object',
                         'properties' => [
-                            'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'Indicates whether the threat analysis feature was disabled. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求消息ID。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => 'F375A043-4F5B-55F2-A564-CC47FFC6****',
-                            ],
+                            'Data' => ['title' => '', 'description' => 'The data returned.', 'type' => 'any', 'example' => '123456'],
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request is successful. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The request is successful.'."\n"
+                                ."\n"
+                                .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The message returned.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
-                400 => [
-                    [
-                        'errorCode' => 'Siem.Delivery.MissingProductCode',
-                        'errorMessage' => 'ProductCode is mandatory for this action.',
-                    ],
-                ],
                 500 => [
-                    [
-                        'errorCode' => 'InternalError',
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                    ],
-                    [
-                        'errorCode' => 'Siem.Delivery.ErrorMapping',
-                        'errorMessage' => 'The Mapping between productCode and logCode is error.',
-                    ],
-                    [
-                        'errorCode' => 'Siem.Delivery.ErrorProductCode',
-                        'errorMessage' => 'ProductCode is error for this action.',
-                    ],
-                    [
-                        'errorCode' => 'SLS.Ship.Error',
-                        'errorMessage' => 'The Simple Log Service about data shipping is unavailable.',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": true,\\n  \\"RequestId\\": \\"F375A043-4F5B-55F2-A564-CC47FFC6****\\"\\n}","type":"json"}]',
-            'title' => 'CloseDelivery',
-        ],
-        'UpdateWhiteRuleList' => [
-            'summary' => 'Creates or updates an alert whitelist rule.',
-            'methods' => [
-                'get',
-                'post',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'PostRuleStatusChange',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:43:22.000Z', 'description' => 'Error codes changed, Request parameters changed'],
             ],
-            'schemes' => [
-                'https',
-                'http',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'PostRuleStatusChange'],
+                ],
             ],
+            'ramActions' => [
+                [
+                    'operationType' => 'update',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:PostRuleStatusChange',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
+            ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": \\"123456\\",\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
+        ],
+        'RestoreCapacity' => [
+            'summary' => 'Releases storage space. This operation is irreversible and causes data loss. Use with caution.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
@@ -18311,170 +12174,86 @@
             'deprecated' => false,
             'systemTags' => [
                 'operationType' => 'update',
-                'riskType' => 'none',
-                'chargeType' => 'free',
+                'abilityTreeCode' => '173446',
+                'abilityTreeNodes' => ['FEATUREsasRXJ9SY'],
             ],
             'parameters' => [
                 [
-                    'name' => 'WhiteRuleId',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '加白规则唯一ID。',
-                        'description' => 'The unique ID of the whitelist rule.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => true,
-                        'example' => '123456789',
-                    ],
-                ],
-                [
-                    'name' => 'IncidentUuid',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '事件全局唯一ID。',
-                        'description' => 'The UUID of the event.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '85ea4241-798f-4684-a876-65d4f0c3****',
-                    ],
-                ],
-                [
-                    'name' => 'Expression',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '告警加白规则 json对象。',
-                        'description' => 'The alert whitelist rule. The value is a JSON object.'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => '['."\n"
-                            .'      {'."\n"
-                            .'            "alertName": "webshell",'."\n"
-                            .'            "alertNameId": "webshell",'."\n"
-                            .'            "alertType": "command",'."\n"
-                            .'            "alertTypeId": "command",'."\n"
-                            .'            "expression": {'."\n"
-                            .'                  "status": 1,'."\n"
-                            .'                  "conditions": ['."\n"
-                            .'                        {'."\n"
-                            .'                              "isNot": false,'."\n"
-                            .'                              "left": {'."\n"
-                            .'                                    "value": "file_path"'."\n"
-                            .'                              },'."\n"
-                            .'                              "operator": "gt",'."\n"
-                            .'                              "right": {'."\n"
-                            .'                                    "value": "cp"'."\n"
-                            .'                              }'."\n"
-                            .'                        }'."\n"
-                            .'                  ]'."\n"
-                            .'            }'."\n"
-                            .'      }'."\n"
-                            .']',
-                    ],
-                ],
-                [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'integer',
-                        'format' => 'int32',
-                    ],
+                    'schema' => ['description' => 'The type of view. Valid values:'."\n"
+                        ."\n"
+                        .'- 0: The view for the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: The view for all accounts that belong to the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'integer',
-                        'format' => 'int64',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member. An administrator can use this parameter to switch to the perspective of a specific member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region where the Data Management center is located. Select a region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'BaseResponse',
-                        'description' => 'BaseResponse'."\n",
+                        'title' => 'CloudSiemResponse<Boolean>',
+                        'description' => 'CloudSiemResponse',
                         'type' => 'object',
                         'properties' => [
-                            'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'any',
-                                'example' => '123456',
-                            ],
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true：成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
-                            ],
+                            'Data' => ['title' => '', 'description' => 'Indicates whether the delete command was sent. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The delete command was sent and the cleanup is in progress.'."\n"
+                                ."\n"
+                                .'- false: The command failed to send.', 'type' => 'boolean', 'example' => 'true'],
+                            'RequestId' => ['title' => '', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-58D4-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'title' => 'RestoreCapacity',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:44:02.000Z', 'description' => 'Request parameters changed'],
+                ['createdAt' => '2023-12-13T09:49:23.000Z', 'description' => 'Error codes changed, Request parameters changed, Response parameters changed'],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": \\"123456\\",\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
-            'title' => 'UpdateWhiteRuleList',
-        ],
-        'PostEventWhiteruleList' => [
-            'summary' => 'Submits an alert whitelist rule.',
-            'methods' => [
-                'get',
-                'post',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'RestoreCapacity'],
+                ],
             ],
-            'schemes' => [
-                'https',
-                'http',
+            'ramActions' => [
+                [
+                    'operationType' => 'update',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:RestoreCapacity',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": true,\\n  \\"RequestId\\": \\"6276D891-58D4-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+        ],
+        'SetStorage' => [
+            'summary' => 'Sets user settings, such as the storage duration and storage region.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
@@ -18482,1156 +12261,777 @@
             ],
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'create',
-                'riskType' => 'none',
-                'chargeType' => 'free',
+                'operationType' => 'update',
+                'abilityTreeCode' => '179221',
+                'abilityTreeNodes' => ['FEATUREsasRXJ9SY'],
             ],
             'parameters' => [
                 [
-                    'name' => 'IncidentUuid',
+                    'name' => 'Ttl',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '事件全局唯一ID。',
-                        'description' => 'The UUID of the event.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '85ea4241-798f-4684-a876-65d4f0c3****',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The log storage duration in days. The default value is 180. The minimum value is 30 and the maximum value is 3000.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'example' => '180'],
                 ],
                 [
-                    'name' => 'WhiteruleList',
+                    'name' => 'Region',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '告警加白规则 json对象。',
-                        'description' => 'The alert whitelist rule. The value is a JSON object.'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => '['."\n"
-                            .'      {'."\n"
-                            .'            "alertName": "webshell",'."\n"
-                            .'            "alertNameId": "webshell",'."\n"
-                            .'            "alertType": "command",'."\n"
-                            .'            "alertTypeId": "command",'."\n"
-                            .'            "expression": {'."\n"
-                            .'                  "status": 1,'."\n"
-                            .'                  "conditions": ['."\n"
-                            .'                        {'."\n"
-                            .'                              "isNot": false,'."\n"
-                            .'                              "left": {'."\n"
-                            .'                                    "value": "file_path"'."\n"
-                            .'                              },'."\n"
-                            .'                              "operator": "gt",'."\n"
-                            .'                              "right": {'."\n"
-                            .'                                    "value": "cp"'."\n"
-                            .'                              }'."\n"
-                            .'                        }'."\n"
-                            .'                  ]'."\n"
-                            .'            }'."\n"
-                            .'      }'."\n"
-                            .']',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The log storage region.'."\n"
+                        ."\n"
+                        .'If the Data Management center is in cn-hangzhou, the default value of Region is **cn-shanghai**. If the Data Management center is in **ap-southeast-1**, the default value of **Region** is **ap-southeast-1**.'."\n"
+                        ."\n"
+                        .'The log storage region cannot be changed. To change the region, contact the Threat Analysis operations team.', 'type' => 'string', 'required' => false, 'example' => 'cn-shanghai'],
                 ],
                 [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['description' => 'The type of the view.'."\n"
+                        ."\n"
+                        .'- 0: The view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: The view of all accounts in your enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member. An administrator can use this parameter to switch to the view of a specific member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region of the Data Management center for Threat Analysis. Select the region for the Data Management center based on the region of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Select this value if your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Select this value if your assets are in a region outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'BaseResponse<String>',
-                        'description' => 'BaseResponse'."\n",
+                        'title' => 'CloudSiemResponse<Boolean>',
+                        'description' => 'CloudSiemResponse',
                         'type' => 'object',
                         'properties' => [
-                            'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'string',
-                                'example' => '123456',
-                            ],
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true：成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
-                            ],
+                            'Data' => ['title' => '', 'description' => 'Indicates whether the settings were saved. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The settings were saved.'."\n"
+                                ."\n"
+                                .'- false: The settings failed to be saved.', 'type' => 'boolean', 'example' => 'true'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-58D4-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
+                400 => [
+                    ['errorCode' => 'Siem.TTL.Limit', 'errorMessage' => 'TTL should be set 30 days at least', 'description' => ''],
+                ],
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'title' => 'SetStorage',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:44:01.000Z', 'description' => 'Request parameters changed'],
+                ['createdAt' => '2023-12-13T09:49:24.000Z', 'description' => 'Error codes changed, Request parameters changed, Response parameters changed'],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": \\"123456\\",\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
-            'title' => 'PostEventWhiteruleList',
-        ],
-        'DescribeWhiteRuleList' => [
-            'summary' => 'Queries a list of whitelist rules for alerts.',
-            'methods' => [
-                'get',
-                'post',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'SetStorage'],
+                ],
             ],
-            'schemes' => [
-                'https',
-                'http',
+            'ramActions' => [
+                [
+                    'operationType' => 'update',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:SetStorage',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": true,\\n  \\"RequestId\\": \\"6276D891-58D4-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+        ],
+        'SubmitImportLogTasks' => [
+            'summary' => 'Submits a batch of log ingestion tasks.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['http', 'https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
+            'operationType' => 'write',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'list',
+                'operationType' => 'create',
                 'riskType' => 'none',
                 'chargeType' => 'free',
+                'abilityTreeCode' => '195545',
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
-                    'name' => 'AlertType',
+                    'name' => 'ProdCode',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '告警类型。',
-                        'description' => 'The type of the alert.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'scan',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The code of the product.', 'type' => 'string', 'required' => true, 'example' => 'qcloud_waf'],
                 ],
                 [
-                    'name' => 'AlertName',
+                    'name' => 'LogCodes',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '告警名称。',
-                        'description' => 'The name of the alert.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'Try SNMP weak password',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The list of logs to be ingested. The value must be a JSON array.', 'type' => 'string', 'required' => false, 'example' => '["cloud_siem_qcloud_cfw_alert_log"]'],
                 ],
                 [
-                    'name' => 'IncidentUuid',
+                    'name' => 'Accounts',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '事件ID。',
-                        'description' => 'The UUID of the event.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '85ea4241-798f-4684-a876-65d4f0c3****',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The list of accounts for log ingestion. The value must be a JSON array. Valid values:'."\n"
+                        ."\n"
+                        .'- AccountId: The ID of the account.'."\n"
+                        ."\n"
+                        .'- Imported: Specifies whether to enable or disable log ingestion for the account. Valid values:'."\n"
+                        ."\n"
+                        .'  - 0: Disable ingestion.'."\n"
+                        ."\n"
+                        .'  - 1: Enable ingestion.', 'type' => 'string', 'required' => false, 'example' => '[{"AccountId":"123123","Imported":1}]'],
                 ],
                 [
-                    'name' => 'CurrentPage',
+                    'name' => 'AutoImported',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '列表当前页号， 大于等于1。',
-                        'description' => 'The page number. Pages start from page 1.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => true,
-                        'minimum' => '1',
-                        'example' => '1',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'Specifies whether to automatically enable log ingestion for accounts that are configured with the specified log. Valid values:'."\n"
+                        ."\n"
+                        .'- 1: Yes.'."\n"
+                        ."\n"
+                        .'- 0: No.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1'],
                 ],
                 [
-                    'name' => 'PageSize',
+                    'name' => 'CloudCode',
                     'in' => 'formData',
                     'schema' => [
-                        'title' => '列表每页条数， 最大不超过100。',
-                        'description' => 'The number of entries per page. Valid values: 1 to 100.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int32',
+                        'title' => '',
+                        'description' => 'The code of the cloud service provider.',
+                        'type' => 'string',
                         'required' => true,
-                        'maximum' => '100',
-                        'minimum' => '1',
-                        'example' => '10',
+                        'enum' => ['qcloud', 'hcloud', 'aliyun', 'idc'],
+                        'example' => 'hcloud',
                     ],
                 ],
                 [
-                    'name' => 'RoleType',
+                    'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region where the data management center for Threat Analysis is located. Select a region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or Hong Kong (China).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['type' => 'integer', 'format' => 'int64', 'required' => false, 'description' => 'The user ID of the member that the administrator wants to access.', 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
-                    'name' => 'RegionId',
+                    'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['type' => 'integer', 'format' => 'int32', 'required' => false, 'description' => 'The type of view. Valid values:'."\n"
+                        ."\n"
+                        .'- 0: The view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: The view of all accounts within the enterprise.', 'title' => '', 'example' => '1'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'PageResponse<List<WhitelistRule>>',
-                        'description' => 'PageResponse\\<List>'."\n",
+                        'title' => 'CloudSiemSuccessResponse<SubmitImportLogTasksResult>',
+                        'description' => 'CloudSiemSuccessResponse',
                         'type' => 'object',
                         'properties' => [
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true:成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The response code.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
-                            ],
                             'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
+                                'title' => '',
+                                'description' => 'The data returned.',
                                 'type' => 'object',
                                 'properties' => [
-                                    'PageInfo' => [
-                                        'title' => '分页记录。',
-                                        'description' => 'The pagination information.'."\n",
-                                        'type' => 'object',
-                                        'properties' => [
-                                            'CurrentPage' => [
-                                                'title' => '列表当前页号。',
-                                                'description' => 'The current page number.'."\n",
-                                                'type' => 'integer',
-                                                'format' => 'int32',
-                                                'example' => '1',
-                                            ],
-                                            'PageSize' => [
-                                                'title' => '每页返回记录数。',
-                                                'description' => 'The number of entries per page.'."\n",
-                                                'type' => 'integer',
-                                                'format' => 'int32',
-                                                'example' => '10',
-                                            ],
-                                            'TotalCount' => [
-                                                'title' => '记录总数。',
-                                                'description' => 'The total number of entries returned.'."\n",
-                                                'type' => 'integer',
-                                                'format' => 'int64',
-                                                'example' => '100',
-                                            ],
-                                        ],
-                                    ],
-                                    'ResponseData' => [
-                                        'title' => '详细数据。',
-                                        'description' => 'The detailed data.'."\n",
-                                        'type' => 'array',
-                                        'items' => [
-                                            'type' => 'object',
-                                            'properties' => [
-                                                'Id' => [
-                                                    'title' => '加白规则唯一ID。',
-                                                    'description' => 'The ID of the whitelist rule.'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int64',
-                                                    'example' => '123456789',
-                                                ],
-                                                'GmtCreate' => [
-                                                    'title' => '创建时间。',
-                                                    'description' => 'The time when the whitelist rule was created.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '2021-01-06 16:37:29',
-                                                ],
-                                                'GmtModified' => [
-                                                    'title' => '修改时间。',
-                                                    'description' => 'The time when the whitelist rule was modified.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '2021-01-06 16:37:29',
-                                                ],
-                                                'Aliuid' => [
-                                                    'title' => '规则关联siem主账号ID。',
-                                                    'description' => 'The ID of the Alibaba Cloud account that is used to purchase the threat analysis feature.'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int64',
-                                                    'example' => '127608589417****',
-                                                ],
-                                                'SubAliuid' => [
-                                                    'title' => '规则创建阿里账号ID。',
-                                                    'description' => 'The ID of the Alibaba Cloud account that is used to create the whitelist rule.'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int64',
-                                                    'example' => '176555323***',
-                                                ],
-                                                'AlertType' => [
-                                                    'title' => '告警类型。',
-                                                    'description' => 'The alert type.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'scan',
-                                                ],
-                                                'AlertTypeId' => [
-                                                    'title' => '告警类型标识。',
-                                                    'description' => 'The ID of the alert type.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'scan',
-                                                ],
-                                                'AlertName' => [
-                                                    'title' => '告警名称。',
-                                                    'description' => 'The alert name.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'Try SNMP weak password',
-                                                ],
-                                                'AlertNameId' => [
-                                                    'title' => '告警名称标识。',
-                                                    'description' => 'The ID of the alert name.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'Try SNMP weak password',
-                                                ],
-                                                'Status' => [
-                                                    'title' => '规则启用状态。 取值：'."\n"
-                                                        .'- 1：开启'."\n"
-                                                        .'- 0：关闭',
-                                                    'description' => 'The status of the whitelist rule. Valid values:'."\n"
-                                                        ."\n"
-                                                        .'*   1: enabled.'."\n"
-                                                        .'*   0: disabled.'."\n",
-                                                    'type' => 'integer',
-                                                    'format' => 'int32',
-                                                    'example' => '1',
-                                                ],
-                                                'IncidentUuid' => [
-                                                    'title' => '事件全局唯一ID。',
-                                                    'description' => 'The UUID of the event.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => '85ea4241-798f-4684-a876-65d4f0c3****',
-                                                ],
-                                                'AlertUuid' => [
-                                                    'title' => '告警ID。',
-                                                    'description' => 'The UUID of the alert.'."\n",
-                                                    'type' => 'string',
-                                                    'example' => 'sas_71e24437d2797ce8fc59692905a4****',
-                                                ],
-                                                'Expression' => [
-                                                    'title' => '规则集 json数组格式。',
-                                                    'description' => 'The conditions in the rule. The value is a JSON array.'."\n",
-                                                    'type' => 'object',
-                                                    'properties' => [
-                                                        'Logic' => [
-                                                            'description' => 'The logical relationships among the rule conditions.'."\n",
-                                                            'type' => 'string',
-                                                            'example' => '(1&2)|(3&4)',
-                                                        ],
-                                                        'Conditions' => [
-                                                            'description' => 'The rule conditions.'."\n",
-                                                            'type' => 'array',
-                                                            'items' => [
-                                                                'description' => '',
-                                                                'type' => 'object',
-                                                                'properties' => [
-                                                                    'ItemId' => [
-                                                                        'description' => 'The ID of the rule condition.'."\n",
-                                                                        'type' => 'integer',
-                                                                        'format' => 'int32',
-                                                                        'example' => '1',
-                                                                    ],
-                                                                    'Operator' => [
-                                                                        'description' => 'The logical operator of the rule condition. Valid values:'."\n"
-                                                                            ."\n"
-                                                                            .'*   `=`: equals to.'."\n"
-                                                                            .'*   `<>`: does not equal to.'."\n"
-                                                                            .'*   `in`: contains.'."\n"
-                                                                            .'*   `not in`: does not contain.'."\n"
-                                                                            .'*   `REGEXP`: matches a regular expression.'."\n"
-                                                                            .'*   `NOT REGEXP`: does not match a regular expression.'."\n",
-                                                                        'type' => 'string',
-                                                                        'example' => 'REGEXP',
-                                                                    ],
-                                                                    'IsNot' => [
-                                                                        'description' => 'Indicates whether the result is inverted. Valid values:'."\n"
-                                                                            ."\n"
-                                                                            .'*   true'."\n"
-                                                                            .'*   false'."\n",
-                                                                        'type' => 'boolean',
-                                                                        'example' => 'false',
-                                                                    ],
-                                                                    'Left' => [
-                                                                        'description' => 'The left operand of the rule condition.'."\n",
-                                                                        'type' => 'object',
-                                                                        'properties' => [
-                                                                            'Value' => [
-                                                                                'description' => 'The variable of the left operand.'."\n",
-                                                                                'type' => 'string',
-                                                                                'example' => 'ip',
-                                                                            ],
-                                                                            'IsVar' => [
-                                                                                'description' => 'Indicates whether the left operand is a variable. Valid values:'."\n"
-                                                                                    ."\n"
-                                                                                    .'*   true: variable.'."\n"
-                                                                                    .'*   false: constant.'."\n",
-                                                                                'type' => 'boolean',
-                                                                                'example' => 'true',
-                                                                            ],
-                                                                            'Type' => [
-                                                                                'description' => 'Indicates whether the left operand is a constant. Valid values:'."\n"
-                                                                                    ."\n"
-                                                                                    .'*   true'."\n"
-                                                                                    .'*   false'."\n",
-                                                                                'type' => 'string',
-                                                                                'example' => 'false',
-                                                                            ],
-                                                                            'Modifier' => [
-                                                                                'description' => 'The remarks on the right operand.'."\n",
-                                                                                'type' => 'string',
-                                                                                'example' => 'length',
-                                                                            ],
-                                                                            'ModifierParam' => [
-                                                                                'description' => 'The key-value pair information of the remarks.'."\n",
-                                                                                'type' => 'object',
-                                                                                'additionalProperties' => [
-                                                                                    'type' => 'any',
-                                                                                    'example' => '{"tage":"description"}',
-                                                                                    'description' => 'The key-value pair.'."\n",
-                                                                                ],
-                                                                            ],
-                                                                        ],
-                                                                    ],
-                                                                    'Right' => [
-                                                                        'description' => 'The right operand of the rule condition.'."\n",
-                                                                        'type' => 'object',
-                                                                        'properties' => [
-                                                                            'Value' => [
-                                                                                'description' => 'The right operand.'."\n",
-                                                                                'type' => 'string',
-                                                                                'example' => '12345',
-                                                                            ],
-                                                                            'IsVar' => [
-                                                                                'description' => 'Indicates whether the right operand is a constant or a runtime variable that is obtained from the runtime context. Valid values:'."\n"
-                                                                                    ."\n"
-                                                                                    .'*   true: runtime variable.'."\n"
-                                                                                    .'*   false: constant.'."\n",
-                                                                                'type' => 'boolean',
-                                                                                'example' => 'false',
-                                                                            ],
-                                                                            'Type' => [
-                                                                                'description' => 'The data type of the right operand.'."\n",
-                                                                                'type' => 'string',
-                                                                                'example' => 'String',
-                                                                            ],
-                                                                            'Modifier' => [
-                                                                                'description' => 'The remarks on the right operand.'."\n",
-                                                                                'type' => 'string',
-                                                                                'example' => 'length',
-                                                                            ],
-                                                                            'ModifierParam' => [
-                                                                                'description' => 'The key-value pair information of the remarks.'."\n",
-                                                                                'type' => 'object',
-                                                                                'additionalProperties' => [
-                                                                                    'type' => 'any',
-                                                                                    'example' => '{"tage":"description"}',
-                                                                                    'description' => 'The key-value pair.'."\n",
-                                                                                ],
-                                                                            ],
-                                                                        ],
-                                                                    ],
-                                                                ],
-                                                            ],
-                                                        ],
-                                                    ],
-                                                    'example' => '[{"conditions":[{"isNot":false,"itemId":0,"left":{"value":"host_uuid.host_name"},"operator":"containsString","right":{"value":"Cloud-MCH"}}]}]',
-                                                ],
-                                            ],
-                                        ],
-                                    ],
+                                    'Count' => ['title' => '', 'description' => 'The number of log ingestion tasks that are successfully submitted.', 'type' => 'integer', 'format' => 'int32', 'example' => '10'],
                                 ],
-                                'example' => '123456',
+                                'example' => '',
                             ],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n  \\"Data\\": {\\n    \\"PageInfo\\": {\\n      \\"CurrentPage\\": 1,\\n      \\"PageSize\\": 10,\\n      \\"TotalCount\\": 100\\n    },\\n    \\"ResponseData\\": [\\n      {\\n        \\"Id\\": 123456789,\\n        \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n        \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n        \\"Aliuid\\": 0,\\n        \\"SubAliuid\\": 0,\\n        \\"AlertType\\": \\"scan\\",\\n        \\"AlertTypeId\\": \\"scan\\",\\n        \\"AlertName\\": \\"Try SNMP weak password\\",\\n        \\"AlertNameId\\": \\"Try SNMP weak password\\",\\n        \\"Status\\": 1,\\n        \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n        \\"AlertUuid\\": \\"sas_71e24437d2797ce8fc59692905a4****\\",\\n        \\"Expression\\": {\\n          \\"Logic\\": \\"(1&2)|(3&4)\\",\\n          \\"Conditions\\": [\\n            {\\n              \\"ItemId\\": 1,\\n              \\"Operator\\": \\"REGEXP\\",\\n              \\"IsNot\\": false,\\n              \\"Left\\": {\\n                \\"Value\\": \\"ip\\",\\n                \\"IsVar\\": true,\\n                \\"Type\\": \\"false\\",\\n                \\"Modifier\\": \\"length\\",\\n                \\"ModifierParam\\": {\\n                  \\"key\\": \\"{\\\\\\"tage\\\\\\":\\\\\\"description\\\\\\"}\\"\\n                }\\n              },\\n              \\"Right\\": {\\n                \\"Value\\": \\"12345\\",\\n                \\"IsVar\\": false,\\n                \\"Type\\": \\"String\\",\\n                \\"Modifier\\": \\"length\\",\\n                \\"ModifierParam\\": {\\n                  \\"key\\": \\"{\\\\\\"tage\\\\\\":\\\\\\"description\\\\\\"}\\"\\n                }\\n              }\\n            }\\n          ]\\n        }\\n      }\\n    ]\\n  }\\n}","type":"json"}]',
-            'title' => 'DescribeWhiteRuleList',
-        ],
-        'DescribeAlertScene' => [
-            'summary' => 'Queries the scenarios in which an alert needs to be added to the whitelist.',
-            'methods' => [
-                'get',
-                'post',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'eventInfo' => [
+                'enable' => false,
+                'eventNames' => [],
             ],
-            'schemes' => [
-                'https',
-                'http',
+            'title' => 'SubmitImportLogTasks',
+            'changeSet' => [
+                ['createdAt' => '2024-09-27T08:27:57.000Z', 'description' => 'Request parameters changed'],
+                ['createdAt' => '2024-07-18T01:29:00.000Z', 'description' => 'Request parameters changed'],
             ],
-            'security' => [
-                [
-                    'AK' => [],
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'SubmitImportLogTasks'],
                 ],
             ],
-            'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'get',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-            ],
-            'parameters' => [
+            'ramActions' => [
                 [
-                    'name' => 'RoleType',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
-                ],
-                [
-                    'name' => 'RoleFor',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
-                ],
-                [
-                    'name' => 'RegionId',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
-                ],
-            ],
-            'responses' => [
-                200 => [
-                    'schema' => [
-                        'title' => 'BaseResponse<List<SceneAndTarget>>',
-                        'description' => 'BaseResponse\\<List>'."\n",
-                        'type' => 'object',
-                        'properties' => [
-                            'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'array',
-                                'items' => [
-                                    'type' => 'object',
-                                    'properties' => [
-                                        'AlertType' => [
-                                            'title' => '告警类型展示值，随中英文环境变化。',
-                                            'description' => 'The type of the alert. The value varies based on the display language (Chinese or English) of the Security Center console.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'unusual login',
-                                        ],
-                                        'AlertTypeId' => [
-                                            'title' => '告警类型标识。',
-                                            'description' => 'The ID of the alert type.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'unusual login',
-                                        ],
-                                        'AlertName' => [
-                                            'title' => '告警名称展示值，随中英文环境变化。',
-                                            'description' => 'The name of the alert. The value varies based on the display language (Chinese or English) of the Security Center console.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'login_common_ip',
-                                        ],
-                                        'AlertNameId' => [
-                                            'title' => '告警名称标识。',
-                                            'description' => 'The ID of the alert name.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'login_common_ip',
-                                        ],
-                                        'AlertTile' => [
-                                            'title' => '告警title展示值，随中英文环境变化。',
-                                            'description' => 'The title of the alert notification. The value varies based on the display language (Chinese or English) of the Security Center console.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'unusual login-login_common_ip',
-                                        ],
-                                        'AlertTileId' => [
-                                            'title' => '告警title 标识。',
-                                            'description' => 'The ID of the alert title.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'unusual login-login_common_ip',
-                                        ],
-                                        'Targets' => [
-                                            'title' => '加白对象。',
-                                            'description' => 'The information about the entities for which you need to add the alert to the whitelist.'."\n",
-                                            'type' => 'array',
-                                            'items' => [
-                                                'type' => 'object',
-                                                'properties' => [
-                                                    'Type' => [
-                                                        'title' => '可以加白的实体属性字段。',
-                                                        'description' => 'The attribute of the entity.'."\n",
-                                                        'type' => 'string',
-                                                        'example' => 'host_uuid',
-                                                    ],
-                                                    'Name' => [
-                                                        'title' => '可以加白的实体属性字段展示名。',
-                                                        'description' => 'The display name of the attribute for the entity.'."\n",
-                                                        'type' => 'string',
-                                                        'example' => 'HOST UUID',
-                                                    ],
-                                                    'Value' => [
-                                                        'title' => '加白规则默认展示的右值。',
-                                                        'description' => 'The right operand that is displayed by default in the whitelist rule.'."\n",
-                                                        'type' => 'string',
-                                                        'example' => '441862da-a539-4cc0-a00d-47395582****',
-                                                    ],
-                                                    'Values' => [
-                                                        'title' => '加白规则可选的右值。',
-                                                        'description' => 'The right operands supported by the whitelist rule.'."\n",
-                                                        'type' => 'array',
-                                                        'items' => [
-                                                            'description' => 'The right operand.'."\n",
-                                                            'type' => 'string',
-                                                            'example' => '[441862da-a539-4cc0-a00d-47395582****]',
-                                                        ],
-                                                        'example' => '["441862da-a539-4cc0-a00d-473955826881"]',
-                                                    ],
-                                                ],
-                                            ],
-                                            'example' => '[{"Type": "host_uuid","Value": "441862da-a539-4cc0-a00d-473955826881","Values": ["441862da-a539-4cc0-a00d-473955826881"],"Name": "${aliyun.siem.entity.host_uuid}"}]',
-                                        ],
-                                    ],
-                                ],
-                                'example' => '123456',
-                            ],
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true：成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The response code.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
-                            ],
+                    'operationType' => 'create',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:SubmitImportLogTasks',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
                         ],
                     ],
                 ],
             ],
-            'errorCodes' => [
-                500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
-                ],
-            ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"AlertType\\": \\"unusual login\\",\\n      \\"AlertTypeId\\": \\"unusual login\\",\\n      \\"AlertName\\": \\"login_common_ip\\",\\n      \\"AlertNameId\\": \\"login_common_ip\\",\\n      \\"AlertTile\\": \\"unusual login-login_common_ip\\",\\n      \\"AlertTileId\\": \\"unusual login-login_common_ip\\",\\n      \\"Targets\\": [\\n        {\\n          \\"Type\\": \\"host_uuid\\",\\n          \\"Name\\": \\"HOST UUID\\",\\n          \\"Value\\": \\"441862da-a539-4cc0-a00d-47395582****\\",\\n          \\"Values\\": [\\n            \\"[441862da-a539-4cc0-a00d-47395582****]\\"\\n          ]\\n        }\\n      ]\\n    }\\n  ],\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
-            'title' => 'DescribeAlertScene',
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"Count\\": 10\\n  },\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
         ],
-        'DescribeAlertSceneByEvent' => [
-            'summary' => 'Queries the scenarios and objects that can be added to an alert whitelist rule.',
-            'methods' => [
-                'get',
-                'post',
-            ],
-            'schemes' => [
-                'https',
-                'http',
-            ],
+        'UpdateAutomateResponseConfigStatus' => [
+            'methods' => ['get', 'post'],
+            'schemes' => ['https', 'http'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'get',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-            ],
+            'systemTags' => ['operationType' => 'update', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
-                    'name' => 'IncidentUuid',
+                    'name' => 'Ids',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '事件ID。',
-                        'description' => 'The ID of the event.'."\n",
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => '85ea4241-798f-4684-a876-65d4f0c3****',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'A JSON array of automated response rule IDs.', 'type' => 'string', 'required' => false, 'example' => '[123,345]'],
+                ],
+                [
+                    'name' => 'InUse',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The enabling status of the rule. Valid values:'."\n"
+                        ."\n"
+                        .'- true: enabled'."\n"
+                        ."\n"
+                        .'- false: disabled', 'type' => 'boolean', 'required' => false, 'example' => 'true'],
                 ],
                 [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['description' => 'The view type.'."\n"
+                        ."\n"
+                        .'- 0: The view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: The view of all accounts that belong to the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The ID of the member account that the administrator wants to access.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region where the Data Management center for threat analysis is deployed. You must select a region based on the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'BaseResponse<List<SceneAndTarget>>',
-                        'description' => 'BaseResponse\\<List>'."\n",
+                        'title' => 'BaseResponse<String>',
+                        'description' => 'BaseResponse',
                         'type' => 'object',
                         'properties' => [
-                            'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'array',
-                                'items' => [
-                                    'type' => 'object',
-                                    'properties' => [
-                                        'AlertType' => [
-                                            'title' => '告警类型展示值，随中英文环境变化。',
-                                            'description' => 'The alert type. The display name of the alert type varies based on the language of the system, such as Chinese and English.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'Unusual Logon',
-                                        ],
-                                        'AlertTypeId' => [
-                                            'title' => '告警类型标识。',
-                                            'description' => 'The ID of the alert type.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'Unusual Logon',
-                                        ],
-                                        'AlertName' => [
-                                            'title' => '告警名称展示值，随中英文环境变化。',
-                                            'description' => 'The alert name. The display name of the alert name varies based on the language of the system, such as Chinese and English.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'login_common_ip',
-                                        ],
-                                        'AlertNameId' => [
-                                            'title' => '告警名称标识。',
-                                            'description' => 'The ID of the alert name.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'login_common_ip',
-                                        ],
-                                        'AlertTile' => [
-                                            'title' => '告警title展示值，随中英文环境变化。',
-                                            'description' => 'The alert title. The display name of the alert title varies based on the language of the system, such as Chinese and English.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'Unusual Logon-login_common_ip',
-                                        ],
-                                        'AlertTileId' => [
-                                            'title' => '告警title 标识。',
-                                            'description' => 'The ID of the alert title.'."\n",
-                                            'type' => 'string',
-                                            'example' => 'Unusual Logon-login_common_ip',
-                                        ],
-                                        'Targets' => [
-                                            'title' => '加白对象。',
-                                            'description' => 'The objects that can be added to the whitelist.'."\n",
-                                            'type' => 'array',
-                                            'items' => [
-                                                'type' => 'object',
-                                                'properties' => [
-                                                    'Type' => [
-                                                        'title' => '可以加白的实体属性字段。',
-                                                        'description' => 'The entity attribute field that can be added to the whitelist.'."\n",
-                                                        'type' => 'string',
-                                                        'example' => 'host_uuid',
-                                                    ],
-                                                    'Name' => [
-                                                        'title' => '可以加白的实体属性字段展示名。',
-                                                        'description' => 'The display name of the entity attribute field that can be added to the whitelist.'."\n",
-                                                        'type' => 'string',
-                                                        'example' => 'host uuid',
-                                                    ],
-                                                    'Value' => [
-                                                        'title' => '加白规则默认展示的右值。',
-                                                        'description' => 'The right operand that is displayed by default in the whitelist rule.'."\n",
-                                                        'type' => 'string',
-                                                        'example' => '441862da-a539-4cc0-a00d-47395582****',
-                                                    ],
-                                                    'Values' => [
-                                                        'title' => '加白规则可选的右值。',
-                                                        'description' => 'The supported right operands of the whitelist rule.'."\n",
-                                                        'type' => 'array',
-                                                        'items' => [
-                                                            'description' => 'The right operand.'."\n",
-                                                            'type' => 'string',
-                                                            'example' => '[441862da-a539-4cc0-a00d-47395582****]',
-                                                        ],
-                                                        'example' => '["441862da-a539-4cc0-a00d-473955826881"]',
-                                                    ],
-                                                ],
-                                            ],
-                                            'example' => '[{"Type": "host_uuid","Value": "441862da-a539-4cc0-a00d-473955826881","Values": ["441862da-a539-4cc0-a00d-473955826881"],"Name": "${aliyun.siem.entity.host_uuid}"}]',
-                                        ],
-                                    ],
-                                ],
-                                'example' => '123456',
-                            ],
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true：成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
-                            ],
+                            'Data' => ['title' => '', 'description' => 'The return value of the request.', 'type' => 'string', 'example' => '123456'],
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The request was successful.'."\n"
+                                ."\n"
+                                .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The message returned for the request.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'UpdateAutomateResponseConfigStatus',
+            'summary' => 'Updates the status of an automated response rule.',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:43:23.000Z', 'description' => 'Error codes changed, Request parameters changed'],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": [\\n    {\\n      \\"AlertType\\": \\"Unusual Logon\\",\\n      \\"AlertTypeId\\": \\"Unusual Logon\\",\\n      \\"AlertName\\": \\"login_common_ip\\",\\n      \\"AlertNameId\\": \\"login_common_ip\\",\\n      \\"AlertTile\\": \\"Unusual Logon-login_common_ip\\",\\n      \\"AlertTileId\\": \\"Unusual Logon-login_common_ip\\",\\n      \\"Targets\\": [\\n        {\\n          \\"Type\\": \\"host_uuid\\",\\n          \\"Name\\": \\"host uuid\\",\\n          \\"Value\\": \\"441862da-a539-4cc0-a00d-47395582****\\",\\n          \\"Values\\": [\\n            \\"[441862da-a539-4cc0-a00d-47395582****]\\"\\n          ]\\n        }\\n      ]\\n    }\\n  ],\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
-            'title' => 'DescribeAlertSceneByEvent',
-        ],
-        'DeleteWhiteRuleList' => [
-            'summary' => 'Deletes an alert whitelist rule with a specified ID.',
-            'methods' => [
-                'get',
-                'post',
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'UpdateAutomateResponseConfigStatus'],
+                ],
             ],
-            'schemes' => [
-                'https',
-                'http',
+            'ramActions' => [
+                [
+                    'operationType' => 'update',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:UpdateAutomateResponseConfigStatus',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": \\"123456\\",\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
+        ],
+        'UpdateWhiteRuleList' => [
+            'summary' => 'Adds or updates alert whitelist rules.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['https', 'http'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
             'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'delete',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-            ],
+            'systemTags' => ['operationType' => 'update', 'riskType' => 'none', 'chargeType' => 'free'],
             'parameters' => [
                 [
-                    'name' => 'Id',
+                    'name' => 'WhiteRuleId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '加白规则唯一ID。',
-                        'description' => 'The unique ID of the whitelist rule.'."\n",
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => true,
-                        'example' => '123456789',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The unique ID of the whitelist rule.', 'type' => 'integer', 'format' => 'int64', 'required' => true, 'example' => '123456789'],
+                ],
+                [
+                    'name' => 'IncidentUuid',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The global unique ID of the event.', 'type' => 'string', 'required' => false, 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'],
+                ],
+                [
+                    'name' => 'Expression',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The alert whitelist rule. This is a JSON object.', 'type' => 'string', 'required' => true, 'example' => '['."\n"
+                        .'      {'."\n"
+                        .'            "alertName": "webshell",'."\n"
+                        .'            "alertNameId": "webshell",'."\n"
+                        .'            "alertType": "command",'."\n"
+                        .'            "alertTypeId": "command",'."\n"
+                        .'            "expression": {'."\n"
+                        .'                  "status": 1,'."\n"
+                        .'                  "conditions": ['."\n"
+                        .'                        {'."\n"
+                        .'                              "isNot": false,'."\n"
+                        .'                              "left": {'."\n"
+                        .'                                    "value": "file_path"'."\n"
+                        .'                              },'."\n"
+                        .'                              "operator": "gt",'."\n"
+                        .'                              "right": {'."\n"
+                        .'                                    "value": "cp"'."\n"
+                        .'                              }'."\n"
+                        .'                        }'."\n"
+                        .'                  ]'."\n"
+                        .'            }'."\n"
+                        .'      }'."\n"
+                        .']'],
                 ],
                 [
                     'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The type of the view. Valid values:'."\n"
-                            .'- 0: the current Alibaba Cloud account'."\n"
-                            .'- 1: the global account',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['description' => 'The view type.'."\n"
+                        ."\n"
+                        .'- 0: The view of the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: The view of all accounts that belong to the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => 'The ID of the account that you switch from the management account.',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member. This parameter is used when an administrator switches to the perspective of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n"
-                            .'- cn-hangzhou：资产属于中国内地与中国香港'."\n"
-                            .'- ap-southeast-1：资产属于海外地域',
-                        'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n"
-                            ."\n"
-                            .'*   cn-hangzhou: Your assets reside in regions in China.'."\n"
-                            .'*   ap-southeast-1: Your assets reside in regions outside China.'."\n",
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The region of the Data Management center for threat analysis. Select a region for the Data Management center based on the region of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'BaseResponse',
-                        'description' => 'BaseResponse'."\n",
+                        'description' => 'BaseResponse',
                         'type' => 'object',
                         'properties' => [
-                            'Data' => [
-                                'title' => '请求返回值。',
-                                'description' => 'The data returned.'."\n",
-                                'type' => 'any',
-                                'example' => '123456',
-                            ],
-                            'Success' => [
-                                'title' => '请求是否成功。取值：'."\n"
-                                    .'- true：成功'."\n"
-                                    .'- false：失败',
-                                'description' => 'Indicates whether the request was successful. Valid values:'."\n"
-                                    ."\n"
-                                    .'*   true'."\n"
-                                    .'*   false'."\n",
-                                'type' => 'boolean',
-                                'example' => 'true',
-                            ],
-                            'Code' => [
-                                'title' => '请求状态码。',
-                                'description' => 'The HTTP status code.'."\n",
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '200',
-                            ],
-                            'Message' => [
-                                'title' => '请求返回消息。',
-                                'description' => 'The returned message.'."\n",
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'RequestId' => [
-                                'title' => '请求id。',
-                                'description' => 'The request ID.'."\n",
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
-                            ],
+                            'Data' => ['title' => '', 'description' => 'The return value of the request.', 'type' => 'any', 'example' => '123456'],
+                            'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n"
+                                ."\n"
+                                .'- true: The request was successful.'."\n"
+                                ."\n"
+                                .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'],
+                            'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'],
+                            'Message' => ['title' => '', 'description' => 'The message returned for the request.', 'type' => 'string', 'example' => 'success'],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 500 => [
-                    [
-                        'errorMessage' => 'The request processing has failed due to some unknown error.',
-                        'errorCode' => 'InternalError',
-                    ],
+                    ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'UpdateWhiteRuleList',
+            'changeSet' => [
+                ['createdAt' => '2024-04-17T12:43:22.000Z', 'description' => 'Error codes changed, Request parameters changed'],
+            ],
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'UpdateWhiteRuleList'],
+                ],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'update',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:UpdateWhiteRuleList',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
             'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": \\"123456\\",\\n  \\"Success\\": true,\\n  \\"Code\\": 200,\\n  \\"Message\\": \\"success\\",\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
-            'title' => 'DeleteWhiteRuleList',
         ],
     ],
     'endpoints' => [
+        ['regionId' => 'cn-shanghai', 'regionName' => 'China (Shanghai)', 'areaId' => 'asiaPacific', 'areaName' => 'Asia Pacific', 'public' => 'cloud-siem.cn-shanghai.aliyuncs.com', 'endpoint' => 'cloud-siem.cn-shanghai.aliyuncs.com', 'vpc' => 'cloud-siem-vpc.cn-shanghai.aliyuncs.com'],
+        ['regionId' => 'ap-southeast-1', 'regionName' => 'Singapore', 'areaId' => 'asiaPacific', 'areaName' => 'Asia Pacific', 'public' => 'cloud-siem.ap-southeast-1.aliyuncs.com', 'endpoint' => 'cloud-siem.ap-southeast-1.aliyuncs.com', 'vpc' => 'cloud-siem-vpc.ap-southeast-1.aliyuncs.com'],
+    ],
+    'errorCodes' => [
+        ['code' => 'AccessKey.NotFound', 'message' => 'Access Key not found, please add access key for siem.', 'http_code' => 400, 'description' => ''],
+        ['code' => 'AssumeRoleError', 'message' => 'Specified role "AliyunServiceRoleForSasCloudSiem" is not exists.', 'http_code' => 400, 'description' => 'AliyunServiceRoleForSasCloudSiem associated role is missing.'],
+        ['code' => 'CloudSiemCustomizeRuleDuplicateRuleNameExcepiton', 'message' => 'The rule name is duplicated.', 'http_code' => 400, 'description' => 'Custom rule naming conflict.'],
+        ['code' => 'Datasets with associated references cannot be deleted', 'message' => 'Delete the dataset-related references before attempting to delete the current dataset.', 'http_code' => 400, 'description' => 'Delete the dataset-related references before attempting to delete the current dataset.'],
+        ['code' => 'Expired.Log', 'message' => 'CloudFireWall Alert Log is expired, please select CloudFireWall Real-Time Alert Log.', 'http_code' => 400, 'description' => ''],
+        ['code' => 'Forbidden.UserDenied.RdAccount', 'message' => 'Forbidden User.', 'http_code' => 403, 'description' => 'The current user is a resource directory user, please contact the administrator to add as a delegated administrator for threat analysis.'],
+        ['code' => 'ForbiddenAction', 'message' => 'Unknown error.', 'http_code' => 400, 'description' => 'Illegal operation.'],
+        ['code' => 'ForbiddenOperation', 'message' => 'Please stop log import task.', 'http_code' => 400, 'description' => ''],
+        ['code' => 'IllegalParameter', 'message' => 'The specified parameter %s is not valid, only support %s.', 'http_code' => 400, 'description' => 'Parameters'],
+        ['code' => 'InternalError', 'message' => 'The request processing has failed due to some unknown error.', 'http_code' => 500, 'description' => ''],
+        ['code' => 'InvalidOperation', 'message' => 'Accesskey %s already bound.', 'http_code' => 400, 'description' => 'AccessKey has been bound.'],
+        ['code' => 'InvalidOperation', 'message' => 'Access key %s already bound.', 'http_code' => 400, 'description' => 'AK has been bound to account%.'],
+        ['code' => 'InvalidParameter', 'message' => 'The specified parameter %s is not valid.', 'http_code' => 400, 'description' => 'Parameter is not valid, try again.'],
+        ['code' => 'InvalidUpdateRecord.Conflict', 'message' => 'Only one of selectedEntityList or unSelectedEntityList can be specified.', 'http_code' => 400, 'description' => 'User fails in performing automatic disposal'],
+        ['code' => 'Need.CfwFlowLog', 'message' => 'Cloud FireWall Real-Time Alert Log is dependency Cloud FireWall Flow Log. Please open Cloud FireWall Flow Log for account %s first.', 'http_code' => 400, 'description' => 'Real-time alert logs of Cloud Firewall depend on the flow logs of Cloud Firewall. You must first add the Cloud Firewall flow logs of account %s.'],
+        ['code' => 'NeedCfwFlowLog', 'message' => 'Cloud Firewall Traffic Log must be integrated first.', 'http_code' => 400, 'description' => 'Cloud Firewall Traffic Log must be integrated first.'],
+        ['code' => 'OrderExpired', 'message' => 'Siem Order Not Found.', 'http_code' => 403, 'description' => 'No valid threat analysis order.'],
+        ['code' => 'RamAssumeException', 'message' => 'The request processing has failed due to ram service error.', 'http_code' => 500, 'description' => 'The request processing has failed due to ram service error.'],
+        ['code' => 'Siem.Analysis.IllegalParameter', 'message' => 'Start time should less than or equal to end time.', 'http_code' => 400, 'description' => ''],
+        ['code' => 'Siem.Analysis.SQLError', 'message' => 'Analysis SQL is error.', 'http_code' => 400, 'description' => ''],
+        ['code' => 'Siem.Delivery.ErrorMapping', 'message' => 'The Mapping between productCode and logCode is error.', 'http_code' => 500, 'description' => ''],
+        ['code' => 'Siem.Delivery.ErrorProductCode', 'message' => 'ProductCode is error for this action.', 'http_code' => 500, 'description' => ''],
+        ['code' => 'Siem.Delivery.MissingProductCode', 'message' => 'ProductCode is mandatory for this action.', 'http_code' => 400, 'description' => ''],
+        ['code' => 'SIEM.Region.Duplicate', 'message' => 'The region can be set only once.', 'http_code' => 400, 'description' => 'Region can only be set once.'],
+        ['code' => 'Siem.Storage.Exception', 'message' => 'The request timed out, try again.', 'http_code' => 500, 'description' => ''],
+        ['code' => 'Siem.TTL.Limit', 'message' => 'TTL should be set 30 days at least.', 'http_code' => 400, 'description' => ''],
+        ['code' => 'Sls.Delivery.Error', 'message' => 'SLS service is unavailable.', 'http_code' => 500, 'description' => 'SLS service is unavailable.'],
+        ['code' => 'SLS.Index.Lost', 'message' => 'The SLS project initialization will take a few minutes, try again later.', 'http_code' => 400, 'description' => 'Log Service takes several minutes to create an index. Please try again later.'],
+        ['code' => 'SLS.Operation.Error', 'message' => 'SLS service is unavailable.', 'http_code' => 500, 'description' => ''],
+        ['code' => 'SLS.Project.Lost', 'message' => 'The SLS project initialization will take a few minutes, try again later.', 'http_code' => 400, 'description' => 'Log Service initialization takes several minutes. Please try again later.'],
+        ['code' => 'SLS.Ship.Error', 'message' => 'The Simple Log Service about data shipping is unavailable.', 'http_code' => 500, 'description' => ''],
+        ['code' => 'SLS.Sls4Service.Error', 'message' => 'The Simple Log Service about embedding console pages is unavailable.', 'http_code' => 500, 'description' => ''],
+        ['code' => 'UserDeliveryFailed', 'message' => 'failed in opening log delivery.', 'http_code' => 500, 'description' => 'Failed to open delivery.'],
+        ['code' => 'Siem.Delivery.ErrorMapping', 'message' => 'The Mapping between productCode and logCode is error.', 'http_code' => 400, 'description' => ''],
+        ['code' => 'Sls.Delivery.Error', 'message' => 'SLS service is unavailable.', 'http_code' => 400, 'description' => 'SLS service is unavailable.'],
+        ['code' => 'Siem.Delivery.ErrorProductCode', 'message' => 'ProductCode is error for this action.', 'http_code' => 400, 'description' => ''],
+    ],
+    'changeSet' => [
+        [
+            'apis' => [
+                ['description' => 'Request parameters changed', 'api' => 'DescribeImportedLogCount'],
+            ],
+            'createdAt' => '2024-12-16T08:47:16.000Z',
+            'description' => '',
+        ],
+        [
+            'apis' => [
+                ['description' => 'Request parameters changed, Response parameters changed', 'api' => 'DescribeAlertsWithEntity'],
+                ['description' => 'Request parameters changed', 'api' => 'DescribeAlertsWithEvent'],
+                ['description' => 'Request parameters changed', 'api' => 'DescribeCloudSiemAssets'],
+                ['description' => 'Request parameters changed, Response parameters changed', 'api' => 'DescribeCloudSiemEvents'],
+                ['description' => 'Request parameters changed, Response parameters changed', 'api' => 'DescribeDisposeAndPlaybook'],
+            ],
+            'createdAt' => '2024-11-04T11:27:25.000Z',
+            'description' => '',
+        ],
+        [
+            'apis' => [
+                ['description' => 'Request parameters changed', 'api' => 'SubmitImportLogTasks'],
+            ],
+            'createdAt' => '2024-09-27T08:28:28.000Z',
+            'description' => '',
+        ],
         [
-            'regionId' => 'cn-shanghai',
-            'endpoint' => 'cloud-siem.cn-shanghai.aliyuncs.com',
+            'apis' => [
+                ['description' => 'Request parameters changed, Response parameters changed', 'api' => 'DescribeAlerts'],
+                ['description' => 'Request parameters changed, Response parameters changed', 'api' => 'DescribeAlertsCount'],
+                ['description' => 'Request parameters changed, Response parameters changed', 'api' => 'DescribeAlertsWithEvent'],
+                ['description' => 'Response parameters changed', 'api' => 'DescribeCloudSiemEventDetail'],
+                ['description' => 'Request parameters changed, Response parameters changed', 'api' => 'ListDisposeStrategy'],
+            ],
+            'createdAt' => '2024-09-26T11:11:26.000Z',
+            'description' => '',
         ],
         [
-            'regionId' => 'ap-southeast-1',
-            'endpoint' => 'cloud-siem.ap-southeast-1.aliyuncs.com',
+            'apis' => [
+                ['description' => 'Request parameters changed, Response parameters changed', 'api' => 'DescribeCloudSiemEventDetail'],
+            ],
+            'createdAt' => '2024-09-13T03:05:13.000Z',
+            'description' => '',
+        ],
+        [
+            'apis' => [
+                ['description' => 'Request parameters changed, Response parameters changed', 'api' => 'DescribeProdCount'],
+                ['description' => 'Request parameters changed', 'api' => 'ListAccountsByLog'],
+                ['description' => 'Request parameters changed', 'api' => 'ListImportedLogsByProd'],
+            ],
+            'createdAt' => '2024-08-13T11:51:19.000Z',
+            'description' => '',
+        ],
+        [
+            'apis' => [
+                ['description' => 'Request parameters changed', 'api' => 'BindAccount'],
+                ['description' => 'Request parameters changed', 'api' => 'DeleteBindAccount'],
+                ['description' => 'Request parameters changed', 'api' => 'DescribeProdCount'],
+                ['description' => 'Request parameters changed', 'api' => 'ListAccountAccessId'],
+                ['description' => 'Request parameters changed', 'api' => 'ListBindAccount'],
+                ['description' => 'Request parameters changed', 'api' => 'ModifyBindAccount'],
+                ['description' => 'Request parameters changed', 'api' => 'SubmitImportLogTasks'],
+            ],
+            'createdAt' => '2024-07-18T01:29:20.000Z',
+            'description' => '',
+        ],
+        [
+            'apis' => [
+                ['description' => 'Request parameters changed', 'api' => 'DescribeImportedLogCount'],
+            ],
+            'createdAt' => '2024-07-08T11:46:20.000Z',
+            'description' => '',
+        ],
+        [
+            'apis' => [
+                ['description' => 'Request parameters changed, Response parameters changed', 'api' => 'ListUserProdLogs'],
+                ['description' => 'Request parameters changed, Response parameters changed', 'api' => 'ListUsersByProd'],
+            ],
+            'createdAt' => '2024-04-26T09:44:29.000Z',
+            'description' => '',
+        ],
+        [
+            'apis' => [
+                ['description' => 'Request parameters changed, Response parameters changed', 'api' => 'DescribeUserBuyStatus'],
+                ['description' => 'Request parameters changed', 'api' => 'EnableAccessForCloudSiem'],
+                ['description' => 'Request parameters changed', 'api' => 'ListAccountsByLog'],
+                ['description' => 'Request parameters changed', 'api' => 'ListAllProds'],
+                ['description' => 'Request parameters changed, Response parameters changed', 'api' => 'ListImportedLogsByProd'],
+            ],
+            'createdAt' => '2024-04-17T12:56:17.000Z',
+            'description' => '',
+        ],
+        [
+            'apis' => [
+                ['description' => 'Request parameters changed', 'api' => 'CloseDelivery'],
+                ['description' => 'Request parameters changed', 'api' => 'DescribeStorage'],
+                ['description' => 'Request parameters changed', 'api' => 'GetCapacity'],
+                ['description' => 'Request parameters changed', 'api' => 'GetStorage'],
+                ['description' => 'Request parameters changed', 'api' => 'ListDelivery'],
+                ['description' => 'Request parameters changed', 'api' => 'OpenDelivery'],
+                ['description' => 'Request parameters changed', 'api' => 'RestoreCapacity'],
+                ['description' => 'Request parameters changed', 'api' => 'SetStorage'],
+            ],
+            'createdAt' => '2024-04-17T12:44:21.000Z',
+            'description' => '',
+        ],
+        [
+            'apis' => [
+                ['description' => 'Error codes changed, Request parameters changed', 'api' => 'DeleteAutomateResponseConfig'],
+                ['description' => 'Error codes changed, Request parameters changed', 'api' => 'DeleteCustomizeRule'],
+                ['description' => 'Error codes changed, Request parameters changed', 'api' => 'DeleteWhiteRuleList'],
+                ['description' => 'Error codes changed, Request parameters changed', 'api' => 'DescribeAggregateFunction'],
+                ['description' => 'Error codes changed, Request parameters changed', 'api' => 'DescribeAlerts'],
+                ['description' => 'Error codes changed, Request parameters changed', 'api' => 'DescribeAlertScene'],
+                ['description' => 'Error codes changed, Request parameters changed', 'api' => 'DescribeAlertSceneByEvent'],
+                ['description' => 'Error codes changed, Request parameters changed', 'api' => 'DescribeAlertsCount'],
+                ['description' => 'Error codes changed, Request parameters changed', 'api' => 'DescribeAlertSource'],
+                ['description' => 'Error codes changed, Request parameters changed', 'api' => 'DescribeAlertSourceWithEvent'],
+            ],
+            'createdAt' => '2024-04-17T12:43:46.000Z',
+            'description' => '',
+        ],
+        [
+            'apis' => [
+                ['description' => 'Response parameters changed', 'api' => 'BatchJobCheck'],
+            ],
+            'createdAt' => '2024-03-27T06:33:53.000Z',
+            'description' => '',
+        ],
+        [
+            'apis' => [
+                ['description' => 'Error codes changed, Response parameters changed', 'api' => 'DescribeCloudSiemEventDetail'],
+            ],
+            'createdAt' => '2024-02-22T06:05:09.000Z',
+            'description' => '',
+        ],
+        [
+            'apis' => [
+                ['description' => 'Error codes changed, Response parameters changed', 'api' => 'DescribeDisposeAndPlaybook'],
+            ],
+            'createdAt' => '2024-01-18T11:56:49.000Z',
+            'description' => '',
+        ],
+        [
+            'apis' => [
+                ['description' => 'Error codes changed, Request parameters changed, Response parameters changed', 'api' => 'CloseDelivery'],
+                ['description' => 'Error codes changed, Request parameters changed, Response parameters changed', 'api' => 'DeleteQuickQuery'],
+                ['description' => 'Error codes changed, Request parameters changed, Response parameters changed', 'api' => 'DescribeLogStore'],
+                ['description' => 'Error codes changed, Request parameters changed, Response parameters changed', 'api' => 'DescribeStorage'],
+                ['description' => 'Error codes changed, Request parameters changed, Response parameters changed', 'api' => 'DoQuickField'],
+                ['description' => 'Error codes changed, Request parameters changed, Response parameters changed', 'api' => 'DoSelfDelegate'],
+                ['description' => 'Error codes changed, Request parameters changed, Response parameters changed', 'api' => 'GetCapacity'],
+                ['description' => 'Error codes changed, Request parameters changed, Response parameters changed', 'api' => 'GetHistograms'],
+                ['description' => 'Error codes changed, Request parameters changed, Response parameters changed', 'api' => 'GetLogs'],
+                ['description' => 'Error codes changed, Request parameters changed, Response parameters changed', 'api' => 'GetQuickQuery'],
+            ],
+            'createdAt' => '2023-12-13T09:49:43.000Z',
+            'description' => '',
+        ],
+    ],
+    'flowControl' => [
+        'flowControlList' => [
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeServiceStatus'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DeleteCustomizeRule'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAlertsWithEntity'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListEntities'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'UpdateWhiteRuleList'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeCloudSiemEventDetail'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListAccountsByLog'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'UpdateAutomateResponseConfigStatus'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAlertType'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeProdCount'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAlertsWithEvent'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'EnableServiceForCloudSiem'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'PostEventDisposeAndWhiteruleList'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeLogSource'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAlertSceneByEvent'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeDataSourceParameters'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'RestoreCapacity'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'SetStorage'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListProjectLogStores'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeDisposeStrategyPlaybook'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeScopeUsers'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListDataSourceLogs'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'PostAutomateResponseConfig'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAlertSource'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListDisposeStrategy'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeDisposeAndPlaybook'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeCloudSiemAssetsCounter'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'GetCapacity'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListDelivery'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'GetStorage'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAlertScene'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListCustomizeRuleTestResult'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DeleteDataSourceLog'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ModifyDataSource'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'EnableAccessForCloudSiem'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'AddDataSourceLog'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeEntityInfo'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListBindDataSources'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'PostCustomizeRule'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeEventDispose'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'CloseDelivery'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListCloudSiemCustomizeRules'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAutomateResponseConfigCounter'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeCloudSiemAssets'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListAutomateResponseConfigs'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListRdUsers'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'PostFinishCustomizeRuleTest'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeLogFields'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListAccountAccessId'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'AddUserSourceLogConfig'],
+            ['threshold' => '15', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAuth'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'OpenDelivery'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeEventCountByThreatLevel'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeStorage'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DeleteAutomateResponseConfig'],
+            ['threshold' => '-1', 'countWindow' => 1, 'regionId' => '*'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeCustomizeRuleTestHistogram'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DeleteBindAccount'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeUserBuyStatus'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAlerts'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeWafScope'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ModifyBindAccount'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'PostCustomizeRuleTest'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAggregateFunction'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeLogType'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ModifyDataSourceLog'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeWhiteRuleList'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAlertSourceWithEvent'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListDataSourceTypes'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeCustomizeRuleCount'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeCustomizeRuleTest'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeCloudSiemEvents'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DeleteDataSource'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListBindAccount'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'SubmitImportLogTasks'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'PostRuleStatusChange'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAutomateResponseConfigPlayBooks'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListImportedLogsByProd'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DeleteWhiteRuleList'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'BindAccount'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeOperators'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'AddDataSource'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeImportedLogCount'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'PostEventWhiteruleList'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeDataSourceInstance'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAlertsCount'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListAllProds'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListCloudSiemPredefinedRules'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAutomateResponseConfigFeature'],
+        ],
+    ],
+    'ram' => [
+        'productCode' => 'ThreatDetection',
+        'productName' => 'Security Center',
+        'ramCodes' => ['threatdetection', 'yundun-aegis', 'yundun-sas'],
+        'ramLevel' => 'SERVICE',
+        'ramConditions' => [
+            [
+                'name' => 'acs:ResourceGroupId',
+                'schema' => ['type' => 'String', 'description' => '资源组ID'],
+            ],
         ],
+        'ramActions' => [],
+        'resourceTypes' => [],
     ],
 ];
diff --git a/data/en_us/cloud-siem/2024-12-12/api-docs.php b/data/en_us/cloud-siem/2024-12-12/api-docs.php
index 6fc871a..b0f2d99 100644
--- a/data/en_us/cloud-siem/2024-12-12/api-docs.php
+++ b/data/en_us/cloud-siem/2024-12-12/api-docs.php
@@ -1,178 +1,75 @@
 <?php return [
     'version' => '1.0',
-    'info' => [
-        'style' => 'RPC',
-        'product' => 'cloud-siem',
-        'version' => '2024-12-12',
-    ],
+    'info' => ['style' => 'RPC', 'product' => 'cloud-siem', 'version' => '2024-12-12'],
     'directories' => [
         [
-            'id' => 332850,
-            'title' => null,
+            'children' => ['GetUserConfig'],
             'type' => 'directory',
-            'children' => [
-                'GetUserConfig',
-            ],
+            'title' => 'Account management',
         ],
         [
-            'id' => 332852,
-            'title' => null,
+            'children' => ['CheckUpgradeItem', 'ExecuteUpgrade', 'ListUpgradeItems'],
             'type' => 'directory',
-            'children' => [
-                'CheckUpgradeItem',
-                'ExecuteUpgrade',
-                'ListUpgradeItems',
-            ],
+            'title' => 'Version upgrade',
         ],
         [
-            'id' => 332856,
-            'title' => null,
+            'children' => ['UpdateDataStorage', 'UpdateDataStorageTtl', 'UpdateDataStorageDelivery', 'ResetDataStorage', 'GetDataStorage'],
             'type' => 'directory',
-            'children' => [
-                'UpdateDataStorage',
-                'UpdateDataStorageTtl',
-                'UpdateDataStorageDelivery',
-                'ResetDataStorage',
-                'GetDataStorage',
-            ],
+            'title' => 'Log management',
         ],
         [
-            'id' => 332862,
-            'title' => null,
+            'children' => ['RefreshDataSource', 'UpdateDataSourceTemplate', 'ListDataSourceTemplates', 'ValidateLogStore', 'ListLogRegions', 'ListLogProjects', 'GetLogTicket'],
             'type' => 'directory',
-            'children' => [
-                'CreateDataSource',
-                'UpdateDataSource',
-                'RefreshDataSource',
-                'DeleteDataSource',
-                'ListDataSources',
-                'UpdateDataSourceTemplate',
-                'ListDataSourceTemplates',
-                'CreateLogStore',
-                'DeleteLogStore',
-                'ValidateLogStore',
-                'ListLogRegions',
-                'ListLogProjects',
-                'ListLogStores',
-                'GetLogTicket',
-            ],
+            'title' => 'Data source',
         ],
         [
-            'id' => 332881,
-            'title' => null,
+            'children' => ['CreateVendor', 'UpdateVendor', 'DeleteVendor', 'ListVendors', 'CreateDataIngestion', 'EnableDataIngestion', 'DisableDataIngestion', 'UpdateDataIngestion', 'DeleteDataIngestion', 'GetDataBatchIngestion', 'UpdateDataBatchIngestion', 'ListDataIngestions', 'UpdateDataIngestionTemplate', 'ListDataIngestionTemplates', 'ListTrafficStatistics', 'ExecuteLogQuery'],
             'type' => 'directory',
-            'children' => [
-                'CreateProduct',
-                'UpdateProduct',
-                'DeleteProduct',
-                'ListProducts',
-                'CreateVendor',
-                'UpdateVendor',
-                'DeleteVendor',
-                'ListVendors',
-                'CreateDataIngestion',
-                'EnableDataIngestion',
-                'DisableDataIngestion',
-                'UpdateDataIngestion',
-                'DeleteDataIngestion',
-                'GetDataBatchIngestion',
-                'UpdateDataBatchIngestion',
-                'ListDataIngestions',
-                'UpdateDataIngestionTemplate',
-                'ListDataIngestionTemplates',
-                'ListTrafficStatistics',
-                'ExecuteLogQuery',
-            ],
+            'title' => 'Data ingestion',
         ],
         [
-            'id' => 332906,
-            'title' => null,
+            'children' => ['CreateNormalizationRule', 'UpdateNormalizationRule', 'DeleteNormalizationRule', 'ValidateNormalizationRule', 'GetNormalizationRule', 'GetNormalizationSchema', 'GetNormalizationRuleVersion', 'DeleteNormalizationRuleVersion', 'SetDefaultNormalizationRuleVersion', 'ListNormalizationRuleVersions', 'ListNormalizationRules', 'ListNormalizationFields', 'ListNormalizationCategories', 'ListNormalizationRuleCapacities', 'ListNormalizationSchemas'],
             'type' => 'directory',
-            'children' => [
-                'CreateNormalizationRule',
-                'UpdateNormalizationRule',
-                'DeleteNormalizationRule',
-                'ValidateNormalizationRule',
-                'GetNormalizationRule',
-                'GetNormalizationSchema',
-                'GetNormalizationRuleVersion',
-                'DeleteNormalizationRuleVersion',
-                'SetDefaultNormalizationRuleVersion',
-                'ListNormalizationRuleVersions',
-                'ListNormalizationRules',
-                'ListNormalizationFields',
-                'ListNormalizationCategories',
-                'ListNormalizationRuleCapacities',
-                'ListNormalizationSchemas',
-            ],
+            'title' => 'Data normalization',
         ],
         [
-            'id' => 332922,
-            'title' => null,
+            'children' => ['UpdateDataSetRecord', 'DeleteDataSetRecord', 'ListDataSetRecords'],
             'type' => 'directory',
-            'children' => [
-                'CreateDataSet',
-                'UpdateDataSet',
-                'DeleteDataSet',
-                'ListDataSets',
-                'UpdateDataSetRecord',
-                'DeleteDataSetRecord',
-                'ListDataSetRecords',
-            ],
+            'title' => 'Dataset',
         ],
         [
-            'id' => 332930,
-            'title' => null,
+            'children' => ['CreateDetectionRule', 'UpdateDetectionRule', 'DeleteDetectionRule', 'ListDetectionRules', 'GetDetectionStatistic'],
             'type' => 'directory',
-            'children' => [
-                'CreateDetectionRule',
-                'UpdateDetectionRule',
-                'DeleteDetectionRule',
-                'ListDetectionRules',
-                'GetDetectionStatistic',
-            ],
+            'title' => 'Detection rule',
         ],
         [
-            'id' => 332936,
-            'title' => null,
+            'children' => ['ListIncidents', 'GetIncident'],
             'type' => 'directory',
-            'children' => [
-                'GetIncident',
-                'ListIncidents',
-            ],
+            'title' => 'Security event',
         ],
         [
-            'id' => 332939,
-            'title' => null,
+            'children' => ['CreateExportTask', 'GetExportTask'],
             'type' => 'directory',
-            'children' => [
-                'CreateExportTask',
-                'GetExportTask',
-            ],
+            'title' => 'Export task',
         ],
         [
-            'id' => 0,
-            'title' => '其它',
-            'type' => 'directory',
             'children' => [
-                'UpdateNormalizationSchema',
-                'CreateNormalizationSchema',
+                'CreateAutoDisposeConfig', 'CreateDataSet', 'CreateDataSource', 'CreateLogStore', 'CreateNormalizationSchema', 'CreateProduct', 'CreateResponseRule', 'DeleteDataSet', 'DeleteDataSource', 'DeleteLogStore', 'DeleteProduct', 'DeleteResponseRule', 'ExecuteAutoDisposeRecords', 'GetAutoDisposeConfig', 'ListAutoDisposeEntities', 'ListDataSets', 'ListDataSources', 'ListLogStores', 'ListProducts', 'ListResponseRules',
+                'UpdateAutoDisposeConfig', 'UpdateAutoDisposeRecord', 'UpdateDataSet', 'UpdateDataSource', 'UpdateNormalizationSchema', 'UpdateProduct', 'UpdateResponseRule', 'GetAlert', 'GetResponseRuleStatistic', 'ListAlerts', 'ListDataConnectors', 'ListNormalizationSecurityDomains', 'ListQueryViews', 'ListResponseRuleFields', 'ListTags', 'UpdateAlert',
             ],
+            'type' => 'directory',
+            'title' => 'Others',
         ],
     ],
     'components' => [
         'schemas' => [],
     ],
     'apis' => [
-        'GetUserConfig' => [
-            'summary' => '获取用户配置信息',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'CheckUpgradeItem' => [
+            'summary' => 'Checks for available version upgrades.',
+            'path' => '',
+            'methods' => ['post'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
@@ -181,429 +78,309 @@
             'operationType' => 'read',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'get',
+                'operationType' => 'none',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
+                    'name' => 'UpgradeItemId',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The ID of the upgrade item.', 'type' => 'string', 'required' => false, 'example' => 'dispose_task_upgrade', 'title' => ''],
+                ],
+                [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['description' => 'The region of the Data Management center. Select a region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: The assets are in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: The assets are in a region outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-shanghai', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'en',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '173326*******',
-                    ],
+                    'schema' => ['description' => 'The user ID of a member. An administrator can use this parameter to switch to the member\'s perspective.', 'type' => 'string', 'required' => false, 'example' => '113091674488****', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'Schema of Response',
-                        'description' => 'Schema of Response',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****',
-                            ],
-                            'User' => [
-                                'description' => '',
+                            'RequestId' => ['title' => 'Id of the request', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
+                            'UpgradeItem' => [
+                                'description' => 'The upgrade item.',
                                 'type' => 'object',
                                 'properties' => [
-                                    'CtdrVersion' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'v2',
-                                    ],
-                                    'DataStorageVersion' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'pending',
-                                    ],
-                                    'UpgradeStatus' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'v2',
-                                    ],
-                                    'UpgradeCtdrVersion' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'v2',
-                                    ],
+                                    'UpgradeItemId' => ['description' => 'The ID of the upgrade item.', 'type' => 'string', 'example' => 'incident_upgrade', 'title' => ''],
+                                    'CheckStatus' => ['description' => 'The check status.', 'type' => 'string', 'example' => 'success', 'title' => ''],
+                                    'CheckResult' => ['description' => 'The name of the module.', 'type' => 'string', 'example' => 'OK', 'title' => ''],
                                 ],
+                                'title' => '',
+                                'example' => '',
                             ],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
-            'errorCodes' => [
-                400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"UpgradeItem\\": {\\n    \\"UpgradeItemId\\": \\"incident_upgrade\\",\\n    \\"CheckStatus\\": \\"success\\",\\n    \\"CheckResult\\": \\"OK\\"\\n  }\\n}","type":"json"}]',
+            'title' => 'CheckUpgradeItem',
+            'description' => 'The JsonConfig input parameter is a complex JSON configuration. A supporting tool class that includes configuration examples is provided. For more information, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'none',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:CheckUpgradeItem',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
                     ],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"User\\": {\\n    \\"CtdrVersion\\": \\"v2\\",\\n    \\"DataStorageVersion\\": \\"pending\\",\\n    \\"UpgradeStatus\\": \\"v2\\",\\n    \\"UpgradeCtdrVersion\\": \\"v2\\"\\n  }\\n}","type":"json"}]',
         ],
-        'CheckUpgradeItem' => [
-            'summary' => '检查升级项',
+        'CreateAutoDisposeConfig' => [
+            'summary' => 'Creates an auto-dispose configuration.',
             'path' => '',
-            'methods' => [
-                'post',
-            ],
-            'schemes' => [
-                'https',
-            ],
+            'methods' => ['post'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'read',
+            'operationType' => 'readAndWrite',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'none',
+                'operationType' => 'create',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas731ZAS'],
+                'tenantRelevance' => 'tenant',
             ],
             'parameters' => [
                 [
-                    'name' => 'UpgradeItemId',
+                    'name' => 'AutoDecisionStatus',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'dispose_task_upgrade',
-                    ],
+                    'schema' => ['description' => 'Specifies whether to enable automated analysis. Valid values:'."\n"
+                        ."\n"
+                        .'- enabled: Enables automated analysis.'."\n"
+                        ."\n"
+                        .'- disabled: Disables automated analysis.', 'type' => 'string', 'required' => true, 'example' => 'enabled', 'title' => ''],
                 ],
                 [
-                    'name' => 'RegionId',
+                    'name' => 'ProductCode',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-shanghai',
-                    ],
+                    'schema' => ['description' => 'The code of the cloud product.', 'type' => 'string', 'required' => true, 'example' => 'alibaba_cloud_sas', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh',
-                    ],
-                ],
-                [
-                    'name' => 'RoleFor',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => true, 'example' => 'zh', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'Schema of Response',
-                        'description' => '',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'title' => 'Id of the request',
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****',
-                            ],
-                            'UpgradeItem' => [
-                                'description' => '',
-                                'type' => 'object',
-                                'properties' => [
-                                    'UpgradeItemId' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'incident_upgrade',
-                                    ],
-                                    'CheckStatus' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'success',
-                                    ],
-                                    'CheckResult' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'OK',
-                                    ],
-                                ],
-                            ],
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'title' => '', 'example' => '6D7B26AD-2EDD-5A96-B9D2-CDEABFC55690'],
                         ],
+                        'title' => '',
+                        'description' => 'The response body.',
+                        'example' => '',
                     ],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'CreateAutoDisposeConfig',
+            'description' => 'The JsonConfig input parameter is a complex JSON configuration. Refer to the helper class in the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java) for configuration examples.',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"UpgradeItem\\": {\\n    \\"UpgradeItemId\\": \\"incident_upgrade\\",\\n    \\"CheckStatus\\": \\"success\\",\\n    \\"CheckResult\\": \\"OK\\"\\n  }\\n}","type":"json"}]',
+            'ramActions' => [],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6D7B26AD-2EDD-5A96-B9D2-CDEABFC55690\\"\\n}","type":"json"}]',
         ],
-        'ExecuteUpgrade' => [
-            'summary' => '执行升级',
-            'path' => '',
-            'methods' => [
-                'post',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'CreateDataIngestion' => [
+            'summary' => 'Creates a data ingestion policy.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'readAndWrite',
+            'operationType' => 'write',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'update',
+                'operationType' => 'create',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The region where the Data Management hub for threat analysis is located. Select a region for the management hub based on the region of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
+                    'schema' => ['description' => 'The user ID of a member. An administrator can use this parameter to assume the permissions of the specified member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
-            ],
-            'responses' => [
-                200 => [
-                    'schema' => [
-                        'title' => 'Schema of Response',
-                        'description' => '',
-                        'type' => 'object',
-                        'properties' => [
-                            'RequestId' => [
-                                'title' => 'Id of the request',
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。',
-                            ],
-                        ],
-                    ],
+                [
+                    'name' => 'DataIngestionMode',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The data ingestion mode. Valid values:'."\n"
+                        ."\n"
+                        .'- realtime'."\n"
+                        ."\n"
+                        .'- scan', 'type' => 'string', 'required' => false, 'example' => 'realtime', 'title' => ''],
                 ],
-            ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
-        ],
-        'ListUpgradeItems' => [
-            'summary' => '获取升级项列表',
-            'path' => '',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
-            ],
-            'security' => [
                 [
-                    'AK' => [],
+                    'name' => 'DataSourceId',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The ID of the data source.', 'type' => 'string', 'required' => false, 'example' => 'ds-3g6lyf4eonngyohaq7tr', 'title' => ''],
                 ],
-            ],
-            'operationType' => 'read',
-            'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'list',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
+                [
+                    'name' => 'NormalizationRuleId',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The ID of the normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'nr-hdmady54piigkjfv17yp', 'title' => ''],
                 ],
-            ],
-            'parameters' => [
                 [
-                    'name' => 'MaxResults',
+                    'name' => 'DataSourceEditable',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'minimum' => '0',
-                        'example' => '50',
-                    ],
+                    'schema' => ['description' => 'Specifies whether the data source can be edited.', 'type' => 'boolean', 'required' => false, 'example' => 'true', 'title' => ''],
                 ],
                 [
-                    'name' => 'NextToken',
+                    'name' => 'DataIngestionStateCode',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****',
-                    ],
+                    'schema' => ['description' => 'The error code for the data ingestion status.', 'type' => 'string', 'required' => false, 'example' => 'UserUnauthorized', 'title' => ''],
                 ],
                 [
-                    'name' => 'RegionId',
+                    'name' => 'CapacityCount',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['description' => 'The number of associated security capabilities.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '10', 'title' => ''],
                 ],
                 [
-                    'name' => 'Lang',
+                    'name' => 'StreamJobId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh',
-                    ],
+                    'schema' => ['description' => 'The ID of the stream job.', 'type' => 'string', 'required' => false, 'example' => '802c0129b6cfd50861d4b25deea29afb', 'title' => ''],
                 ],
                 [
-                    'name' => 'RoleFor',
+                    'name' => 'DataIngestionType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The data ingestion type. Valid values:'."\n"
+                        ."\n"
+                        .'- preset'."\n"
+                        ."\n"
+                        .'- custom', 'type' => 'string', 'required' => false, 'example' => 'custom', 'title' => ''],
+                ],
+                [
+                    'name' => 'ScanDataSourceId',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The ID of the data source for the scan mode.', 'type' => 'string', 'required' => false, 'example' => 'ds-014frtpy28m5ct2eoyo1', 'title' => ''],
+                ],
+                [
+                    'name' => 'UpdateTime',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The update time.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '1733269771123', 'title' => ''],
+                ],
+                [
+                    'name' => 'NormalizationRuleEditable',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'Specifies whether the normalization rule can be edited.', 'type' => 'boolean', 'required' => false, 'example' => 'true', 'title' => ''],
+                ],
+                [
+                    'name' => 'ProductId',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The product ID.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_sas', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'Schema of Response',
-                        'description' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'title' => 'Id of the request',
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****',
-                            ],
-                            'UpgradeItems' => [
-                                'description' => '',
-                                'type' => 'array',
-                                'items' => [
-                                    'description' => '',
-                                    'type' => 'object',
-                                    'properties' => [
-                                        'UpgradeItemId' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'data_storage_2_upgrade',
-                                        ],
-                                    ],
-                                ],
-                            ],
-                            'NextToken' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****',
-                            ],
-                            'MaxResults' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '50',
-                            ],
-                            'TotalCount' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '57',
-                            ],
+                            'RequestId' => ['title' => 'Id of the request', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
+                            'DataIngestionId' => ['description' => 'The data ingestion ID.', 'type' => 'string', 'example' => 'di-yxtm3l2rwa7fr5uvxtc7', 'title' => ''],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"UpgradeItems\\": [\\n    {\\n      \\"UpgradeItemId\\": \\"data_storage_2_upgrade\\"\\n    }\\n  ],\\n  \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\",\\n  \\"MaxResults\\": 50,\\n  \\"TotalCount\\": 57\\n}","type":"json"}]',
-        ],
-        'UpdateDataStorage' => [
-            'summary' => '获取日志管理页面里用户数据存储的详情。',
-            'methods' => [
-                'post',
-                'get',
+            'errorCodes' => [
+                400 => [
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
+                ],
             ],
-            'schemes' => [
-                'https',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"DataIngestionId\\": \\"di-yxtm3l2rwa7fr5uvxtc7\\"\\n}","type":"json"}]',
+            'title' => 'CreateDataIngestion',
+            'description' => 'The frequency and timing of notifications are limited. Each user receives a maximum of two notifications per day between 08:00 and 20:00.',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'create',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:CreateDataIngestion',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DataIngestion', 'arn' => 'acs:yundun-sas::{#accountId}:dataingestion/*'],
+                        ],
+                    ],
+                ],
             ],
+        ],
+        'CreateDataSet' => [
+            'summary' => 'Creates a dataset.',
+            'methods' => ['post'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
@@ -612,99 +389,176 @@
             'operationType' => 'write',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'update',
+                'operationType' => 'create',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsasRXJ9SY',
-                ],
-                'tenantRelevance' => 'publicInformation',
+                'abilityTreeNodes' => ['FEATUREsasASHGE7'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['description' => 'The region of the Data Management center for threat analysis. Select a region based on where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataStorageRegionId',
+                    'name' => 'DataSetName',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'cn-shanghai',
-                    ],
+                    'schema' => ['description' => 'The name of the dataset.', 'type' => 'string', 'required' => true, 'maxLength' => 100, 'example' => 'lmftest', 'title' => ''],
                 ],
                 [
-                    'name' => 'DeliveryStatus',
+                    'name' => 'DataSetDescription',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The description of the dataset.', 'type' => 'string', 'maxLength' => 1000, 'required' => false, 'example' => 'lmftest contains ip list', 'title' => ''],
+                ],
+                [
+                    'name' => 'DataSetFieldKeyName',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The name of the unique key for the dataset.', 'type' => 'string', 'required' => true, 'example' => 'ip', 'title' => ''],
+                ],
+                [
+                    'name' => 'DataSetFileName',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The name of the uploaded dataset file.', 'type' => 'string', 'required' => true, 'example' => 'cloudsiem-dataset/1358117679873357_17433*****.csv', 'title' => ''],
+                ],
+                [
+                    'name' => 'IpWhitelistRecognizers',
                     'in' => 'formData',
+                    'style' => 'flat',
                     'schema' => [
-                        'description' => '',
-                        'type' => 'string',
+                        'description' => 'The list of recognizers.',
+                        'type' => 'array',
+                        'items' => [
+                            'type' => 'object',
+                            'properties' => [
+                                'IpWhitelistRecognizerType' => ['description' => 'The type of IP address that the recognizer detects. Valid values:'."\n"
+                                    ."\n"
+                                    .'- sas\\_vulnerability\\_scanner\\_ip: The IP address of the Security Center web vulnerability scanner.'."\n"
+                                    ."\n"
+                                    .'- waf\\_back\\_source\\_ip: The back-to-origin IP address of Web Application Firewall (WAF).'."\n"
+                                    ."\n"
+                                    .'- ddos\\_back\\_source\\_ip: The back-to-origin IP address of Anti-DDoS.'."\n"
+                                    ."\n"
+                                    .'- esa\\_back\\_source\\_ip: The back-to-origin IP address of an Edge Security Acceleration (ESA) node.'."\n"
+                                    ."\n"
+                                    .'- ecs\\_public\\_ip: The public IP address of an Elastic Compute Service (ECS) instance.'."\n"
+                                    ."\n"
+                                    .'- slb\\_public\\_ip: The public IP address of a Server Load Balancer (SLB) instance.'."\n"
+                                    ."\n"
+                                    .'- vpc\\_eip: An Elastic IP Address (EIP).'."\n"
+                                    ."\n"
+                                    .'- cdn\\_back\\_source\\_ip: The back-to-origin IP address of a content delivery network (CDN).'."\n"
+                                    ."\n"
+                                    .'- ga\\_back\\_source\\_ip: The back-to-origin IP address of Global Accelerator (GA).', 'type' => 'string', 'required' => false, 'example' => 'waf_back_source_ip', 'title' => ''],
+                                'AutoRecognizeStatus' => ['description' => 'The automatic detection status. Valid values:'."\n"
+                                    ."\n"
+                                    .'- enabled: enabled.'."\n"
+                                    ."\n"
+                                    .'- disabled: disabled.', 'type' => 'string', 'required' => false, 'example' => 'enabled', 'title' => ''],
+                                'RecognizeScope' => ['description' => 'The detection scope. Valid values:'."\n"
+                                    ."\n"
+                                    .'- current\\_account: the current account only.'."\n"
+                                    ."\n"
+                                    .'- rd\\_accounts: all accounts in your resource directory.', 'type' => 'string', 'required' => false, 'example' => 'current_account', 'title' => ''],
+                            ],
+                            'required' => false,
+                            'description' => 'A recognizer.',
+                            'title' => '',
+                            'example' => '',
+                        ],
                         'required' => false,
-                        'example' => 'enable',
-                        'maxLength' => 1000,
+                        'title' => '',
+                        'example' => '',
                     ],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member whose permissions are used to perform the operation. This parameter is used when an administrator acts on behalf of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''],
+                ],
+                [
+                    'name' => 'DataSetStatus',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The status of the dataset. Valid values:'."\n"
+                        ."\n"
+                        .'- 0: deleted.'."\n"
+                        ."\n"
+                        .'- 1: enabled.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1', 'title' => ''],
+                ],
+                [
+                    'name' => 'DataSetType',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The type of the dataset. Valid values:'."\n"
+                        ."\n"
+                        .'- custom: custom.'."\n"
+                        ."\n"
+                        .'- preset: predefined.', 'type' => 'string', 'required' => false, 'example' => 'custom', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'BaseResponse',
-                        'description' => '',
+                        'title' => 'Schema of Response',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => 'EA7FC160-8D86-5ABE-A08A-7962FDC1****',
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', 'title' => ''],
+                            'DataSetRecordStatistic' => [
+                                'description' => 'The result returned after the dataset is created.',
+                                'type' => 'object',
+                                'properties' => [
+                                    'NewDataSetRecordCount' => ['description' => 'The number of new records in the dataset.', 'type' => 'integer', 'format' => 'int32', 'example' => '6', 'title' => ''],
+                                    'DataSetId' => ['description' => 'The dataset ID.', 'type' => 'string', 'example' => 'dataset-qt0n8246gs9nackg****', 'title' => ''],
+                                ],
+                                'title' => '',
+                                'example' => '',
                             ],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
-            'errorCodes' => [],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"EA7FC160-8D86-5ABE-A08A-7962FDC1****\\"\\n}","type":"json"}]',
-        ],
-        'UpdateDataStorageTtl' => [
-            'summary' => '更新数据存储中日志的数据保存天数。',
-            'methods' => [
-                'post',
-                'get',
+            'errorCodes' => [
+                400 => [
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
+                ],
             ],
-            'schemes' => [
-                'https',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n  \\"DataSetRecordStatistic\\": {\\n    \\"NewDataSetRecordCount\\": 6,\\n    \\"DataSetId\\": \\"dataset-qt0n8246gs9nackg****\\"\\n  }\\n}","type":"json"}]',
+            'title' => 'CreateDataSet',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'create',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:CreateDataSet',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DataSet', 'arn' => 'acs:yundun-sas::{#accountId}:dataset/*'],
+                        ],
+                    ],
+                ],
             ],
+        ],
+        'CreateDataSource' => [
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
@@ -713,120 +567,210 @@
             'operationType' => 'write',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'update',
+                'operationType' => 'create',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsasRXJ9SY',
-                ],
-                'autoTest' => true,
-                'tenantRelevance' => 'tenant',
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['description' => 'The region of the Management Hub. Select a region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Assets are in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
+                ],
+                [
+                    'name' => 'RoleFor',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The user ID of the member whose perspective the administrator assumes.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
+                ],
+                [
+                    'name' => 'DataSourceName',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The name of the data source.', 'type' => 'string', 'required' => false, 'example' => 'AD_LOG', 'title' => ''],
+                ],
+                [
+                    'name' => 'DataSourceType',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The type of the data source. Valid values:'."\n"
+                        ."\n"
+                        .'- preset'."\n"
+                        ."\n"
+                        .'- custom', 'type' => 'string', 'required' => false, 'example' => 'preset', 'title' => ''],
+                ],
+                [
+                    'name' => 'DataSourceFrom',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The source of the data. Valid values:'."\n"
+                        ."\n"
+                        .'- center'."\n"
+                        ."\n"
+                        .'- custom', 'type' => 'string', 'required' => false, 'example' => 'center', 'title' => ''],
+                ],
+                [
+                    'name' => 'LogUserId',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The user ID for data ingestion.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
+                ],
+                [
+                    'name' => 'LogRegionId',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The ID of the log storage region.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
+                ],
+                [
+                    'name' => 'LogProjectName',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The name of the Simple Log Service project.', 'type' => 'string', 'required' => false, 'example' => 'aliyun-cloudsiem-data-173326*******-cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'LogStoreName',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'network-activity',
-                        'maxLength' => 1000,
-                    ],
+                    'schema' => ['description' => 'The name of the Simple Log Service Logstore.', 'type' => 'string', 'required' => false, 'example' => 'mde_raw', 'title' => ''],
                 ],
                 [
-                    'name' => 'RoleFor',
+                    'name' => 'DataSourceStores',
                     'in' => 'formData',
+                    'style' => 'flat',
                     'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
+                        'description' => 'The list of Simple Log Service projects.',
+                        'type' => 'array',
+                        'items' => [
+                            'description' => 'A Simple Log Service project.',
+                            'type' => 'object',
+                            'properties' => [
+                                'LogRegionId' => ['description' => 'The ID of the log storage region.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
+                                'LogProjectName' => ['description' => 'The name of the Simple Log Service project.', 'type' => 'string', 'required' => false, 'example' => 'aliyun-cloudsiem-data-173326*******-cn-hangzhou', 'title' => ''],
+                                'LogStoreName' => ['description' => 'The name of the Simple Log Service Logstore.', 'type' => 'string', 'required' => false, 'example' => 'actiontrail_management-events', 'title' => ''],
+                                'DataSourceStoreStatus' => ['description' => 'The status of the log storage. Valid values:'."\n"
+                                    ."\n"
+                                    .'- normal'."\n"
+                                    ."\n"
+                                    .'- abnormal', 'type' => 'string', 'required' => false, 'example' => 'normal', 'title' => ''],
+                                'DataSourceStoreId' => ['description' => 'The ID of the log storage.', 'type' => 'string', 'required' => false, 'example' => '1', 'title' => ''],
+                                'DataSourceStoreFrom' => ['description' => 'The source of the data. Valid values:'."\n"
+                                    ."\n"
+                                    .'- center'."\n"
+                                    ."\n"
+                                    .'- custom', 'type' => 'string', 'required' => false, 'example' => 'center', 'title' => ''],
+                            ],
+                            'required' => false,
+                            'title' => '',
+                            'example' => '',
+                        ],
                         'required' => false,
-                        'example' => '113091674488****',
+                        'title' => '',
+                        'example' => '',
                     ],
                 ],
                 [
-                    'name' => 'LogStoreTtl',
+                    'name' => 'DataSourceTemplateId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '180',
-                    ],
+                    'schema' => ['description' => 'The ID of the data source template.', 'type' => 'string', 'required' => false, 'example' => 'dst_alibaba_cloud_nas_audit_log_1358117679873357', 'title' => ''],
                 ],
                 [
-                    'name' => 'LogStoreHotTtl',
+                    'name' => 'DataSourceIds',
                     'in' => 'formData',
+                    'style' => 'json',
                     'schema' => [
-                        'description' => '',
-                        'type' => 'string',
+                        'type' => 'array',
+                        'items' => ['description' => 'A data source ID.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_waf_flow_log_1766185894104675', 'title' => ''],
+                        'description' => 'A list of data source IDs.',
+                        'title' => '',
+                        'example' => '',
                         'required' => false,
-                        'example' => '180',
                     ],
                 ],
                 [
-                    'name' => 'LogStoreColdTtl',
+                    'name' => 'DataSourceRecognizer',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The data source recognizer.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_waf_flow_log_1766185894104675', 'title' => ''],
+                ],
+                [
+                    'name' => 'DataSourceRecognizeEnabled',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'Specifies whether to automatically discover new data sources.', 'type' => 'boolean', 'required' => false, 'example' => 'true', 'title' => ''],
+                ],
+                [
+                    'name' => 'DataSourceReferences',
                     'in' => 'formData',
+                    'style' => 'json',
                     'schema' => [
-                        'description' => '',
-                        'type' => 'string',
+                        'type' => 'array',
+                        'items' => ['description' => 'The ID of an associated data access instance.', 'type' => 'string', 'required' => false, 'example' => 'ds-014frtpy28m5ct2eoyo1', 'title' => ''],
+                        'description' => 'The IDs of associated data access instances.',
+                        'title' => '',
+                        'example' => '',
                         'required' => false,
-                        'example' => '0',
                     ],
                 ],
+                [
+                    'name' => 'Order',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The sort order. Valid values:'."\n"
+                        ."\n"
+                        .'- desc: descending.'."\n"
+                        ."\n"
+                        .'- asc: ascending.', 'type' => 'string', 'required' => false, 'example' => 'desc', 'title' => ''],
+                ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'BaseResponse',
-                        'description' => '',
+                        'title' => 'Schema of Response',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => 'D92E4FCF-4584-5E50-9C02-26B79A9C****',
-                            ],
+                            'RequestId' => ['title' => 'Id of the request', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
+                            'DataSourceId' => ['description' => 'The ID of the data source.', 'type' => 'string', 'example' => 'ds-jl67vixpe1scwysgyu3x', 'title' => ''],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
-            'errorCodes' => [],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'errorCodes' => [
+                400 => [
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
+                ],
+            ],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'CreateDataSource',
+            'summary' => 'Creates a data source.',
+            'description' => 'The JsonConfig input parameter is a complex JSON object. For a configuration example, see the supporting tool class in the [demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'create',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:CreateDataSource',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DataSource', 'arn' => 'acs:yundun-sas::{#accountId}:datasource/*'],
+                        ],
+                    ],
+                ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"D92E4FCF-4584-5E50-9C02-26B79A9C****\\"\\n}","type":"json"}]',
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"DataSourceId\\": \\"ds-jl67vixpe1scwysgyu3x\\"\\n}","type":"json"}]',
         ],
-        'UpdateDataStorageDelivery' => [
-            'summary' => '操作日志投递.',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'CreateDetectionRule' => [
+            'summary' => 'Creates a detection rule.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
@@ -835,445 +779,540 @@
             'operationType' => 'write',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'update',
+                'operationType' => 'create',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsasRXJ9SY',
-                ],
-                'autoTest' => true,
-                'tenantRelevance' => 'tenant',
+                'abilityTreeNodes' => ['FEATUREsasASHGE7'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['description' => 'The region where the Data Management center of Threat Analysis is located. Select a region based on the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
+                ],
+                [
+                    'name' => 'DetectionRuleName',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The name of the detection rule.', 'type' => 'string', 'required' => true, 'maxLength' => 128, 'example' => 'dr-ha1i09ob3zmqrs85****', 'title' => ''],
+                ],
+                [
+                    'name' => 'DetectionRuleDescription',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The description of the detection rule.', 'type' => 'string', 'maxLength' => 2000, 'required' => false, 'example' => 'dr-123', 'title' => ''],
+                ],
+                [
+                    'name' => 'DetectionRuleType',
+                    'in' => 'formData',
                     'schema' => [
-                        'description' => '',
+                        'description' => 'The type of the detection rule. Valid values:'."\n"
+                            ."\n"
+                            .'- preset: predefined detection rule.'."\n"
+                            ."\n"
+                            .'- custom: custom detection rule.'."\n"
+                            ."\n"
+                            .'- custom\\_template: rule template.',
                         'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh',
+                        'required' => true,
+                        'enum' => ['custom'],
+                        'example' => 'custom',
+                        'title' => '',
                     ],
                 ],
                 [
-                    'name' => 'LogCode',
+                    'name' => 'DetectionRuleStatus',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The status of the detection rule.', 'type' => 'string', 'required' => false, 'example' => '0', 'title' => ''],
+                ],
+                [
+                    'name' => 'AlertType',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The alert type.', 'type' => 'string', 'required' => true, 'example' => 'WebShell', 'title' => ''],
+                ],
+                [
+                    'name' => 'AlertLevel',
                     'in' => 'formData',
                     'schema' => [
-                        'description' => '',
+                        'description' => 'The threat level of the alert. Valid values:'."\n"
+                            ."\n"
+                            .'- 5: critical.'."\n"
+                            ."\n"
+                            .'- 4: important.'."\n"
+                            ."\n"
+                            .'- 3: medium.'."\n"
+                            ."\n"
+                            .'- 2: low.'."\n"
+                            ."\n"
+                            .'- 1: informational.',
                         'type' => 'string',
                         'required' => true,
-                        'example' => 'aegis-log-login',
+                        'enum' => ['1', '2', '3', '4', '5'],
+                        'example' => '1',
+                        'title' => '',
                     ],
                 ],
                 [
-                    'name' => 'LogDeliveryStatus',
+                    'name' => 'AlertTacticId',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The tactic phase of the alert.', 'type' => 'string', 'required' => false, 'example' => 'TA0042', 'title' => ''],
+                ],
+                [
+                    'name' => 'AlertAttCk',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The ATT\\&CK stage of the alert.', 'type' => 'string', 'required' => false, 'example' => 'Discovery', 'title' => ''],
+                ],
+                [
+                    'name' => 'DetectionExpressionType',
                     'in' => 'formData',
                     'schema' => [
-                        'description' => '',
+                        'description' => 'The type of the detection rule expression. Valid values:'."\n"
+                            ."\n"
+                            .'- sql: SQL.'."\n"
+                            ."\n"
+                            .'- playbook: playbook.',
+                        'enumValueTitles' => ['sql' => 'sql', 'playbook' => 'playbook'],
                         'type' => 'string',
                         'required' => false,
-                        'example' => 'enable',
-                        'maxLength' => 1000,
+                        'enum' => ['sql', 'graphical', 'playbook'],
+                        'example' => 'sql',
+                        'title' => '',
                     ],
                 ],
                 [
-                    'name' => 'RoleFor',
+                    'name' => 'DetectionExpressionContent',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The content of the detection rule expression.', 'type' => 'string', 'required' => false, 'example' => '*|set session mode=scan;SELECT * FROM log'."\n"
+                        .'WHERE schema = \'PROCESS_START_ACTIVITY\''."\n"
+                        .'AND ('."\n"
+                        .'    proc_path LIKE \'%/groups\''."\n"
+                        .'    OR ('."\n"
+                        .'        ('."\n"
+                        .'            proc_path LIKE \'%/cat\''."\n"
+                        .'            OR proc_path LIKE \'%/head\''."\n"
+                        .'            OR proc_path LIKE \'%/tail\''."\n"
+                        .'            OR proc_path LIKE \'%/more\''."\n"
+                        .'        )'."\n"
+                        .'        AND cmdline LIKE \'%/etc/group%\''."\n"
+                        .'    )'."\n"
+                        .')'."\n", 'title' => ''],
+                ],
+                [
+                    'name' => 'LogCategoryId',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The ID of the log normalization category.', 'type' => 'string', 'required' => false, 'example' => 'NETWORK_CATEGORY', 'title' => ''],
+                ],
+                [
+                    'name' => 'LogSchemaId',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The ID of the log normalization schema.', 'type' => 'string', 'required' => true, 'example' => 'API_RISK_ACTIVITY', 'title' => ''],
+                ],
+                [
+                    'name' => 'AlertSchemaId',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The ID of the alert template for the detection rule. Valid values:'."\n"
+                        ."\n"
+                        .'- ALERT\\_ACTIVITY: other alerts.'."\n"
+                        ."\n"
+                        .'- EDR\\_ALERT\\_ACTIVITY: Endpoint Detection and Response (EDR) alerts.'."\n"
+                        ."\n"
+                        .'- FIREWALL\\_ALERT\\_ACTIVITY: firewall alerts.'."\n"
+                        ."\n"
+                        .'- WAF\\_ALERT\\_ACTIVITY: Web Application Firewall (WAF) alerts.', 'type' => 'string', 'required' => true, 'example' => 'ALERT_ACTIVITY', 'title' => ''],
+                ],
+                [
+                    'name' => 'ScheduleType',
                     'in' => 'formData',
                     'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
+                        'description' => 'The scheduling type. Valid values:'."\n"
+                            ."\n"
+                            .'- fixed\\_rate: fixed interval.'."\n"
+                            ."\n"
+                            .'- cron: cron expression.',
+                        'type' => 'string',
+                        'enum' => ['fixed_rate', 'cron'],
                         'required' => false,
-                        'example' => '113091674488****',
+                        'example' => 'fixed_rate',
+                        'title' => '',
                     ],
                 ],
+                [
+                    'name' => 'ScheduleExpression',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The cron expression for scheduling. This parameter is required if you set ScheduleType to cron.', 'type' => 'string', 'required' => false, 'example' => '0/5 * * * *', 'title' => ''],
+                ],
+                [
+                    'name' => 'ScheduleMaxRetries',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The maximum number of retries after a timeout. Valid values: 1 to 100.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1', 'title' => ''],
+                ],
+                [
+                    'name' => 'ScheduleBeginTime',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The start time for scheduling. This is a 13-digit UNIX timestamp.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '1733269771123', 'title' => ''],
+                ],
+                [
+                    'name' => 'ScheduleWindow',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The length of the scheduling window.', 'type' => 'string', 'required' => false, 'example' => '5m', 'title' => ''],
+                ],
+                [
+                    'name' => 'ScheduleMaxTimeout',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The maximum timeout period in seconds. Valid values: 60 to 1800.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '60', 'title' => ''],
+                ],
+                [
+                    'name' => 'AlertThresholdPeriod',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The length of the alert threshold period.', 'type' => 'string', 'required' => false, 'example' => '5m', 'title' => ''],
+                ],
+                [
+                    'name' => 'AlertThresholdCount',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The count for the alert threshold.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '10', 'title' => ''],
+                ],
+                [
+                    'name' => 'AlertThresholdGroup',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The list of fields for the alert threshold. Separate multiple fields with commas.', 'type' => 'string', 'required' => false, 'example' => 'alert_type,ip', 'title' => ''],
+                ],
+                [
+                    'name' => 'IncidentAggregationType',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The event aggregation type. Valid values:'."\n"
+                        ."\n"
+                        .'- none: Events are not generated.'."\n"
+                        ."\n"
+                        .'- graph\\_compute: graph computing (supported by predefined rules).'."\n"
+                        ."\n"
+                        .'- expert: expert rules.'."\n"
+                        ."\n"
+                        .'- passthrough: Alerts are passed through (one-to-one).'."\n"
+                        ."\n"
+                        .'- window: Similar alerts are aggregated (window).', 'type' => 'string', 'required' => false, 'example' => 'window', 'title' => ''],
+                ],
+                [
+                    'name' => 'IncidentAggregationExpression',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The configuration of the event aggregation period.', 'type' => 'string', 'required' => false, 'example' => '5m', 'title' => ''],
+                ],
+                [
+                    'name' => 'PlaybookUuid',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The UUID of the playbook.', 'type' => 'string', 'required' => false, 'example' => 'system_aliyun_clb_process_book', 'title' => ''],
+                ],
+                [
+                    'name' => 'PlaybookParameters',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The custom parameters for the playbook.', 'type' => 'string', 'required' => false, 'example' => '{'."\n"
+                        .'    "ip": {'."\n"
+                        .'        "ip": "124.23.*.*"'."\n"
+                        .'    }'."\n"
+                        .'}', 'title' => ''],
+                ],
+                [
+                    'name' => 'RoleFor',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The user ID that an administrator uses to switch to the perspective of another member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''],
+                ],
+                [
+                    'name' => 'EntityMappings',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The entity mapping configuration.', 'type' => 'string', 'required' => false, 'example' => '[{\\"NormalizationSchemaId\\":\\"host\\",\\"NormalizationFieldMappings\\":[{\\"NormalizationFieldName\\":\\"uuid\\",\\"MappingFieldName\\":\\"host\\",\\"NormalizationFieldType\\":\\"varchar\\"}]}]', 'title' => ''],
+                ],
+                [
+                    'name' => 'DetectionRuleTemplateId',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The ID of the detection rule template.', 'type' => 'string', 'example' => 'cfw-out-ip_aegis-netstat', 'title' => '', 'required' => false],
+                ],
+                [
+                    'name' => 'DetectionRuleTemplateVersion',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The version of the detection rule template.', 'type' => 'string', 'example' => 'v1.0.0', 'title' => '', 'required' => false],
+                ],
+                [
+                    'name' => 'AlertName',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The alert name. You can use $$ to reference fields from the query output.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => 'Detected high-frequency multi-type network attacks from $src_ip$'],
+                ],
+                [
+                    'name' => 'AlertDescription',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The alert description. You can use $$ to reference fields from the query output.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => 'Alert from: $product_code$, detected network attack from $src_ip$, affected assets include: $dst_ip$'],
+                ],
+                [
+                    'name' => 'AlertTypeMapping',
+                    'in' => 'formData',
+                    'schema' => ['type' => 'string', 'title' => '', 'description' => '', 'example' => ''],
+                ],
+                [
+                    'name' => 'AlertLevelMapping',
+                    'in' => 'formData',
+                    'schema' => ['type' => 'string', 'title' => '', 'description' => '', 'example' => ''],
+                ],
+                [
+                    'name' => 'AlertAttCkMapping',
+                    'in' => 'formData',
+                    'schema' => ['type' => 'string', 'title' => '', 'description' => '', 'example' => ''],
+                ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'BaseResponse',
-                        'description' => '',
+                        'title' => 'Schema of Response',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6D7FBF4A-5B95-5760-8B5A-BF8983D4****',
-                            ],
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '5CC09D0C-1CD7-54BD-A853-DCB2D945****', 'title' => ''],
+                            'DetectionRuleId' => ['description' => 'The ID of the detection rule.', 'type' => 'string', 'example' => 'dr-ha1i09ob3zmqrs85****', 'title' => ''],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
-            'errorCodes' => [],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'errorCodes' => [
+                400 => [
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
+                ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6D7FBF4A-5B95-5760-8B5A-BF8983D4****\\"\\n}","type":"json"}]',
-        ],
-        'ResetDataStorage' => [
-            'summary' => '数据存储的清空操作，该动作会删除已有的数据，重新初始化物理存储。',
-            'methods' => [
-                'post',
-                'get',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'CreateDetectionRule',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
             ],
-            'schemes' => [
-                'https',
+            'ramActions' => [
+                [
+                    'operationType' => 'create',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:CreateDetectionRule',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DetectionRule', 'arn' => 'acs:yundun-sas::{#accountId}:detection/*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"5CC09D0C-1CD7-54BD-A853-DCB2D945****\\",\\n  \\"DetectionRuleId\\": \\"dr-ha1i09ob3zmqrs85****\\"\\n}","type":"json"}]',
+        ],
+        'CreateExportTask' => [
+            'summary' => 'Creates an export task.',
+            'methods' => ['post'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'readAndWrite',
+            'operationType' => 'write',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'update',
+                'operationType' => 'create',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsasRXJ9SY',
-                ],
-                'autoTest' => true,
-                'tenantRelevance' => 'tenant',
+                'abilityTreeNodes' => ['FEATUREsasASHGE7'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['description' => 'The region of the Data Management center. Select a region based on where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: The Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
+                ],
+                [
+                    'name' => 'ExportTaskParameter',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The parameters for the export task. The value is a JSON string that is generated based on the query conditions.', 'type' => 'string', 'required' => false, 'example' => '{'."\n"
+                        .'    "IncidentName": "name",'."\n"
+                        .'    "IncidentStatus": "1",'."\n"
+                        .'    "ThreatLevel":["1","2"],'."\n"
+                        .'    "IncidentUuids":"315EE627-39DC-560A-8DFD-CBF66AD9****"'."\n"
+                        .'}', 'title' => ''],
+                ],
+                [
+                    'name' => 'ExportTaskType',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The type of data to export. Valid values:'."\n"
+                        ."\n"
+                        .'- incident\\_list: event list.', 'type' => 'string', 'required' => false, 'example' => 'incident_list', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The user ID of a member. An administrator can use this parameter to switch to the perspective of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'BaseResponse',
-                        'description' => '',
+                        'title' => 'Schema of Response',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****',
-                            ],
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''],
+                            'FileName' => ['description' => 'The name of the exported file.', 'type' => 'string', 'example' => 'event_1193842352994186_17344888****.xlsx', 'title' => ''],
+                            'Id' => ['description' => 'The ID of the export task.', 'type' => 'integer', 'format' => 'int64', 'example' => '400151', 'title' => ''],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
-            'errorCodes' => [],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
-        ],
-        'GetDataStorage' => [
-            'summary' => '获取日志管理页面里用户数据存储的详情。',
-            'methods' => [
-                'post',
-                'get',
+            'errorCodes' => [
+                400 => [
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
+                ],
             ],
-            'schemes' => [
-                'https',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"FileName\\": \\"event_1193842352994186_17344888****.xlsx\\",\\n  \\"Id\\": 400151\\n}","type":"json"}]',
+            'title' => 'CreateExportTask',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'create',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:CreateExportTask',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+        ],
+        'CreateLogStore' => [
+            'summary' => 'Configure client-side storage restrictions.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'read',
+            'operationType' => 'write',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'get',
+                'operationType' => 'create',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsasRXJ9SY',
-                ],
-                'autoTest' => true,
-                'tenantRelevance' => 'tenant',
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['description' => 'The region of the Data Management Center for threat analysis. Select a region for the Management Center based on the region of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh',
-                    ],
+                    'schema' => ['description' => 'The language of the response messages. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The user ID of a member. An administrator can specify this parameter to switch to the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
+                ],
+                [
+                    'name' => 'LogUserId',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The user ID for data access.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
+                ],
+                [
+                    'name' => 'LogRegionId',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The ID of the log storage region.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
+                ],
+                [
+                    'name' => 'LogProjectName',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The name of the Simple Log Service project.', 'type' => 'string', 'required' => false, 'example' => 'aliyun-cloudsiem-channel-173326*******-cn-hangzhou', 'title' => ''],
+                ],
+                [
+                    'name' => 'LogStoreName',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The name of the Simple Log Service Logstore.', 'type' => 'string', 'required' => false, 'example' => 'logstoreqykug', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'DataResponse<DataStorageBean>',
-                        'description' => '',
+                        'title' => 'Schema of Response',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'Data' => [
-                                'description' => '',
-                                'type' => 'object',
-                                'properties' => [
-                                    'DataStorageRegionId' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'cn-shanghai',
-                                    ],
-                                    'DataStorageTotalCapacity' => [
-                                        'description' => '',
-                                        'type' => 'integer',
-                                        'format' => 'int64',
-                                        'example' => '100',
-                                    ],
-                                    'DataStorageUsedCapacity' => [
-                                        'description' => '',
-                                        'type' => 'number',
-                                        'format' => 'double',
-                                        'example' => '100.0',
-                                    ],
-                                    'LogProject' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'aliyun-cloudsiem-data-171835723111****-cn-shanghai',
-                                    ],
-                                    'SasLogStores' => [
-                                        'description' => '',
-                                        'type' => 'array',
-                                        'items' => [
-                                            'description' => '',
-                                            'type' => 'object',
-                                            'properties' => [
-                                                'LogName' => [
-                                                    'description' => '',
-                                                    'type' => 'string',
-                                                    'example' => 'Process Snapshot',
-                                                ],
-                                                'LogStoreName' => [
-                                                    'description' => '',
-                                                    'type' => 'string',
-                                                    'example' => 'sas-security-log',
-                                                ],
-                                                'LogDeliveryStatus' => [
-                                                    'description' => '',
-                                                    'type' => 'string',
-                                                    'example' => 'enable',
-                                                ],
-                                                'LogStoreTtl' => [
-                                                    'description' => '',
-                                                    'type' => 'integer',
-                                                    'format' => 'int32',
-                                                    'example' => '180',
-                                                ],
-                                                'LogDeliveryUpdateTime' => [
-                                                    'description' => '',
-                                                    'type' => 'string',
-                                                    'example' => '2025-07-16T15:10:29',
-                                                ],
-                                                'LogDeliveryPermission' => [
-                                                    'description' => '',
-                                                    'type' => 'string',
-                                                    'example' => 'deny',
-                                                ],
-                                                'LogDeliveryGroup' => [
-                                                    'description' => '',
-                                                    'type' => 'string',
-                                                    'example' => 'host',
-                                                ],
-                                                'LogSearchConditions' => [
-                                                    'title' => 'JSON Array ["key":"product_code", "value":"ctdr"]',
-                                                    'description' => '',
-                                                    'type' => 'string',
-                                                    'example' => '[{\\"__topic__\\":\\"sas-net-block\\"}]',
-                                                ],
-                                                'LogCode' => [
-                                                    'description' => '',
-                                                    'type' => 'string',
-                                                    'example' => 'sas-net-block',
-                                                ],
-                                                'LogStoreExisted' => [
-                                                    'description' => '',
-                                                    'type' => 'boolean',
-                                                    'example' => 'true',
-                                                ],
-                                            ],
-                                        ],
-                                    ],
-                                    'NormalizationLogStores' => [
-                                        'description' => '',
-                                        'type' => 'array',
-                                        'items' => [
-                                            'description' => '',
-                                            'type' => 'object',
-                                            'properties' => [
-                                                'LogStoreName' => [
-                                                    'description' => '',
-                                                    'type' => 'string',
-                                                    'example' => 'vulnerability-activity',
-                                                ],
-                                                'LogStoreTtl' => [
-                                                    'description' => '',
-                                                    'type' => 'integer',
-                                                    'format' => 'int32',
-                                                    'example' => '180',
-                                                ],
-                                            ],
-                                        ],
-                                    ],
-                                    'NormalizationLogViews' => [
-                                        'description' => '',
-                                        'type' => 'array',
-                                        'items' => [
-                                            'description' => '',
-                                            'type' => 'object',
-                                            'properties' => [
-                                                'CategoryName' => [
-                                                    'description' => '',
-                                                    'type' => 'string',
-                                                    'example' => 'Security Category',
-                                                ],
-                                                'ActivityName' => [
-                                                    'description' => '',
-                                                    'type' => 'string',
-                                                    'example' => 'API security risk log',
-                                                ],
-                                                'LogViewName' => [
-                                                    'description' => '',
-                                                    'type' => 'string',
-                                                    'example' => 'risk_activity',
-                                                ],
-                                                'LogStoreName' => [
-                                                    'description' => '',
-                                                    'type' => 'string',
-                                                    'example' => 'risk-activity',
-                                                ],
-                                                'DetectionRuleReferenceCount' => [
-                                                    'description' => '',
-                                                    'type' => 'integer',
-                                                    'format' => 'int32',
-                                                    'example' => '3',
-                                                ],
-                                                'DetectionRuleReferenceProductIds' => [
-                                                    'description' => '',
-                                                    'type' => 'array',
-                                                    'items' => [
-                                                        'description' => '',
-                                                        'type' => 'string',
-                                                        'example' => 'azure_active_directory',
-                                                    ],
-                                                ],
-                                                'LogSearchConditions' => [
-                                                    'title' => 'JSON Array ["key":"product_code", "value":"ctdr"]',
-                                                    'description' => '',
-                                                    'type' => 'string',
-                                                    'example' => '[{\\"SCHEMA\\":\\"AZURE_ACTIVE_DIRECTORY_AUDIT_ACTIVITY\\"}]',
-                                                ],
-                                                'LogViewExisted' => [
-                                                    'description' => '',
-                                                    'type' => 'boolean',
-                                                    'example' => 'true',
-                                                ],
-                                            ],
-                                        ],
-                                    ],
-                                    'ColdStorageUsedCapacity' => [
-                                        'description' => '',
-                                        'type' => 'number',
-                                        'format' => 'double',
-                                        'example' => '100.0',
-                                    ],
-                                    'DataStorageUsedCapacityDetail' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => '{\\"purchasedHotStorageCapacity\\":1000,\\"usedHotStorageCapacity\\":4.2,\\"usedHotStorageCapacityDetail\\":{\\"ap-southeast-1\\":4.2,\\"cn-shenzhen\\":0.0,\\"cn-shanghai\\":0.0}}',
-                                    ],
-                                    'DataStorageRegionPermission' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'deny',
-                                    ],
-                                ],
-                            ],
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '81FB0DEA-52C1-55A0-8631-8E1B9A9D****',
-                            ],
+                            'RequestId' => ['title' => 'Id of the request', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
-            'errorCodes' => [],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"DataStorageRegionId\\": \\"cn-shanghai\\",\\n    \\"DataStorageTotalCapacity\\": 100,\\n    \\"DataStorageUsedCapacity\\": 100,\\n    \\"LogProject\\": \\"aliyun-cloudsiem-data-171835723111****-cn-shanghai\\",\\n    \\"SasLogStores\\": [\\n      {\\n        \\"LogName\\": \\"Process Snapshot\\",\\n        \\"LogStoreName\\": \\"sas-security-log\\",\\n        \\"LogDeliveryStatus\\": \\"enable\\",\\n        \\"LogStoreTtl\\": 180,\\n        \\"LogDeliveryUpdateTime\\": \\"2025-07-16T15:10:29\\",\\n        \\"LogDeliveryPermission\\": \\"deny\\",\\n        \\"LogDeliveryGroup\\": \\"host\\",\\n        \\"LogSearchConditions\\": \\"[{\\\\\\\\\\\\\\"__topic__\\\\\\\\\\\\\\":\\\\\\\\\\\\\\"sas-net-block\\\\\\\\\\\\\\"}]\\",\\n        \\"LogCode\\": \\"sas-net-block\\",\\n        \\"LogStoreExisted\\": true\\n      }\\n    ],\\n    \\"NormalizationLogStores\\": [\\n      {\\n        \\"LogStoreName\\": \\"vulnerability-activity\\",\\n        \\"LogStoreTtl\\": 180\\n      }\\n    ],\\n    \\"NormalizationLogViews\\": [\\n      {\\n        \\"CategoryName\\": \\"Security Category\\",\\n        \\"ActivityName\\": \\"API security risk log\\",\\n        \\"LogViewName\\": \\"risk_activity\\",\\n        \\"LogStoreName\\": \\"risk-activity\\",\\n        \\"DetectionRuleReferenceCount\\": 3,\\n        \\"DetectionRuleReferenceProductIds\\": [\\n          \\"azure_active_directory\\"\\n        ],\\n        \\"LogSearchConditions\\": \\"[{\\\\\\\\\\\\\\"SCHEMA\\\\\\\\\\\\\\":\\\\\\\\\\\\\\"AZURE_ACTIVE_DIRECTORY_AUDIT_ACTIVITY\\\\\\\\\\\\\\"}]\\",\\n        \\"LogViewExisted\\": true\\n      }\\n    ],\\n    \\"ColdStorageUsedCapacity\\": 100,\\n    \\"DataStorageUsedCapacityDetail\\": \\"{\\\\\\\\\\\\\\"purchasedHotStorageCapacity\\\\\\\\\\\\\\":1000,\\\\\\\\\\\\\\"usedHotStorageCapacity\\\\\\\\\\\\\\":4.2,\\\\\\\\\\\\\\"usedHotStorageCapacityDetail\\\\\\\\\\\\\\":{\\\\\\\\\\\\\\"ap-southeast-1\\\\\\\\\\\\\\":4.2,\\\\\\\\\\\\\\"cn-shenzhen\\\\\\\\\\\\\\":0.0,\\\\\\\\\\\\\\"cn-shanghai\\\\\\\\\\\\\\":0.0}}\\",\\n    \\"DataStorageRegionPermission\\": \\"deny\\"\\n  },\\n  \\"RequestId\\": \\"81FB0DEA-52C1-55A0-8631-8E1B9A9D****\\"\\n}","type":"json"}]',
-        ],
-        'CreateDataSource' => [
-            'summary' => '创建数据源',
-            'methods' => [
-                'post',
-                'get',
+            'errorCodes' => [
+                400 => [
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
+                ],
             ],
-            'schemes' => [
-                'https',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+            'title' => 'CreateLogStore',
+            'description' => 'The JsonConfig input parameter uses a complex JSON structure. A supporting tool class is provided to simplify this configuration. For an example, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'create',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:CreateLogStore',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+        ],
+        'CreateNormalizationRule' => [
+            'summary' => 'Creates a normalization rule.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
@@ -1285,252 +1324,171 @@
                 'operationType' => 'create',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the region where your assets reside. Valid values:'."\n"
+                        .'- cn-hangzhou: Your assets reside in the Chinese mainland.'."\n"
+                        .'- ap-southeast-1: Your assets reside outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
+                    'schema' => ['description' => 'The ID of the member accounts in the resource directory.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataSourceName',
+                    'name' => 'NormalizationRuleName',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'AD_LOG。',
-                    ],
+                    'schema' => ['description' => 'The name of the normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'normalization_rule_Z57np', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataSourceType',
+                    'name' => 'NormalizationRuleDescription',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'preset。',
-                    ],
+                    'schema' => ['description' => 'The description of the normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'normalization_rule_Z57np', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataSourceFrom',
+                    'name' => 'NormalizationRuleFormat',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'center。',
-                    ],
+                    'schema' => ['description' => 'The format of the normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'SPL', 'title' => ''],
                 ],
                 [
-                    'name' => 'LogUserId',
+                    'name' => 'NormalizationRuleExpression',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
+                    'schema' => ['description' => 'The expression of the normalization rule.', 'type' => 'string', 'required' => false, 'example' => '* | pack-fields -include=\'[\\s\\S]+\' as extend_content', 'title' => ''],
                 ],
                 [
-                    'name' => 'LogRegionId',
+                    'name' => 'NormalizationCategoryId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The category ID of the normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'NETWORK_CATEGORY', 'title' => ''],
                 ],
                 [
-                    'name' => 'LogProjectName',
+                    'name' => 'NormalizationSchemaId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'aliyun-cloudsiem-data-173326*******-cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The normalization schema ID.', 'type' => 'string', 'required' => false, 'example' => 'HTTP_ACTIVITY', 'title' => ''],
                 ],
                 [
-                    'name' => 'LogStoreName',
+                    'name' => 'VendorId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'mde_raw。',
-                    ],
+                    'schema' => ['description' => 'The vendor ID associated with the normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataSourceStores',
+                    'name' => 'ProductId',
                     'in' => 'formData',
-                    'style' => 'flat',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'array',
-                        'items' => [
-                            'description' => '',
-                            'type' => 'object',
-                            'properties' => [
-                                'LogRegionId' => [
-                                    'description' => '',
-                                    'type' => 'string',
-                                    'required' => false,
-                                    'example' => 'cn-hangzhou。',
-                                ],
-                                'LogProjectName' => [
-                                    'description' => '',
-                                    'type' => 'string',
-                                    'required' => false,
-                                    'example' => 'aliyun-cloudsiem-data-173326*******-cn-hangzhou。',
-                                ],
-                                'LogStoreName' => [
-                                    'description' => '',
-                                    'type' => 'string',
-                                    'required' => false,
-                                    'example' => 'actiontrail_management-events。',
-                                ],
-                                'DataSourceStoreStatus' => [
-                                    'type' => 'string',
-                                ],
-                                'DataSourceStoreId' => [
-                                    'type' => 'string',
-                                ],
-                                'DataSourceStoreFrom' => [
-                                    'type' => 'string',
-                                ],
-                            ],
-                            'required' => false,
-                        ],
-                        'required' => false,
-                    ],
+                    'schema' => ['description' => 'The product ID.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_sas', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataSourceTemplateId',
+                    'name' => 'NormalizationRuleMode',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'string',
-                    ],
+                    'schema' => ['description' => 'The mode of the normalization rule. Valid values:'."\n"
+                        .'- both'."\n"
+                        .'- scan'."\n"
+                        .'- realtime.', 'type' => 'string', 'required' => false, 'example' => 'both', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataSourceIds',
+                    'name' => 'ExtendContentPacked',
                     'in' => 'formData',
-                    'style' => 'json',
-                    'schema' => [
-                        'type' => 'array',
-                        'items' => [
-                            'type' => 'string',
-                        ],
-                    ],
+                    'schema' => ['title' => '', 'description' => 'Specifies whether to pack non-standard fields into the extension field extend_content. Valid values:'."\n"
+                        .'- enabled: Enabled.'."\n"
+                        .'- disabled: Disabled.', 'type' => 'string', 'required' => false, 'example' => 'enabled'],
                 ],
                 [
-                    'name' => 'DataSourceRecognizer',
+                    'name' => 'NormalizationRuleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'string',
-                    ],
+                    'schema' => ['description' => 'The type of the normalization rule. Valid values:'."\n"
+                        .'- predefined: predefined normalization rule.'."\n"
+                        .'- custom: custom normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'custom', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataSourceRecognizeEnabled',
+                    'name' => 'OrderField',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'boolean',
-                    ],
+                    'schema' => ['description' => 'The field used to sort the rule list. Valid values:'."\n"
+                        .'- GmtModified: sorted by modification time.'."\n"
+                        .'- Id: sorted by rule ID (default).', 'type' => 'string', 'required' => false, 'example' => 'Id', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataSourceReferences',
+                    'name' => 'NormalizationRuleVersion',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The version of the normalization rule.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1', 'title' => ''],
+                ],
+                [
+                    'name' => 'NormalizationRuleIds',
                     'in' => 'formData',
                     'style' => 'json',
                     'schema' => [
+                        'description' => 'The list of normalization rule IDs.',
                         'type' => 'array',
-                        'items' => [
-                            'type' => 'string',
-                        ],
+                        'items' => ['description' => 'The list of normalization rule IDs.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_cfw_alert_extract_rule,alibaba_cloud_cfw_flow_rule,alibaba_cloud_ndr_http_rule,alibaba_cloud_ndr_dns_rule,alibaba_cloud_ndr_attack_alert_rule', 'title' => ''],
+                        'required' => false,
+                        'title' => '',
+                        'example' => '',
                     ],
                 ],
                 [
-                    'name' => 'Order',
+                    'name' => 'ExtendFieldStoreMode',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'string',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The storage mode for extension fields. Valid values: flat, pack, and reject.', 'type' => 'string', 'example' => 'flat', 'required' => false],
+                ],
+                [
+                    'name' => 'NormalizationSecurityDomainId',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'type' => 'string', 'example' => 'NETWORK_AND_WEB_SECURITY', 'description' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'Schema of Response',
-                        'description' => '',
+                        'title' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'title' => 'Id of the request',
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。',
-                            ],
-                            'DataSourceId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => 'ds-jl67vixpe1scwysgyu3x。',
-                            ],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
+                            'NormalizationRuleId' => ['description' => 'The normalization rule ID.', 'type' => 'string', 'example' => 'nr-z0b2ssjteut85uoh9nzp', 'title' => ''],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"DataSourceId\\": \\"ds-jl67vixpe1scwysgyu3x\\"\\n}","type":"json"}]',
-        ],
-        'UpdateDataSource' => [
-            'summary' => '更新数据源',
-            'methods' => [
-                'post',
-                'get',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'Create a normalization rule',
+            'description' => 'The input parameter JsonConfig is a complex JSON configuration. A utility class is provided to help with specific configuration examples. For more information, refer to [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
             ],
-            'schemes' => [
-                'https',
+            'ramActions' => [
+                [
+                    'operationType' => 'create',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:CreateNormalizationRule',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'NormalizationRule', 'arn' => 'acs:yundun-sas::{#accountId}:normalizationrule/*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"NormalizationRuleId\\": \\"nr-z0b2ssjteut85uoh9nzp\\"\\n}","type":"json"}]',
+        ],
+        'CreateNormalizationSchema' => [
+            'summary' => 'Creates a data source.',
+            'methods' => ['post'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
@@ -1539,209 +1497,259 @@
             'operationType' => 'write',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'update',
+                'operationType' => 'create',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The region where the Data Management center for threat analysis is located. Select a region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: for assets in the Chinese mainland and China (Hong Kong)'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: for assets in regions outside China', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
-                    ],
+                    'schema' => ['description' => 'The language of the response message. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese'."\n"
+                        ."\n"
+                        .'- **en**: English', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
+                    'schema' => ['description' => 'The user ID of a member. An administrator can use this ID to switch to the member\'s perspective.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataSourceId',
+                    'name' => 'NormalizationSchemaType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'ds-014frtpy28m5ct2eoyo1。',
-                    ],
+                    'schema' => ['description' => 'The type of the normalization structure. Valid values:'."\n"
+                        ."\n"
+                        .'- log: a log'."\n"
+                        ."\n"
+                        .'- entity: an entity', 'type' => 'string', 'required' => true, 'title' => '', 'example' => 'log'],
                 ],
                 [
-                    'name' => 'DataSourceName',
+                    'name' => 'NormalizationSchemaId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'ActiontrailLog。',
-                    ],
+                    'schema' => ['description' => 'The ID of the normalization structure.', 'type' => 'string', 'required' => true, 'title' => '', 'example' => 'PROCESS_QUERY_DNS_ACTIVITY'],
                 ],
                 [
-                    'name' => 'LogUserId',
+                    'name' => 'NormalizationSchemaName',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
+                    'schema' => ['description' => 'The name of the normalization structure.', 'type' => 'string', 'required' => true, 'title' => '', 'example' => 'ProcessQuery'],
                 ],
                 [
-                    'name' => 'DataSourceStores',
+                    'name' => 'NormalizationSchemaDescription',
                     'in' => 'formData',
-                    'style' => 'flat',
+                    'schema' => ['description' => 'The description of the normalization structure.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => 'ProcessQuery'],
+                ],
+                [
+                    'name' => 'NormalizationCategoryId',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The ID of the normalization classification.', 'type' => 'string', 'required' => true, 'title' => '', 'example' => 'NETWORK_CATEGORY'],
+                ],
+                [
+                    'name' => 'TargetLogStore',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The Simple Log Service Logstore.', 'type' => 'string', 'required' => true, 'title' => '', 'example' => 'xxx-activity'],
+                ],
+                [
+                    'name' => 'NormalizationFields',
+                    'in' => 'formData',
+                    'style' => 'repeatList',
                     'schema' => [
-                        'description' => '',
                         'type' => 'array',
                         'items' => [
+                            'title' => '',
                             'type' => 'object',
                             'properties' => [
-                                'LogRegionId' => [
-                                    'description' => '',
-                                    'type' => 'string',
-                                    'required' => false,
-                                    'example' => 'cn-hangzhou。',
-                                ],
-                                'LogProjectName' => [
-                                    'description' => '',
-                                    'type' => 'string',
-                                    'required' => false,
-                                    'example' => 'aliyun-cloudsiem-data-173326*******-cn-hangzhou。',
-                                ],
-                                'LogStoreName' => [
-                                    'description' => '',
-                                    'type' => 'string',
+                                'NormalizationFieldName' => ['description' => 'The name of the normalization field.', 'type' => 'string', 'required' => true, 'title' => '', 'example' => 'cloud_user'],
+                                'NormalizationFieldType' => ['description' => 'The type of the normalization field. Supported types: text, long, double, and json.', 'type' => 'string', 'required' => true, 'title' => '', 'example' => 'varchar'],
+                                'NormalizationFieldRequired' => ['description' => 'Indicates whether the normalization field is required.', 'type' => 'boolean', 'required' => false, 'title' => '', 'example' => 'true'],
+                                'NormalizationFieldDescription' => ['description' => 'The description of the normalization field.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => 'cloud_user'],
+                                'NormalizationFieldFrom' => ['description' => 'The source of the key for a normalization field of the json type.', 'type' => 'string', 'required' => false, 'example' => 'preset', 'title' => ''],
+                                'NormalizationFieldExample' => ['description' => 'An example of the normalization field.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => '173326*******'],
+                                'NormalizationFieldTokenize' => ['description' => 'Indicates whether to tokenize the normalization field.', 'type' => 'boolean', 'required' => false, 'title' => '', 'example' => 'true'],
+                                'NormalizationFieldJsonIndexAll' => ['description' => 'Indicates whether to create an index for all keys of a json type normalization field.', 'type' => 'boolean', 'title' => '', 'required' => false, 'example' => 'true'],
+                                'NormalizationFieldJsonKeys' => [
+                                    'type' => 'array',
+                                    'items' => [
+                                        'type' => 'object',
+                                        'properties' => [
+                                            'NormalizationFieldName' => ['description' => 'The name of the key for a normalization field of the json type.', 'type' => 'string', 'required' => true, 'title' => '', 'example' => 'alert_level'],
+                                            'NormalizationFieldType' => ['description' => 'The type of the key for a normalization field of the json type. Supported types: text, long, double, and json.', 'type' => 'string', 'required' => true, 'title' => '', 'example' => 'text'],
+                                            'NormalizationFieldRequired' => ['description' => 'Indicates whether the key for a normalization field of the json type is required.', 'type' => 'boolean', 'required' => false, 'title' => '', 'example' => 'true'],
+                                            'NormalizationFieldDescription' => ['description' => 'The description of the key for a normalization field of the json type.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => 'The alert severity levels are represented by the values 1, 2, 3, and 4.'],
+                                            'NormalizationFieldFrom' => ['description' => 'The source of the key for a normalization field of the json type.', 'type' => 'string', 'required' => false, 'example' => 'preset', 'title' => ''],
+                                            'NormalizationFieldExample' => ['description' => 'An example of the key for a normalization field of the json type.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => '1, 2, 3, 4'],
+                                            'NormalizationFieldTokenize' => ['description' => 'Indicates whether to tokenize the key for a normalization field of the json type.', 'type' => 'boolean', 'title' => '', 'required' => false, 'example' => 'true'],
+                                        ],
+                                        'description' => 'A key for a normalization field of the json type.',
+                                        'required' => false,
+                                        'title' => '',
+                                        'example' => '',
+                                    ],
+                                    'maxItems' => 50,
+                                    'title' => '',
+                                    'description' => 'The list of keys for a normalization field of the json type.',
                                     'required' => false,
-                                    'example' => 'cn-rds-sqlaudit。',
-                                ],
-                                'DataSourceStoreFrom' => [
-                                    'type' => 'string',
-                                ],
-                                'DataSourceStoreId' => [
-                                    'type' => 'string',
+                                    'example' => '',
                                 ],
+                                'NormalizationFieldRequirement' => ['description' => 'Indicates whether the normalization field is required.', 'type' => 'boolean', 'required' => false, 'example' => 'true', 'title' => ''],
+                                'NormalizationFieldReserved' => ['description' => 'Indicates whether the normalization field is reserved.', 'type' => 'boolean', 'required' => false, 'example' => 'true', 'title' => ''],
                             ],
+                            'description' => 'The normalization fields.',
                             'required' => false,
+                            'example' => '',
                         ],
                         'required' => false,
+                        'maxItems' => 200,
+                        'description' => 'The normalization fields.',
+                        'title' => '',
+                        'example' => '',
                     ],
                 ],
-                [
-                    'name' => 'DataSourceRecognizeEnabled',
-                    'in' => 'formData',
+            ],
+            'responses' => [
+                200 => [
                     'schema' => [
-                        'description' => '',
-                        'type' => 'boolean',
-                        'required' => false,
-                        'example' => 'true',
+                        'type' => 'object',
+                        'properties' => [
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'title' => '', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
+                        ],
+                        'title' => '',
+                        'description' => 'The schema for the response.',
+                        'example' => '',
+                    ],
+                ],
+            ],
+            'errorCodes' => [],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'CreateNormalizationSchema',
+            'description' => 'The JsonConfig input parameter is a complex JSON configuration. A supporting tool class provides configuration examples. For more information, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'create',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:CreateNormalizationSchema',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'NormalizationSchema', 'arn' => 'acs:yundun-sas::{#accountId}:normalizationschema/*'],
+                        ],
                     ],
                 ],
+            ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+        ],
+        'CreateProduct' => [
+            'summary' => 'Creates a product.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
+            'security' => [
                 [
-                    'name' => 'DataSourceFrom',
+                    'AK' => [],
+                ],
+            ],
+            'operationType' => 'write',
+            'deprecated' => false,
+            'systemTags' => [
+                'operationType' => 'create',
+                'riskType' => 'none',
+                'chargeType' => 'free',
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
+            ],
+            'parameters' => [
+                [
+                    'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'string',
-                    ],
+                    'schema' => ['description' => 'The region of the Data Management center. Select a region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Assets are in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
-                    'name' => 'OrderField',
+                    'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'string',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
-                    'name' => 'LogStoreName',
+                    'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-rds-sqlaudit。',
-                    ],
+                    'schema' => ['description' => 'The user ID of a member. This parameter is used when an administrator operates as another member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
                 [
-                    'name' => 'LogProjectName',
+                    'name' => 'VendorName',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'aliyun-cloudsiem-data-173326*******-cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The name of the vendor.', 'type' => 'string', 'required' => false, 'example' => '111', 'title' => ''],
                 ],
                 [
-                    'name' => 'LogRegionId',
+                    'name' => 'ProductName',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The name of the product.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_sas', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'Schema of Response',
-                        'description' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'title' => 'Id of the request',
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。',
-                            ],
+                            'RequestId' => ['title' => 'Id of the request', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
+                            'ProductId' => ['description' => 'The ID of the product.', 'type' => 'string', 'example' => 'alibaba_cloud_sas', 'title' => ''],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"ProductId\\": \\"alibaba_cloud_sas\\"\\n}","type":"json"}]',
+            'title' => 'CreateProduct',
+            'description' => 'The JsonConfig request parameter is a complex JSON configuration. A supporting tool class is available and provides configuration examples. For more information, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'create',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:CreateProduct',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'Product', 'arn' => 'acs:yundun-sas::{#accountId}:product/*'],
+                        ],
+                    ],
+                ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
         ],
-        'RefreshDataSource' => [
-            'summary' => '刷新数据源',
-            'methods' => [
-                'post',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'CreateResponseRule' => [
+            'summary' => 'Creates an automatic response rule.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
@@ -1750,90 +1758,134 @@
             'operationType' => 'write',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'update',
+                'operationType' => 'create',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
-                'autoTest' => true,
-                'tenantRelevance' => 'tenant',
+                'abilityTreeNodes' => ['FEATUREsas104PTS'],
             ],
             'parameters' => [
                 [
+                    'name' => 'NextToken',
+                    'in' => 'formData',
+                    'allowEmptyValue' => true,
+                    'schema' => ['description' => 'The token that specifies the position from which to start the query. If you do not specify this parameter, the query starts from the beginning.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****'],
+                ],
+                [
+                    'name' => 'MaxResults',
+                    'in' => 'formData',
+                    'allowEmptyValue' => true,
+                    'schema' => ['description' => 'The maximum number of results to return.', 'type' => 'integer', 'format' => 'int32', 'title' => '', 'required' => false, 'example' => '50'],
+                ],
+                [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['description' => 'The deployment region of the data management center for threat analysis. You must select a region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or Hong Kong (China).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in regions outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese'."\n"
+                        ."\n"
+                        .'- **en**: English', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
+                ],
+                [
+                    'name' => 'ResponseRuleName',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The name of the automatic response rule.', 'type' => 'string', 'required' => false, 'example' => 'Send Notification When Generating Urgent Incident', 'title' => ''],
+                ],
+                [
+                    'name' => 'ResponseRulePriority',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The execution priority of the automatic response rule.', 'type' => 'string', 'required' => false, 'example' => '1', 'title' => ''],
+                ],
+                [
+                    'name' => 'ResponseExecutionCondition',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The trigger conditions for the rule, specified as a JSON string.', 'type' => 'string', 'required' => false, 'example' => '[{"left":{"value":"threat_level"},"operator":"equals","right":{"value":"suspicious"}}]', 'title' => ''],
+                ],
+                [
+                    'name' => 'ResponseActionType',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The action type for the automatic response rule. Valid values:'."\n"
+                        ."\n"
+                        .'- doPlaybook: Runs a playbook.'."\n"
+                        ."\n"
+                        .'- changeEventStatus: Changes the status of an event.'."\n"
+                        ."\n"
+                        .'- changeThreatLevel: Changes the threat level of an event.'."\n"
+                        ."\n"
+                        .'- addEventTag: Adds a tag to an event.'."\n"
+                        ."\n"
+                        .'- deleteEventTag: Deletes a tag from an event.'."\n"
+                        ."\n"
+                        .'- alertWhitelist: Adds an alert to the allowlist.', 'type' => 'string', 'required' => false, 'example' => 'doPlaybook', 'title' => ''],
+                ],
+                [
+                    'name' => 'ResponseTriggerType',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The trigger type for the automatic response rule. Valid values:'."\n"
+                        ."\n"
+                        .'- event: An event is generated.'."\n"
+                        ."\n"
+                        .'- event\\_update: An event is updated.'."\n"
+                        ."\n"
+                        .'- alert: An alert is generated.', 'type' => 'string', 'required' => false, 'example' => 'event', 'title' => ''],
+                ],
+                [
+                    'name' => 'ResponseActionConfig',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The action configuration, specified as a JSON string.', 'type' => 'string', 'required' => false, 'example' => '[{"actionType":"doPlaybook","playbookName":"block waf IP","playbookUuid":"system_aliyun_waf_whole_process_book","disposeParam":{"period":"7d"}}]', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The ID of the member account. An administrator uses this parameter to operate on behalf of the specified member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataSourceId',
+                    'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'ds-jl67vixpe1scwysgyu3x',
-                    ],
+                    'schema' => ['description' => 'The operational scope. Valid values:'."\n"
+                        ."\n"
+                        .'- 0: Sets the scope to the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- 1: Sets the scope to all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'Schema of Response',
-                        'description' => 'Schema of Response',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'title' => 'Id of the request',
-                                'description' => 'Id of the request',
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
-                            ],
+                            'RequestId' => ['description' => 'The unique request ID.', 'type' => 'string', 'title' => '', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
+                            'ResponseRuleId' => ['description' => 'The ID of the automatic response rule.', 'type' => 'string', 'example' => '399827', 'title' => ''],
                         ],
+                        'title' => '',
+                        'description' => 'The response data.',
+                        'example' => '',
                     ],
                 ],
             ],
-            'errorCodes' => [],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'CreateResponseRule',
+            'description' => 'Some parameters require complex JSON configurations. We provide a helper class with configuration examples. For more information, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
+            'ramActions' => [],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n  \\"ResponseRuleId\\": \\"399827\\"\\n}","type":"json"}]',
         ],
-        'DeleteDataSource' => [
-            'summary' => '删除数据源',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'CreateVendor' => [
+            'summary' => 'Creates a vendor.',
+            'path' => '',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
@@ -1842,562 +1894,259 @@
             'operationType' => 'write',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'delete',
+                'operationType' => 'create',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The region of the Data Management center. Select a region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: The assets are in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: The assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
-                    ],
+                    'schema' => ['description' => 'The language of the response messages. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'en', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
+                    'schema' => ['description' => 'The user ID of a member. An administrator can use this parameter to switch to the member\'s view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataSourceId',
+                    'name' => 'VendorName',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'ds-txejfbrh94k5cx58a4qh。',
-                    ],
+                    'schema' => ['description' => 'The name of the vendor.', 'type' => 'string', 'required' => false, 'example' => '111', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'Schema of Response',
-                        'description' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'title' => 'Id of the request',
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。',
-                            ],
+                            'RequestId' => ['title' => 'Id of the request', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
+                            'VendorId' => ['description' => 'The vendor ID.', 'type' => 'string', 'example' => 'vd-qlsw5eocx94w9', 'title' => ''],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"VendorId\\": \\"vd-qlsw5eocx94w9\\"\\n}","type":"json"}]',
+            'title' => 'CreateVendor',
+            'description' => 'Notifications are limited by frequency and time. Each user can receive a maximum of two notifications per day between 08:00 and 20:00. Notifications are not sent outside this time frame.',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'create',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:CreateVendor',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'Vendor', 'arn' => 'acs:yundun-sas::{#accountId}:vendor/*'],
+                        ],
+                    ],
+                ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
         ],
-        'ListDataSources' => [
-            'summary' => '获取厂商列表',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'DeleteDataIngestion' => [
+            'summary' => 'Deletes a data ingestion policy.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'read',
+            'operationType' => 'write',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'list',
+                'operationType' => 'get',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The region of the Management Hub for threat analysis. Select the region of the Management Hub based on the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
-                    ],
+                    'schema' => ['description' => 'The language of the response message. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
-                ],
-                [
-                    'name' => 'DataSourceIds',
-                    'in' => 'formData',
-                    'style' => 'simple',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'array',
-                        'items' => [
-                            'description' => '',
-                            'type' => 'string',
-                            'required' => false,
-                            'example' => 'alibaba_cloud_waf_alert_log_173326*******,alibaba_cloud_waf_flow_log_173326*******。',
-                        ],
-                        'required' => false,
-                    ],
-                ],
-                [
-                    'name' => 'DataSourceName',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'alibaba_cloud_waf_alert_log。',
-                    ],
+                    'schema' => ['description' => 'The user ID of a member. This parameter allows an administrator to operate on behalf of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataSourceType',
+                    'name' => 'DataIngestionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'custom。',
-                    ],
+                    'schema' => ['description' => 'The data ingestion ID.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_sas_netstat_ingestion_173326*******', 'title' => ''],
                 ],
-                [
-                    'name' => 'LogUserIds',
-                    'in' => 'formData',
-                    'style' => 'simple',
+            ],
+            'responses' => [
+                200 => [
                     'schema' => [
-                        'description' => '',
-                        'type' => 'array',
-                        'items' => [
-                            'description' => '',
-                            'type' => 'integer',
-                            'format' => 'int64',
-                            'required' => false,
-                            'example' => '173326*******。',
+                        'title' => 'Schema of Response',
+                        'description' => 'The response body.',
+                        'type' => 'object',
+                        'properties' => [
+                            'RequestId' => ['title' => 'Id of the request', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
-                        'required' => false,
-                    ],
-                ],
-                [
-                    'name' => 'LogRegionId',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
-                ],
-                [
-                    'name' => 'LogProjectName',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'aliyun-cloudsiem-data-173326*******-cn-hangzhou。',
+                        'example' => '',
                     ],
                 ],
-                [
-                    'name' => 'LogStoreName',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'audit-activity。',
-                    ],
+            ],
+            'errorCodes' => [
+                400 => [
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
-                [
-                    'name' => 'DataSourceTemplateIds',
-                    'in' => 'formData',
-                    'style' => 'simple',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'array',
-                        'items' => [
-                            'description' => '',
-                            'type' => 'string',
-                            'required' => false,
-                            'example' => 'alibaba_cloud_sas_account_snapshot_log_173326*******。',
+            ],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+            'title' => 'DeleteDataIngestion',
+            'description' => 'Notifications are sent only between 08:00 and 20:00. Each user can receive a maximum of two notifications per day.',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DeleteDataIngestion',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DataIngestion', 'arn' => 'acs:yundun-sas::{#accountId}:dataingestion/{#DataIngestionId}'],
                         ],
-                        'required' => false,
-                    ],
-                ],
-                [
-                    'name' => 'OrderField',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'UpdateTime。',
-                    ],
-                ],
-                [
-                    'name' => 'Order',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'desc。',
-                    ],
-                ],
-                [
-                    'name' => 'PageNumber',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '1。',
-                    ],
-                ],
-                [
-                    'name' => 'PageSize',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '5。',
                     ],
                 ],
+            ],
+        ],
+        'DeleteDataSet' => [
+            'summary' => 'Deletes a dataset.',
+            'methods' => ['post'],
+            'schemes' => ['https'],
+            'security' => [
                 [
-                    'name' => 'MaxResults',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'minimum' => '0',
-                        'example' => '50。',
-                    ],
+                    'AK' => [],
                 ],
+            ],
+            'operationType' => 'write',
+            'deprecated' => false,
+            'systemTags' => [
+                'operationType' => 'delete',
+                'riskType' => 'none',
+                'chargeType' => 'free',
+                'abilityTreeNodes' => ['FEATUREsasASHGE7'],
+            ],
+            'parameters' => [
                 [
-                    'name' => 'NextToken',
+                    'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****。',
-                    ],
+                    'schema' => ['description' => 'The region of the Data Management center for threat analysis. Select a region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: for assets in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: for assets outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataSourceFrom',
+                    'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'center。',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataSourceStoreStatus',
+                    'name' => 'DataSetId',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'string',
-                        'required' => false,
-                    ],
+                    'schema' => ['description' => 'The ID of the dataset.', 'type' => 'string', 'required' => true, 'example' => 'dataset-10iy8mbifnb4gniv****', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataSourceStatus',
+                    'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'string',
-                        'required' => false,
-                    ],
+                    'schema' => ['description' => 'The user ID that an administrator uses to switch to the perspective of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'Schema of Response',
-                        'description' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。',
-                            ],
-                            'DataSources' => [
-                                'description' => '',
-                                'type' => 'array',
-                                'items' => [
-                                    'description' => '',
-                                    'type' => 'object',
-                                    'properties' => [
-                                        'CreateTime' => [
-                                            'description' => '',
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '1733269771123。',
-                                        ],
-                                        'UpdateTime' => [
-                                            'description' => '',
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '1733269771123。',
-                                        ],
-                                        'DataSourceId' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'ds-scpfegri73oyoknbc90c。',
-                                        ],
-                                        'DataSourceName' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'AD_LOG。',
-                                        ],
-                                        'DataSourceType' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'custom。',
-                                        ],
-                                        'LogUserId' => [
-                                            'description' => '',
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '173326*******。',
-                                        ],
-                                        'LogRegionId' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'cn-hangzhou。',
-                                        ],
-                                        'LogProjectName' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'aliyun-cloudsiem-data-173326*******-cn-hangzhou。',
-                                        ],
-                                        'DataSourceFrom' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'center。',
-                                        ],
-                                        'LogStoreName' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'audit-activity。',
-                                        ],
-                                        'DataSourceTemplateId' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'alibaba_cloud_sas_account_snapshot_log_173326*******。'."\n",
-                                        ],
-                                        'DataSourceStores' => [
-                                            'description' => '',
-                                            'type' => 'array',
-                                            'items' => [
-                                                'description' => '',
-                                                'type' => 'object',
-                                                'properties' => [
-                                                    'DataSourceStoreId' => [
-                                                        'description' => '',
-                                                        'type' => 'string',
-                                                        'example' => 'di_xxxx_source_1。',
-                                                    ],
-                                                    'DataSourceStoreStatus' => [
-                                                        'description' => '',
-                                                        'type' => 'string',
-                                                        'example' => 'normal。',
-                                                        'title' => '日志存储状态码',
-                                                    ],
-                                                    'DataSourceStoreFrom' => [
-                                                        'description' => '',
-                                                        'type' => 'string',
-                                                        'example' => 'center。',
-                                                    ],
-                                                    'LogRegionId' => [
-                                                        'description' => '',
-                                                        'type' => 'string',
-                                                        'example' => 'cn-hangzhou。',
-                                                    ],
-                                                    'LogProjectName' => [
-                                                        'description' => '',
-                                                        'type' => 'string',
-                                                        'example' => 'aliyun-cloudsiem-data-173326*******-cn-hangzhou。',
-                                                    ],
-                                                    'LogStoreName' => [
-                                                        'description' => '',
-                                                        'type' => 'string',
-                                                        'example' => 'audit-activity。',
-                                                    ],
-                                                    'CreateTime' => [
-                                                        'description' => '',
-                                                        'type' => 'integer',
-                                                        'format' => 'int64',
-                                                        'example' => '1733269771123。',
-                                                    ],
-                                                    'UpdateTime' => [
-                                                        'description' => '',
-                                                        'type' => 'integer',
-                                                        'format' => 'int64',
-                                                        'example' => '1733269771123。',
-                                                    ],
-                                                    'CheckTime' => [
-                                                        'type' => 'integer',
-                                                        'format' => 'int64',
-                                                    ],
-                                                    'DataSourceStoreStatusCode' => [
-                                                        'title' => '日志存储状态码',
-                                                        'type' => 'string',
-                                                        'example' => 'LogStoreNotExist',
-                                                    ],
-                                                ],
-                                            ],
-                                        ],
-                                        'DataSourceRecognizer' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'alibaba_cloud_sas_account_snapshot。',
-                                        ],
-                                        'DataSourceRecognizeEnabled' => [
-                                            'description' => '',
-                                            'type' => 'boolean',
-                                            'example' => 'true。',
-                                        ],
-                                        'DataSourceReferences' => [
-                                            'description' => '',
-                                            'type' => 'array',
-                                            'items' => [
-                                                'description' => '',
-                                                'type' => 'object',
-                                                'properties' => [
-                                                    'DataIngestionId' => [
-                                                        'description' => '',
-                                                        'type' => 'string',
-                                                        'example' => 'alibaba_cloud_sas_account_snapshot_log_173326*******。',
-                                                    ],
-                                                ],
-                                            ],
-                                        ],
-                                        'DataSourceStatus' => [
-                                            'type' => 'string',
-                                        ],
-                                    ],
-                                ],
-                            ],
-                            'PageNumber' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '1。',
-                            ],
-                            'PageSize' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '1。',
-                            ],
-                            'TotalCount' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '2。',
-                            ],
-                            'TotalPage' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '1。',
-                            ],
-                            'MaxResults' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '50。',
-                            ],
-                            'NextToken' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****。',
-                            ],
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', 'title' => ''],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
+            'title' => 'DeleteDataSet',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'delete',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DeleteDataSet',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DataSet', 'arn' => 'acs:yundun-sas::{#accountId}:dataset/{#DataSetId}'],
+                        ],
+                    ],
+                ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"DataSources\\": [\\n    {\\n      \\"CreateTime\\": 1733269771123,\\n      \\"UpdateTime\\": 1733269771123,\\n      \\"DataSourceId\\": \\"ds-scpfegri73oyoknbc90c\\",\\n      \\"DataSourceName\\": \\"AD_LOG\\",\\n      \\"DataSourceType\\": \\"custom\\",\\n      \\"LogUserId\\": 0,\\n      \\"LogRegionId\\": \\"cn-hangzhou\\",\\n      \\"LogProjectName\\": \\"aliyun-cloudsiem-data-173326*******-cn-hangzhou\\",\\n      \\"DataSourceFrom\\": \\"center\\",\\n      \\"LogStoreName\\": \\"audit-activity\\",\\n      \\"DataSourceTemplateId\\": \\"alibaba_cloud_sas_account_snapshot_log_173326*******\\",\\n      \\"DataSourceStores\\": [\\n        {\\n          \\"DataSourceStoreId\\": \\"di_xxxx_source_1\\",\\n          \\"DataSourceStoreStatus\\": \\"normal\\",\\n          \\"DataSourceStoreFrom\\": \\"center\\",\\n          \\"LogRegionId\\": \\"cn-hangzhou\\",\\n          \\"LogProjectName\\": \\"aliyun-cloudsiem-data-173326*******-cn-hangzhou\\",\\n          \\"LogStoreName\\": \\"audit-activity\\",\\n          \\"CreateTime\\": 1733269771123,\\n          \\"UpdateTime\\": 1733269771123,\\n          \\"CheckTime\\": 1733269771123,\\n          \\"DataSourceStoreStatusCode\\": \\"LogStoreNotExist\\"\\n        }\\n      ],\\n      \\"DataSourceRecognizer\\": \\"alibaba_cloud_sas_account_snapshot\\",\\n      \\"DataSourceRecognizeEnabled\\": true,\\n      \\"DataSourceReferences\\": [\\n        {\\n          \\"DataIngestionId\\": \\"alibaba_cloud_sas_account_snapshot_log_173326*******\\"\\n        }\\n      ],\\n      \\"DataSourceStatus\\": \\"unconfigured\\"\\n    }\\n  ],\\n  \\"PageNumber\\": 1,\\n  \\"PageSize\\": 1,\\n  \\"TotalCount\\": 2,\\n  \\"TotalPage\\": 1,\\n  \\"MaxResults\\": 50,\\n  \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\"\\n}","type":"json"}]',
         ],
-        'UpdateDataSourceTemplate' => [
-            'summary' => '修改数据源模板',
-            'path' => '',
-            'methods' => [
-                'get',
-                'post',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'DeleteDataSetRecord' => [
+            'summary' => 'Deletes dataset records.',
+            'methods' => ['post'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
@@ -2406,370 +2155,176 @@
             'operationType' => 'write',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'update',
+                'operationType' => 'delete',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
-                'tenantRelevance' => 'tenant',
+                'abilityTreeNodes' => ['FEATUREsasASHGE7'],
             ],
             'parameters' => [
                 [
-                    'name' => 'DataSourceTemplateId',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'alibaba_cloud_actiontrail_event_ingestion。'."\n",
-                    ],
-                ],
-                [
-                    'name' => 'DataSourceTemplateName',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'alibaba_cloud_actiontrail_event_ingestion。'."\n",
-                    ],
-                ],
-                [
-                    'name' => 'LogUserIds',
-                    'in' => 'formData',
-                    'style' => 'simple',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'array',
-                        'items' => [
-                            'description' => '',
-                            'type' => 'string',
-                            'required' => false,
-                            'example' => '173326*******。',
-                        ],
-                        'required' => false,
-                    ],
-                ],
-                [
-                    'name' => 'LogRegionIds',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
-                ],
-                [
-                    'name' => 'LogProjectPattern',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'aliyun-cloudsiem-data-173326*******。',
-                    ],
-                ],
-                [
-                    'name' => 'LogStorePattern',
+                    'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'audit-activity。',
-                    ],
+                    'schema' => ['description' => 'The region of the Data Management center for Threat Analysis. Select a region based on where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
-                    'name' => 'RegionId',
+                    'name' => 'DataSetId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The ID of the dataset.', 'type' => 'string', 'required' => true, 'example' => 'dataset-10iy8mbifnb4gniv****', 'title' => ''],
                 ],
                 [
-                    'name' => 'RoleFor',
+                    'name' => 'DataSetRecordIds',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
+                    'schema' => ['description' => 'A list of dataset record IDs in a JSON array format.', 'type' => 'string', 'required' => true, 'example' => '[1,2,3,4]', 'title' => ''],
                 ],
                 [
-                    'name' => 'AutoScanNew',
+                    'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'enabled。',
-                    ],
-                ],
-                [
-                    'name' => 'DataSourceRecognizeEnabled',
-                    'in' => 'query',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'boolean',
-                        'required' => false,
-                        'example' => 'true。',
-                    ],
+                    'schema' => ['description' => 'The user ID of a member. An administrator can specify this parameter to operate as the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'Schema of Response',
-                        'description' => 'Schema of Response',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'title' => 'Id of the request',
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。',
-                            ],
+                            'RequestId' => ['description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'errorCodes' => [
+                400 => [
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
+                ],
             ],
+            'staticInfo' => ['returnType' => 'synchronous'],
             'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
-        ],
-        'ListDataSourceTemplates' => [
-            'summary' => '查询数据源模板',
-            'path' => '',
-            'methods' => [
-                'get',
-                'post',
-            ],
-            'schemes' => [
-                'https',
+            'title' => 'DeleteDataSetRecord',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'delete',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DeleteDataSetRecord',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+        ],
+        'DeleteDataSource' => [
+            'summary' => 'Deletes a data source.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'read',
+            'operationType' => 'write',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'list',
+                'operationType' => 'delete',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
-                    'name' => 'DataSourceTemplateIds',
+                    'name' => 'RegionId',
                     'in' => 'formData',
-                    'style' => 'simple',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'array',
-                        'items' => [
-                            'description' => '',
-                            'type' => 'string',
-                            'required' => false,
-                            'example' => 'alibaba_cloud_actiontrail_event_ingestion。',
-                        ],
-                        'required' => false,
-                        'minItems' => 0,
-                    ],
+                    'schema' => ['description' => 'The region where the Data Management center for threat analysis is located. Select a region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
-                    ],
-                ],
-                [
-                    'name' => 'RegionId',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
-                ],
-                [
-                    'name' => 'PageNumber',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '1。',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member whose permissions you want to use. This parameter is available only to administrators.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
                 [
-                    'name' => 'PageSize',
+                    'name' => 'DataSourceId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '10。',
-                    ],
+                    'schema' => ['description' => 'The ID of the data source.', 'type' => 'string', 'required' => false, 'example' => 'ds-txejfbrh94k5cx58a4qh', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'Schema of Response',
-                        'description' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。',
-                            ],
-                            'DataSourceTemplates' => [
-                                'description' => '',
-                                'type' => 'array',
-                                'items' => [
-                                    'description' => '',
-                                    'type' => 'object',
-                                    'properties' => [
-                                        'CreateTime' => [
-                                            'description' => '',
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '1733269771123。',
-                                        ],
-                                        'DataSourceTemplateId' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'alibaba_cloud_actiontrail_event_ingestion。',
-                                        ],
-                                        'DataSourceTemplateName' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'alibaba_cloud_actiontrail_event_ingestion。',
-                                        ],
-                                        'LogProjectPattern' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'aliyun-cloudsiem-data-173326*******。',
-                                        ],
-                                        'LogRegionIds' => [
-                                            'description' => '',
-                                            'type' => 'array',
-                                            'items' => [
-                                                'description' => '',
-                                                'type' => 'string',
-                                                'example' => 'cn-hangzhou。',
-                                            ],
-                                        ],
-                                        'LogStorePattern' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'audit-activity。',
-                                        ],
-                                        'LogUserIds' => [
-                                            'description' => '',
-                                            'type' => 'array',
-                                            'items' => [
-                                                'description' => '',
-                                                'type' => 'string',
-                                                'example' => '173326*******。',
-                                            ],
-                                        ],
-                                        'UpdateTime' => [
-                                            'description' => '',
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '2025-01-08 10:28:31',
-                                        ],
-                                        'DataSourceFrom' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'custom。',
-                                        ],
-                                        'AutoScanNew' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'enabled。',
-                                        ],
-                                        'DataSourceRecognizer' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'alibaba_cloud_actiontrail_event_ingestion。',
-                                        ],
-                                        'DataSourceRecognizeEnabled' => [
-                                            'description' => '',
-                                            'type' => 'boolean',
-                                            'example' => 'true。',
-                                        ],
-                                    ],
-                                ],
-                            ],
-                            'PageNumber' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '1。',
-                            ],
-                            'PageSize' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '10。',
-                            ],
+                            'RequestId' => ['title' => 'Id of the request', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"DataSourceTemplates\\": [\\n    {\\n      \\"CreateTime\\": 1733269771123,\\n      \\"DataSourceTemplateId\\": \\"alibaba_cloud_actiontrail_event_ingestion\\",\\n      \\"DataSourceTemplateName\\": \\"alibaba_cloud_actiontrail_event_ingestion\\",\\n      \\"LogProjectPattern\\": \\"aliyun-cloudsiem-data-173326*******\\",\\n      \\"LogRegionIds\\": [\\n        \\"cn-hangzhou\\"\\n      ],\\n      \\"LogStorePattern\\": \\"audit-activity\\",\\n      \\"LogUserIds\\": [\\n        \\"173326*******\\"\\n      ],\\n      \\"UpdateTime\\": 1733269771123,\\n      \\"DataSourceFrom\\": \\"custom\\",\\n      \\"AutoScanNew\\": \\"enabled\\",\\n      \\"DataSourceRecognizer\\": \\"alibaba_cloud_actiontrail_event_ingestion\\",\\n      \\"DataSourceRecognizeEnabled\\": true\\n    }\\n  ],\\n  \\"PageNumber\\": \\"1\\",\\n  \\"PageSize\\": \\"10\\"\\n}","type":"json"}]',
-        ],
-        'CreateLogStore' => [
-            'summary' => '创建LogStore',
-            'methods' => [
-                'post',
-                'get',
+            'errorCodes' => [
+                400 => [
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
+                ],
             ],
-            'schemes' => [
-                'https',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+            'title' => 'DeleteDataSource',
+            'description' => 'The JsonConfig request parameter is a complex JSON configuration. A supporting tool class provides configuration examples. For more information, see the [demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'delete',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DeleteDataSource',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DataSource', 'arn' => 'acs:yundun-sas::{#accountId}:datasource/{#DataSourceId}'],
+                        ],
+                    ],
+                ],
             ],
+        ],
+        'DeleteDetectionRule' => [
+            'summary' => 'Deletes a detection rule.',
+            'methods' => ['post'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
@@ -2778,126 +2333,84 @@
             'operationType' => 'write',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'create',
+                'operationType' => 'delete',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsasASHGE7'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The region of the Management Hub. Select a region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: The assets are in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: The assets are outside China.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'cn-hangzhou'],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
-                    ],
-                ],
-                [
-                    'name' => 'RoleFor',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
-                ],
-                [
-                    'name' => 'LogUserId',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
-                ],
-                [
-                    'name' => 'LogRegionId',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'zh'],
                 ],
                 [
-                    'name' => 'LogProjectName',
+                    'name' => 'DetectionRuleId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'aliyun-cloudsiem-channel-173326*******-cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The ID of the detection rule.', 'type' => 'string', 'required' => true, 'title' => '', 'example' => 'dr-53np4nguf5jmh1vc****'],
                 ],
                 [
-                    'name' => 'LogStoreName',
+                    'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'logstoreqykug。',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member. This parameter is used by an administrator to switch to the perspective of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'Schema of Response',
-                        'description' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'title' => 'Id of the request',
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。',
-                            ],
+                            'RequestId' => ['description' => 'The ID of the request.', 'type' => 'string', 'title' => '', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
+            'title' => 'DeleteDetectionRule',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'delete',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DeleteDetectionRule',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DetectionRule', 'arn' => 'acs:yundun-sas::{#accountId}:detection/{#DetectionRuleId}'],
+                        ],
+                    ],
+                ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
         ],
         'DeleteLogStore' => [
-            'summary' => '删除LogStore',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
-            ],
+            'summary' => 'Deletes a Logstore.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
@@ -2909,1082 +2422,824 @@
                 'operationType' => 'create',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The region of the Management Hub. Select a region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: if your assets are in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: if your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member whose perspective the administrator wants to switch to.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
                 [
                     'name' => 'LogUserId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
+                    'schema' => ['description' => 'The user ID for data ingestion.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
                 [
                     'name' => 'LogRegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The ID of the log storage region.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'LogProjectName',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'aliyun-cloudsiem-data-173326*******-cn-hangzhou',
-                    ],
+                    'schema' => ['description' => 'The name of the Simple Log Service project.', 'type' => 'string', 'required' => false, 'example' => 'aliyun-cloudsiem-data-173326*******-cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'LogStoreName',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'rds-logstore。',
-                    ],
+                    'schema' => ['description' => 'The name of the Simple Log Service Logstore.', 'type' => 'string', 'required' => false, 'example' => 'rds-logstore', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'Schema of Response',
-                        'description' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'title' => 'Id of the request',
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。',
-                            ],
+                            'RequestId' => ['title' => 'Id of the request', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
+            'staticInfo' => ['returnType' => 'synchronous'],
             'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
-        ],
-        'ValidateLogStore' => [
-            'summary' => '校验LogStore',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
+            'title' => 'DeleteLogStore',
+            'description' => 'The \\`JsonConfig\\` request parameter is a complex JSON configuration. A supporting tool class with configuration examples is available. For more information, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'create',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DeleteLogStore',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+        ],
+        'DeleteNormalizationRule' => [
+            'summary' => 'Deletes a normalization rule.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'readAndWrite',
+            'operationType' => 'write',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'none',
+                'operationType' => 'delete',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
-                'tenantRelevance' => 'tenant',
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The region of the threat analysis Management Hub. Select the region of the Management Hub based on the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'cn-hangzhou'],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'zh'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
-                ],
-                [
-                    'name' => 'LogUserId',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
-                ],
-                [
-                    'name' => 'LogRegionId',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
-                ],
-                [
-                    'name' => 'LogProjectName',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'aliyun-cloudsiem-data-173326*******-cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The user ID of a member. An administrator can specify this parameter to operate on behalf of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '173326*******'],
                 ],
                 [
-                    'name' => 'LogStoreName',
+                    'name' => 'NormalizationRuleId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'ssglauncher-log。',
-                    ],
+                    'schema' => ['description' => 'The ID of the normalization rule.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'nr-z0b2ssjteut85uoh9nzp'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'Schema of Response',
-                        'description' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'title' => 'Id of the request',
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。',
-                            ],
+                            'RequestId' => ['description' => 'The ID of the request.', 'type' => 'string', 'title' => '', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
+            'staticInfo' => ['returnType' => 'synchronous'],
             'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
-        ],
-        'ListLogRegions' => [
-            'summary' => '获取所有的区域',
-            'path' => '',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
+            'title' => 'DeleteNormalizationRule',
+            'description' => 'The JsonConfig request parameter is a complex JSON configuration. A supporting tool class that contains configuration examples is provided. For more information, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'delete',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DeleteNormalizationRule',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'NormalizationRule', 'arn' => 'acs:yundun-sas::{#accountId}:normalizationrule/{#NormalizationRuleId}'],
+                        ],
+                    ],
+                ],
             ],
+        ],
+        'DeleteNormalizationRuleVersion' => [
+            'summary' => 'Deletes a normalization rule version.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'read',
+            'operationType' => 'write',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'get',
+                'operationType' => 'delete',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
-                'tenantRelevance' => 'publicInformation',
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
+                    'name' => 'RegionId',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The region of the Data Management center. Select a region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'cn-hangzhou'],
+                ],
+                [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
-                    ],
+                    'schema' => ['description' => 'The language of the response message. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'zh'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member. An administrator can specify this parameter to switch to the member\'s perspective.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '173326*******'],
+                ],
+                [
+                    'name' => 'NormalizationRuleId',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The ID of the normalization rule.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'nr-z0b2ssjteut85uoh9nzp'],
+                ],
+                [
+                    'name' => 'NormalizationRuleVersion',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The version of the normalization rule.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'Schema of Response',
-                        'description' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'title' => 'Id of the request',
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。',
-                            ],
-                            'LogRegions' => [
-                                'description' => '',
-                                'type' => 'array',
-                                'items' => [
-                                    'description' => '',
-                                    'type' => 'string',
-                                    'example' => 'cn-hangzhou。',
-                                ],
-                            ],
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'title' => '', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"LogRegions\\": [\\n    \\"cn-hangzhou\\"\\n  ]\\n}","type":"json"}]',
-        ],
-        'ListLogProjects' => [
-            'summary' => '获取日志Project列表',
-            'methods' => [
-                'post',
-                'get',
+            'errorCodes' => [
+                400 => [
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
+                ],
             ],
-            'schemes' => [
-                'https',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+            'title' => 'DeleteNormalizationRuleVersion',
+            'description' => 'The JsonConfig request parameter is a complex JSON configuration. A supporting tool class with configuration examples is provided. For more information, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'delete',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DeleteNormalizationRuleVersion',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'NormalizationRuleVersion', 'arn' => 'acs:yundun-sas::{#accountId}:normalizationruleversion/{#NormalizationRuleId}/{#NormalizationRuleVersion}'],
+                        ],
+                    ],
+                ],
             ],
+        ],
+        'DeleteProduct' => [
+            'summary' => 'Deletes a product.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'readAndWrite',
+            'operationType' => 'write',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'list',
+                'operationType' => 'delete',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The region of the Data Management center for Threat Analysis. Select a region for the Management Hub based on the region of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
-                ],
-                [
-                    'name' => 'LogUserId',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
-                ],
-                [
-                    'name' => 'LogRegionId',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
-                ],
-                [
-                    'name' => 'MaxResults',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'minimum' => '0',
-                        'example' => '50。',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member. An administrator can use this parameter to switch to the member\'s perspective.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
                 [
-                    'name' => 'NextToken',
+                    'name' => 'ProductId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****。',
-                    ],
+                    'schema' => ['description' => 'The product ID.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_sas', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'Schema of Response',
-                        'description' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'title' => 'Id of the request',
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。',
-                            ],
-                            'LogProjects' => [
-                                'description' => '',
-                                'type' => 'array',
-                                'items' => [
-                                    'description' => '',
-                                    'type' => 'string',
-                                    'example' => 'aliyun-cloudsiem-channel-173326*******-cn-beijing。',
-                                ],
-                            ],
-                            'MaxResults' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '50。',
-                            ],
-                            'NextToken' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****。',
-                            ],
-                            'TotalCount' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '57。',
-                            ],
+                            'RequestId' => ['title' => 'Id of the request', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+            'title' => 'DeleteProduct',
+            'description' => 'The JsonConfig request parameter is a complex JSON configuration. A supporting tool class is provided to help you create the configuration. For an example, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'delete',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DeleteProduct',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'Product', 'arn' => 'acs:yundun-sas::{#accountId}:product/{#ProductId}'],
+                        ],
+                    ],
+                ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"LogProjects\\": [\\n    \\"aliyun-cloudsiem-channel-173326*******-cn-beijing\\"\\n  ],\\n  \\"MaxResults\\": 50,\\n  \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\",\\n  \\"TotalCount\\": 57\\n}","type":"json"}]',
         ],
-        'ListLogStores' => [
-            'summary' => '获取日志store列表',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'DeleteResponseRule' => [
+            'methods' => ['post'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'readAndWrite',
+            'operationType' => 'write',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'list',
+                'operationType' => 'delete',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas104PTS'],
             ],
             'parameters' => [
                 [
-                    'name' => 'RegionId',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
-                ],
-                [
-                    'name' => 'Lang',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
-                    ],
-                ],
-                [
-                    'name' => 'RoleFor',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
-                ],
-                [
-                    'name' => 'LogUserId',
+                    'name' => 'NextToken',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
+                    'allowEmptyValue' => true,
+                    'schema' => ['description' => 'The token used to retrieve the next page of results. If you do not specify this parameter, the service returns the first page of results.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****'],
                 ],
                 [
-                    'name' => 'LogRegionId',
+                    'name' => 'MaxResults',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'allowEmptyValue' => true,
+                    'schema' => ['description' => 'The maximum number of entries to return on each page.', 'type' => 'integer', 'format' => 'int32', 'title' => '', 'required' => false, 'example' => '50'],
                 ],
                 [
-                    'name' => 'LogProjectName',
+                    'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'aliyun-cloudsiem-data-173326*******-cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The region ID of the data management center for threat analysis. This must be the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- `cn-hangzhou`: for assets in the Chinese mainland or Hong Kong (China).'."\n"
+                        ."\n"
+                        .'- `ap-southeast-1`: for assets in international regions.', 'type' => 'string', 'required' => false, 'example' => 'cn-shanghai', 'title' => ''],
                 ],
                 [
-                    'name' => 'MaxResults',
+                    'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'minimum' => '0',
-                        'example' => '50。',
-                    ],
+                    'schema' => ['description' => 'The language of the response message. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
-                    'name' => 'NextToken',
+                    'name' => 'ResponseRuleId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****。',
-                    ],
+                    'schema' => ['description' => 'The ID of the automatic response rule to delete.', 'type' => 'string', 'required' => false, 'example' => '403235', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'Schema of Response',
-                        'description' => '',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'title' => 'Id of the request',
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。',
-                            ],
-                            'LogStores' => [
-                                'description' => '',
-                                'type' => 'array',
-                                'items' => [
-                                    'description' => '',
-                                    'type' => 'string',
-                                    'example' => 'wadaaaa。',
-                                ],
-                            ],
-                            'MaxResults' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '50。',
-                            ],
-                            'NextToken' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****。',
-                            ],
-                            'TotalCount' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '57。',
-                            ],
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'title' => '', 'example' => '9BCE0BF1-4F0C-5860-87D2-C391799AF4F2'],
                         ],
+                        'title' => '',
+                        'description' => 'The response object.',
+                        'example' => '',
                     ],
                 ],
             ],
-            'errorCodes' => [
-                400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
-                ],
-            ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'DeleteResponseRule',
+            'summary' => 'Deletes an automatic response rule.',
+            'description' => 'Notifications are subject to frequency and time limits. Each user can receive a maximum of two notifications per day between 08:00 and 20:00.',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"LogStores\\": [\\n    \\"wadaaaa\\"\\n  ],\\n  \\"MaxResults\\": 50,\\n  \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\",\\n  \\"TotalCount\\": 57\\n}","type":"json"}]',
+            'ramActions' => [],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"9BCE0BF1-4F0C-5860-87D2-C391799AF4F2\\"\\n}","type":"json"}]',
         ],
-        'GetLogTicket' => [
-            'summary' => '查看LogStore',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'DeleteVendor' => [
+            'summary' => 'Deletes a vendor.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'read',
+            'operationType' => 'write',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'get',
+                'operationType' => 'delete',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The region where the Data Management Center of your threat analysis service is located. Select a region for the Management Center based on the region of your asset. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your asset is in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your asset is in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member. This parameter is used when an administrator switches to the perspective of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
                 [
-                    'name' => 'LogUserId',
+                    'name' => 'VendorId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
+                    'schema' => ['description' => 'The vendor ID.', 'type' => 'string', 'required' => false, 'example' => 'vd-qlsw5eocx94w9', 'title' => ''],
+                ],
+                [
+                    'name' => 'VendorName',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The vendor name.', 'type' => 'string', 'required' => false, 'example' => '111', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'Schema of Response',
-                        'description' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '173326*******。',
-                            ],
-                            'LogTicket' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '*******。',
-                            ],
+                            'RequestId' => ['title' => 'Id of the request', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+            'title' => 'DeleteVendor',
+            'description' => 'Notifications are subject to frequency and time limits. Each user can receive a maximum of two notifications per day. These notifications are sent only between 08:00 and 20:00.',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'delete',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DeleteVendor',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'Vendor', 'arn' => 'acs:yundun-sas::{#accountId}:vendor/{#VendorId}'],
+                        ],
+                    ],
+                ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"173326*******\\",\\n  \\"LogTicket\\": \\"*******\\"\\n}","type":"json"}]',
         ],
-        'CreateProduct' => [
-            'summary' => '创建产品',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'DisableDataIngestion' => [
+            'summary' => 'Disables a data ingestion policy.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'write',
+            'operationType' => 'readAndWrite',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'create',
+                'operationType' => 'update',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The region of the Data Management center for threat analysis. Select the region of the management center based on the region where your asset is located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your asset is in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your asset is outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
-                ],
-                [
-                    'name' => 'VendorName',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '111。',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member account that the administrator wants to switch to.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
                 [
-                    'name' => 'ProductName',
+                    'name' => 'DataIngestionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'alibaba_cloud_sas。',
-                    ],
+                    'schema' => ['description' => 'The data ingestion ID.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_sas_netstat_ingestion_173326*******', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'Schema of Response',
-                        'description' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'title' => 'Id of the request',
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。'."\n",
-                            ],
-                            'ProductId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => 'alibaba_cloud_sas。',
-                            ],
+                            'RequestId' => ['title' => 'Id of the request', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+            'title' => 'DisableDataIngestion',
+            'description' => 'The frequency and time of notifications are limited. Each user receives a maximum of two notifications per day between 08:00 and 20:00.',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'update',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:DisableDataIngestion',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DataIngestion', 'arn' => 'acs:yundun-sas::{#accountId}:dataingestion/{#DataIngestionId}'],
+                        ],
+                    ],
+                ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"ProductId\\": \\"alibaba_cloud_sas\\"\\n}","type":"json"}]',
         ],
-        'UpdateProduct' => [
-            'summary' => '更新产品品',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'EnableDataIngestion' => [
+            'summary' => 'Enables the data ingestion policy.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'write',
+            'operationType' => 'readAndWrite',
             'deprecated' => false,
             'systemTags' => [
                 'operationType' => 'update',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The region of the Data Management center for threat analysis. Select the region of the management center based on the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'en。',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '1733269771123。',
-                    ],
-                ],
-                [
-                    'name' => 'ProductId',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'alibaba_cloud_sas。',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member. An administrator can use this parameter to assume the permissions of the specified member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
                 [
-                    'name' => 'ProductName',
+                    'name' => 'DataIngestionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'alibaba_cloud_sas。',
-                    ],
+                    'schema' => ['description' => 'The data ingestion ID.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_sas_netstat_ingestion_173326*******', 'title' => ''],
                 ],
                 [
-                    'name' => 'VendorName',
+                    'name' => 'ProductId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '111。',
-                    ],
+                    'schema' => ['description' => 'The product ID.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_sas', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'Schema of Response',
-                        'description' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'title' => 'Id of the request',
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。'."\n",
-                            ],
+                            'RequestId' => ['title' => 'Id of the request', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
+            'staticInfo' => ['returnType' => 'synchronous'],
             'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
-        ],
-        'DeleteProduct' => [
-            'summary' => '删除产品',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
+            'title' => 'EnableDataIngestion',
+            'description' => 'Notification frequency is limited to a maximum of two per user per day. Notifications are sent only between 08:00 and 20:00.',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'update',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:EnableDataIngestion',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DataIngestion', 'arn' => 'acs:yundun-sas::{#accountId}:dataingestion/{#DataIngestionId}'],
+                        ],
+                    ],
+                ],
             ],
+        ],
+        'ExecuteAutoDisposeRecords' => [
+            'path' => '',
+            'methods' => ['post'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'write',
+            'operationType' => 'readAndWrite',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'delete',
+                'operationType' => 'update',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas731ZAS'],
+                'tenantRelevance' => 'tenant',
             ],
             'parameters' => [
                 [
-                    'name' => 'RegionId',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
-                ],
-                [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => true, 'example' => 'zh', 'title' => ''],
                 ],
                 [
-                    'name' => 'RoleFor',
+                    'name' => 'SelectedEntityList',
                     'in' => 'formData',
+                    'style' => 'flat',
                     'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
+                        'description' => 'The list of entities selected for manual handling.',
+                        'type' => 'array',
+                        'items' => [
+                            'description' => 'The entity information selected for manual handling.',
+                            'type' => 'object',
+                            'properties' => [
+                                'AutoDisposeRecordId' => ['description' => 'The unique ID of the investigation record.', 'type' => 'string', 'required' => false, 'example' => '0000089b040b8935fed2e24ca2ec8335', 'title' => ''],
+                                'EntityUuid' => ['description' => 'The UUID of the entity.', 'type' => 'string', 'required' => false, 'example' => '9938fc2708ddc7b7651f3a19e4f09962', 'title' => ''],
+                            ],
+                            'required' => false,
+                            'title' => '',
+                            'example' => '',
+                        ],
                         'required' => false,
-                        'example' => '173326*******。',
+                        'title' => '',
+                        'example' => '',
                     ],
                 ],
                 [
-                    'name' => 'ProductId',
+                    'name' => 'UnSelectedEntityList',
                     'in' => 'formData',
+                    'style' => 'flat',
                     'schema' => [
-                        'description' => '',
-                        'type' => 'string',
+                        'description' => 'The list of entities not selected for manual handling.',
+                        'type' => 'array',
+                        'items' => [
+                            'description' => 'The entity information not selected for manual handling.',
+                            'type' => 'object',
+                            'properties' => [
+                                'AutoDisposeRecordId' => ['description' => 'The unique ID of the investigation record.', 'type' => 'string', 'required' => false, 'example' => '0000089b040b8935fed2e24ca2ec8335', 'title' => ''],
+                                'EntityUuid' => ['description' => 'The UUID of the entity.', 'type' => 'string', 'required' => false, 'example' => 'ae6ac3e1c9ada174eb8dadd029a2e9d1', 'title' => ''],
+                            ],
+                            'required' => false,
+                            'title' => '',
+                            'example' => '',
+                        ],
                         'required' => false,
-                        'example' => 'alibaba_cloud_sas。',
+                        'title' => '',
+                        'example' => '',
                     ],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'Schema of Response',
-                        'description' => '',
+                        'title' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'title' => 'Id of the request',
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。',
-                            ],
+                            'RequestId' => ['title' => '', 'description' => 'Id of the request', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
+                    ['errorCode' => 'InvalidUpdateRecord.Conflict', 'errorMessage' => 'Only one of selectedEntityList or unSelectedEntityList can be specified.', 'description' => 'User fails in performing automatic disposal'],
+                ],
+            ],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'Manually handle alerts',
+            'summary' => 'Manually handles alerts. Batch operations are supported.',
+            'description' => 'The JsonConfig input parameter is a complex JSON configuration. A utility class is provided to help with specific configuration examples. For more information, refer to [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'update',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ExecuteAutoDisposeRecords',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
                     ],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
             'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
         ],
-        'ListProducts' => [
-            'summary' => '获取产品列表',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'ExecuteLogQuery' => [
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
@@ -3993,573 +3248,530 @@
             'operationType' => 'read',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'list',
+                'operationType' => 'get',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['description' => 'The region where the threat analysis data management center is located. Specify the management center based on the region of your assets. Valid values:'."\n"
+                        .'- cn-hangzhou: the asset is in the Chinese mainland.'."\n"
+                        .'- ap-southeast-1: the asset is outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member to which the administrator switches the view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
                 [
-                    'name' => 'ProductIds',
+                    'name' => 'LogUserId',
                     'in' => 'formData',
-                    'style' => 'simple',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'array',
-                        'items' => [
-                            'description' => '',
-                            'type' => 'string',
-                            'required' => false,
-                            'example' => 'alibaba_cloud_sas',
-                        ],
-                        'required' => false,
-                    ],
+                    'schema' => ['description' => 'The user ID for data access.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
                 [
-                    'name' => 'ProductName',
+                    'name' => 'LogRegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'sas',
-                    ],
+                    'schema' => ['description' => 'The log storage region ID.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
-                    'name' => 'ProductType',
+                    'name' => 'LogProjectName',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'preset',
-                    ],
+                    'schema' => ['description' => 'The Simple Log Service project name.', 'type' => 'string', 'required' => false, 'example' => 'slsaudit-center-173326*******-cn-hangzhou', 'title' => ''],
                 ],
                 [
-                    'name' => 'VendorId',
+                    'name' => 'LogStoreName',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'vd-qlsw5eocx94w9',
-                    ],
+                    'schema' => ['description' => 'The Simple Log Service project name.', 'type' => 'string', 'required' => false, 'example' => 'huawei-cn-cfw', 'title' => ''],
                 ],
                 [
-                    'name' => 'MaxResults',
+                    'name' => 'LogQuery',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'minimum' => '0',
-                        'example' => '50',
-                    ],
+                    'schema' => ['description' => 'The Simple Log Service query statement.', 'type' => 'string', 'required' => false, 'example' => '*', 'title' => ''],
                 ],
                 [
-                    'name' => 'NextToken',
+                    'name' => 'LogCondition',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****',
-                    ],
+                    'schema' => ['type' => 'string', 'description' => '', 'title' => '', 'example' => ''],
+                ],
+                [
+                    'name' => 'ExtendContentPacked',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'Specifies whether to pack non-standard fields into the extension field extend_content. Valid values:'."\n"
+                        .'- enabled: Enabled.'."\n"
+                        .'- disabled: Disabled.', 'type' => 'string', 'required' => false, 'example' => 'enabled'],
+                ],
+                [
+                    'name' => 'NormalizationSchemaId',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'If packing is enabled, you must specify NormalizationSchemaId.', 'type' => 'string', 'required' => false, 'example' => 'WAF_ALERT_ACTIVITY'],
+                ],
+                [
+                    'name' => 'StartTime',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The start time.', 'type' => 'string', 'required' => false, 'example' => '1733269771123', 'title' => ''],
+                ],
+                [
+                    'name' => 'EndTime',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The end time.', 'type' => 'string', 'required' => false, 'example' => '1733269771123', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'Schema of Response',
-                        'description' => '',
+                        'title' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****',
-                            ],
-                            'Products' => [
-                                'description' => '',
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''],
+                            'QueryResult' => [
+                                'description' => 'The query result.',
                                 'type' => 'array',
-                                'items' => [
-                                    'description' => '',
-                                    'type' => 'object',
-                                    'properties' => [
-                                        'CreateTime' => [
-                                            'description' => '',
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '1733269771123',
-                                        ],
-                                        'UpdateTime' => [
-                                            'description' => '',
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '1733269771123',
-                                        ],
-                                        'ProductId' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'alibaba_cloud_sas',
-                                        ],
-                                        'ProductAlias' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'alibaba_cloud_sas',
-                                        ],
-                                        'ProductName' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'sas',
-                                        ],
-                                        'ProductType' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'preset',
-                                        ],
-                                        'VendorId' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'vd-qlsw5eocx94w9',
-                                        ],
-                                        'VendorName' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => '111',
-                                        ],
-                                        'DataIngestionStatus' => [
-                                            'description' => '',
-                                            'type' => 'boolean',
-                                            'example' => 'enabled',
-                                        ],
-                                        'TotalDataIngestionCount' => [
-                                            'description' => '',
-                                            'type' => 'integer',
-                                            'format' => 'int32',
-                                            'example' => '10',
-                                        ],
-                                        'EnabledDataIngestionCount' => [
-                                            'description' => '',
-                                            'type' => 'integer',
-                                            'format' => 'int32',
-                                            'example' => '1',
-                                        ],
-                                        'AllowAddDataIngestion' => [
-                                            'description' => '',
-                                            'type' => 'boolean',
-                                            'example' => 'true',
-                                        ],
-                                        'AbnormalDataIngestionCount' => [
-                                            'description' => '',
-                                            'type' => 'integer',
-                                            'format' => 'int32',
-                                            'example' => '2',
-                                        ],
-                                        'ActiveTime' => [
-                                            'description' => '',
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '1733269771123',
-                                        ],
-                                    ],
-                                ],
-                            ],
-                            'MaxResults' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '50',
-                            ],
-                            'NextToken' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****',
-                            ],
-                            'TotalCount' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '57',
+                                'items' => ['description' => 'The query result.', 'type' => 'any', 'example' => '[]', 'title' => ''],
+                                'example' => '[]。',
+                                'title' => '',
                             ],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
+                ],
+            ],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'Execute a log service query',
+            'summary' => 'Executes a data query.',
+            'description' => 'The input parameter JsonConfig is a complex JSON Configurations. A utility class is provided to help with specific configuration examples. Refer to [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:CheckLogQuery',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
                     ],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"Products\\": [\\n    {\\n      \\"CreateTime\\": 1733269771123,\\n      \\"UpdateTime\\": 1733269771123,\\n      \\"ProductId\\": \\"alibaba_cloud_sas\\",\\n      \\"ProductAlias\\": \\"alibaba_cloud_sas\\",\\n      \\"ProductName\\": \\"sas\\",\\n      \\"ProductType\\": \\"preset\\",\\n      \\"VendorId\\": \\"vd-qlsw5eocx94w9\\",\\n      \\"VendorName\\": \\"111\\",\\n      \\"DataIngestionStatus\\": true,\\n      \\"TotalDataIngestionCount\\": 10,\\n      \\"EnabledDataIngestionCount\\": 1,\\n      \\"AllowAddDataIngestion\\": true,\\n      \\"AbnormalDataIngestionCount\\": 2,\\n      \\"ActiveTime\\": 1733269771123\\n    }\\n  ],\\n  \\"MaxResults\\": 50,\\n  \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\",\\n  \\"TotalCount\\": 57\\n}","type":"json"}]',
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"QueryResult\\": [\\n    \\"[]\\"\\n  ]\\n}","type":"json"}]',
         ],
-        'CreateVendor' => [
-            'summary' => '创建厂商',
+        'ExecuteUpgrade' => [
+            'summary' => 'Performs a version upgrade.',
             'path' => '',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
-            ],
+            'methods' => ['post'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'write',
+            'operationType' => 'readAndWrite',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'create',
+                'operationType' => 'update',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The region of the Data Management center for threat analysis. Select a region for the Management Hub based on the region of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'en。',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
-                ],
-                [
-                    'name' => 'VendorName',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '111。',
-                    ],
+                    'schema' => ['description' => 'The user ID of a member. An administrator can switch to the perspective of this member.', 'type' => 'string', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'Schema of Response',
-                        'description' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'title' => 'Id of the request',
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。'."\n",
-                            ],
-                            'VendorId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => 'vd-qlsw5eocx94w9。',
-                            ],
+                            'RequestId' => ['title' => 'Id of the request', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
-            'errorCodes' => [
-                400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+            'title' => 'ExecuteUpgrade',
+            'description' => 'The JsonConfig input parameter is a complex JSON configuration. A supporting tool class is provided to assist with this configuration. For an example, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'update',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ExecuteUpgrade',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
                     ],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"VendorId\\": \\"vd-qlsw5eocx94w9\\"\\n}","type":"json"}]',
         ],
-        'UpdateVendor' => [
-            'summary' => '更新厂商',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'GetAlert' => [
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'write',
+            'operationType' => 'read',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'update',
+                'operationType' => 'get',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas731ZAS'],
+                'tenantRelevance' => 'tenant',
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The region in which the threat detection and response data management center resides. Specify this parameter based on the region where your assets reside. Valid values:'."\n"
+                        .'- cn-hangzhou: Your assets reside in the Chinese mainland.'."\n"
+                        .'- ap-southeast-1: Your assets reside outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
-                    'name' => 'RoleFor',
+                    'name' => 'AlertUuid',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。'."\n",
-                    ],
+                    'schema' => ['description' => 'The ID of the alert that is associated with the incident.', 'type' => 'string', 'required' => false, 'example' => 'sas_71e24437d2797ce8fc59692905a4****', 'title' => ''],
                 ],
                 [
-                    'name' => 'VendorId',
+                    'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'vd-qlsw5eocx94w9。',
-                    ],
+                    'schema' => ['description' => 'The ID of the member to which the administrator switches the view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''],
                 ],
                 [
-                    'name' => 'VendorName',
+                    'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '111。',
-                    ],
+                    'schema' => ['description' => 'The view type.'."\n"
+                        ."\n"
+                        .'- 0: the view of the current Alibaba Cloud account.'."\n"
+                        .'- 1: the view of all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '1', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'Schema of Response',
-                        'description' => '',
+                        'title' => '',
+                        'description' => 'Schema of Response',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'title' => 'Id of the request',
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。'."\n",
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', 'title' => ''],
+                            'Alert' => [
+                                'description' => 'If this value is true, the minor engine version is not the latest version.'."\n"
+                                    ."\n"
+                                    .'> If the minor engine version of your server is not the latest version, the sampling logs may be inaccurate, which causes inaccurate IP statistics. We recommend that you upgrade the minor engine version at your earliest convenience.',
+                                'type' => 'object',
+                                'properties' => [
+                                    'AlertUuid' => ['description' => 'The alert UUID.', 'type' => 'string', 'example' => 'sas_1175554881779200_e59368b3ce1690eae7978f7712a69050', 'title' => ''],
+                                    'AlertRecord' => ['description' => 'The alert content.', 'type' => 'string', 'example' => '{***}', 'title' => ''],
+                                ],
+                                'title' => '',
+                                'example' => '',
                             ],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'Retrieve alert details',
+            'summary' => 'Retrieves the details of an alert.',
+            'description' => 'The input parameter JsonConfig is a complex JSON configuration. We provide a utility class to help with specific configuration examples. For more information, see [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+            'ramActions' => [],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n  \\"Alert\\": {\\n    \\"AlertUuid\\": \\"sas_1175554881779200_e59368b3ce1690eae7978f7712a69050\\",\\n    \\"AlertRecord\\": \\"{***}\\"\\n  }\\n}","type":"json"}]',
         ],
-        'DeleteVendor' => [
-            'summary' => '删除厂商',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'GetAutoDisposeConfig' => [
+            'path' => '',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'write',
+            'operationType' => 'read',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'delete',
+                'operationType' => 'get',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas731ZAS'],
+                'tenantRelevance' => 'tenant',
             ],
             'parameters' => [
                 [
-                    'name' => 'RegionId',
+                    'name' => 'ProductCode',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The code for the cloud product.', 'type' => 'string', 'required' => true, 'example' => 'alibaba_cloud_sas', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => true, 'example' => 'zh', 'title' => ''],
+                ],
+            ],
+            'responses' => [
+                200 => [
                     'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
+                        'type' => 'object',
+                        'properties' => [
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'title' => '', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
+                            'AutoDisposeConfig' => [
+                                'type' => 'object',
+                                'properties' => [
+                                    'ProductCode' => ['description' => 'The code for the cloud product.', 'type' => 'string', 'example' => 'alibaba_cloud_sas', 'title' => ''],
+                                    'AutoDecisionStatus' => ['description' => 'Indicates whether automatic response is enabled. Valid values:'."\n"
+                                        ."\n"
+                                        .'- enabled: Enabled.'."\n"
+                                        ."\n"
+                                        .'- disabled: Disabled.', 'type' => 'string', 'example' => 'enabled', 'title' => ''],
+                                ],
+                                'description' => 'The automatic response configuration.',
+                                'title' => '',
+                                'example' => '',
+                            ],
+                        ],
+                        'title' => '',
+                        'description' => 'The response body.',
+                        'example' => '',
                     ],
                 ],
+            ],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'GetAutoDisposeConfig',
+            'summary' => 'Retrieves the automatic response configuration.',
+            'description' => 'The `JsonConfig` input parameter uses a complex JSON structure. Refer to the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java) for a helper utility and configuration examples.',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n  \\"AutoDisposeConfig\\": {\\n    \\"ProductCode\\": \\"alibaba_cloud_sas\\",\\n    \\"AutoDecisionStatus\\": \\"enabled\\"\\n  }\\n}","type":"json"}]',
+        ],
+        'GetDataBatchIngestion' => [
+            'summary' => 'Retrieves the details of a batch data ingestion task.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
+            'security' => [
                 [
-                    'name' => 'RoleFor',
+                    'AK' => [],
+                ],
+            ],
+            'operationType' => 'read',
+            'deprecated' => false,
+            'systemTags' => [
+                'operationType' => 'get',
+                'riskType' => 'none',
+                'chargeType' => 'free',
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
+            ],
+            'parameters' => [
+                [
+                    'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
+                    'schema' => ['description' => 'The region where the Data Management Center for threat analysis is located. Select the region of the Management Center based on the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
-                    'name' => 'VendorId',
+                    'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'vd-qlsw5eocx94w9。',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
-                    'name' => 'VendorName',
+                    'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '111。',
-                    ],
+                    'schema' => ['description' => 'The user ID of a member. An administrator can use this parameter to switch to the member\'s perspective.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******'."\n", 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'Schema of Response',
-                        'description' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'title' => 'Id of the request',
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。'."\n",
+                            'RequestId' => ['description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''],
+                            'DataBatchIngestion' => [
+                                'description' => 'The details of the batch data ingestion task.',
+                                'type' => 'object',
+                                'properties' => [
+                                    'DataBatchIngestionStatus' => ['description' => 'The status of the batch data ingestion task. Valid values:'."\n"
+                                        ."\n"
+                                        .'- pending: The configuration is pending to take effect.'."\n"
+                                        ."\n"
+                                        .'- running: The configuration is taking effect.'."\n"
+                                        ."\n"
+                                        .'- success: The configuration has taken effect.'."\n"
+                                        ."\n"
+                                        .'- failed: The configuration failed to take effect.', 'type' => 'string', 'example' => 'pending', 'title' => ''],
+                                    'DataBatchIngestionSetTime' => ['description' => 'The time when the batch data ingestion task was configured.', 'type' => 'string', 'example' => '1733269771123', 'title' => ''],
+                                    'DataBatchIngestionEffectTime' => ['description' => 'The time when the configuration of the batch data ingestion task took effect.', 'type' => 'string', 'example' => '1733269771123', 'title' => ''],
+                                    'LogUserIds' => [
+                                        'description' => 'The list of user IDs for batch data ingestion.',
+                                        'type' => 'array',
+                                        'items' => ['description' => 'The user ID for batch data ingestion.', 'type' => 'string', 'example' => '173326*******', 'title' => ''],
+                                        'title' => '',
+                                        'example' => '',
+                                    ],
+                                    'AutoScanNew' => ['description' => 'Specifies whether to automatically discover new users. Valid values:'."\n"
+                                        ."\n"
+                                        .'- enabled: New users are automatically discovered.'."\n"
+                                        ."\n"
+                                        .'- disabled: New users are not automatically discovered.', 'type' => 'string', 'example' => 'enabled', 'title' => ''],
+                                    'DataIngestions' => [
+                                        'description' => 'The list of data ingestion tasks.',
+                                        'type' => 'array',
+                                        'items' => [
+                                            'description' => 'The data ingestion object.',
+                                            'type' => 'object',
+                                            'properties' => [
+                                                'DataIngestionId' => ['description' => 'The ID of the data ingestion task.', 'type' => 'string', 'example' => 'alibaba_cloud_sas_process_ingestion_173326*******', 'title' => ''],
+                                                'DataIngestionStatus' => ['description' => 'The status of the data ingestion task. Valid values:'."\n"
+                                                    ."\n"
+                                                    .'- enabled: enabled'."\n"
+                                                    ."\n"
+                                                    .'- disabled: disabled', 'type' => 'string', 'example' => 'enabled', 'title' => ''],
+                                                'DataSourceId' => ['description' => 'The ID of the data source.', 'type' => 'string', 'example' => 'alibaba_cloud_sas_process_log_173326*******', 'title' => ''],
+                                                'ProductId' => ['description' => 'The ID of the product.', 'type' => 'string', 'example' => 'alibaba_cloud_sas', 'title' => ''],
+                                                'VendorId' => ['description' => 'The ID of the vendor.', 'type' => 'string', 'example' => 'alibaba_cloud', 'title' => ''],
+                                            ],
+                                            'title' => '',
+                                            'example' => '',
+                                        ],
+                                        'title' => '',
+                                        'example' => '',
+                                    ],
+                                    'RecommendDataIngestionIds' => [
+                                        'description' => 'The list of recommended data ingestion IDs.',
+                                        'type' => 'array',
+                                        'items' => ['description' => 'The recommended data ingestion ID.', 'type' => 'string', 'example' => 'alibaba_cloud_sas_process_log_173326*******', 'title' => ''],
+                                        'title' => '',
+                                        'example' => '',
+                                    ],
+                                    'ApsaraDataIngestionIds' => [
+                                        'description' => 'The list of data ingestion IDs for Alibaba Cloud services.',
+                                        'type' => 'array',
+                                        'items' => ['description' => 'The data ingestion ID for an Alibaba Cloud service.', 'type' => 'string', 'example' => 'alibaba_cloud_sas_process_log_173326*******', 'title' => ''],
+                                        'title' => '',
+                                        'example' => '',
+                                    ],
+                                    'DataSourceRecognizeEnabled' => ['description' => 'Specifies whether to automatically discover new Logstores.', 'type' => 'boolean', 'example' => 'true', 'title' => ''],
+                                    'DataBatchIngestionMode' => ['description' => 'The mode of the batch data ingestion task.', 'type' => 'string', 'example' => 'full', 'title' => ''],
+                                ],
+                                'title' => '',
+                                'example' => '',
                             ],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"DataBatchIngestion\\": {\\n    \\"DataBatchIngestionStatus\\": \\"pending\\",\\n    \\"DataBatchIngestionSetTime\\": \\"1733269771123\\",\\n    \\"DataBatchIngestionEffectTime\\": \\"1733269771123\\",\\n    \\"LogUserIds\\": [\\n      \\"173326*******\\"\\n    ],\\n    \\"AutoScanNew\\": \\"enabled\\",\\n    \\"DataIngestions\\": [\\n      {\\n        \\"DataIngestionId\\": \\"alibaba_cloud_sas_process_ingestion_173326*******\\",\\n        \\"DataIngestionStatus\\": \\"enabled\\",\\n        \\"DataSourceId\\": \\"alibaba_cloud_sas_process_log_173326*******\\",\\n        \\"ProductId\\": \\"alibaba_cloud_sas\\",\\n        \\"VendorId\\": \\"alibaba_cloud\\"\\n      }\\n    ],\\n    \\"RecommendDataIngestionIds\\": [\\n      \\"alibaba_cloud_sas_process_log_173326*******\\"\\n    ],\\n    \\"ApsaraDataIngestionIds\\": [\\n      \\"alibaba_cloud_sas_process_log_173326*******\\"\\n    ],\\n    \\"DataSourceRecognizeEnabled\\": true,\\n    \\"DataBatchIngestionMode\\": \\"full\\"\\n  }\\n}","type":"json"}]',
+            'title' => 'GetDataBatchIngestion',
+            'description' => 'The JsonConfig request parameter is a complex JSON configuration. A supporting tool class with configuration examples is provided. For more information, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:GetDataBatchIngestion',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
         ],
-        'ListVendors' => [
-            'summary' => '获取厂商列表',
-            'path' => '',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'GetDataStorage' => [
+            'summary' => 'Retrieves the details of user logs in log management.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
@@ -4568,809 +3780,1156 @@
             'operationType' => 'read',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'list',
+                'operationType' => 'get',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsasRXJ9SY'],
+                'autoTest' => true,
+                'tenantRelevance' => 'tenant',
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。'."\n",
-                    ],
+                    'schema' => ['description' => 'The region where the threat analysis data management center is located. Specify the management center region based on the region of your assets. Valid values:'."\n"
+                        .'- cn-hangzhou: the asset is in the Chinese mainland.'."\n"
+                        .'- ap-southeast-1: the asset is outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'en。'."\n",
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
+                    'schema' => ['description' => 'The ID of the member to which the administrator switches the view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''],
+                ],
+            ],
+            'responses' => [
+                200 => [
                     'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。'."\n",
+                        'title' => '',
+                        'description' => 'The response body.',
+                        'type' => 'object',
+                        'properties' => [
+                            'Data' => [
+                                'description' => 'The returned details.',
+                                'type' => 'object',
+                                'properties' => [
+                                    'DataStorageRegionId' => ['description' => 'The storage region of user logs.', 'type' => 'string', 'example' => 'cn-shanghai', 'title' => ''],
+                                    'DataStorageTotalCapacity' => ['description' => 'The storage capacity purchased in the subscription scenario.', 'type' => 'integer', 'format' => 'int64', 'example' => '100', 'title' => ''],
+                                    'DataStorageUsedCapacity' => ['description' => 'The storage capacity used in user log management.', 'type' => 'number', 'format' => 'double', 'example' => '100.0', 'title' => ''],
+                                    'LogProject' => ['description' => 'The name of the Simple Log Service project that stores user logs.', 'type' => 'string', 'example' => 'aliyun-cloudsiem-data-171835723111****-cn-shanghai', 'title' => ''],
+                                    'SasLogStores' => [
+                                        'description' => 'The details of raw log storage in Security Center.',
+                                        'type' => 'array',
+                                        'items' => [
+                                            'description' => 'The details of raw log storage in Security Center.',
+                                            'type' => 'object',
+                                            'properties' => [
+                                                'LogName' => ['description' => 'The log name.', 'type' => 'string', 'example' => 'Process Snapshot', 'title' => ''],
+                                                'LogStoreName' => ['description' => 'The name of the Logstore where the log is stored.', 'type' => 'string', 'example' => 'sas-security-log', 'title' => ''],
+                                                'LogDeliveryStatus' => ['description' => 'The log delivery status. Valid values:'."\n"
+                                                    .'- enable: log delivery is enabled.'."\n"
+                                                    .'- disable: log delivery is disabled.', 'type' => 'string', 'example' => 'enable', 'title' => ''],
+                                                'LogStoreTtl' => ['description' => 'The storage duration of the Logstore where the log is stored. Logs are stored for at least 30 days.', 'type' => 'integer', 'format' => 'int32', 'example' => '180', 'title' => ''],
+                                                'LogDeliveryUpdateTime' => ['description' => 'The time when the log delivery was last modified.', 'type' => 'string', 'example' => '2025-07-16T15:10:29', 'title' => ''],
+                                                'LogDeliveryPermission' => ['description' => 'Indicates whether log delivery can be toggled. Log delivery cannot be enabled if the service is not purchased. Valid values:'."\n"
+                                                    .'- allow: Allowed.'."\n"
+                                                    .'- deny: Not allowed.', 'type' => 'string', 'example' => 'deny', 'title' => ''],
+                                                'LogDeliveryGroup' => ['description' => 'The group to which the log belongs. Valid values:'."\n"
+                                                    .'- host: host logs.'."\n"
+                                                    .'- security: security logs.', 'type' => 'string', 'example' => 'host', 'title' => ''],
+                                                'LogSearchConditions' => ['title' => '', 'description' => 'The default log query conditions for the log. When multiple logs are stored in the same Logstore, log query conditions are required to query individual logs.', 'type' => 'string', 'example' => '[{\\"__topic__\\":\\"sas-net-block\\"}]'],
+                                                'LogCode' => ['description' => 'The log code.', 'type' => 'string', 'example' => 'sas-net-block', 'title' => ''],
+                                                'LogStoreExisted' => ['description' => 'Indicates whether the Logstore where the log is stored exists. Valid values:'."\n"
+                                                    .'- true: The Logstore exists.'."\n"
+                                                    .'- false: The Logstore does not exist.', 'type' => 'boolean', 'example' => 'true', 'title' => ''],
+                                                'UsedCapacity' => ['title' => '', 'description' => 'The hot storage capacity used.', 'type' => 'number', 'format' => 'double', 'example' => '10.333'],
+                                            ],
+                                            'title' => '',
+                                            'example' => '',
+                                        ],
+                                        'title' => '',
+                                        'example' => '',
+                                    ],
+                                    'NormalizationLogStores' => [
+                                        'description' => 'The details of the Logstores for normalized data.',
+                                        'type' => 'array',
+                                        'items' => [
+                                            'description' => 'The details of the Logstores for normalized data.',
+                                            'type' => 'object',
+                                            'properties' => [
+                                                'LogStoreName' => ['description' => 'The name of the Logstore that stores normalized data.', 'type' => 'string', 'example' => 'vulnerability-activity', 'title' => ''],
+                                                'LogStoreTtl' => ['description' => 'The storage duration of normalized data.', 'type' => 'integer', 'format' => 'int32', 'example' => '180', 'title' => ''],
+                                                'UsedCapacity' => ['title' => '', 'description' => 'The hot storage capacity used.', 'type' => 'number', 'format' => 'double', 'example' => '10.333'],
+                                            ],
+                                            'title' => '',
+                                            'example' => '',
+                                        ],
+                                        'title' => '',
+                                        'example' => '',
+                                    ],
+                                    'UnusedLogStores' => [
+                                        'title' => '',
+                                        'description' => 'The list of legacy SIEM V1 Logstores.',
+                                        'type' => 'array',
+                                        'items' => [
+                                            'title' => '',
+                                            'description' => 'The legacy SIEM V1 Logstore information.',
+                                            'type' => 'object',
+                                            'properties' => [
+                                                'LogStoreName' => ['title' => '', 'description' => 'The Logstore name.', 'type' => 'string', 'example' => 'cloud-siem'],
+                                                'LogStoreTtl' => ['title' => '', 'description' => 'The data storage duration.', 'type' => 'integer', 'format' => 'int32', 'example' => '180'],
+                                                'UsedCapacity' => ['title' => '', 'description' => 'The hot storage capacity used.', 'type' => 'number', 'format' => 'double', 'example' => '10.333'],
+                                            ],
+                                            'example' => '',
+                                        ],
+                                        'example' => '',
+                                    ],
+                                    'RecordLogStores' => [
+                                        'title' => '',
+                                        'description' => 'The list of record Logstores.',
+                                        'type' => 'array',
+                                        'items' => [
+                                            'title' => '',
+                                            'description' => 'The Logstore information.',
+                                            'type' => 'object',
+                                            'properties' => [
+                                                'LogStoreName' => ['title' => '', 'description' => 'The Logstore name.', 'type' => 'string', 'example' => 'alert-record'],
+                                                'LogStoreTtl' => ['title' => '', 'description' => 'The time-to-live (TTL) of the Logstore.', 'type' => 'integer', 'format' => 'int32', 'example' => '90'],
+                                                'UsedCapacity' => ['title' => '', 'description' => 'The used capacity of the Logstore.', 'type' => 'number', 'format' => 'double', 'example' => '11.111'],
+                                            ],
+                                            'example' => '',
+                                        ],
+                                        'example' => '',
+                                    ],
+                                    'NormalizationLogViews' => [
+                                        'description' => 'The details of normalized datasets.',
+                                        'type' => 'array',
+                                        'items' => [
+                                            'description' => 'The details of normalized datasets.',
+                                            'type' => 'object',
+                                            'properties' => [
+                                                'CategoryName' => ['description' => 'The category of the normalized log.', 'type' => 'string', 'example' => 'Security Category', 'title' => ''],
+                                                'ActivityName' => ['description' => 'The log type of the normalized log.', 'type' => 'string', 'example' => 'API security risk log', 'title' => ''],
+                                                'LogViewName' => ['description' => 'The name of the normalized dataset.', 'type' => 'string', 'example' => 'risk_activity', 'title' => ''],
+                                                'LogStoreName' => ['description' => 'The Logstore where threat analysis stores normalized logs.', 'type' => 'string', 'example' => 'risk-activity', 'title' => ''],
+                                                'DetectionRuleReferenceCount' => ['description' => 'The number of times the normalized dataset is referenced in the threat analysis access center.', 'type' => 'integer', 'format' => 'int32', 'example' => '3', 'title' => ''],
+                                                'DetectionRuleReferenceProductIds' => [
+                                                    'description' => 'The list of products that reference the normalized dataset in the threat analysis access center.',
+                                                    'type' => 'array',
+                                                    'items' => ['description' => 'The product ID in the threat analysis access center.', 'type' => 'string', 'example' => 'azure_active_directory', 'title' => ''],
+                                                    'title' => '',
+                                                    'example' => '',
+                                                ],
+                                                'LogSearchConditions' => ['title' => '', 'description' => 'The query statement used to query the log type in the normalized dataset.', 'type' => 'string', 'example' => '[{\\"SCHEMA\\":\\"AZURE_ACTIVE_DIRECTORY_AUDIT_ACTIVITY\\"}]'],
+                                                'LogViewExisted' => ['description' => 'Indicates whether the normalized dataset exists. Valid values:'."\n"
+                                                    .'- true: The normalized dataset exists.'."\n"
+                                                    .'- false: The normalized dataset does not exist.', 'type' => 'boolean', 'example' => 'true', 'title' => ''],
+                                            ],
+                                            'title' => '',
+                                            'example' => '',
+                                        ],
+                                        'title' => '',
+                                        'example' => '',
+                                    ],
+                                    'ColdStorageUsedCapacity' => ['description' => 'The cold storage capacity used by user logs.', 'type' => 'number', 'format' => 'double', 'example' => '100.0', 'title' => ''],
+                                    'DataStorageUsedCapacityDetail' => ['description' => 'The storage usage details in log management.', 'type' => 'string', 'example' => '{\\"purchasedHotStorageCapacity\\":1000,\\"usedHotStorageCapacity\\":4.2,\\"usedHotStorageCapacityDetail\\":{\\"ap-southeast-1\\":4.2,\\"cn-shenzhen\\":0.0,\\"cn-shanghai\\":0.0}}', 'title' => ''],
+                                    'DataStorageRegionPermission' => ['description' => 'Indicates whether the storage region can be modified. By default, the storage region cannot be modified. Contact your account manager to reset the region. The region can be reset only once. Valid values:'."\n"
+                                        .'- allow: The storage region can be modified.'."\n"
+                                        .'- deny: The storage region cannot be modified.', 'type' => 'string', 'example' => 'deny', 'title' => ''],
+                                ],
+                                'title' => '',
+                                'example' => '',
+                            ],
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '81FB0DEA-52C1-55A0-8631-8E1B9A9D****', 'title' => ''],
+                        ],
+                        'example' => '',
                     ],
                 ],
-                [
-                    'name' => 'VendorIds',
-                    'in' => 'formData',
-                    'style' => 'simple',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'array',
-                        'items' => [
-                            'description' => '',
-                            'type' => 'string',
-                            'required' => false,
-                            'example' => 'vd-qlsw5eocx94w9。',
+            ],
+            'errorCodes' => [],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"Data\\": {\\n    \\"DataStorageRegionId\\": \\"cn-shanghai\\",\\n    \\"DataStorageTotalCapacity\\": 100,\\n    \\"DataStorageUsedCapacity\\": 100,\\n    \\"LogProject\\": \\"aliyun-cloudsiem-data-171835723111****-cn-shanghai\\",\\n    \\"SasLogStores\\": [\\n      {\\n        \\"LogName\\": \\"Process Snapshot\\",\\n        \\"LogStoreName\\": \\"sas-security-log\\",\\n        \\"LogDeliveryStatus\\": \\"enable\\",\\n        \\"LogStoreTtl\\": 180,\\n        \\"LogDeliveryUpdateTime\\": \\"2025-07-16T15:10:29\\",\\n        \\"LogDeliveryPermission\\": \\"deny\\",\\n        \\"LogDeliveryGroup\\": \\"host\\",\\n        \\"LogSearchConditions\\": \\"[{\\\\\\\\\\\\\\"__topic__\\\\\\\\\\\\\\":\\\\\\\\\\\\\\"sas-net-block\\\\\\\\\\\\\\"}]\\",\\n        \\"LogCode\\": \\"sas-net-block\\",\\n        \\"LogStoreExisted\\": true,\\n        \\"UsedCapacity\\": 10.333\\n      }\\n    ],\\n    \\"NormalizationLogStores\\": [\\n      {\\n        \\"LogStoreName\\": \\"vulnerability-activity\\",\\n        \\"LogStoreTtl\\": 180,\\n        \\"UsedCapacity\\": 10.333\\n      }\\n    ],\\n    \\"UnusedLogStores\\": [\\n      {\\n        \\"LogStoreName\\": \\"cloud-siem\\",\\n        \\"LogStoreTtl\\": 180,\\n        \\"UsedCapacity\\": 10.333\\n      }\\n    ],\\n    \\"RecordLogStores\\": [\\n      {\\n        \\"LogStoreName\\": \\"alert-record\\",\\n        \\"LogStoreTtl\\": 90,\\n        \\"UsedCapacity\\": 11.111\\n      }\\n    ],\\n    \\"NormalizationLogViews\\": [\\n      {\\n        \\"CategoryName\\": \\"Security Category\\",\\n        \\"ActivityName\\": \\"API security risk log\\",\\n        \\"LogViewName\\": \\"risk_activity\\",\\n        \\"LogStoreName\\": \\"risk-activity\\",\\n        \\"DetectionRuleReferenceCount\\": 3,\\n        \\"DetectionRuleReferenceProductIds\\": [\\n          \\"azure_active_directory\\"\\n        ],\\n        \\"LogSearchConditions\\": \\"[{\\\\\\\\\\\\\\"SCHEMA\\\\\\\\\\\\\\":\\\\\\\\\\\\\\"AZURE_ACTIVE_DIRECTORY_AUDIT_ACTIVITY\\\\\\\\\\\\\\"}]\\",\\n        \\"LogViewExisted\\": true\\n      }\\n    ],\\n    \\"ColdStorageUsedCapacity\\": 100,\\n    \\"DataStorageUsedCapacityDetail\\": \\"{\\\\\\\\\\\\\\"purchasedHotStorageCapacity\\\\\\\\\\\\\\":1000,\\\\\\\\\\\\\\"usedHotStorageCapacity\\\\\\\\\\\\\\":4.2,\\\\\\\\\\\\\\"usedHotStorageCapacityDetail\\\\\\\\\\\\\\":{\\\\\\\\\\\\\\"ap-southeast-1\\\\\\\\\\\\\\":4.2,\\\\\\\\\\\\\\"cn-shenzhen\\\\\\\\\\\\\\":0.0,\\\\\\\\\\\\\\"cn-shanghai\\\\\\\\\\\\\\":0.0}}\\",\\n    \\"DataStorageRegionPermission\\": \\"deny\\"\\n  },\\n  \\"RequestId\\": \\"81FB0DEA-52C1-55A0-8631-8E1B9A9D****\\"\\n}","type":"json"}]',
+            'title' => 'Retrieve user log details in log management',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:GetDataStorage',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
                         ],
-                        'required' => false,
                     ],
                 ],
+            ],
+        ],
+        'GetDetectionStatistic' => [
+            'methods' => ['get', 'post'],
+            'schemes' => ['https'],
+            'security' => [
                 [
-                    'name' => 'VendorName',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '111。',
-                    ],
+                    'AK' => [],
                 ],
+            ],
+            'operationType' => 'read',
+            'deprecated' => false,
+            'systemTags' => [
+                'operationType' => 'get',
+                'riskType' => 'none',
+                'chargeType' => 'free',
+                'abilityTreeNodes' => ['FEATUREsasASHGE7'],
+            ],
+            'parameters' => [
                 [
-                    'name' => 'VendorType',
+                    'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'preset。',
-                    ],
+                    'schema' => ['description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the region where your assets reside. Valid values:'."\n"
+                        .'- cn-hangzhou: China (Hangzhou). Your assets reside in the Chinese mainland.'."\n"
+                        .'- ap-southeast-1: Singapore. Your assets reside outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
-                    'name' => 'MaxResults',
+                    'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'minimum' => '0',
-                        'example' => '50。',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
-                    'name' => 'NextToken',
+                    'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****。',
-                    ],
+                    'schema' => ['description' => 'The ID of the member to which the administrator switches the view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'Schema of Response',
-                        'description' => '',
+                        'title' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。'."\n",
-                            ],
-                            'Vendors' => [
-                                'description' => '',
-                                'type' => 'array',
-                                'items' => [
-                                    'description' => '',
-                                    'type' => 'object',
-                                    'properties' => [
-                                        'CreateTime' => [
-                                            'description' => '',
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '1733269771123。',
-                                        ],
-                                        'UpdateTime' => [
-                                            'description' => '',
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '1733269771123。',
-                                        ],
-                                        'VendorId' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'vd-qlsw5eocx94w9。',
-                                        ],
-                                        'VendorName' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => '111。',
-                                        ],
-                                        'VendorType' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'preset。',
-                                        ],
-                                    ],
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6FB890AC-90B2-5EEA-845B-F7C86FB2****', 'title' => ''],
+                            'DetectionStatistic' => [
+                                'description' => 'The detection rule count result.',
+                                'type' => 'object',
+                                'properties' => [
+                                    'DetectionRuleOnlineCount' => ['description' => 'The number of online rules.', 'type' => 'integer', 'format' => 'int32', 'example' => '10', 'title' => ''],
+                                    'DetectionRuleTestCount' => ['description' => 'The number of test rules.', 'type' => 'integer', 'format' => 'int32', 'example' => '5', 'title' => ''],
+                                    'DetectionRuleTemplateCount' => ['description' => 'The number of rule templates.', 'type' => 'integer', 'format' => 'int32', 'example' => '20', 'title' => ''],
+                                    'GraphComputeRuleCount' => ['description' => 'The number of graph computing rules.', 'type' => 'integer', 'format' => 'int32', 'example' => '12', 'title' => ''],
+                                    'WindowRuleCount' => ['description' => 'The number of similar aggregation rules.', 'type' => 'integer', 'format' => 'int32', 'example' => '6', 'title' => ''],
+                                    'PassthroughRuleCount' => ['description' => 'The number of alert pass-through rules.', 'type' => 'integer', 'format' => 'int32', 'example' => '2', 'title' => ''],
+                                    'AiPoweredAggregationRuleCount' => ['type' => 'integer', 'format' => 'int32', 'description' => '', 'title' => '', 'example' => ''],
                                 ],
-                            ],
-                            'MaxResults' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'minimum' => '0',
-                                'example' => '50。',
-                            ],
-                            'NextToken' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****。',
-                            ],
-                            'TotalCount' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '57。',
+                                'title' => '',
+                                'example' => '',
                             ],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"Vendors\\": [\\n    {\\n      \\"CreateTime\\": 1733269771123,\\n      \\"UpdateTime\\": 1733269771123,\\n      \\"VendorId\\": \\"vd-qlsw5eocx94w9\\",\\n      \\"VendorName\\": \\"111\\",\\n      \\"VendorType\\": \\"preset\\"\\n    }\\n  ],\\n  \\"MaxResults\\": 50,\\n  \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\",\\n  \\"TotalCount\\": 57\\n}","type":"json"}]',
-        ],
-        'CreateDataIngestion' => [
-            'summary' => '创建数据源',
-            'methods' => [
-                'post',
-                'get',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'Retrieve detection rule count',
+            'summary' => 'Retrieves the count of detection rules.',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
             ],
-            'schemes' => [
-                'https',
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:GetDetectionStatistic',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6FB890AC-90B2-5EEA-845B-F7C86FB2****\\",\\n  \\"DetectionStatistic\\": {\\n    \\"DetectionRuleOnlineCount\\": 10,\\n    \\"DetectionRuleTestCount\\": 5,\\n    \\"DetectionRuleTemplateCount\\": 20,\\n    \\"GraphComputeRuleCount\\": 12,\\n    \\"WindowRuleCount\\": 6,\\n    \\"PassthroughRuleCount\\": 2,\\n    \\"AiPoweredAggregationRuleCount\\": 0\\n  }\\n}","type":"json"}]',
+        ],
+        'GetExportTask' => [
+            'summary' => 'Retrieves the progress of an export task.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'write',
+            'operationType' => 'read',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'create',
+                'operationType' => 'get',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsasASHGE7'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The region where the threat analysis data management center is deployed. Select a region based on your asset location. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
-                    'name' => 'RoleFor',
+                    'name' => 'ExportId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
+                    'schema' => ['description' => 'The ID of the export task.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '200013', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataIngestionMode',
+                    'name' => 'RoleFor',
                     'in' => 'formData',
+                    'schema' => ['description' => 'The user ID of a member account. An administrator can use this parameter to operate as the specified member account.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''],
+                ],
+            ],
+            'responses' => [
+                200 => [
                     'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'realtime。',
+                        'title' => 'Schema of Response',
+                        'description' => 'The response body.',
+                        'type' => 'object',
+                        'properties' => [
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', 'title' => ''],
+                            'FileName' => ['description' => 'The name of the file.', 'type' => 'string', 'example' => 'event_1193842352994186_17344888****.xlsx', 'title' => ''],
+                            'Id' => ['description' => 'The ID of the export task.', 'type' => 'integer', 'format' => 'int64', 'example' => '400185', 'title' => ''],
+                            'ExportType' => ['description' => 'The type of the export task. Valid value:'."\n"
+                                ."\n"
+                                .'- incident\\_list: event list.', 'type' => 'string', 'example' => 'incident_list', 'title' => ''],
+                            'ExportStatus' => ['description' => 'The status of the task. Valid values:'."\n"
+                                ."\n"
+                                .'- success: The task is successful.'."\n"
+                                ."\n"
+                                .'- exporting: The task is in progress.', 'type' => 'string', 'example' => 'success', 'title' => ''],
+                            'Progress' => ['description' => 'The progress of the export task.', 'type' => 'integer', 'format' => 'int32', 'example' => '66', 'title' => ''],
+                            'GmtCreate' => ['description' => 'The time when the task was created.', 'type' => 'string', 'example' => '1605076118000', 'title' => ''],
+                            'Link' => ['description' => 'The download link for the exported Excel file.', 'type' => 'string', 'example' => 'https://cloud-siem-user-dataset.oss-cn-shanghai.aliyuncs.com/export_file/17661858******5/event_17661858******5_175748****.xlsx', 'title' => ''],
+                        ],
+                        'example' => '',
                     ],
                 ],
-                [
-                    'name' => 'DataSourceId',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'ds-3g6lyf4eonngyohaq7tr。',
+            ],
+            'errorCodes' => [
+                400 => [
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
+                ],
+            ],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n  \\"FileName\\": \\"event_1193842352994186_17344888****.xlsx\\",\\n  \\"Id\\": 400185,\\n  \\"ExportType\\": \\"incident_list\\",\\n  \\"ExportStatus\\": \\"success\\",\\n  \\"Progress\\": 66,\\n  \\"GmtCreate\\": \\"1605076118000\\",\\n  \\"Link\\": \\"https://cloud-siem-user-dataset.oss-cn-shanghai.aliyuncs.com/export_file/17661858******5/event_17661858******5_175748****.xlsx\\"\\n}","type":"json"}]',
+            'title' => 'GetExportTask',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:GetExportTask',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
                     ],
                 ],
+            ],
+        ],
+        'GetIncident' => [
+            'summary' => 'Retrieves the details of an event.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['https'],
+            'security' => [
                 [
-                    'name' => 'NormalizationRuleId',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'nr-hdmady54piigkjfv17yp。',
-                    ],
+                    'AK' => [],
                 ],
+            ],
+            'operationType' => 'read',
+            'deprecated' => false,
+            'systemTags' => [
+                'operationType' => 'get',
+                'riskType' => 'none',
+                'chargeType' => 'free',
+                'abilityTreeNodes' => ['FEATUREsasASHGE7'],
+            ],
+            'parameters' => [
                 [
-                    'name' => 'DataSourceEditable',
+                    'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'boolean',
-                    ],
+                    'schema' => ['description' => 'The region where the data management center of the threat analysis feature is located. Specify this parameter based on the region where your assets reside. Valid values:'."\n"
+                        .'- cn-hangzhou: Your assets reside in the Chinese mainland.'."\n"
+                        .'- ap-southeast-1: Your assets reside outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataIngestionStateCode',
+                    'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'string',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
-                    'name' => 'CapacityCount',
+                    'name' => 'IncidentUuid',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'integer',
-                        'format' => 'int32',
-                    ],
+                    'schema' => ['description' => 'The UUID of the event.', 'type' => 'string', 'required' => false, 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', 'title' => ''],
                 ],
                 [
-                    'name' => 'StreamJobId',
+                    'name' => 'RoleFor',
                     'in' => 'formData',
+                    'schema' => ['description' => 'The ID of the member to which the administrator switches the view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''],
+                ],
+            ],
+            'responses' => [
+                200 => [
                     'schema' => [
-                        'type' => 'string',
+                        'title' => '',
+                        'description' => 'The response struct.',
+                        'type' => 'object',
+                        'properties' => [
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', 'title' => ''],
+                            'Incident' => [
+                                'description' => 'The event information.',
+                                'type' => 'object',
+                                'properties' => [
+                                    'CreateTime' => ['description' => 'The creation time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1757386075000', 'title' => ''],
+                                    'UpdateTime' => ['description' => 'The update time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1757386075000', 'title' => ''],
+                                    'IncidentUuid' => ['description' => 'The UUID of the event.', 'type' => 'string', 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', 'title' => ''],
+                                    'Owner' => ['title' => '', 'description' => 'The owner of the event.', 'type' => 'string', 'example' => '1234567890xxxxxx'],
+                                    'IncidentDescription' => ['description' => 'The description of the event.', 'type' => 'string', 'example' => 'Forti incident desc', 'title' => ''],
+                                    'IncidentName' => ['description' => 'The name of the event.', 'type' => 'string', 'example' => 'Forti', 'title' => ''],
+                                    'ThreatLevel' => ['description' => 'The threat level. Valid values:'."\n"
+                                        .'- 5: critical.'."\n"
+                                        .'- 4: high.'."\n"
+                                        .'- 3: medium.'."\n"
+                                        .'- 2: low.'."\n"
+                                        .'- 1: informational.', 'type' => 'string', 'example' => '2', 'title' => ''],
+                                    'IncidentAggregationType' => ['description' => 'The event summaries type. Valid values:'."\n"
+                                        ."\n"
+                                        .'- none: no event is generated.'."\n"
+                                        .'- graph_compute: graph computing (supported by predefined rules).'."\n"
+                                        .'- expert: expert rule.'."\n"
+                                        .'- passthrough: alerting pass-through (one-to-one).'."\n"
+                                        .'- window: same-type aggregation (window).', 'type' => 'string', 'example' => 'window', 'title' => ''],
+                                    'ThreatScore' => ['description' => 'The threat score of the event. Valid values: 0 to 100. A higher score indicates a higher risk level.', 'type' => 'string', 'example' => '90', 'title' => ''],
+                                    'DetectionRuleId' => ['description' => 'The ID of the detection rule.', 'type' => 'string', 'example' => 'dr-fy2zvgiykjifbiim****', 'title' => ''],
+                                    'RelateAlertCount' => ['description' => 'The number of alerts associated with the event.', 'type' => 'integer', 'format' => 'int32', 'example' => '23', 'title' => ''],
+                                    'RelateAssetCount' => ['description' => 'The number of assets associated with the event.', 'type' => 'integer', 'format' => 'int32', 'example' => '2', 'title' => ''],
+                                    'IncidentRemark' => ['description' => 'The remarks of the event.', 'type' => 'string', 'example' => 'Remark', 'title' => ''],
+                                    'AttckTactics' => ['description' => 'The count of attack stages associated with the event alerts.', 'type' => 'any', 'example' => '{'."\n"
+                                        .'	"AttckTactics": ['."\n"
+                                        .'		{'."\n"
+                                        .'			"tacticName": "Reconnaissance",'."\n"
+                                        .'			"alertNum": 0,'."\n"
+                                        .'			"tacticId": "TA0040"'."\n"
+                                        .'		}'."\n"
+                                        .'	]'."\n"
+                                        .'}', 'title' => ''],
+                                    'IncidentTags' => ['description' => 'The tags of the event.', 'type' => 'string', 'example' => '["sys:data_source:waf"]', 'title' => ''],
+                                    'RelateDataSourceIds' => ['description' => 'The list of associated data sources.', 'type' => 'any', 'example' => '["siem"]', 'title' => ''],
+                                    'RelateUserIds' => ['description' => 'The list of user IDs associated with the event.', 'type' => 'any', 'example' => '["176618589410****","1130916744888****"]', 'title' => ''],
+                                    'IncidentStatus' => ['description' => 'The status of the event. Valid values:'."\n"
+                                        .'- 0: unhandled.'."\n"
+                                        .'- 1: handling.'."\n"
+                                        .'- 5: handling failed.'."\n"
+                                        .'- 10: handled.', 'type' => 'integer', 'format' => 'int32', 'example' => '0', 'title' => ''],
+                                    'ResponseTime' => ['description' => 'The response time. Unit: milliseconds (ms).', 'type' => 'integer', 'format' => 'int64', 'example' => '1757386075000', 'title' => ''],
+                                ],
+                                'title' => '',
+                                'example' => '',
+                            ],
+                        ],
+                        'example' => '',
                     ],
                 ],
+            ],
+            'errorCodes' => [
+                400 => [
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
+                ],
+            ],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n  \\"Incident\\": {\\n    \\"CreateTime\\": 1757386075000,\\n    \\"UpdateTime\\": 1757386075000,\\n    \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n    \\"Owner\\": \\"1234567890xxxxxx\\",\\n    \\"IncidentDescription\\": \\"Forti incident desc\\",\\n    \\"IncidentName\\": \\"Forti\\",\\n    \\"ThreatLevel\\": \\"2\\",\\n    \\"IncidentAggregationType\\": \\"window\\",\\n    \\"ThreatScore\\": \\"90\\",\\n    \\"DetectionRuleId\\": \\"dr-fy2zvgiykjifbiim****\\",\\n    \\"RelateAlertCount\\": 23,\\n    \\"RelateAssetCount\\": 2,\\n    \\"IncidentRemark\\": \\"Remark\\",\\n    \\"AttckTactics\\": \\"{\\\\n\\\\t\\\\\\"AttckTactics\\\\\\": [\\\\n\\\\t\\\\t{\\\\n\\\\t\\\\t\\\\t\\\\\\"tacticName\\\\\\": \\\\\\"Reconnaissance\\\\\\",\\\\n\\\\t\\\\t\\\\t\\\\\\"alertNum\\\\\\": 0,\\\\n\\\\t\\\\t\\\\t\\\\\\"tacticId\\\\\\": \\\\\\"TA0040\\\\\\"\\\\n\\\\t\\\\t}\\\\n\\\\t]\\\\n}\\",\\n    \\"IncidentTags\\": \\"[\\\\\\"sys:data_source:waf\\\\\\"]\\",\\n    \\"RelateDataSourceIds\\": \\"[\\\\\\"siem\\\\\\"]\\",\\n    \\"RelateUserIds\\": \\"[\\\\\\"176618589410****\\\\\\",\\\\\\"1130916744888****\\\\\\"]\\",\\n    \\"IncidentStatus\\": 0,\\n    \\"ResponseTime\\": 1757386075000\\n  }\\n}","type":"json"}]',
+            'title' => 'Get event details',
+            'description' => 'The JsonConfig input parameter is a complex JSON configuration string. A utility class is provided to help with specific configuration examples. For more information, see [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'GetIncident'],
+                ],
+            ],
+            'ramActions' => [
                 [
-                    'name' => 'DataIngestionType',
-                    'in' => 'formData',
-                    'schema' => [
-                        'type' => 'string',
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:GetIncident',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'Incident', 'arn' => 'acs:yundun-sas::{#accountId}:incident/{#IncidentUuid}'],
+                        ],
                     ],
                 ],
+            ],
+        ],
+        'GetLogTicket' => [
+            'summary' => 'Retrieves a log ticket.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
+            'security' => [
                 [
-                    'name' => 'ScanDataSourceId',
+                    'AK' => [],
+                ],
+            ],
+            'operationType' => 'read',
+            'deprecated' => false,
+            'systemTags' => [
+                'operationType' => 'get',
+                'riskType' => 'none',
+                'chargeType' => 'free',
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
+            ],
+            'parameters' => [
+                [
+                    'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'string',
-                    ],
+                    'schema' => ['description' => 'The region of the Data Management hub for threat analysis. Select the region based on the location of your asset. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: The asset is in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: The asset is in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
-                    'name' => 'UpdateTime',
+                    'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'integer',
-                        'format' => 'int64',
-                    ],
+                    'schema' => ['description' => 'The language of the response messages. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
-                    'name' => 'NormalizationRuleEditable',
+                    'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'boolean',
-                    ],
+                    'schema' => ['description' => 'The user ID of a member. This parameter lets an administrator switch to the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
                 [
-                    'name' => 'ProductId',
+                    'name' => 'LogUserId',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'string',
-                    ],
+                    'schema' => ['description' => 'The user ID for data access.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'Schema of Response',
-                        'description' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'title' => 'Id of the request',
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。',
-                            ],
-                            'DataIngestionId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => 'di-yxtm3l2rwa7fr5uvxtc7。',
-                            ],
+                            'RequestId' => ['description' => 'The ID of the request.', 'type' => 'string', 'example' => '173326*******', 'title' => ''],
+                            'LogTicket' => ['description' => 'The ticket for Simple Log Service.', 'type' => 'string', 'example' => '*******', 'title' => ''],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"173326*******\\",\\n  \\"LogTicket\\": \\"*******\\"\\n}","type":"json"}]',
+            'title' => 'GetLogTicket',
+            'description' => 'The JsonConfig input parameter is a complex JSON configuration. A supporting tool class is provided to assist with the configuration. For an example, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:GetLogTicket',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"DataIngestionId\\": \\"di-yxtm3l2rwa7fr5uvxtc7\\"\\n}","type":"json"}]',
         ],
-        'EnableDataIngestion' => [
-            'summary' => '启动数据接入',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'GetNormalizationRule' => [
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'readAndWrite',
+            'operationType' => 'read',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'update',
+                'operationType' => 'get',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The region where the data management center of threat analysis is located. Specify the management center based on the region of your assets. Valid values:'."\n"
+                        .'- cn-hangzhou: the asset is in the Chinese mainland.'."\n"
+                        .'- ap-southeast-1: the asset is outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
+                    'schema' => ['description' => 'The user ID that the administrator uses to switch to the view of another member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataIngestionId',
+                    'name' => 'NormalizationRuleId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'alibaba_cloud_sas_netstat_ingestion_173326*******。',
-                    ],
+                    'schema' => ['description' => 'The normalization rule ID.', 'type' => 'string', 'required' => false, 'example' => 'nr-z0b2ssjteut85uoh9nzp', 'title' => ''],
                 ],
                 [
-                    'name' => 'ProductId',
+                    'name' => 'NormalizationSecurityDomainId',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'string',
-                    ],
+                    'schema' => ['type' => 'string', 'example' => 'NETWORK_AND_WEB_SECURITY', 'description' => '', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'Schema of Response',
-                        'description' => '',
+                        'title' => '',
+                        'description' => 'The response struct.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'title' => 'Id of the request',
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。',
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''],
+                            'NormalizationRule' => [
+                                'description' => 'The normalization rule.',
+                                'type' => 'object',
+                                'properties' => [
+                                    'CreateTime' => ['description' => 'The creation time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''],
+                                    'UpdateTime' => ['description' => 'The update time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''],
+                                    'NormalizationRuleId' => ['description' => 'The normalization rule ID.', 'type' => 'string', 'example' => 'nr-z0b2ssjteut85uoh9nzp', 'title' => ''],
+                                    'NormalizationRuleName' => ['description' => 'The name of the normalization rule.', 'type' => 'string', 'example' => 'normalization_rule_Z57np', 'title' => ''],
+                                    'NormalizationRuleType' => ['description' => 'The type of the normalization rule. Valid values:'."\n"
+                                        .'- predefined: predefined normalization rule.'."\n"
+                                        .'- custom: custom normalization rule.', 'type' => 'string', 'example' => 'predefined', 'title' => ''],
+                                    'NormalizationRuleFormat' => ['description' => 'The format of the normalization rule.', 'type' => 'string', 'example' => 'SPL', 'title' => ''],
+                                    'NormalizationRuleDescription' => ['description' => 'The description of the normalization rule.', 'type' => 'string', 'example' => 'normalization_rule_Z57np', 'title' => ''],
+                                    'NormalizationRuleVersion' => ['description' => 'The version of the normalization rule.', 'type' => 'integer', 'format' => 'int32', 'example' => 'V1', 'title' => ''],
+                                    'NormalizationRuleExpression' => ['description' => 'The expression of the normalization rule.', 'type' => 'string', 'example' => '* | pack-fields -include=\'[\\s\\S]+\' as extend_content', 'title' => ''],
+                                    'NormalizationRuleStatus' => ['description' => 'The status of the normalization rule.', 'type' => 'string', 'example' => 'started', 'title' => ''],
+                                    'NormalizationCategoryId' => ['description' => 'The category ID of the normalization rule.', 'type' => 'string', 'example' => 'NETWORK_CATEGORY', 'title' => ''],
+                                    'NormalizationSchemaId' => ['description' => 'The normalization schema ID.', 'type' => 'string', 'example' => 'HTTP_ACTIVITY', 'title' => ''],
+                                    'NormalizationSecurityDomainId' => ['type' => 'string', 'example' => 'NETWORK_AND_WEB_SECURITY', 'description' => '', 'title' => ''],
+                                    'VendorId' => ['description' => 'The vendor ID associated with the normalization rule.', 'type' => 'string', 'example' => 'alibaba_cloud', 'title' => ''],
+                                    'ProductId' => ['description' => 'The product ID.', 'type' => 'string', 'example' => 'alibaba_cloud_sas', 'title' => ''],
+                                    'NormalizationRuleMode' => ['description' => 'The mode of the normalization rule. Valid values:'."\n"
+                                        .'- both'."\n"
+                                        .'- scan'."\n"
+                                        .'- realtime.', 'type' => 'string', 'example' => 'both', 'title' => ''],
+                                    'NormalizationFieldSource' => ['type' => 'string', 'example' => 'normalized', 'description' => '', 'title' => ''],
+                                    'ExtendContentPacked' => ['description' => 'Specifies whether to pack non-standard fields into the extend_content field. Valid values:'."\n"
+                                        .'- enabled: Enabled.'."\n"
+                                        .'- disabled: Disabled.', 'type' => 'string', 'example' => 'enabled', 'title' => ''],
+                                    'OrderField' => ['description' => 'The field used to sort the rule list. Valid values:'."\n"
+                                        .'- GmtModified: sorted by modification time.'."\n"
+                                        .'- Id: sorted by rule ID (default).', 'type' => 'string', 'example' => 'GmtModified', 'title' => ''],
+                                    'NormalizationRuleIds' => [
+                                        'description' => 'The list of normalization rule IDs.',
+                                        'type' => 'array',
+                                        'items' => ['description' => 'The list of normalization rule IDs.', 'type' => 'string', 'example' => 'nr-z0b2ssjteut85uoh9nzp', 'title' => ''],
+                                        'title' => '',
+                                        'example' => '',
+                                    ],
+                                    'ExtendFieldStoreMode' => ['title' => '', 'description' => 'The storage mode for extended fields. Valid values:'."\n"
+                                        .'- flat: ingested as-is.'."\n"
+                                        .'- reject: not ingested.'."\n"
+                                        .'- pack: packed into the extend_content field.', 'type' => 'string', 'example' => 'flat'],
+                                ],
+                                'title' => '',
+                                'example' => '',
                             ],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
+                ],
+            ],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'Retrieve normalization rule information',
+            'summary' => 'Retrieves normalization rule information.',
+            'description' => 'The input parameter JsonConfig is a complex JSON configuration string. A utility class is provided to help with specific configuration examples. For more information, refer to [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:GetNormalizationRule',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'NormalizationRule', 'arn' => 'acs:yundun-sas::{#accountId}:normalizationrule/{#NormalizationRuleId}'],
+                        ],
                     ],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"NormalizationRule\\": {\\n    \\"CreateTime\\": 1733269771123,\\n    \\"UpdateTime\\": 1733269771123,\\n    \\"NormalizationRuleId\\": \\"nr-z0b2ssjteut85uoh9nzp\\",\\n    \\"NormalizationRuleName\\": \\"normalization_rule_Z57np\\",\\n    \\"NormalizationRuleType\\": \\"predefined\\",\\n    \\"NormalizationRuleFormat\\": \\"SPL\\",\\n    \\"NormalizationRuleDescription\\": \\"normalization_rule_Z57np\\",\\n    \\"NormalizationRuleVersion\\": 0,\\n    \\"NormalizationRuleExpression\\": \\"* | pack-fields -include=\'[\\\\\\\\s\\\\\\\\S]+\' as extend_content\\",\\n    \\"NormalizationRuleStatus\\": \\"started\\",\\n    \\"NormalizationCategoryId\\": \\"NETWORK_CATEGORY\\",\\n    \\"NormalizationSchemaId\\": \\"HTTP_ACTIVITY\\",\\n    \\"NormalizationSecurityDomainId\\": \\"NETWORK_AND_WEB_SECURITY\\",\\n    \\"VendorId\\": \\"alibaba_cloud\\",\\n    \\"ProductId\\": \\"alibaba_cloud_sas\\",\\n    \\"NormalizationRuleMode\\": \\"both\\",\\n    \\"NormalizationFieldSource\\": \\"normalized\\",\\n    \\"ExtendContentPacked\\": \\"enabled\\",\\n    \\"OrderField\\": \\"GmtModified\\",\\n    \\"NormalizationRuleIds\\": [\\n      \\"nr-z0b2ssjteut85uoh9nzp\\"\\n    ],\\n    \\"ExtendFieldStoreMode\\": \\"flat\\"\\n  }\\n}","type":"json"}]',
         ],
-        'DisableDataIngestion' => [
-            'summary' => '停止数据接入',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'GetNormalizationRuleVersion' => [
+            'summary' => 'Retrieves information about a normalization rule version.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'readAndWrite',
+            'operationType' => 'read',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'update',
+                'operationType' => 'get',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The region where the Data Management center for Threat Analysis is located. Select a region for the management center based on the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'cn-hangzhou'],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
-                    ],
+                    'schema' => ['description' => 'The language of the response message. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'zh'],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member. An administrator can use this parameter to switch to the perspective of a specific member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '173326*******'],
                 ],
                 [
-                    'name' => 'DataIngestionId',
+                    'name' => 'NormalizationRuleId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'alibaba_cloud_sas_netstat_ingestion_173326*******。',
-                    ],
+                    'schema' => ['description' => 'The ID of the normalization rule.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'nr-z0b2ssjteut85uoh9nzp'],
+                ],
+                [
+                    'name' => 'NormalizationRuleVersion',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The version of the normalization rule.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'Schema of Response',
-                        'description' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'title' => 'Id of the request',
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。',
+                            'RequestId' => ['description' => 'The ID of the request.', 'type' => 'string', 'title' => '', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
+                            'NormalizationRuleVersion' => [
+                                'description' => 'The version of the normalization rule.',
+                                'type' => 'object',
+                                'properties' => [
+                                    'CreateTime' => ['description' => 'The time when the rule version was created.', 'type' => 'integer', 'format' => 'int64', 'title' => '', 'example' => '1733269771123'],
+                                    'UpdateTime' => ['description' => 'The time when the rule version was last updated.', 'type' => 'integer', 'format' => 'int64', 'title' => '', 'example' => '1733269771123'],
+                                    'NormalizationRuleId' => ['description' => 'The ID of the normalization rule.', 'type' => 'string', 'title' => '', 'example' => 'nr-z0b2ssjteut85uoh9nzp'],
+                                    'NormalizationRuleName' => ['description' => 'The name of the normalization rule.', 'type' => 'string', 'title' => '', 'example' => 'normalization_rule_Z57np'],
+                                    'NormalizationRuleType' => ['description' => 'The type of the normalization rule. Valid values:'."\n"
+                                        ."\n"
+                                        .'- predefined: a predefined rule.'."\n"
+                                        ."\n"
+                                        .'- custom: a custom rule.', 'type' => 'string', 'title' => '', 'example' => 'predefined'],
+                                    'NormalizationRuleFormat' => ['description' => 'The format of the normalization rule.', 'type' => 'string', 'title' => '', 'example' => 'SPL'],
+                                    'NormalizationRuleDescription' => ['description' => 'The description of the normalization rule.', 'type' => 'string', 'title' => '', 'example' => 'normalization_rule_Z57np'],
+                                    'NormalizationRuleVersion' => ['description' => 'The version of the normalization rule.', 'type' => 'integer', 'format' => 'int32', 'title' => '', 'example' => 'V1'],
+                                    'NormalizationRuleExpression' => ['description' => 'The expression for the normalization rule.', 'type' => 'string', 'title' => '', 'example' => '* | pack-fields -include=\'[\\s\\S]+\' as extend_content'],
+                                    'NormalizationRuleStatus' => ['description' => 'The status of the normalization rule.', 'type' => 'string', 'title' => '', 'example' => 'started'],
+                                    'NormalizationCategoryId' => ['description' => 'The ID of the normalization rule category.', 'type' => 'string', 'title' => '', 'example' => 'NETWORK_CATEGORY'],
+                                    'NormalizationSchemaId' => ['description' => 'The ID of the normalization schema.', 'type' => 'string', 'title' => '', 'example' => 'HTTP_ACTIVITY'],
+                                    'VendorId' => ['description' => 'The ID of the vendor for the normalization rule.', 'type' => 'string', 'title' => '', 'example' => 'alibaba_cloud'],
+                                    'ProductId' => ['description' => 'The product ID.', 'type' => 'string', 'title' => '', 'example' => 'alibaba_cloud_sas'],
+                                    'NormalizationRuleVersionName' => ['type' => 'string', 'description' => 'The name of the normalization rule version.', 'title' => '', 'example' => 'v1'],
+                                    'RegionId' => ['type' => 'string', 'description' => 'The region where the Data Management center for Threat Analysis is located. Select a region for the management center based on the region where your assets are located. Valid values:'."\n"
+                                        ."\n"
+                                        .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n"
+                                        ."\n"
+                                        .'- ap-southeast-1: Your assets are in a region outside China.', 'title' => '', 'example' => 'cn-hangzhou'],
+                                ],
+                                'title' => '',
+                                'example' => '',
                             ],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"NormalizationRuleVersion\\": {\\n    \\"CreateTime\\": 1733269771123,\\n    \\"UpdateTime\\": 1733269771123,\\n    \\"NormalizationRuleId\\": \\"nr-z0b2ssjteut85uoh9nzp\\",\\n    \\"NormalizationRuleName\\": \\"normalization_rule_Z57np\\",\\n    \\"NormalizationRuleType\\": \\"predefined\\",\\n    \\"NormalizationRuleFormat\\": \\"SPL\\",\\n    \\"NormalizationRuleDescription\\": \\"normalization_rule_Z57np\\",\\n    \\"NormalizationRuleVersion\\": 0,\\n    \\"NormalizationRuleExpression\\": \\"* | pack-fields -include=\'[\\\\\\\\s\\\\\\\\S]+\' as extend_content\\",\\n    \\"NormalizationRuleStatus\\": \\"started\\",\\n    \\"NormalizationCategoryId\\": \\"NETWORK_CATEGORY\\",\\n    \\"NormalizationSchemaId\\": \\"HTTP_ACTIVITY\\",\\n    \\"VendorId\\": \\"alibaba_cloud\\",\\n    \\"ProductId\\": \\"alibaba_cloud_sas\\",\\n    \\"NormalizationRuleVersionName\\": \\"v1\\",\\n    \\"RegionId\\": \\"cn-hangzhou\\"\\n  }\\n}","type":"json"}]',
+            'title' => 'GetNormalizationRuleVersion',
+            'description' => 'The JsonConfig request parameter is a complex JSON configuration. A supporting tool class provides examples. For more information, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:GetNormalizationRuleVersion',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'NormalizationRuleVersion', 'arn' => 'acs:yundun-sas::{#accountId}:normalizationruleversion/{#NormalizationRuleId}/{#NormalizationRuleVersion}'],
+                        ],
+                    ],
+                ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
         ],
-        'UpdateDataIngestion' => [
-            'summary' => '更新数据接入信息',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'GetNormalizationSchema' => [
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'write',
+            'operationType' => 'read',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'update',
+                'operationType' => 'get',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The region where the threat analysis data management center resides. Specify the management center based on the region of your assets. Valid values:'."\n"
+                        .'- cn-hangzhou: Your assets reside in the Chinese mainland.'."\n"
+                        .'- ap-southeast-1: Your assets reside outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
-                ],
-                [
-                    'name' => 'DataIngestionId',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'alibaba_cloud_actiontrail_event_ingestion_173326*******。',
-                    ],
-                ],
-                [
-                    'name' => 'DataIngestionMode',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'realtime。',
-                    ],
+                    'schema' => ['description' => 'The user ID that the administrator switches to when viewing as another member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataSourceId',
+                    'name' => 'NormalizationSchemaType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'alibaba_cloud_actiontrail_event_log_173326*******。',
-                    ],
+                    'schema' => ['description' => 'The normalization schema type. Valid values:'."\n"
+                        .'- log: log.'."\n"
+                        .'- entity: entity.', 'type' => 'string', 'required' => false, 'example' => 'log', 'title' => ''],
                 ],
                 [
-                    'name' => 'NormalizationRuleId',
+                    'name' => 'NormalizationSchemaId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'alibaba_cloud_actiontrail_event_rule。',
-                    ],
+                    'schema' => ['description' => 'The ID of the normalization rule category.', 'type' => 'string', 'required' => false, 'example' => 'HTTP_ACTIVITY', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'Schema of Response',
-                        'description' => '',
+                        'title' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'title' => 'Id of the request',
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。',
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''],
+                            'NormalizationSchema' => [
+                                'description' => 'The normalization schema.',
+                                'type' => 'object',
+                                'properties' => [
+                                    'NormalizationSchemaId' => ['description' => 'The normalization schema ID.', 'type' => 'string', 'example' => 'HTTP_ACTIVITY', 'title' => ''],
+                                    'NormalizationSchemaName' => ['description' => 'The normalization schema name.', 'type' => 'string', 'example' => 'normalization_rule_Z57np', 'title' => ''],
+                                    'NormalizationCategoryId' => ['description' => 'The ID of the normalization rule category.', 'type' => 'string', 'example' => 'NETWORK_CATEGORY', 'title' => ''],
+                                    'NormalizationFields' => [
+                                        'description' => 'The list of normalization fields.',
+                                        'type' => 'array',
+                                        'items' => [
+                                            'description' => 'The normalization field.',
+                                            'type' => 'object',
+                                            'properties' => [
+                                                'NormalizationFieldName' => ['title' => '', 'description' => 'The normalization field name.', 'type' => 'string', 'example' => 'cloud_user'],
+                                                'NormalizationFieldType' => ['title' => '', 'description' => 'The normalization field type. Valid values:'."\n"
+                                                    .'- varchar'."\n"
+                                                    .'- bigint'."\n"
+                                                    .'- double', 'type' => 'string', 'example' => 'varchar'],
+                                                'NormalizationFieldRequired' => ['title' => '', 'description' => 'Indicates whether the field is required.', 'type' => 'boolean', 'example' => ''],
+                                                'NormalizationFieldDescription' => ['title' => '', 'description' => 'The normalization field description.', 'type' => 'string', 'example' => 'cloud_user'],
+                                                'NormalizationFieldExample' => ['title' => '', 'description' => 'The normalization field example.', 'type' => 'string', 'example' => '173326*******'],
+                                                'NormalizationFieldReserved' => ['title' => '', 'description' => 'Indicates whether the normalization field is reserved.', 'type' => 'boolean', 'example' => 'true'],
+                                                'NormalizationFieldFrom' => ['title' => '', 'description' => 'The source of the standard field. Valid values:'."\n"
+                                                    .'- preset: built-in.'."\n"
+                                                    .'- custom: custom.', 'type' => 'string', 'example' => 'preset'],
+                                                'NormalizationFieldTokenize' => ['title' => '', 'description' => 'Indicates whether the standard field is tokenized.', 'type' => 'boolean', 'example' => ''],
+                                                'NormalizationFieldJsonIndexAll' => ['title' => '', 'description' => 'Indicates whether indexes are created for all keys of the JSON-type standard field.', 'type' => 'boolean', 'example' => ''],
+                                                'NormalizationFieldJsonKeys' => [
+                                                    'title' => '',
+                                                    'description' => 'The key list of the JSON-type standard field.',
+                                                    'type' => 'array',
+                                                    'items' => [
+                                                        'title' => '',
+                                                        'description' => 'The key of the JSON-type standard field.',
+                                                        'type' => 'object',
+                                                        'properties' => [
+                                                            'NormalizationFieldName' => ['title' => '', 'description' => 'The key name of the JSON-type standard field.', 'type' => 'string', 'example' => 'cloud_code'],
+                                                            'NormalizationFieldType' => ['title' => '', 'description' => 'The key type of the JSON-type standard field.', 'type' => 'string', 'example' => 'varchar'],
+                                                            'NormalizationFieldRequired' => ['title' => '', 'description' => 'Indicates whether the key of the JSON-type standard field is required.', 'type' => 'boolean', 'example' => ''],
+                                                            'NormalizationFieldDescription' => ['title' => '', 'description' => 'The key description of the JSON-type standard field.', 'type' => 'string', 'example' => 'Cloud Provider Code'],
+                                                            'NormalizationFieldExample' => ['title' => '', 'description' => 'The key example of the JSON-type standard field.', 'type' => 'string', 'example' => 'alibaba_cloud'],
+                                                            'NormalizationFieldFrom' => ['title' => '', 'description' => 'The key source of the JSON-type standard field.', 'type' => 'string', 'example' => 'preset'],
+                                                            'NormalizationFieldTokenize' => ['title' => '', 'description' => 'Indicates whether the key of the JSON-type standard field is tokenized.', 'type' => 'boolean', 'example' => ''],
+                                                            'NormalizationFieldReserved' => ['title' => '', 'description' => 'Indicates whether the field is a system built-in standard field name.', 'type' => 'boolean', 'example' => ''],
+                                                            'CreateTime' => ['title' => '', 'description' => 'The creation time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1736386610000'],
+                                                            'UpdateTime' => ['title' => '', 'description' => 'The update time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1736386610000'],
+                                                        ],
+                                                        'example' => '',
+                                                    ],
+                                                    'example' => '',
+                                                ],
+                                                'CreateTime' => ['title' => '', 'description' => 'The creation time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1736386610000'],
+                                                'UpdateTime' => ['title' => '', 'description' => 'The update time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1736386610000'],
+                                                'NormalizationFieldRequirement' => ['description' => 'Indicates whether the normalization field is required.', 'type' => 'boolean', 'example' => 'true', 'title' => ''],
+                                            ],
+                                            'title' => '',
+                                            'example' => '',
+                                        ],
+                                        'title' => '',
+                                        'example' => '',
+                                    ],
+                                    'TargetLogStore' => ['title' => '', 'description' => 'The Simple Log Service LogStore.', 'type' => 'string', 'example' => 'network-activity'],
+                                    'TargetStoreView' => ['title' => '', 'description' => 'The Simple Log Service StoreView.', 'type' => 'string', 'example' => 'network_activity'],
+                                    'NormalizationSchemaType' => ['title' => '', 'description' => 'The normalization schema type. Valid values:'."\n"
+                                        .'- log'."\n"
+                                        .'- entity'."\n"
+                                        .'- incident', 'type' => 'string', 'example' => 'log'],
+                                    'UpdateTime' => ['title' => '', 'description' => 'The update time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123'],
+                                    'CreateTime' => ['title' => '', 'description' => 'The creation time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123'],
+                                    'NormalizationSchemaReferences' => [
+                                        'title' => '',
+                                        'description' => 'The list of normalization schema references.',
+                                        'type' => 'array',
+                                        'items' => [
+                                            'title' => '',
+                                            'description' => 'The normalization schema reference.',
+                                            'type' => 'object',
+                                            'properties' => [
+                                                'NormalizationRuleId' => ['title' => '', 'description' => 'The normalization rule ID.', 'type' => 'string', 'example' => 'alibaba_cloud_cfw_flow_rule'],
+                                            ],
+                                            'example' => '',
+                                        ],
+                                        'example' => '',
+                                    ],
+                                    'NormalizationSchemaFrom' => ['title' => '', 'description' => 'The source of the normalization schema. Valid values:'."\n"
+                                        .'- preset: predefined.'."\n"
+                                        .'- custom: custom.', 'type' => 'string', 'example' => 'preset'],
+                                    'VendorId' => ['type' => 'string', 'example' => 'alibaba_cloud', 'description' => '', 'title' => ''],
+                                    'ProductId' => ['type' => 'string', 'example' => 'alibaba_cloud_bastionhost', 'description' => '', 'title' => ''],
+                                    'NormalizationSecurityDomainId' => ['type' => 'string', 'example' => 'DATA_SECURITY', 'description' => '', 'title' => ''],
+                                    'NormalizationSchemaDescription' => ['title' => '', 'description' => 'The normalization schema description.', 'type' => 'string', 'example' => 'Network 5-Tuple Logs'],
+                                    'NormalizationFieldSource' => ['type' => 'string', 'example' => 'native', 'description' => '', 'title' => ''],
+                                    'RecommendEntities' => [
+                                        'type' => 'array',
+                                        'items' => ['type' => 'string', 'description' => '', 'title' => '', 'example' => ''],
+                                        'description' => '',
+                                        'title' => '',
+                                        'example' => '',
+                                    ],
+                                ],
+                                'title' => '',
+                                'example' => '',
                             ],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
+                ],
+            ],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'Retrieve normalization schema',
+            'summary' => 'Retrieves a normalization schema.',
+            'description' => 'The input parameter JsonConfig is a complex JSON configuration string. A supporting tool class is provided to help with specific configuration examples. For more information, refer to [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:GetNormalizationSchema',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'NormalizationSchema', 'arn' => 'acs:yundun-sas::{#accountId}:normalizationschema/{#NormalizationSchemaId}'],
+                        ],
                     ],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"NormalizationSchema\\": {\\n    \\"NormalizationSchemaId\\": \\"HTTP_ACTIVITY\\",\\n    \\"NormalizationSchemaName\\": \\"normalization_rule_Z57np\\",\\n    \\"NormalizationCategoryId\\": \\"NETWORK_CATEGORY\\",\\n    \\"NormalizationFields\\": [\\n      {\\n        \\"NormalizationFieldName\\": \\"cloud_user\\",\\n        \\"NormalizationFieldType\\": \\"varchar\\",\\n        \\"NormalizationFieldRequired\\": false,\\n        \\"NormalizationFieldDescription\\": \\"cloud_user\\",\\n        \\"NormalizationFieldExample\\": \\"173326*******\\",\\n        \\"NormalizationFieldReserved\\": true,\\n        \\"NormalizationFieldFrom\\": \\"preset\\",\\n        \\"NormalizationFieldTokenize\\": false,\\n        \\"NormalizationFieldJsonIndexAll\\": false,\\n        \\"NormalizationFieldJsonKeys\\": [\\n          {\\n            \\"NormalizationFieldName\\": \\"cloud_code\\",\\n            \\"NormalizationFieldType\\": \\"varchar\\",\\n            \\"NormalizationFieldRequired\\": false,\\n            \\"NormalizationFieldDescription\\": \\"Cloud Provider Code\\",\\n            \\"NormalizationFieldExample\\": \\"alibaba_cloud\\",\\n            \\"NormalizationFieldFrom\\": \\"preset\\",\\n            \\"NormalizationFieldTokenize\\": false,\\n            \\"NormalizationFieldReserved\\": false,\\n            \\"CreateTime\\": 1736386610000,\\n            \\"UpdateTime\\": 1736386610000\\n          }\\n        ],\\n        \\"CreateTime\\": 1736386610000,\\n        \\"UpdateTime\\": 1736386610000,\\n        \\"NormalizationFieldRequirement\\": true\\n      }\\n    ],\\n    \\"TargetLogStore\\": \\"network-activity\\",\\n    \\"TargetStoreView\\": \\"network_activity\\",\\n    \\"NormalizationSchemaType\\": \\"log\\",\\n    \\"UpdateTime\\": 1733269771123,\\n    \\"CreateTime\\": 1733269771123,\\n    \\"NormalizationSchemaReferences\\": [\\n      {\\n        \\"NormalizationRuleId\\": \\"alibaba_cloud_cfw_flow_rule\\"\\n      }\\n    ],\\n    \\"NormalizationSchemaFrom\\": \\"preset\\",\\n    \\"VendorId\\": \\"alibaba_cloud\\",\\n    \\"ProductId\\": \\"alibaba_cloud_bastionhost\\",\\n    \\"NormalizationSecurityDomainId\\": \\"DATA_SECURITY\\",\\n    \\"NormalizationSchemaDescription\\": \\"Network 5-Tuple Logs\\",\\n    \\"NormalizationFieldSource\\": \\"native\\",\\n    \\"RecommendEntities\\": [\\n      \\"\\"\\n    ]\\n  }\\n}","type":"json"}]',
         ],
-        'DeleteDataIngestion' => [
-            'summary' => '删除数据接入',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'GetResponseRuleStatistic' => [
+            'summary' => 'Retrieves the count of automated response rules.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'write',
+            'operationType' => 'read',
             'deprecated' => false,
             'systemTags' => [
                 'operationType' => 'get',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsasASHGE7'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the region where your assets reside. Valid values:'."\n"
+                        .'- cn-hangzhou: the Chinese mainland and Hong Kong (China)'."\n"
+                        .'- ap-southeast-1: regions outside China', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
+                    'schema' => ['description' => 'The Alibaba Cloud account ID of the member to which the administrator switches the view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataIngestionId',
+                    'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'alibaba_cloud_sas_netstat_ingestion_173326*******。',
-                    ],
+                    'schema' => ['description' => 'The view type. Valid values:'."\n"
+                        ."\n"
+                        .'- 0: the current Alibaba Cloud account view.'."\n"
+                        .'- 1: the view of all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'Schema of Response',
-                        'description' => '',
+                        'title' => '',
+                        'description' => 'Schema of Response',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'title' => 'Id of the request',
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。',
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''],
+                            'ResponseStatistic' => [
+                                'description' => 'The statistics of automated response rules.',
+                                'type' => 'object',
+                                'properties' => [
+                                    'ResponseRuleOnlineCount' => ['description' => 'The number of online automated response rules.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''],
+                                    'ResponseRuleAllCount' => ['description' => 'The total number of automated response rules.', 'type' => 'integer', 'format' => 'int32', 'example' => '2', 'title' => ''],
+                                ],
+                                'title' => '',
+                                'example' => '',
                             ],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'Retrieve automated response rule count',
+            'description' => 'Notifications are subject to frequency and time restrictions.'."\n"
+                .'Each user receives a maximum of two notifications per day between 08:00 and 20:00. No notifications are sent outside this time range.',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+            'ramActions' => [],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"ResponseStatistic\\": {\\n    \\"ResponseRuleOnlineCount\\": 1,\\n    \\"ResponseRuleAllCount\\": 2\\n  }\\n}","type":"json"}]',
         ],
-        'GetDataBatchIngestion' => [
-            'summary' => '获取数据批量接入',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'GetUserConfig' => [
+            'summary' => 'Retrieves user information.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
@@ -5382,180 +4941,96 @@
                 'operationType' => 'get',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The region of the Data Management center for threat analysis. Select a region for the Management Hub based on the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Assets in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Assets outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'en', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。'."\n",
-                    ],
+                    'schema' => ['description' => 'The user ID of a member. An administrator can use this parameter to switch to the perspective of the specified member.', 'type' => 'string', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'Schema of Response',
-                        'description' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。',
-                            ],
-                            'DataBatchIngestion' => [
-                                'description' => '',
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''],
+                            'User' => [
+                                'description' => 'The user.',
                                 'type' => 'object',
                                 'properties' => [
-                                    'DataBatchIngestionStatus' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'pending。',
-                                    ],
-                                    'DataBatchIngestionSetTime' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => '1733269771123。',
-                                    ],
-                                    'DataBatchIngestionEffectTime' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => '	'."\n"
-                                            .'1733269771123。',
-                                    ],
-                                    'LogUserIds' => [
-                                        'description' => '',
-                                        'type' => 'array',
-                                        'items' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => '173326*******。',
-                                        ],
-                                    ],
-                                    'AutoScanNew' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'enabled。',
-                                    ],
-                                    'DataIngestions' => [
-                                        'description' => '',
-                                        'type' => 'array',
-                                        'items' => [
-                                            'description' => '',
-                                            'type' => 'object',
-                                            'properties' => [
-                                                'DataIngestionId' => [
-                                                    'description' => '',
-                                                    'type' => 'string',
-                                                    'example' => 'alibaba_cloud_sas_process_ingestion_173326*******。',
-                                                ],
-                                                'DataIngestionStatus' => [
-                                                    'description' => '',
-                                                    'type' => 'string',
-                                                    'example' => 'enabled。',
-                                                ],
-                                                'DataSourceId' => [
-                                                    'description' => '',
-                                                    'type' => 'string',
-                                                    'example' => 'alibaba_cloud_sas_process_log_173326*******。',
-                                                ],
-                                                'ProductId' => [
-                                                    'description' => '',
-                                                    'type' => 'string',
-                                                    'example' => 'alibaba_cloud_sas。',
-                                                ],
-                                                'VendorId' => [
-                                                    'description' => '',
-                                                    'type' => 'string',
-                                                    'example' => 'alibaba_cloud。',
-                                                ],
-                                            ],
-                                        ],
-                                    ],
-                                    'RecommendDataIngestionIds' => [
-                                        'description' => '',
-                                        'type' => 'array',
-                                        'items' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'alibaba_cloud_sas_process_log_173326*******。',
-                                        ],
-                                    ],
-                                    'ApsaraDataIngestionIds' => [
-                                        'description' => '',
-                                        'type' => 'array',
-                                        'items' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'alibaba_cloud_sas_process_log_173326*******。'."\n",
-                                        ],
-                                    ],
-                                    'DataSourceRecognizeEnabled' => [
-                                        'description' => '',
-                                        'type' => 'boolean',
-                                        'example' => 'true。',
-                                    ],
-                                    'DataBatchIngestionMode' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'full。',
-                                    ],
+                                    'CtdrVersion' => ['description' => 'The current CTDR version.', 'type' => 'string', 'example' => 'v2', 'title' => ''],
+                                    'DataStorageVersion' => ['description' => 'The upgrade status. Valid values:'."\n"
+                                        ."\n"
+                                        .'- pending: The upgrade is pending.'."\n"
+                                        ."\n"
+                                        .'- upgrading: The upgrade is in progress.'."\n"
+                                        ."\n"
+                                        .'- success: The upgrade is successful.'."\n"
+                                        ."\n"
+                                        .'- failed: The upgrade failed.', 'type' => 'string', 'example' => 'pending', 'title' => ''],
+                                    'UpgradeStatus' => ['description' => 'The target CTDR version for the upgrade.', 'type' => 'string', 'example' => 'v2', 'title' => ''],
+                                    'UpgradeCtdrVersion' => ['description' => 'The version of Log Management.', 'type' => 'string', 'example' => 'v2', 'title' => ''],
                                 ],
+                                'title' => '',
+                                'example' => '',
                             ],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"User\\": {\\n    \\"CtdrVersion\\": \\"v2\\",\\n    \\"DataStorageVersion\\": \\"pending\\",\\n    \\"UpgradeStatus\\": \\"v2\\",\\n    \\"UpgradeCtdrVersion\\": \\"v2\\"\\n  }\\n}","type":"json"}]',
+            'title' => 'GetUserConfig',
+            'description' => 'The JsonConfig request parameter is a complex JSON object. A supporting tool class is provided to help you create the configuration. For an example, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:GetUserConfig',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"DataBatchIngestion\\": {\\n    \\"DataBatchIngestionStatus\\": \\"pending\\",\\n    \\"DataBatchIngestionSetTime\\": \\"1733269771123\\",\\n    \\"DataBatchIngestionEffectTime\\": \\"1733269771123\\",\\n    \\"LogUserIds\\": [\\n      \\"173326*******\\"\\n    ],\\n    \\"AutoScanNew\\": \\"enabled\\",\\n    \\"DataIngestions\\": [\\n      {\\n        \\"DataIngestionId\\": \\"alibaba_cloud_sas_process_ingestion_173326*******\\",\\n        \\"DataIngestionStatus\\": \\"enabled\\",\\n        \\"DataSourceId\\": \\"alibaba_cloud_sas_process_log_173326*******\\",\\n        \\"ProductId\\": \\"alibaba_cloud_sas\\",\\n        \\"VendorId\\": \\"alibaba_cloud\\"\\n      }\\n    ],\\n    \\"RecommendDataIngestionIds\\": [\\n      \\"alibaba_cloud_sas_process_log_173326*******\\"\\n    ],\\n    \\"ApsaraDataIngestionIds\\": [\\n      \\"alibaba_cloud_sas_process_log_173326*******\\"\\n    ],\\n    \\"DataSourceRecognizeEnabled\\": true,\\n    \\"DataBatchIngestionMode\\": \\"full\\"\\n  }\\n}","type":"json"}]',
         ],
-        'UpdateDataBatchIngestion' => [
-            'summary' => '更新数据批量接入',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'ListAlerts' => [
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
@@ -5564,517 +5039,513 @@
             'operationType' => 'read',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'get',
+                'operationType' => 'list',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas731ZAS'],
+                'tenantRelevance' => 'tenant',
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The region where the threat analysis data management center is located. Specify the management center based on the region of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are located in the Chinese mainland or Hong Kong (China).'."\n"
+                        .'- ap-southeast-1: Your assets are located outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-shanghai', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
-                    'name' => 'RoleFor',
+                    'name' => 'AlertLevel',
                     'in' => 'formData',
+                    'style' => 'repeatList',
                     'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
+                        'description' => 'The threat level of the alert. Valid values:'."\n"
+                            ."\n"
+                            .'- 5: critical.'."\n"
+                            .'- 4: high-risk.'."\n"
+                            .'- 3: medium-risk.'."\n"
+                            .'- 2: low-risk.'."\n"
+                            .'- 1: informational.',
+                        'type' => 'array',
+                        'items' => ['description' => 'The threat level of the alert. Valid values:'."\n"
+                            ."\n"
+                            .'- 5: critical.'."\n"
+                            .'- 4: high-risk.'."\n"
+                            .'- 3: medium-risk.'."\n"
+                            .'- 2: low-risk.'."\n"
+                            .'- 1: informational.', 'type' => 'string', 'required' => false, 'example' => '1', 'title' => ''],
                         'required' => false,
-                        'example' => '173326*******。',
+                        'maxItems' => 100,
+                        'title' => '',
+                        'example' => '',
                     ],
                 ],
                 [
-                    'name' => 'LogUserIds',
+                    'name' => 'AlertUuid',
                     'in' => 'formData',
-                    'style' => 'simple',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'array',
-                        'items' => [
-                            'description' => '',
-                            'type' => 'integer',
-                            'format' => 'int64',
-                            'required' => false,
-                            'example' => '173326*******。',
-                        ],
-                        'required' => false,
-                    ],
+                    'schema' => ['description' => 'The alert ID associated with the event.', 'type' => 'string', 'required' => false, 'example' => 'sas_71e24437d2797ce8fc59692905a4****', 'title' => ''],
                 ],
                 [
-                    'name' => 'AutoScanNew',
+                    'name' => 'QueryViewId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'enabled。',
-                    ],
+                    'schema' => ['description' => 'The unique identifier of the query view.', 'type' => 'string', 'required' => false, 'example' => 'qv-a1b2c3d4e5f6g7****', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataIngestionIds',
+                    'name' => 'QueryCondition',
                     'in' => 'formData',
-                    'style' => 'simple',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'array',
-                        'items' => [
-                            'description' => '',
-                            'type' => 'string',
-                            'required' => false,
-                            'example' => 'alibaba_cloud_actiontrail_event_ingestion_173326*******。',
-                        ],
-                        'required' => false,
-                    ],
+                    'schema' => ['description' => 'The query filter condition in JSON format. Valid values:'."\n"
+                        ."\n"
+                        .'- `{"Type":"maxCost", "Value":"100"}`: the top 100 queries with the longest execution duration.'."\n"
+                        .'- `{"Type":"status","Value":"finished"}`: completed queries.'."\n"
+                        .'- `{"Type":"status","Value":"running"}`: running queries.'."\n"
+                        .'- `{"Type":"cost","Min":"30","Max":"50"}`: queries with a custom execution duration range. You can specify the minimum and maximum execution duration. **Min** specifies the minimum execution duration. **Max** specifies the maximum execution duration. Unit: milliseconds (ms).'."\n"
+                        .'    - If only **Min** is specified, queries with an execution duration greater than this value are returned.'."\n"
+                        .'    - If only **Max** is specified, queries with an execution duration less than this value are returned.'."\n"
+                        .'    - If both **Min** and **Max** are specified, queries with an execution duration greater than or equal to **Min** and less than or equal to **Max** are returned.', 'type' => 'string', 'required' => false, 'example' => '{\\"Type\\":\\"cost\\",\\"Max\\":\\"200\\"}', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataSourceRecognizeEnabled',
+                    'name' => 'StartTime',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'boolean',
-                        'required' => false,
-                        'example' => 'true。',
-                    ],
+                    'schema' => ['description' => 'The time when the alert first occurred.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '2025-09-30T02:23:00Z', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataBatchIngestionMode',
+                    'name' => 'EndTime',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'full。',
-                    ],
+                    'schema' => ['description' => 'The end time of the alert.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '1766801904000', 'title' => ''],
+                ],
+                [
+                    'name' => 'OrderFieldName',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The field used for sorting. Valid values:'."\n"
+                        ."\n"
+                        .'- GmtCreate: creation time.'."\n"
+                        .'- GmtModified: update time.', 'type' => 'string', 'required' => false, 'example' => 'GmtModified', 'title' => ''],
+                ],
+                [
+                    'name' => 'OrderDirection',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The sort order. Valid values:'."\n"
+                        ."\n"
+                        .'- **asc** (default): ascending order.'."\n"
+                        .'- **desc**: descending order.', 'type' => 'string', 'required' => false, 'example' => 'asc', 'title' => ''],
+                ],
+                [
+                    'name' => 'PageNumber',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The page number.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'minimum' => '1', 'example' => '1', 'title' => ''],
+                ],
+                [
+                    'name' => 'PageSize',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'maximum' => '100', 'minimum' => '1', 'example' => '10', 'title' => ''],
+                ],
+                [
+                    'name' => 'RoleFor',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The ID of the member accounts in the resource folder.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''],
+                ],
+                [
+                    'name' => 'RoleType',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The view type. Valid values:'."\n"
+                        ."\n"
+                        .'- 0: the view of the current Alibaba Cloud account.'."\n"
+                        .'- 1: the view of all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1', 'title' => ''],
+                ],
+                [
+                    'name' => 'MaxResults',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The maximum number of entries to return in this request.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '50', 'title' => ''],
+                ],
+                [
+                    'name' => 'NextToken',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The pagination token. You do not need to specify this parameter for the first request or if no more results exist. If more results exist, set this parameter to the NextToken value returned in the previous API call.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'Schema of Response',
-                        'description' => '',
+                        'title' => '',
+                        'description' => 'Schema of Response',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。',
-                            ],
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''],
+                            'Alerts' => [
+                                'description' => 'The alert details.',
+                                'type' => 'array',
+                                'items' => [
+                                    'description' => 'The alert details.',
+                                    'type' => 'object',
+                                    'properties' => [
+                                        'AlertUuid' => ['description' => 'The alert UUID.', 'type' => 'string', 'example' => '798341271677187', 'title' => ''],
+                                        'AlertRecord' => ['description' => 'The alert details.', 'type' => 'string', 'example' => '{"alert_uuid":"a3f8c2e1-9b7d-4f6a-8c2e-1d5b9a7f****"}', 'title' => ''],
+                                    ],
+                                    'title' => '',
+                                    'example' => '',
+                                ],
+                                'title' => '',
+                                'example' => '',
+                            ],
+                            'PageSize' => ['description' => 'The number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10', 'title' => ''],
+                            'PageNumber' => ['description' => 'The page number.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''],
+                            'TotalCount' => ['description' => 'The total number of records.', 'type' => 'integer', 'format' => 'int32', 'example' => '57', 'title' => ''],
+                            'MaxResults' => ['description' => 'The maximum number of entries to return in this request.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''],
+                            'NextToken' => ['description' => 'The token for the next query.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'Retrieve alert list',
+            'summary' => 'Retrieves a list of alerts.',
+            'description' => 'The input parameter JsonConfig is a complex JSON configuration. We provide a utility class with configuration examples. For more information, refer to [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+            'ramActions' => [],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"Alerts\\": [\\n    {\\n      \\"AlertUuid\\": \\"798341271677187\\",\\n      \\"AlertRecord\\": \\"{\\\\\\"alert_uuid\\\\\\":\\\\\\"a3f8c2e1-9b7d-4f6a-8c2e-1d5b9a7f****\\\\\\"}\\"\\n    }\\n  ],\\n  \\"PageSize\\": 10,\\n  \\"PageNumber\\": 1,\\n  \\"TotalCount\\": 57,\\n  \\"MaxResults\\": 50,\\n  \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\"\\n}","type":"json"}]',
         ],
-        'ListDataIngestions' => [
-            'summary' => '获取数据接入任务列表',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'ListAutoDisposeEntities' => [
+            'path' => '',
+            'methods' => ['get', 'post'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'readAndWrite',
+            'operationType' => 'read',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'get',
+                'operationType' => 'list',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas731ZAS'],
+                'tenantRelevance' => 'tenant',
             ],
             'parameters' => [
                 [
-                    'name' => 'RegionId',
+                    'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
-                    'name' => 'Lang',
+                    'name' => 'CurrentPage',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
-                    ],
+                    'schema' => ['description' => 'The page number. The value must be 1 or greater.', 'type' => 'string', 'required' => true, 'example' => '1', 'title' => ''],
                 ],
                 [
-                    'name' => 'RoleFor',
+                    'name' => 'PageSize',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
+                    'schema' => ['description' => 'The number of entries to return on each page.', 'type' => 'string', 'required' => true, 'example' => '10', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataIngestionIds',
+                    'name' => 'DataSourceType',
                     'in' => 'formData',
-                    'style' => 'simple',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'array',
-                        'items' => [
-                            'description' => '',
-                            'type' => 'string',
-                            'required' => false,
-                            'example' => 'alibaba_cloud_sas_netstat_ingestion_173326*******。',
-                        ],
-                        'required' => false,
-                    ],
+                    'schema' => ['description' => 'The type of the data source.', 'type' => 'string', 'required' => true, 'example' => 'alibaba_cloud_sas', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataIngestionStatus',
+                    'name' => 'NextToken',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'enabled。',
-                    ],
+                    'schema' => ['description' => 'The token that is used to retrieve the next page of results. You can obtain this token from the response to a previous call.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
                 ],
                 [
-                    'name' => 'ProductId',
+                    'name' => 'MaxResults',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'alibaba_cloud_sas。',
-                    ],
+                    'schema' => ['description' => 'The maximum number of entries to return.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '50', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataIngestionTemplateIds',
+                    'name' => 'AutoDisposeRecordIds',
                     'in' => 'formData',
                     'style' => 'simple',
                     'schema' => [
-                        'description' => '',
                         'type' => 'array',
-                        'items' => [
-                            'description' => '',
-                            'type' => 'string',
-                            'required' => false,
-                            'example' => 'alibaba_cloud_sas_netstat_ingestion。',
-                        ],
+                        'items' => ['description' => 'The ID of the automated disposal record.', 'type' => 'string', 'required' => false, 'example' => '01f2c3ed23e1e157eb5368fc49db*****', 'title' => ''],
+                        'description' => 'The IDs of automated disposal records.',
                         'required' => false,
+                        'title' => '',
+                        'example' => '',
                     ],
                 ],
+                [
+                    'name' => 'Uuid',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The unique identifier of the playbook.', 'type' => 'string', 'required' => false, 'example' => 'b2491e39-ddf2-478a-8c07-*****', 'title' => ''],
+                ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'Schema of Response',
-                        'description' => '',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'title' => 'Id of the request',
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。',
-                            ],
-                            'DataIngestions' => [
-                                'description' => '',
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'title' => '', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
+                            'AutoDecisionEntities' => [
                                 'type' => 'array',
                                 'items' => [
-                                    'description' => '',
                                     'type' => 'object',
                                     'properties' => [
-                                        'CreateTime' => [
-                                            'description' => '',
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '1733269771123。',
-                                        ],
-                                        'UpdateTime' => [
-                                            'description' => '',
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '1733269771123。',
-                                        ],
-                                        'DataIngestionId' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'alibaba_cloud_sas_netstat_ingestion_173326*******。',
-                                        ],
-                                        'DataIngestionType' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'preset。',
-                                        ],
-                                        'DataIngestionMode' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'realtime。',
-                                        ],
-                                        'DataIngestionStatus' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'enabled。',
-                                        ],
-                                        'DataIngestionState' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'ingested。',
-                                        ],
-                                        'DataSourceId' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'ds-scpfegri73oyoknbc90c。',
-                                        ],
-                                        'NormalizationRuleId' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'nr-0aywiqdtaqdvwac7xkbjsf3a。',
-                                        ],
-                                        'StreamJobId' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => '73a78aa245e3b1299d6ceed093de7bd8。',
-                                        ],
-                                        'CapacityCount' => [
-                                            'description' => '',
-                                            'type' => 'integer',
-                                            'format' => 'int32',
-                                            'example' => '3。',
-                                        ],
-                                        'DataSourceEditable' => [
-                                            'description' => '',
-                                            'type' => 'boolean',
-                                            'example' => 'true。',
-                                        ],
-                                        'NormalizationRuleEditable' => [
-                                            'description' => '',
-                                            'type' => 'boolean',
-                                            'example' => 'true。',
-                                        ],
-                                        'DataIngestionModeEditable' => [
-                                            'description' => '',
-                                            'type' => 'boolean',
-                                            'example' => 'true。',
-                                        ],
-                                        'DataIngestionTemplateId' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'alibaba_cloud_sas_netstat_ingestion。',
-                                        ],
-                                        'RealtimeDataSourceId' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'ds-scpfegri73oyoknbc90c。',
-                                        ],
-                                        'ScanDataSourceId' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'ds-scpfegri73oyoknbc90c。',
-                                        ],
-                                        'DataIngestionStateCode' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'UserUnauthorized。',
-                                        ],
-                                        'ActiveTime' => [
-                                            'description' => '',
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '1733269771123。',
-                                        ],
+                                        'EntityType' => ['description' => 'The entity type. Valid values:'."\n"
+                                            ."\n"
+                                            .'- `ip`: An IP address.'."\n"
+                                            ."\n"
+                                            .'- `domain`: A domain.'."\n"
+                                            ."\n"
+                                            .'- `process`: A process.'."\n"
+                                            ."\n"
+                                            .'- `file`: A file.'."\n"
+                                            ."\n"
+                                            .'- `host`: A host.', 'type' => 'string', 'example' => 'process', 'title' => ''],
+                                        'EntityName' => ['description' => 'The entity name.', 'type' => 'string', 'example' => '/apps/ext/ka****', 'title' => ''],
+                                        'EntityUuid' => ['description' => 'The entity UUID.', 'type' => 'string', 'example' => '022ed6c601514a370cc9e3acd37a****', 'title' => ''],
+                                        'DisposalMethod' => ['description' => 'The disposal method. Valid values:'."\n"
+                                            ."\n"
+                                            .'- `ignore`: Ignore.'."\n"
+                                            ."\n"
+                                            .'- `dispose`: Playbook-based disposal.', 'type' => 'string', 'example' => 'dispose', 'title' => ''],
+                                        'PlaybookUuid' => ['description' => 'The playbook UUID.', 'type' => 'string', 'example' => '6fd2b143-e420-4c1b-a118-e764*****', 'title' => ''],
+                                        'DisposeRecordId' => ['description' => 'The disposal ID.', 'type' => 'string', 'example' => '1ec121479b341a61886dbd2c4ccd*****', 'title' => ''],
+                                        'Uuid' => ['description' => 'The unique identifier (UUID) of the entry.', 'type' => 'string', 'example' => '0d23f133-22d7-4388-b738-ab******', 'title' => ''],
+                                        'AlertId' => ['description' => 'The alert rule ID.', 'type' => 'string', 'example' => '20403189', 'title' => ''],
                                     ],
+                                    'description' => '',
+                                    'title' => '',
+                                    'example' => '',
                                 ],
-                            ],
+                                'description' => 'A list of AI-powered automated analysis entities.',
+                                'title' => '',
+                                'example' => '',
+                            ],
+                            'CurrentPage' => ['description' => 'The current page number. The value must be greater than or equal to 1.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''],
+                            'PageSize' => ['description' => 'The number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10', 'title' => ''],
+                            'TotalCount' => ['description' => 'The total count of entries.', 'type' => 'integer', 'format' => 'int32', 'example' => '57', 'title' => ''],
+                            'MaxResults' => ['description' => 'The maximum number of entries returned in this request.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''],
+                            'NextToken' => ['description' => 'The token used to retrieve the next page of results. An empty value indicates that all results have been returned.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
                         ],
+                        'title' => '',
+                        'description' => 'The response body.',
+                        'example' => '',
                     ],
                 ],
             ],
-            'errorCodes' => [
-                400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
-                ],
-            ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'ListAutoDisposeEntities',
+            'summary' => 'Get AI-analyzed entity list',
+            'description' => 'Each user can receive up to two notifications daily, but only between 08:00 and 20:00.',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"DataIngestions\\": [\\n    {\\n      \\"CreateTime\\": 1733269771123,\\n      \\"UpdateTime\\": 1733269771123,\\n      \\"DataIngestionId\\": \\"alibaba_cloud_sas_netstat_ingestion_173326*******\\",\\n      \\"DataIngestionType\\": \\"preset\\",\\n      \\"DataIngestionMode\\": \\"realtime\\",\\n      \\"DataIngestionStatus\\": \\"enabled\\",\\n      \\"DataIngestionState\\": \\"ingested\\",\\n      \\"DataSourceId\\": \\"ds-scpfegri73oyoknbc90c\\",\\n      \\"NormalizationRuleId\\": \\"nr-0aywiqdtaqdvwac7xkbjsf3a\\",\\n      \\"StreamJobId\\": \\"73a78aa245e3b1299d6ceed093de7bd8\\",\\n      \\"CapacityCount\\": 3,\\n      \\"DataSourceEditable\\": true,\\n      \\"NormalizationRuleEditable\\": true,\\n      \\"DataIngestionModeEditable\\": true,\\n      \\"DataIngestionTemplateId\\": \\"alibaba_cloud_sas_netstat_ingestion\\",\\n      \\"RealtimeDataSourceId\\": \\"ds-scpfegri73oyoknbc90c\\",\\n      \\"ScanDataSourceId\\": \\"ds-scpfegri73oyoknbc90c\\",\\n      \\"DataIngestionStateCode\\": \\"UserUnauthorized\\",\\n      \\"ActiveTime\\": 1733269771123\\n    }\\n  ]\\n}","type":"json"}]',
+            'ramActions' => [],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"AutoDecisionEntities\\": [\\n    {\\n      \\"EntityType\\": \\"process\\",\\n      \\"EntityName\\": \\"/apps/ext/ka****\\",\\n      \\"EntityUuid\\": \\"022ed6c601514a370cc9e3acd37a****\\",\\n      \\"DisposalMethod\\": \\"dispose\\",\\n      \\"PlaybookUuid\\": \\"6fd2b143-e420-4c1b-a118-e764*****\\",\\n      \\"DisposeRecordId\\": \\"1ec121479b341a61886dbd2c4ccd*****\\",\\n      \\"Uuid\\": \\"0d23f133-22d7-4388-b738-ab******\\",\\n      \\"AlertId\\": \\"20403189\\"\\n    }\\n  ],\\n  \\"CurrentPage\\": 1,\\n  \\"PageSize\\": 10,\\n  \\"TotalCount\\": 57,\\n  \\"MaxResults\\": 50,\\n  \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\"\\n}","type":"json"}]',
         ],
-        'UpdateDataIngestionTemplate' => [
-            'summary' => '更新接入模板',
+        'ListDataConnectors' => [
+            'summary' => 'Queries collectors by paging.',
             'path' => '',
-            'methods' => [
-                'get',
-                'post',
-            ],
-            'schemes' => [
-                'https',
-            ],
+            'methods' => ['get', 'post'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'write',
+            'operationType' => 'read',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'update',
+                'operationType' => 'list',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
                 'tenantRelevance' => 'tenant',
             ],
             'parameters' => [
                 [
-                    'name' => 'DataIngestionTemplateId',
+                    'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'alibaba_cloud_actiontrail_event_ingestion_173326*******。'."\n",
-                    ],
+                    'schema' => ['description' => 'The region where the threat analysis data management center resides. Specify the management center region based on the region of your assets. Valid values:'."\n"
+                        .'- cn-hangzhou: The assets reside in the Chinese mainland.'."\n"
+                        .'- ap-southeast-1: The assets reside outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataIngestionTemplateName',
+                    'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'alibaba_cloud_actiontrail_event_ingestion_173326*******。'."\n",
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
-                    'name' => 'NormalizationRuleId',
+                    'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'alibaba_cloud_actiontrail_event_rule。',
-                    ],
+                    'schema' => ['description' => 'The user ID that the administrator switches to when viewing as another member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''],
                 ],
                 [
-                    'name' => 'Lang',
+                    'name' => 'DataConnectorIds',
                     'in' => 'formData',
+                    'style' => 'json',
                     'schema' => [
-                        'description' => '',
-                        'type' => 'string',
+                        'description' => 'The list of collector IDs.',
+                        'type' => 'array',
+                        'items' => ['description' => 'The collector ID.', 'type' => 'string', 'required' => false, 'example' => 'dc-1a2b3c4d5e6f7a8d1****', 'title' => ''],
                         'required' => false,
-                        'example' => 'zh。',
+                        'title' => '',
+                        'example' => '',
                     ],
                 ],
                 [
-                    'name' => 'RegionId',
+                    'name' => 'DataConnectorName',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The collector name.', 'type' => 'string', 'required' => false, 'example' => 'SAS-CTDR-2026070210****', 'title' => ''],
                 ],
                 [
-                    'name' => 'RoleFor',
+                    'name' => 'SlsIngestionJobName',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
+                    'schema' => ['description' => 'The name of the Simple Log Service (SLS) data import job for the collector.', 'type' => 'string', 'required' => false, 'example' => 'ingest-oss-dc-1a2b3c4d5e6f7a8****', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataIngestionStatus',
+                    'name' => 'SrcDataType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'enabled。',
-                    ],
+                    'schema' => ['description' => 'The source data type.', 'type' => 'string', 'required' => false, 'example' => 's3', 'title' => ''],
+                ],
+                [
+                    'name' => 'DataConnectorType',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The collector type. Valid values:'."\n"
+                        .'- oss'."\n"
+                        .'- s3'."\n"
+                        .'- kafka', 'type' => 'string', 'required' => false, 'example' => 's3'],
+                ],
+                [
+                    'name' => 'DestDataSourceId',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The destination data source ID. This parameter is required only for synchronization.', 'type' => 'string', 'required' => false, 'example' => 'ds-5sfe68t122pxnti1cjpl', 'title' => ''],
+                ],
+                [
+                    'name' => 'DataConnectorStatus',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The collector status. Valid values:'."\n"
+                        .'- "enabled": enabled.'."\n"
+                        .'- "disabled" (default): disabled.', 'type' => 'string', 'required' => false, 'example' => 'enabled'],
+                ],
+                [
+                    'name' => 'PageSize',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The number of records per page. Default value: 1000.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1'],
+                ],
+                [
+                    'name' => 'PageNumber',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The current page number. Default value: 1.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1'],
+                ],
+                [
+                    'name' => 'OrderField',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The sort field. Currently, only sorting by updateTime is supported. If OrderField is left empty, the default order returned by the database is used.', 'type' => 'string', 'required' => false, 'example' => 'Id'],
+                ],
+                [
+                    'name' => 'OrderType',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The sort order. Valid values:'."\n"
+                        .'- "asc": ascending order.'."\n"
+                        .'- "desc" (default): descending order.', 'type' => 'string', 'required' => false, 'example' => 'desc'],
+                ],
+                [
+                    'name' => 'MaxResults',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The maximum number of results to return when you use the NextToken-based pagination method. Valid values: 1 to 100. Default value: 50.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '50', 'title' => ''],
+                ],
+                [
+                    'name' => 'NextToken',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The pagination token. You do not need to set this parameter for the first request or if no more results exist. If more results exist, set this parameter to the NextToken value returned by the previous API call.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'Schema of Response',
-                        'description' => '',
+                        'title' => '',
+                        'description' => 'Schema of Response',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'title' => 'Id of the request',
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。',
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''],
+                            'PageSize' => ['description' => 'The number of records per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10', 'title' => ''],
+                            'PageNumber' => ['description' => 'The current page number.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''],
+                            'TotalCount' => ['description' => 'The total number of records.', 'type' => 'integer', 'format' => 'int32', 'example' => '57', 'title' => ''],
+                            'MaxResults' => ['description' => 'The maximum number of records returned in this request.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''],
+                            'NextToken' => ['description' => 'The token for the next query.', 'type' => 'string', 'example' => 'AAAAASLVeIxed4466E0LVmGkzwS6hJKd9DGVGMDRM6Lu****', 'title' => ''],
+                            'DataConnector' => [
+                                'description' => 'The list of collectors.',
+                                'type' => 'array',
+                                'items' => [
+                                    'description' => 'The collector.',
+                                    'type' => 'object',
+                                    'properties' => [
+                                        'CreationTime' => ['description' => 'The creation time.', 'type' => 'integer', 'format' => 'int64', 'example' => '2026-06-01T02:14:24Z', 'title' => ''],
+                                        'UpdateTime' => ['description' => 'The update time.', 'type' => 'integer', 'format' => 'int64', 'example' => '2025-01-04 22:31:54', 'title' => ''],
+                                        'DataConnectorId' => ['description' => 'The collector ID.', 'type' => 'string', 'example' => 'dc-07423146117d77db266f78bc41f4fd80', 'title' => ''],
+                                        'DataConnectorName' => ['description' => 'The data connector name.', 'type' => 'string', 'example' => 'dc-***', 'title' => ''],
+                                        'DataConnectorStatus' => ['description' => 'The connector status.', 'type' => 'string', 'example' => 'enable', 'title' => ''],
+                                        'DataConnectorType' => ['description' => 'The connector type.', 'type' => 'string', 'example' => 'oss', 'title' => ''],
+                                        'SrcDataType' => ['title' => '', 'description' => 'The source data type.', 'type' => 'string', 'example' => 's3'],
+                                        'DestDataSourceId' => ['description' => 'The destination data source ID. This parameter is required only for synchronization.', 'type' => 'string', 'example' => 'ds-t3ywipile7gctobaunx0', 'title' => ''],
+                                        'LogProjectName' => ['description' => 'The Simple Log Service project name.', 'type' => 'string', 'example' => 'aliyun-cloudsiem-channel-1371069058301795-cn-shanghai', 'title' => ''],
+                                        'LogStoreName' => ['description' => 'The Simple Log Service Logstore name.', 'type' => 'string', 'example' => 'ls-wecom-crontasklog-prod', 'title' => ''],
+                                        'LogRegionId' => ['description' => 'The log storage region ID.', 'type' => 'string', 'example' => 'cn-hangzhou', 'title' => ''],
+                                        'AuthConfigId' => ['title' => '', 'description' => 'The configuration item ID of the collector access object in the multi-cloud configuration.', 'type' => 'string', 'example' => 'cn-smbc-prod-cloudtrail.s3.cn-north-1.amazonaws.com.cn_AKIAX4AUG6AYSJO7FAG4'],
+                                        'AuthConfigVendor' => ['description' => 'The cloud vendor of the authentication configuration.', 'type' => 'string', 'example' => 'SALESFORCE', 'title' => ''],
+                                        'AuthConfigProduct' => ['description' => 'The cloud product of the authentication configuration.', 'type' => 'string', 'example' => 'salesForceRestAPI', 'title' => ''],
+                                        'DataConnectorConfig' => ['title' => '', 'description' => 'The collector configuration information.', 'type' => 'string', 'example' => '{\\"endpoint\\":\\"csrm-sentinel.s3.cn-north-1.amazonaws.com.cn_AKIARGUYUGSX6A6VUXQJ\\",\\"bucket\\":\\"csrm-sentinel\\",\\"prefix\\":\\"AliTest/\\",\\"format\\":{\\"type\\":\\"JSON\\"},\\"encoding\\":\\"UTF-8\\"}'],
+                                        'SlsIngestionJobName' => ['title' => '', 'description' => 'The name of the SLS data import job associated with the collector.', 'type' => 'string', 'example' => '1a2b3c4d5e6f7a8b9c0d1e2f3a4b****'],
+                                        'SlsIngestionJobState' => ['title' => '', 'description' => 'The status of the SLS data import job associated with the collector.', 'type' => 'string', 'example' => 'running'],
+                                    ],
+                                    'title' => '',
+                                    'example' => '',
+                                ],
+                                'title' => '',
+                                'example' => '',
                             ],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'errorCodes' => [
+                400 => [
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
+                ],
+            ],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'Query collectors by paging',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+            'ramActions' => [],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"PageSize\\": 10,\\n  \\"PageNumber\\": 1,\\n  \\"TotalCount\\": 57,\\n  \\"MaxResults\\": 50,\\n  \\"NextToken\\": \\"AAAAASLVeIxed4466E0LVmGkzwS6hJKd9DGVGMDRM6Lu****\\",\\n  \\"DataConnector\\": [\\n    {\\n      \\"CreationTime\\": 0,\\n      \\"UpdateTime\\": 0,\\n      \\"DataConnectorId\\": \\"dc-07423146117d77db266f78bc41f4fd80\\",\\n      \\"DataConnectorName\\": \\"dc-***\\",\\n      \\"DataConnectorStatus\\": \\"enable\\",\\n      \\"DataConnectorType\\": \\"oss\\",\\n      \\"SrcDataType\\": \\"s3\\",\\n      \\"DestDataSourceId\\": \\"ds-t3ywipile7gctobaunx0\\",\\n      \\"LogProjectName\\": \\"aliyun-cloudsiem-channel-1371069058301795-cn-shanghai\\",\\n      \\"LogStoreName\\": \\"ls-wecom-crontasklog-prod\\",\\n      \\"LogRegionId\\": \\"cn-hangzhou\\",\\n      \\"AuthConfigId\\": \\"cn-smbc-prod-cloudtrail.s3.cn-north-1.amazonaws.com.cn_AKIAX4AUG6AYSJO7FAG4\\",\\n      \\"AuthConfigVendor\\": \\"SALESFORCE\\",\\n      \\"AuthConfigProduct\\": \\"salesForceRestAPI\\",\\n      \\"DataConnectorConfig\\": \\"{\\\\\\\\\\\\\\"endpoint\\\\\\\\\\\\\\":\\\\\\\\\\\\\\"csrm-sentinel.s3.cn-north-1.amazonaws.com.cn_AKIARGUYUGSX6A6VUXQJ\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"bucket\\\\\\\\\\\\\\":\\\\\\\\\\\\\\"csrm-sentinel\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"prefix\\\\\\\\\\\\\\":\\\\\\\\\\\\\\"AliTest/\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"format\\\\\\\\\\\\\\":{\\\\\\\\\\\\\\"type\\\\\\\\\\\\\\":\\\\\\\\\\\\\\"JSON\\\\\\\\\\\\\\"},\\\\\\\\\\\\\\"encoding\\\\\\\\\\\\\\":\\\\\\\\\\\\\\"UTF-8\\\\\\\\\\\\\\"}\\",\\n      \\"SlsIngestionJobName\\": \\"1a2b3c4d5e6f7a8b9c0d1e2f3a4b****\\",\\n      \\"SlsIngestionJobState\\": \\"running\\"\\n    }\\n  ]\\n}","type":"json"}]',
         ],
         'ListDataIngestionTemplates' => [
-            'summary' => '查询接入模板',
+            'summary' => 'Queries data ingestion templates.',
             'path' => '',
-            'methods' => [
-                'get',
-                'post',
-            ],
-            'schemes' => [
-                'https',
-            ],
+            'methods' => ['get', 'post'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
@@ -6086,200 +5557,148 @@
                 'operationType' => 'list',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
                     'name' => 'DataSourceTemplateIds',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'alibaba_cloud_sas_account_snapshot_log_173326*******。',
-                    ],
+                    'schema' => ['description' => 'A list of data source template IDs.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_sas_account_snapshot_log_173326*******', 'title' => ''],
                 ],
                 [
                     'name' => 'DataIngestionTemplateStatus',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'running。',
-                    ],
+                    'schema' => ['description' => 'The status of the data ingestion template. Valid values:'."\n"
+                        ."\n"
+                        .'- pending'."\n"
+                        ."\n"
+                        .'- running'."\n"
+                        ."\n"
+                        .'- success'."\n"
+                        ."\n"
+                        .'- failed', 'type' => 'string', 'required' => false, 'example' => 'running', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member whose perspective you want to use. This parameter is available only for administrators.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The region where the Data Management center of threat analysis is located. You must select a region based on the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'ProductId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'alibaba_cloud_sas。',
-                    ],
+                    'schema' => ['description' => 'The product ID.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_sas', 'title' => ''],
                 ],
                 [
                     'name' => 'PageNumber',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '1。',
-                    ],
+                    'schema' => ['description' => 'The page number.', 'type' => 'string', 'required' => false, 'example' => '1', 'title' => ''],
                 ],
                 [
                     'name' => 'PageSize',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '10。',
-                    ],
+                    'schema' => ['description' => 'The number of entries per page.', 'type' => 'string', 'required' => false, 'example' => '10', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'Schema of Response',
-                        'description' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。',
-                            ],
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''],
                             'DataIngestionTemplates' => [
-                                'description' => '',
+                                'description' => 'The list of data ingestion templates.',
                                 'type' => 'array',
                                 'items' => [
-                                    'description' => '',
+                                    'description' => 'The data ingestion template.',
                                     'type' => 'object',
                                     'properties' => [
-                                        'CreateTime' => [
-                                            'description' => '',
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '1733269771123。',
-                                        ],
-                                        'DataIngestionStatus' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'enabled。',
-                                        ],
-                                        'DataIngestionTemplateId' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'alibaba_cloud_sas_account_snapshot_log。',
-                                        ],
-                                        'DataIngestionTemplateName' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'alibaba_cloud_sas_account_snapshot_log。',
-                                        ],
-                                        'DataSourceTemplateId' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'alibaba_cloud_sas_account_snapshot_log_173326*******。'."\n",
-                                        ],
-                                        'NormalizationRuleId' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'alibaba_cloud_actiontrail_event_rule。',
-                                        ],
-                                        'NormalizationRuleName' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'normalization_rule_ke1RN。',
-                                        ],
-                                        'UpdateTime' => [
-                                            'description' => '',
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '173326*******。',
-                                        ],
-                                        'CapacityCount' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => '3。',
-                                        ],
-                                        'DataIngestionMode' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'realtime。',
-                                        ],
-                                        'DataIngestionTemplateStatus' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'running。',
-                                        ],
-                                    ],
+                                        'CreateTime' => ['description' => 'The time when the template was created.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''],
+                                        'DataIngestionStatus' => ['description' => 'The data ingestion status. Valid values:'."\n"
+                                            ."\n"
+                                            .'- enabled: enabled.'."\n"
+                                            ."\n"
+                                            .'- disabled: disabled.', 'type' => 'string', 'example' => 'enabled', 'title' => ''],
+                                        'DataIngestionTemplateId' => ['description' => 'The ID of the data ingestion template.', 'type' => 'string', 'example' => 'alibaba_cloud_sas_account_snapshot_log', 'title' => ''],
+                                        'DataIngestionTemplateName' => ['description' => 'The name of the data ingestion template.', 'type' => 'string', 'example' => 'alibaba_cloud_sas_account_snapshot_log', 'title' => ''],
+                                        'DataSourceTemplateId' => ['description' => 'The ID of the data source template.', 'type' => 'string', 'example' => 'alibaba_cloud_sas_account_snapshot_log_173326*******', 'title' => ''],
+                                        'NormalizationRuleId' => ['description' => 'The ID of the normalization rule.', 'type' => 'string', 'example' => 'alibaba_cloud_actiontrail_event_rule', 'title' => ''],
+                                        'NormalizationRuleName' => ['description' => 'The name of the normalization rule.', 'type' => 'string', 'example' => 'normalization_rule_ke1RN', 'title' => ''],
+                                        'UpdateTime' => ['description' => 'The time when the template was last updated.', 'type' => 'integer', 'format' => 'int64', 'example' => '173326*******', 'title' => ''],
+                                        'CapacityCount' => ['description' => 'The number of associated security capabilities.', 'type' => 'string', 'example' => '3', 'title' => ''],
+                                        'DataIngestionMode' => ['description' => 'The data ingestion mode. Valid values:'."\n"
+                                            ."\n"
+                                            .'- realtime'."\n"
+                                            ."\n"
+                                            .'- scan', 'type' => 'string', 'example' => 'realtime', 'title' => ''],
+                                        'DataIngestionTemplateStatus' => ['description' => 'The status of the data ingestion template. Valid values:'."\n"
+                                            ."\n"
+                                            .'- pending'."\n"
+                                            ."\n"
+                                            .'- running'."\n"
+                                            ."\n"
+                                            .'- success'."\n"
+                                            ."\n"
+                                            .'- failed', 'type' => 'string', 'example' => 'running', 'title' => ''],
+                                    ],
+                                    'title' => '',
+                                    'example' => '',
                                 ],
+                                'title' => '',
+                                'example' => '',
                             ],
-                            'PageNumber' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '1。',
-                            ],
-                            'PageSize' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '10。',
-                            ],
+                            'PageNumber' => ['description' => 'The page number.', 'type' => 'string', 'example' => '1', 'title' => ''],
+                            'PageSize' => ['description' => 'The number of entries per page.', 'type' => 'string', 'example' => '10', 'title' => ''],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
+            'staticInfo' => ['returnType' => 'synchronous'],
             'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"DataIngestionTemplates\\": [\\n    {\\n      \\"CreateTime\\": 1733269771123,\\n      \\"DataIngestionStatus\\": \\"enabled\\",\\n      \\"DataIngestionTemplateId\\": \\"alibaba_cloud_sas_account_snapshot_log\\",\\n      \\"DataIngestionTemplateName\\": \\"alibaba_cloud_sas_account_snapshot_log\\",\\n      \\"DataSourceTemplateId\\": \\"alibaba_cloud_sas_account_snapshot_log_173326*******\\",\\n      \\"NormalizationRuleId\\": \\"alibaba_cloud_actiontrail_event_rule\\",\\n      \\"NormalizationRuleName\\": \\"normalization_rule_ke1RN\\",\\n      \\"UpdateTime\\": 0,\\n      \\"CapacityCount\\": \\"3\\",\\n      \\"DataIngestionMode\\": \\"realtime\\",\\n      \\"DataIngestionTemplateStatus\\": \\"running\\"\\n    }\\n  ],\\n  \\"PageNumber\\": \\"1\\",\\n  \\"PageSize\\": \\"10\\"\\n}","type":"json"}]',
-        ],
-        'ListTrafficStatistics' => [
-            'summary' => '获取接入流量统计',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
+            'title' => 'ListDataIngestionTemplates',
+            'description' => 'Notifications are subject to frequency and time limits. Each user can receive a maximum of two notifications per day between 08:00 and 20:00. Notifications are not sent outside this time frame.',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'list',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ListDataIngestionTemplates',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DataIngestionTemplate', 'arn' => 'acs:yundun-sas::{#accountId}:dataingestiontemplate/*'],
+                        ],
+                    ],
+                ],
             ],
+        ],
+        'ListDataIngestions' => [
+            'summary' => 'Retrieves a list of data access policies.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
@@ -6291,120 +5710,83 @@
                 'operationType' => 'get',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The region where the threat analysis feature is deployed. Select the region that corresponds to the location of your asset. Valid values:'."\n"
+                        ."\n"
+                        .'- `cn-hangzhou`: Your asset is in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- `ap-southeast-1`: Your asset is in a region outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
-                ],
-                [
-                    'name' => 'TrafficStatisticPeriod',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '30。',
-                    ],
+                    'schema' => ['description' => 'The user ID of a member. An administrator can use this parameter to query data as the specified member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
                 [
-                    'name' => 'TrafficStatisticPeriodType',
+                    'name' => 'DataIngestionIds',
                     'in' => 'formData',
+                    'style' => 'simple',
                     'schema' => [
-                        'description' => '',
-                        'type' => 'string',
+                        'description' => 'An array of data ingestion policy IDs.',
+                        'type' => 'array',
+                        'items' => ['description' => 'The data ingestion policy ID.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_sas_netstat_ingestion_173326*******', 'title' => ''],
                         'required' => false,
-                        'example' => 'day。',
+                        'title' => '',
+                        'example' => '',
                     ],
                 ],
                 [
-                    'name' => 'TrafficStatisticType',
+                    'name' => 'DataIngestionStatus',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'Region。',
-                    ],
+                    'schema' => ['description' => 'The data ingestion status. Valid values:'."\n"
+                        ."\n"
+                        .'- `enabled`: Enabled.'."\n"
+                        ."\n"
+                        .'- `disabled`: Disabled.', 'type' => 'string', 'required' => false, 'example' => 'enabled', 'title' => ''],
                 ],
                 [
                     'name' => 'ProductId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'alibaba_cloud_sas。',
-                    ],
-                ],
-                [
-                    'name' => 'TrafficType',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '日志流量类型:'."\n"
-                            .'- "commonLogTraffic"：通用日志流量 (默认)'."\n"
-                            .'- "agentAnalysisLogTraffic"：AI智能分析日志流量',
-                        'type' => 'string',
-                        'example' => 'agentAnalysisLogTraffic',
-                        'default' => 'commonLogTraffic',
-                    ],
+                    'schema' => ['description' => 'The product ID.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_sas', 'title' => ''],
                 ],
                 [
-                    'name' => 'RegionTag',
+                    'name' => 'DataIngestionTemplateIds',
                     'in' => 'formData',
+                    'style' => 'simple',
                     'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int32',
+                        'description' => 'An array of data ingestion template IDs.',
+                        'type' => 'array',
+                        'items' => ['description' => 'The data ingestion template ID.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_sas_netstat_ingestion', 'title' => ''],
                         'required' => false,
-                        'example' => '1。',
+                        'title' => '',
+                        'example' => '',
                     ],
                 ],
                 [
-                    'name' => 'LogUserIds',
+                    'name' => 'NormalizationSchemaIds',
                     'in' => 'formData',
                     'style' => 'simple',
                     'schema' => [
-                        'description' => '',
                         'type' => 'array',
-                        'items' => [
-                            'description' => '',
-                            'type' => 'integer',
-                            'format' => 'int64',
-                            'required' => false,
-                            'example' => '173326*******。',
-                        ],
+                        'items' => ['description' => 'The normalization schema ID.', 'type' => 'string', 'required' => false, 'example' => 'NETWORK_SESSION_ACTIVITY', 'title' => ''],
+                        'title' => '',
+                        'description' => 'An array of normalization schema IDs.',
                         'required' => false,
+                        'example' => '',
                     ],
                 ],
             ],
@@ -6412,78 +5794,97 @@
                 200 => [
                     'schema' => [
                         'title' => 'Schema of Response',
-                        'description' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'title' => 'Id of the request',
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。',
-                            ],
-                            'TrafficStatistics' => [
-                                'description' => '',
+                            'RequestId' => ['title' => 'Id of the request', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
+                            'DataIngestions' => [
+                                'description' => 'The list of data ingestions.',
                                 'type' => 'array',
                                 'items' => [
-                                    'description' => '',
+                                    'description' => 'The data ingestion.',
                                     'type' => 'object',
                                     'properties' => [
-                                        'TrafficStatisticTarget' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'all。',
-                                        ],
-                                        'TrafficStatisticData' => [
-                                            'description' => '',
-                                            'type' => 'array',
-                                            'items' => [
-                                                'description' => '',
-                                                'type' => 'object',
-                                                'properties' => [
-                                                    'TrafficStatisticTime' => [
-                                                        'description' => '',
-                                                        'type' => 'integer',
-                                                        'format' => 'int64',
-                                                        'example' => '20250815。',
-                                                    ],
-                                                    'TrafficStatisticValue' => [
-                                                        'description' => '',
-                                                        'type' => 'number',
-                                                        'format' => 'double',
-                                                        'example' => '1.699814。',
-                                                    ],
-                                                ],
-                                            ],
-                                        ],
-                                    ],
+                                        'CreateTime' => ['description' => 'The time when the data ingestion was created.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''],
+                                        'UpdateTime' => ['description' => 'The time when the data ingestion was last updated.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''],
+                                        'DataIngestionId' => ['description' => 'The ID of the data ingestion.', 'type' => 'string', 'example' => 'alibaba_cloud_sas_netstat_ingestion_173326*******', 'title' => ''],
+                                        'DataIngestionType' => ['description' => 'The type of the data ingestion. Valid values:'."\n"
+                                            ."\n"
+                                            .'- preset'."\n"
+                                            ."\n"
+                                            .'- custom', 'type' => 'string', 'example' => 'preset', 'title' => ''],
+                                        'DataIngestionMode' => ['description' => 'The mode of the data ingestion. Valid values:'."\n"
+                                            ."\n"
+                                            .'- realtime'."\n"
+                                            ."\n"
+                                            .'- scan', 'type' => 'string', 'example' => 'realtime', 'title' => ''],
+                                        'DataIngestionStatus' => ['description' => 'The status of the data ingestion. Valid values:'."\n"
+                                            ."\n"
+                                            .'- enabled: The data ingestion is enabled.'."\n"
+                                            ."\n"
+                                            .'- disabled: The data ingestion is disabled.', 'type' => 'string', 'example' => 'enabled', 'title' => ''],
+                                        'DataIngestionState' => ['description' => 'The state of the data ingestion. Valid values:'."\n"
+                                            ."\n"
+                                            .'- ingested'."\n"
+                                            ."\n"
+                                            .'- uningested'."\n"
+                                            ."\n"
+                                            .'- abnormal', 'type' => 'string', 'example' => 'ingested', 'title' => ''],
+                                        'DataSourceId' => ['description' => 'The ID of the data source.', 'type' => 'string', 'example' => 'ds-scpfegri73oyoknbc90c', 'title' => ''],
+                                        'NormalizationRuleId' => ['description' => 'The ID of the normalization rule.', 'type' => 'string', 'example' => 'nr-0aywiqdtaqdvwac7xkbjsf3a', 'title' => ''],
+                                        'StreamJobId' => ['description' => 'The job ID of the stream processing task.', 'type' => 'string', 'example' => '73a78aa245e3b1299d6ceed093de7bd8', 'title' => ''],
+                                        'CapacityCount' => ['description' => 'The number of associated security capabilities.', 'type' => 'integer', 'format' => 'int32', 'example' => '3', 'title' => ''],
+                                        'DataSourceEditable' => ['description' => 'Indicates whether the data source is editable.', 'type' => 'boolean', 'example' => 'true', 'title' => ''],
+                                        'NormalizationRuleEditable' => ['description' => 'Indicates whether the normalization rule is editable.', 'type' => 'boolean', 'example' => 'true', 'title' => ''],
+                                        'DataIngestionModeEditable' => ['description' => 'Indicates whether the data ingestion mode is editable.', 'type' => 'boolean', 'example' => 'true', 'title' => ''],
+                                        'DataIngestionTemplateId' => ['description' => 'The ID of the data ingestion template.', 'type' => 'string', 'example' => 'alibaba_cloud_sas_netstat_ingestion', 'title' => ''],
+                                        'RealtimeDataSourceId' => ['description' => 'The ID of the data source for real-time ingestion.', 'type' => 'string', 'example' => 'ds-scpfegri73oyoknbc90c', 'title' => ''],
+                                        'ScanDataSourceId' => ['description' => 'The ID of the data source for scan-based ingestion.', 'type' => 'string', 'example' => 'ds-scpfegri73oyoknbc90c', 'title' => ''],
+                                        'DataIngestionStateCode' => ['description' => 'The error code for the data ingestion anomaly.', 'type' => 'string', 'example' => 'UserUnauthorized', 'title' => ''],
+                                        'ActiveTime' => ['description' => 'The time when the data ingestion was enabled.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''],
+                                    ],
+                                    'title' => '',
+                                    'example' => '',
                                 ],
+                                'title' => '',
+                                'example' => '',
                             ],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"DataIngestions\\": [\\n    {\\n      \\"CreateTime\\": 1733269771123,\\n      \\"UpdateTime\\": 1733269771123,\\n      \\"DataIngestionId\\": \\"alibaba_cloud_sas_netstat_ingestion_173326*******\\",\\n      \\"DataIngestionType\\": \\"preset\\",\\n      \\"DataIngestionMode\\": \\"realtime\\",\\n      \\"DataIngestionStatus\\": \\"enabled\\",\\n      \\"DataIngestionState\\": \\"ingested\\",\\n      \\"DataSourceId\\": \\"ds-scpfegri73oyoknbc90c\\",\\n      \\"NormalizationRuleId\\": \\"nr-0aywiqdtaqdvwac7xkbjsf3a\\",\\n      \\"StreamJobId\\": \\"73a78aa245e3b1299d6ceed093de7bd8\\",\\n      \\"CapacityCount\\": 3,\\n      \\"DataSourceEditable\\": true,\\n      \\"NormalizationRuleEditable\\": true,\\n      \\"DataIngestionModeEditable\\": true,\\n      \\"DataIngestionTemplateId\\": \\"alibaba_cloud_sas_netstat_ingestion\\",\\n      \\"RealtimeDataSourceId\\": \\"ds-scpfegri73oyoknbc90c\\",\\n      \\"ScanDataSourceId\\": \\"ds-scpfegri73oyoknbc90c\\",\\n      \\"DataIngestionStateCode\\": \\"UserUnauthorized\\",\\n      \\"ActiveTime\\": 1733269771123\\n    }\\n  ]\\n}","type":"json"}]',
+            'title' => 'ListDataIngestions',
+            'description' => 'Each user receives up to two notifications per day, sent only between 08:00 and 20:00.',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ListDataIngestions',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DataIngestion', 'arn' => 'acs:yundun-sas::{#accountId}:dataingestion/*'],
+                        ],
+                    ],
+                ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"TrafficStatistics\\": [\\n    {\\n      \\"TrafficStatisticTarget\\": \\"all\\",\\n      \\"TrafficStatisticData\\": [\\n        {\\n          \\"TrafficStatisticTime\\": 20250815,\\n          \\"TrafficStatisticValue\\": 1.699814\\n        }\\n      ]\\n    }\\n  ]\\n}","type":"json"}]',
         ],
-        'ExecuteLogQuery' => [
-            'summary' => '查看LogStore',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'ListDataSetRecords' => [
+            'summary' => 'Retrieves a list of dataset records.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
@@ -6492,1199 +5893,1667 @@
             'operationType' => 'read',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'get',
+                'operationType' => 'list',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsasASHGE7'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The region of the data management center for Threat Analysis. Select the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- `cn-hangzhou`: For assets in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- `ap-southeast-1`: For assets in regions outside mainland China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
-                    ],
-                ],
-                [
-                    'name' => 'RoleFor',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese'."\n"
+                        ."\n"
+                        .'- **en**: English', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
-                    'name' => 'LogUserId',
+                    'name' => 'DataSetId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
+                    'schema' => ['description' => 'The ID of the dataset.', 'type' => 'string', 'required' => true, 'example' => 'dataset-nhcrmjpx1zsorlaq****', 'title' => ''],
                 ],
                 [
-                    'name' => 'LogRegionId',
+                    'name' => 'PageNumber',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The page number.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'minimum' => '1', 'example' => '1', 'title' => ''],
                 ],
                 [
-                    'name' => 'LogProjectName',
+                    'name' => 'PageSize',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'slsaudit-center-173326*******-cn-hangzhou',
-                    ],
+                    'schema' => ['description' => 'The number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'maximum' => '100', 'minimum' => '1', 'example' => '10', 'title' => ''],
                 ],
                 [
-                    'name' => 'LogStoreName',
+                    'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'huawei-cn-cfw',
-                    ],
+                    'schema' => ['description' => 'The user ID that an administrator can use to view data as another member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''],
                 ],
                 [
-                    'name' => 'LogQuery',
+                    'name' => 'MaxResults',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '*',
-                    ],
+                    'schema' => ['description' => 'The maximum number of results to return for each request when `NextToken` is used for pagination. Valid values: 1 to 100. Default value: 50.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '50', 'title' => ''],
                 ],
                 [
-                    'name' => 'ExtendContentPacked',
+                    'name' => 'NextToken',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '用于标识否将非标准字段打包到扩展字段extend_content,取值：'."\n"
-                            .'- "enabled" ：启用打包'."\n"
-                            .'- "disabled" ：不启用打包'."\n"
-                            .'默认："disabled"',
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                    ],
+                    'schema' => ['description' => 'The pagination token that is used in the next request to retrieve a new page of results.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
                 ],
                 [
-                    'name' => 'NormalizationSchemaId',
+                    'name' => 'Filter',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '如果启用打包，则需要指定NormalizationSchemaId',
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                    ],
+                    'schema' => ['description' => 'The filter conditions, specified as a JSON string. For example: {"field1":"value1","field2":"value2"}', 'type' => 'string', 'example' => '{"field1":"value1","field2":"value2"}', 'title' => '', 'required' => false],
                 ],
                 [
-                    'name' => 'StartTime',
+                    'name' => 'Order',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '1733269771123。',
-                    ],
+                    'schema' => ['description' => 'The sort order. Valid values:'."\n"
+                        ."\n"
+                        .'- "desc" (default)'."\n"
+                        ."\n"
+                        .'- "asc"', 'type' => 'string', 'example' => 'desc', 'title' => '', 'required' => false],
                 ],
                 [
-                    'name' => 'EndTime',
+                    'name' => 'OrderField',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '1733269771123。',
-                    ],
+                    'schema' => ['description' => 'The sort field. Valid values:'."\n"
+                        ."\n"
+                        .'- "updatetime" (default)'."\n"
+                        ."\n"
+                        .'- "createtime"', 'type' => 'string', 'example' => 'updatetime', 'title' => '', 'required' => false],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'Schema of Response',
-                        'description' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。',
-                            ],
-                            'QueryResult' => [
-                                'description' => '',
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', 'title' => ''],
+                            'DataSetRecords' => [
+                                'description' => 'A list of dataset records.',
                                 'type' => 'array',
                                 'items' => [
-                                    'description' => '',
-                                    'type' => 'any',
-                                    'example' => '[]。',
+                                    'description' => 'The dataset record.',
+                                    'type' => 'object',
+                                    'properties' => [
+                                        'CreateTime' => ['description' => 'The creation time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1658974643000', 'title' => ''],
+                                        'UpdateTime' => ['description' => 'The update time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1658974643000', 'title' => ''],
+                                        'DataSetId' => ['description' => 'The dataset ID.', 'type' => 'string', 'example' => 'dataset-t8ha6p7k61rmniqw****', 'title' => ''],
+                                        'DataSetName' => ['description' => 'The dataset name.', 'type' => 'string', 'example' => 'lmftest', 'title' => ''],
+                                        'DataSetRecordId' => ['description' => 'The dataset record ID.', 'type' => 'string', 'example' => '124566', 'title' => ''],
+                                        'DataSetRecordValues' => ['description' => 'The dataset record value.', 'type' => 'string', 'example' => '{"ip":"10.0.*.*/8","region":"shanghai"}', 'title' => ''],
+                                    ],
+                                    'title' => '',
+                                    'example' => '',
                                 ],
-                                'example' => '[]。',
-                            ],
+                                'title' => '',
+                                'example' => '',
+                            ],
+                            'PageNumber' => ['description' => 'The page number.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''],
+                            'PageSize' => ['description' => 'The number of entries to return on each page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10', 'title' => ''],
+                            'TotalCount' => ['description' => 'The total number of entries that match the query.', 'type' => 'integer', 'format' => 'int32', 'example' => '57', 'title' => ''],
+                            'MaxResults' => ['description' => 'The maximum number of results to return per page for token-based pagination. Valid values: 1 to 100. Default: 50.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''],
+                            'NextToken' => ['description' => 'The token to retrieve the next page of results.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n  \\"DataSetRecords\\": [\\n    {\\n      \\"CreateTime\\": 1658974643000,\\n      \\"UpdateTime\\": 1658974643000,\\n      \\"DataSetId\\": \\"dataset-t8ha6p7k61rmniqw****\\",\\n      \\"DataSetName\\": \\"lmftest\\",\\n      \\"DataSetRecordId\\": \\"124566\\",\\n      \\"DataSetRecordValues\\": \\"{\\\\\\"ip\\\\\\":\\\\\\"10.0.*.*/8\\\\\\",\\\\\\"region\\\\\\":\\\\\\"shanghai\\\\\\"}\\"\\n    }\\n  ],\\n  \\"PageNumber\\": 1,\\n  \\"PageSize\\": 10,\\n  \\"TotalCount\\": 57,\\n  \\"MaxResults\\": 50,\\n  \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\"\\n}","type":"json"}]',
+            'title' => 'ListDataSetRecords',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'list',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ListDataSetRecords',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"QueryResult\\": [\\n    \\"[]\\"\\n  ]\\n}","type":"json"}]',
         ],
-        'CreateNormalizationRule' => [
-            'summary' => '创建标准化规则',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'ListDataSets' => [
+            'summary' => 'Retrieves a list of datasets.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'write',
+            'operationType' => 'read',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'create',
+                'operationType' => 'list',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsasASHGE7'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The region where the Data Management Center for threat analysis is deployed. Select a region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
-                    'name' => 'RoleFor',
+                    'name' => 'DataSetId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
+                    'schema' => ['description' => 'The ID of the dataset.', 'type' => 'string', 'required' => false, 'example' => 'dataset-qt0n8246gs9nackg****', 'title' => ''],
                 ],
                 [
-                    'name' => 'NormalizationRuleName',
+                    'name' => 'DataSetName',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'normalization_rule_Z57np。',
-                    ],
+                    'schema' => ['description' => 'The name of the dataset.', 'type' => 'string', 'required' => false, 'example' => 'lmftest', 'title' => ''],
                 ],
                 [
-                    'name' => 'NormalizationRuleDescription',
+                    'name' => 'DataSetStatus',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'normalization_rule_Z57np。',
-                    ],
+                    'schema' => ['description' => 'The status of the dataset. Valid values:'."\n"
+                        ."\n"
+                        .'- 0: deleted.'."\n"
+                        ."\n"
+                        .'- 1: enabled.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '0', 'title' => ''],
                 ],
                 [
-                    'name' => 'NormalizationRuleFormat',
+                    'name' => 'OrderFieldName',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'SPL。',
-                    ],
+                    'schema' => ['description' => 'The field to use for sorting. Valid values:'."\n"
+                        ."\n"
+                        .'- GmtCreate: creation time.'."\n"
+                        ."\n"
+                        .'- GmtModified: update time.', 'type' => 'string', 'required' => false, 'example' => 'GmtCreate', 'title' => ''],
                 ],
                 [
-                    'name' => 'NormalizationRuleExpression',
+                    'name' => 'OrderDirection',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '* | pack-fields -include=\'[\\s\\S]+\' as extend_content。',
-                    ],
+                    'schema' => ['description' => 'The sort order. Valid values:'."\n"
+                        ."\n"
+                        .'- **asc** (default): ascending.'."\n"
+                        ."\n"
+                        .'- **desc**: descending.', 'type' => 'string', 'required' => false, 'example' => 'asc', 'title' => ''],
                 ],
                 [
-                    'name' => 'NormalizationCategoryId',
+                    'name' => 'PageNumber',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'NETWORK_CATEGORY。',
-                    ],
+                    'schema' => ['description' => 'The page number.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1', 'title' => ''],
                 ],
                 [
-                    'name' => 'NormalizationSchemaId',
+                    'name' => 'PageSize',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'HTTP_ACTIVITY。',
-                    ],
+                    'schema' => ['description' => 'The number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'maximum' => '100', 'minimum' => '1', 'example' => '10', 'title' => ''],
                 ],
                 [
-                    'name' => 'VendorId',
+                    'name' => 'DataSetIds',
                     'in' => 'formData',
+                    'style' => 'simple',
                     'schema' => [
-                        'description' => '',
-                        'type' => 'string',
+                        'description' => 'The list of dataset IDs.',
+                        'type' => 'array',
+                        'items' => ['description' => 'The list of dataset IDs.', 'type' => 'string', 'required' => false, 'example' => '["dataset-1lz4nf2x08mklchy****"]', 'title' => ''],
                         'required' => false,
-                        'example' => 'alibaba_cloud。',
+                        'maxItems' => 50,
+                        'title' => '',
+                        'example' => '',
                     ],
                 ],
                 [
-                    'name' => 'ProductId',
+                    'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'alibaba_cloud_sas。',
-                    ],
+                    'schema' => ['description' => 'The user ID that an administrator uses to switch to the perspective of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''],
                 ],
                 [
-                    'name' => 'NormalizationRuleMode',
+                    'name' => 'MaxResults',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The maximum number of results to return for the request. This parameter is used for queries that use NextToken. Valid values: 1 to 100. Default value: 50.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '50', 'title' => ''],
+                ],
+                [
+                    'name' => 'NextToken',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The token that is used to start the next query.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
+                ],
+                [
+                    'name' => 'DataSetType',
                     'in' => 'formData',
+                    'schema' => ['description' => 'The type of the dataset. Valid values:'."\n"
+                        ."\n"
+                        .'- custom: custom.'."\n"
+                        ."\n"
+                        .'- preset: predefined.', 'type' => 'string', 'required' => false, 'example' => 'custom', 'title' => ''],
+                ],
+            ],
+            'responses' => [
+                200 => [
                     'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'both。',
+                        'title' => 'Schema of Response',
+                        'description' => 'The response body.',
+                        'type' => 'object',
+                        'properties' => [
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '157CFBB5-B56F-566F-8991-B3C51799****', 'title' => ''],
+                            'DataSets' => [
+                                'description' => 'The list of datasets.',
+                                'type' => 'array',
+                                'items' => [
+                                    'type' => 'object',
+                                    'properties' => [
+                                        'CreateTime' => ['description' => 'The time when the dataset was created.', 'type' => 'integer', 'format' => 'int64', 'example' => '1713787368000', 'title' => ''],
+                                        'UpdateTime' => ['description' => 'The time when the dataset was updated.', 'type' => 'integer', 'format' => 'int64', 'example' => '1713787368000', 'title' => ''],
+                                        'DataSetId' => ['description' => 'The ID of the dataset.', 'type' => 'string', 'example' => 'dataset-t8ha6p7k61rmniqw****', 'title' => ''],
+                                        'DataSetName' => ['description' => 'The name of the dataset.', 'type' => 'string', 'example' => 'lmftest', 'title' => ''],
+                                        'DataSetDescription' => ['description' => 'The description of the dataset.', 'type' => 'string', 'example' => 'lmftest desc', 'title' => ''],
+                                        'DataSetFieldNames' => ['description' => 'The names of the fields in the dataset.', 'type' => 'string', 'example' => '["ip","region"]', 'title' => ''],
+                                        'DataSetFieldKeyName' => ['description' => 'The name of the unique key for the dataset.', 'type' => 'string', 'example' => 'ip', 'title' => ''],
+                                        'DataSetFileName' => ['description' => 'The name of the uploaded dataset file.', 'type' => 'string', 'example' => 'cloudsiem-dataset/1358117679873357_174338773****.csv', 'title' => ''],
+                                        'DataSetStatus' => ['description' => 'The status of the dataset. Valid values:'."\n"
+                                            ."\n"
+                                            .'- 0: deleted.'."\n"
+                                            ."\n"
+                                            .'- 1: enabled.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''],
+                                        'DataSetReferences' => [
+                                            'description' => 'The dataset references.',
+                                            'type' => 'array',
+                                            'items' => [
+                                                'type' => 'object',
+                                                'properties' => [
+                                                    'DataSetId' => ['description' => 'The ID of the dataset.', 'type' => 'string', 'example' => 'dataset-nhcrmjpx1zsorlaq****', 'title' => ''],
+                                                    'DataSetReferenceType' => ['description' => 'The type of the service that is associated with the dataset. Valid values:'."\n"
+                                                        ."\n"
+                                                        .'- custom\\_rule: custom rule.'."\n"
+                                                        ."\n"
+                                                        .'- playbook: playbook.', 'type' => 'string', 'example' => 'playbook', 'title' => ''],
+                                                    'DataSetReferenceId' => ['description' => 'The ID of the rule or playbook that is associated with the dataset.', 'type' => 'string', 'example' => '456232', 'title' => ''],
+                                                    'DataSetReferenceName' => ['description' => 'The name of the rule or playbook that is associated with the dataset.', 'type' => 'string', 'example' => 'playbook_name', 'title' => ''],
+                                                ],
+                                                'description' => 'The dataset reference.',
+                                                'title' => '',
+                                                'example' => '',
+                                            ],
+                                            'title' => '',
+                                            'example' => '',
+                                        ],
+                                        'DataSetType' => ['description' => 'The type of the dataset. Valid values:'."\n"
+                                            ."\n"
+                                            .'- custom: custom.'."\n"
+                                            ."\n"
+                                            .'- preset: predefined.', 'type' => 'string', 'example' => 'preset', 'title' => ''],
+                                        'IpWhitelistRecognizers' => [
+                                            'description' => 'The list of recognizers.',
+                                            'type' => 'array',
+                                            'items' => [
+                                                'type' => 'object',
+                                                'properties' => [
+                                                    'IpWhitelistRecognizerType' => ['description' => 'The type of IP address that the recognizer detects. Valid values:'."\n"
+                                                        ."\n"
+                                                        .'- sas\\_vulnerability\\_scanner\\_ip: Security Center web vulnerability scanner IP address.'."\n"
+                                                        ."\n"
+                                                        .'- waf\\_back\\_source\\_ip: Web Application Firewall back-to-origin IP address.'."\n"
+                                                        ."\n"
+                                                        .'- ddos\\_back\\_source\\_ip: Anti-DDoS back-to-origin IP address.'."\n"
+                                                        ."\n"
+                                                        .'- esa\\_back\\_source\\_ip: Edge Security Acceleration (ESA) back-to-origin node IP address.'."\n"
+                                                        ."\n"
+                                                        .'- ecs\\_public\\_ip: Elastic Compute Service (ECS) public IP address.'."\n"
+                                                        ."\n"
+                                                        .'- slb\\_public\\_ip: Server Load Balancer (SLB) public IP address.'."\n"
+                                                        ."\n"
+                                                        .'- vpc\\_eip: Elastic IP Address (EIP).'."\n"
+                                                        ."\n"
+                                                        .'- cdn\\_back\\_source\\_ip: Alibaba Cloud CDN back-to-origin IP address.'."\n"
+                                                        ."\n"
+                                                        .'- ga\\_back\\_source\\_ip: Global Accelerator (GA) back-to-origin IP address.', 'type' => 'string', 'example' => 'waf_back_source_ip', 'title' => ''],
+                                                    'AutoRecognizeStatus' => ['description' => 'The status of automatic detection. Valid values:'."\n"
+                                                        ."\n"
+                                                        .'- enabled: enabled.'."\n"
+                                                        ."\n"
+                                                        .'- disabled: disabled.', 'type' => 'string', 'example' => 'enabled', 'title' => ''],
+                                                    'RecognizeScope' => ['description' => 'The detection scope. Valid values:'."\n"
+                                                        ."\n"
+                                                        .'- current\\_account: current account only.'."\n"
+                                                        ."\n"
+                                                        .'- rd\\_accounts: multiple accounts.', 'type' => 'string', 'example' => 'current_account', 'title' => ''],
+                                                    'UpdateTime' => ['description' => 'The time when the dataset was updated.', 'type' => 'integer', 'format' => 'int64', 'example' => '1713787368000', 'title' => ''],
+                                                ],
+                                                'description' => 'The recognizer.',
+                                                'title' => '',
+                                                'example' => '',
+                                            ],
+                                            'title' => '',
+                                            'example' => '',
+                                        ],
+                                    ],
+                                    'description' => 'The dataset.',
+                                    'title' => '',
+                                    'example' => '',
+                                ],
+                                'title' => '',
+                                'example' => '',
+                            ],
+                            'PageNumber' => ['description' => 'The page number.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''],
+                            'PageSize' => ['description' => 'The number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10', 'title' => ''],
+                            'TotalCount' => ['description' => 'The total number of entries.', 'type' => 'integer', 'format' => 'int32', 'example' => '57', 'title' => ''],
+                            'MaxResults' => ['description' => 'The maximum number of results to return for the request. This parameter is used for queries that use NextToken. Valid values: 1 to 100. Default value: 50.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''],
+                            'NextToken' => ['description' => 'The token that is used to start the next query.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
+                        ],
+                        'example' => '',
+                    ],
+                ],
+            ],
+            'errorCodes' => [
+                400 => [
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
+                ],
+            ],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"157CFBB5-B56F-566F-8991-B3C51799****\\",\\n  \\"DataSets\\": [\\n    {\\n      \\"CreateTime\\": 1713787368000,\\n      \\"UpdateTime\\": 1713787368000,\\n      \\"DataSetId\\": \\"dataset-t8ha6p7k61rmniqw****\\",\\n      \\"DataSetName\\": \\"lmftest\\",\\n      \\"DataSetDescription\\": \\"lmftest desc\\",\\n      \\"DataSetFieldNames\\": \\"[\\\\\\"ip\\\\\\",\\\\\\"region\\\\\\"]\\",\\n      \\"DataSetFieldKeyName\\": \\"ip\\",\\n      \\"DataSetFileName\\": \\"cloudsiem-dataset/1358117679873357_174338773****.csv\\",\\n      \\"DataSetStatus\\": 1,\\n      \\"DataSetReferences\\": [\\n        {\\n          \\"DataSetId\\": \\"dataset-nhcrmjpx1zsorlaq****\\",\\n          \\"DataSetReferenceType\\": \\"playbook\\",\\n          \\"DataSetReferenceId\\": \\"456232\\",\\n          \\"DataSetReferenceName\\": \\"playbook_name\\"\\n        }\\n      ],\\n      \\"DataSetType\\": \\"preset\\",\\n      \\"IpWhitelistRecognizers\\": [\\n        {\\n          \\"IpWhitelistRecognizerType\\": \\"waf_back_source_ip\\",\\n          \\"AutoRecognizeStatus\\": \\"enabled\\",\\n          \\"RecognizeScope\\": \\"current_account\\",\\n          \\"UpdateTime\\": 1713787368000\\n        }\\n      ]\\n    }\\n  ],\\n  \\"PageNumber\\": 1,\\n  \\"PageSize\\": 10,\\n  \\"TotalCount\\": 57,\\n  \\"MaxResults\\": 50,\\n  \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\"\\n}","type":"json"}]',
+            'title' => 'ListDataSets',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'list',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ListDataSets',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DataSet', 'arn' => 'acs:yundun-sas::{#accountId}:dataset/*'],
+                        ],
                     ],
                 ],
+            ],
+        ],
+        'ListDataSourceTemplates' => [
+            'summary' => 'Queries data source templates.',
+            'path' => '',
+            'methods' => ['get', 'post'],
+            'schemes' => ['https'],
+            'security' => [
+                [
+                    'AK' => [],
+                ],
+            ],
+            'operationType' => 'read',
+            'deprecated' => false,
+            'systemTags' => [
+                'operationType' => 'list',
+                'riskType' => 'none',
+                'chargeType' => 'free',
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
+            ],
+            'parameters' => [
                 [
-                    'name' => 'ExtendContentPacked',
+                    'name' => 'DataSourceTemplateIds',
                     'in' => 'formData',
+                    'style' => 'simple',
                     'schema' => [
-                        'title' => '用于标识否将非标准字段打包到扩展字段extend_content,取值：'."\n"
-                            .'    - "enabled" ：启用打包'."\n"
-                            .'    - "disabled" ：不启用打包'."\n"
-                            .'    默认："disabled"',
-                        'description' => '',
-                        'type' => 'string',
+                        'description' => 'The list of data source template IDs.',
+                        'type' => 'array',
+                        'items' => ['description' => 'The list of data source template IDs.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_actiontrail_event_ingestion', 'title' => ''],
                         'required' => false,
+                        'minItems' => 0,
+                        'title' => '',
+                        'example' => '',
                     ],
                 ],
                 [
-                    'name' => 'NormalizationRuleType',
+                    'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'string',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
-                    'name' => 'OrderField',
+                    'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'string',
-                    ],
+                    'schema' => ['description' => 'The region of the Data Management center for threat analysis. Select a region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
-                    'name' => 'NormalizationRuleVersion',
+                    'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'integer',
-                        'format' => 'int32',
-                    ],
+                    'schema' => ['description' => 'The user ID of a member. An administrator can switch to the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
                 [
-                    'name' => 'NormalizationRuleIds',
+                    'name' => 'PageNumber',
                     'in' => 'formData',
-                    'style' => 'json',
-                    'schema' => [
-                        'type' => 'array',
-                        'items' => [
-                            'type' => 'string',
-                        ],
-                    ],
+                    'schema' => ['description' => 'The page number.', 'type' => 'string', 'required' => false, 'example' => '1', 'title' => ''],
                 ],
                 [
-                    'name' => 'ExtendFieldStoreMode',
+                    'name' => 'PageSize',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '扩展字段存储模式，可选项：flat、pack、reject。',
-                        'type' => 'string',
-                        'example' => 'flat',
-                    ],
+                    'schema' => ['description' => 'The number of entries per page.', 'type' => 'string', 'required' => false, 'example' => '10', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'Schema of Response',
-                        'description' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'title' => 'Id of the request',
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。',
-                            ],
-                            'NormalizationRuleId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => 'nr-z0b2ssjteut85uoh9nzp。',
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''],
+                            'DataSourceTemplates' => [
+                                'description' => 'The list of data source templates.',
+                                'type' => 'array',
+                                'items' => [
+                                    'description' => 'The data source template.',
+                                    'type' => 'object',
+                                    'properties' => [
+                                        'CreateTime' => ['description' => 'The time when the template was created.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''],
+                                        'DataSourceTemplateId' => ['description' => 'The ID of the data source template.', 'type' => 'string', 'example' => 'alibaba_cloud_actiontrail_event_ingestion', 'title' => ''],
+                                        'DataSourceTemplateName' => ['description' => 'The name of the data source template.', 'type' => 'string', 'example' => 'alibaba_cloud_actiontrail_event_ingestion', 'title' => ''],
+                                        'LogProjectPattern' => ['description' => 'The rule for matching the name of the Simple Log Service project.', 'type' => 'string', 'example' => 'aliyun-cloudsiem-data-173326*******', 'title' => ''],
+                                        'LogRegionIds' => [
+                                            'description' => 'The list of log storage region IDs.',
+                                            'type' => 'array',
+                                            'items' => ['description' => 'The log storage region ID.', 'type' => 'string', 'example' => 'cn-hangzhou', 'title' => ''],
+                                            'title' => '',
+                                            'example' => '',
+                                        ],
+                                        'LogStorePattern' => ['description' => 'The rule for matching the name of the Simple Log Service Logstore.', 'type' => 'string', 'example' => 'audit-activity', 'title' => ''],
+                                        'LogUserIds' => [
+                                            'description' => 'The list of user IDs for batch data ingestion.',
+                                            'type' => 'array',
+                                            'items' => ['description' => 'The user ID for batch data ingestion.', 'type' => 'string', 'example' => '173326*******', 'title' => ''],
+                                            'title' => '',
+                                            'example' => '',
+                                        ],
+                                        'UpdateTime' => ['description' => 'The time when the template was updated.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''],
+                                        'DataSourceFrom' => ['description' => 'The source of the data. Valid values:'."\n"
+                                            ."\n"
+                                            .'- center'."\n"
+                                            ."\n"
+                                            .'- custom', 'type' => 'string', 'example' => 'custom', 'title' => ''],
+                                        'AutoScanNew' => ['description' => 'Indicates whether to automatically discover new users. Valid values:'."\n"
+                                            ."\n"
+                                            .'- enabled: enabled.'."\n"
+                                            ."\n"
+                                            .'- disabled: disabled.', 'type' => 'string', 'example' => 'enabled', 'title' => ''],
+                                        'DataSourceRecognizer' => ['description' => 'The data source recognizer.', 'type' => 'string', 'example' => 'alibaba_cloud_actiontrail_event_ingestion', 'title' => ''],
+                                        'DataSourceRecognizeEnabled' => ['description' => 'Indicates whether to automatically discover new data sources.', 'type' => 'boolean', 'example' => 'true', 'title' => ''],
+                                    ],
+                                    'title' => '',
+                                    'example' => '',
+                                ],
+                                'title' => '',
+                                'example' => '',
                             ],
+                            'PageNumber' => ['description' => 'The page number.', 'type' => 'string', 'example' => '1', 'title' => ''],
+                            'PageSize' => ['description' => 'The number of entries per page.', 'type' => 'string', 'example' => '10', 'title' => ''],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
-            'errorCodes' => [
-                400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"DataSourceTemplates\\": [\\n    {\\n      \\"CreateTime\\": 1733269771123,\\n      \\"DataSourceTemplateId\\": \\"alibaba_cloud_actiontrail_event_ingestion\\",\\n      \\"DataSourceTemplateName\\": \\"alibaba_cloud_actiontrail_event_ingestion\\",\\n      \\"LogProjectPattern\\": \\"aliyun-cloudsiem-data-173326*******\\",\\n      \\"LogRegionIds\\": [\\n        \\"cn-hangzhou\\"\\n      ],\\n      \\"LogStorePattern\\": \\"audit-activity\\",\\n      \\"LogUserIds\\": [\\n        \\"173326*******\\"\\n      ],\\n      \\"UpdateTime\\": 1733269771123,\\n      \\"DataSourceFrom\\": \\"custom\\",\\n      \\"AutoScanNew\\": \\"enabled\\",\\n      \\"DataSourceRecognizer\\": \\"alibaba_cloud_actiontrail_event_ingestion\\",\\n      \\"DataSourceRecognizeEnabled\\": true\\n    }\\n  ],\\n  \\"PageNumber\\": \\"1\\",\\n  \\"PageSize\\": \\"10\\"\\n}","type":"json"}]',
+            'title' => 'ListDataSourceTemplates',
+            'description' => 'Notifications are limited by frequency and time. Each user receives a maximum of two notifications per day between 08:00 and 20:00.',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'list',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ListDataSourceTemplates',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DataSourceTemplate', 'arn' => 'acs:yundun-sas::{#accountId}:datasourcetemplate/*'],
+                        ],
                     ],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"NormalizationRuleId\\": \\"nr-z0b2ssjteut85uoh9nzp\\"\\n}","type":"json"}]',
         ],
-        'UpdateNormalizationRule' => [
-            'summary' => '更新标准化规则',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'ListDataSources' => [
+            'summary' => 'Lists data sources.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'write',
+            'operationType' => 'read',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'update',
+                'operationType' => 'list',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The region where the Data Management Center of your threat analysis feature is located. Select a region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member. You can use this parameter to switch the perspective to a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
                 [
-                    'name' => 'NormalizationRuleId',
+                    'name' => 'DataSourceIds',
                     'in' => 'formData',
+                    'style' => 'simple',
                     'schema' => [
-                        'description' => '',
-                        'type' => 'string',
+                        'description' => 'The IDs of the data sources.',
+                        'type' => 'array',
+                        'items' => ['description' => 'The ID of the data source.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_waf_alert_log_173326*******,alibaba_cloud_waf_flow_log_173326*******', 'title' => ''],
                         'required' => false,
-                        'example' => 'nr-z0b2ssjteut85uoh9nzp。',
+                        'title' => '',
+                        'example' => '',
                     ],
                 ],
                 [
-                    'name' => 'NormalizationRuleName',
+                    'name' => 'DataSourceName',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'normalization_rule_Z57np。',
-                    ],
+                    'schema' => ['description' => 'The name of the data source.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_waf_alert_log', 'title' => ''],
                 ],
                 [
-                    'name' => 'NormalizationRuleDescription',
+                    'name' => 'DataSourceType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'normalization_rule_Z57np。',
-                    ],
+                    'schema' => ['description' => 'The type of the data source. Valid values:'."\n"
+                        ."\n"
+                        .'- preset'."\n"
+                        ."\n"
+                        .'- custom', 'type' => 'string', 'required' => false, 'example' => 'custom', 'title' => ''],
                 ],
                 [
-                    'name' => 'NormalizationRuleFormat',
+                    'name' => 'LogUserIds',
                     'in' => 'formData',
+                    'style' => 'simple',
                     'schema' => [
-                        'description' => '',
-                        'type' => 'string',
+                        'description' => 'The IDs of the users who can access the data.',
+                        'type' => 'array',
+                        'items' => ['description' => 'The ID of the user who can access the data.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                         'required' => false,
-                        'example' => 'SPL。',
+                        'title' => '',
+                        'example' => '',
                     ],
                 ],
                 [
-                    'name' => 'NormalizationRuleExpression',
+                    'name' => 'LogRegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '* | pack-fields -include=\'[\\s\\S]+\' as extend_content。',
-                    ],
+                    'schema' => ['description' => 'The ID of the log storage region.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
-                    'name' => 'NormalizationSchemaId',
+                    'name' => 'LogProjectName',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'HTTP_ACTIVITY。',
-                    ],
+                    'schema' => ['description' => 'The name of the Simple Log Service project.', 'type' => 'string', 'required' => false, 'example' => 'aliyun-cloudsiem-data-173326*******-cn-hangzhou', 'title' => ''],
                 ],
                 [
-                    'name' => 'VendorId',
+                    'name' => 'LogStoreName',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'alibaba_cloud。',
-                    ],
+                    'schema' => ['description' => 'The name of the Simple Log Service Logstore.', 'type' => 'string', 'required' => false, 'example' => 'audit-activity', 'title' => ''],
                 ],
                 [
-                    'name' => 'ProductId',
+                    'name' => 'DataSourceTemplateIds',
                     'in' => 'formData',
+                    'style' => 'simple',
                     'schema' => [
-                        'description' => '',
-                        'type' => 'string',
+                        'description' => 'The IDs of the data source templates.',
+                        'type' => 'array',
+                        'items' => ['description' => 'The ID of the data source template.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_sas_account_snapshot_log_173326*******', 'title' => ''],
                         'required' => false,
-                        'example' => 'alibaba_cloud_sas。',
+                        'title' => '',
+                        'example' => '',
                     ],
                 ],
                 [
-                    'name' => 'NormalizationRuleMode',
+                    'name' => 'OrderField',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'both。',
-                    ],
+                    'schema' => ['description' => 'The sorting field.', 'type' => 'string', 'required' => false, 'example' => 'UpdateTime', 'title' => ''],
                 ],
                 [
-                    'name' => 'ExtendContentPacked',
+                    'name' => 'Order',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '用于标识否将非标准字段打包到扩展字段extend_content,取值：'."\n"
-                            .'- "enabled" ：启用打包'."\n"
-                            .'- "disabled" ：不启用打包'."\n"
-                            .'默认："disabled"',
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                    ],
+                    'schema' => ['description' => 'The sorting order. Valid values:'."\n"
+                        ."\n"
+                        .'- desc'."\n"
+                        ."\n"
+                        .'- asc', 'type' => 'string', 'required' => false, 'example' => 'desc', 'title' => ''],
                 ],
                 [
-                    'name' => 'OrderField',
+                    'name' => 'PageNumber',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'string',
-                    ],
+                    'schema' => ['description' => 'The page number.', 'type' => 'string', 'required' => false, 'example' => '1', 'title' => ''],
                 ],
                 [
-                    'name' => 'NormalizationRuleType',
+                    'name' => 'PageSize',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'string',
-                    ],
+                    'schema' => ['description' => 'The number of entries per page.', 'type' => 'string', 'required' => false, 'example' => '5', 'title' => ''],
                 ],
                 [
-                    'name' => 'NormalizationRuleIds',
+                    'name' => 'MaxResults',
                     'in' => 'formData',
-                    'style' => 'json',
-                    'schema' => [
-                        'type' => 'array',
-                        'items' => [
-                            'type' => 'string',
-                        ],
-                    ],
+                    'schema' => ['description' => 'The maximum number of entries to return for a single request.', 'type' => 'integer', 'format' => 'int32', 'minimum' => '0', 'required' => false, 'example' => '50', 'title' => ''],
                 ],
                 [
-                    'name' => 'ExtendFieldStoreMode',
+                    'name' => 'NextToken',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '扩展字段存储模式，可选项：flat、pack、reject。',
-                        'type' => 'string',
-                        'example' => 'flat',
-                    ],
+                    'schema' => ['description' => 'The token that is used to retrieve the next page of results. Set this parameter to the value of NextToken that is returned in the response to the previous query. Leave this parameter empty for the first query.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
                 ],
                 [
-                    'name' => 'NormalizationCategoryId',
+                    'name' => 'DataSourceFrom',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'NETWORK_CATEGORY。',
-                        'title' => '所属标准化类目',
-                    ],
+                    'schema' => ['description' => 'The source of the data. Valid values:'."\n"
+                        ."\n"
+                        .'- center'."\n"
+                        ."\n"
+                        .'- custom', 'type' => 'string', 'required' => false, 'example' => 'center', 'title' => ''],
+                ],
+                [
+                    'name' => 'DataSourceStoreStatus',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The status of the Logstore. Valid values:'."\n"
+                        ."\n"
+                        .'- normal'."\n"
+                        ."\n"
+                        .'- abnormal', 'type' => 'string', 'required' => false, 'example' => 'normal', 'title' => ''],
+                ],
+                [
+                    'name' => 'DataSourceStatus',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The status of the data source. Valid values:'."\n"
+                        ."\n"
+                        .'- unconfigured'."\n"
+                        ."\n"
+                        .'- normal'."\n"
+                        ."\n"
+                        .'- abnormal', 'type' => 'string', 'required' => false, 'example' => 'unconfigured', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'Schema of Response',
-                        'description' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'title' => 'Id of the request',
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。',
-                            ],
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''],
+                            'DataSources' => [
+                                'description' => 'The data sources.',
+                                'type' => 'array',
+                                'items' => [
+                                    'description' => 'The data sources.',
+                                    'type' => 'object',
+                                    'properties' => [
+                                        'CreateTime' => ['description' => 'The time when the data source was created.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''],
+                                        'UpdateTime' => ['description' => 'The time when the data source was last updated.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''],
+                                        'DataSourceId' => ['description' => 'The ID of the data source.', 'type' => 'string', 'example' => 'ds-scpfegri73oyoknbc90c', 'title' => ''],
+                                        'DataSourceName' => ['description' => 'The name of the data source.', 'type' => 'string', 'example' => 'AD_LOG', 'title' => ''],
+                                        'DataSourceType' => ['description' => 'The type of the data source. Valid values:'."\n"
+                                            ."\n"
+                                            .'- preset'."\n"
+                                            ."\n"
+                                            .'- custom', 'type' => 'string', 'example' => 'custom', 'title' => ''],
+                                        'LogUserId' => ['description' => 'The ID of the user who can access the data.', 'type' => 'integer', 'format' => 'int64', 'example' => '173326*******', 'title' => ''],
+                                        'LogRegionId' => ['description' => 'The ID of the log storage region.', 'type' => 'string', 'example' => 'cn-hangzhou', 'title' => ''],
+                                        'LogProjectName' => ['description' => 'The name of the Simple Log Service project.', 'type' => 'string', 'example' => 'aliyun-cloudsiem-data-173326*******-cn-hangzhou', 'title' => ''],
+                                        'DataSourceFrom' => ['description' => 'The source of the data. Valid values:'."\n"
+                                            ."\n"
+                                            .'- center'."\n"
+                                            ."\n"
+                                            .'- custom', 'type' => 'string', 'example' => 'center', 'title' => ''],
+                                        'LogStoreName' => ['description' => 'The name of the Simple Log Service Logstore.', 'type' => 'string', 'example' => 'audit-activity', 'title' => ''],
+                                        'DataSourceTemplateId' => ['description' => 'The ID of the data source template.', 'type' => 'string', 'example' => 'alibaba_cloud_sas_account_snapshot_log_173326*******', 'title' => ''],
+                                        'DataSourceStores' => [
+                                            'description' => 'The list of Logstores.',
+                                            'type' => 'array',
+                                            'items' => [
+                                                'description' => 'The Logstore.',
+                                                'type' => 'object',
+                                                'properties' => [
+                                                    'DataSourceStoreId' => ['description' => 'The ID of the log storage.', 'type' => 'string', 'example' => 'di_xxxx_source_1', 'title' => ''],
+                                                    'DataSourceStoreStatus' => ['description' => 'The status of the log storage. Valid values:'."\n"
+                                                        ."\n"
+                                                        .'- normal'."\n"
+                                                        ."\n"
+                                                        .'- abnormal', 'type' => 'string', 'title' => '', 'example' => 'normal'],
+                                                    'DataSourceStoreFrom' => ['description' => 'The source of the data. Valid values:'."\n"
+                                                        ."\n"
+                                                        .'- center'."\n"
+                                                        ."\n"
+                                                        .'- custom', 'type' => 'string', 'example' => 'center', 'title' => ''],
+                                                    'LogRegionId' => ['description' => 'The ID of the log storage region.', 'type' => 'string', 'example' => 'cn-hangzhou', 'title' => ''],
+                                                    'LogProjectName' => ['description' => 'The name of the Simple Log Service project.', 'type' => 'string', 'example' => 'aliyun-cloudsiem-data-173326*******-cn-hangzhou', 'title' => ''],
+                                                    'LogStoreName' => ['description' => 'The name of the Simple Log Service Logstore.', 'type' => 'string', 'example' => 'audit-activity', 'title' => ''],
+                                                    'CreateTime' => ['description' => 'The time when the log storage was created.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''],
+                                                    'UpdateTime' => ['description' => 'The time when the log storage was last updated.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''],
+                                                    'CheckTime' => ['description' => 'The time when the check was performed.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''],
+                                                    'DataSourceStoreStatusCode' => ['description' => 'The status code of the log storage.', 'type' => 'string', 'example' => 'LogStoreNotExist', 'title' => ''],
+                                                ],
+                                                'title' => '',
+                                                'example' => '',
+                                            ],
+                                            'title' => '',
+                                            'example' => '',
+                                        ],
+                                        'DataSourceRecognizer' => ['description' => 'The data source recognizer.', 'type' => 'string', 'example' => 'alibaba_cloud_sas_account_snapshot', 'title' => ''],
+                                        'DataSourceRecognizeEnabled' => ['description' => 'Indicates whether new Logstores are automatically discovered.', 'type' => 'boolean', 'example' => 'true', 'title' => ''],
+                                        'DataSourceReferences' => [
+                                            'description' => 'The list of data ingestion IDs that are associated with the data source.',
+                                            'type' => 'array',
+                                            'items' => [
+                                                'description' => 'The data ingestion ID that is associated with the data source.',
+                                                'type' => 'object',
+                                                'properties' => [
+                                                    'DataIngestionId' => ['description' => 'The data ingestion ID.', 'type' => 'string', 'example' => 'alibaba_cloud_sas_account_snapshot_log_173326*******', 'title' => ''],
+                                                ],
+                                                'title' => '',
+                                                'example' => '',
+                                            ],
+                                            'title' => '',
+                                            'example' => '',
+                                        ],
+                                        'DataSourceStatus' => ['description' => 'The status of the data source. Valid values:'."\n"
+                                            ."\n"
+                                            .'- unconfigured'."\n"
+                                            ."\n"
+                                            .'- normal'."\n"
+                                            ."\n"
+                                            .'- abnormal', 'type' => 'string', 'example' => 'unconfigured', 'title' => ''],
+                                    ],
+                                    'title' => '',
+                                    'example' => '',
+                                ],
+                                'title' => '',
+                                'example' => '',
+                            ],
+                            'PageNumber' => ['description' => 'The page number.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''],
+                            'PageSize' => ['description' => 'The number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''],
+                            'TotalCount' => ['description' => 'The total number of entries returned.', 'type' => 'integer', 'format' => 'int32', 'example' => '2', 'title' => ''],
+                            'TotalPage' => ['description' => 'The total number of pages.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''],
+                            'MaxResults' => ['description' => 'The maximum number of entries returned on each page.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''],
+                            'NextToken' => ['description' => 'The token that is used to retrieve the next page of results. If a value is returned, it indicates that not all results have been returned. You can use this token in the next query to continue retrieving results.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"DataSources\\": [\\n    {\\n      \\"CreateTime\\": 1733269771123,\\n      \\"UpdateTime\\": 1733269771123,\\n      \\"DataSourceId\\": \\"ds-scpfegri73oyoknbc90c\\",\\n      \\"DataSourceName\\": \\"AD_LOG\\",\\n      \\"DataSourceType\\": \\"custom\\",\\n      \\"LogUserId\\": 0,\\n      \\"LogRegionId\\": \\"cn-hangzhou\\",\\n      \\"LogProjectName\\": \\"aliyun-cloudsiem-data-173326*******-cn-hangzhou\\",\\n      \\"DataSourceFrom\\": \\"center\\",\\n      \\"LogStoreName\\": \\"audit-activity\\",\\n      \\"DataSourceTemplateId\\": \\"alibaba_cloud_sas_account_snapshot_log_173326*******\\",\\n      \\"DataSourceStores\\": [\\n        {\\n          \\"DataSourceStoreId\\": \\"di_xxxx_source_1\\",\\n          \\"DataSourceStoreStatus\\": \\"normal\\",\\n          \\"DataSourceStoreFrom\\": \\"center\\",\\n          \\"LogRegionId\\": \\"cn-hangzhou\\",\\n          \\"LogProjectName\\": \\"aliyun-cloudsiem-data-173326*******-cn-hangzhou\\",\\n          \\"LogStoreName\\": \\"audit-activity\\",\\n          \\"CreateTime\\": 1733269771123,\\n          \\"UpdateTime\\": 1733269771123,\\n          \\"CheckTime\\": 1733269771123,\\n          \\"DataSourceStoreStatusCode\\": \\"LogStoreNotExist\\"\\n        }\\n      ],\\n      \\"DataSourceRecognizer\\": \\"alibaba_cloud_sas_account_snapshot\\",\\n      \\"DataSourceRecognizeEnabled\\": true,\\n      \\"DataSourceReferences\\": [\\n        {\\n          \\"DataIngestionId\\": \\"alibaba_cloud_sas_account_snapshot_log_173326*******\\"\\n        }\\n      ],\\n      \\"DataSourceStatus\\": \\"unconfigured\\"\\n    }\\n  ],\\n  \\"PageNumber\\": 1,\\n  \\"PageSize\\": 1,\\n  \\"TotalCount\\": 2,\\n  \\"TotalPage\\": 1,\\n  \\"MaxResults\\": 50,\\n  \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\"\\n}","type":"json"}]',
+            'title' => 'ListDataSources',
+            'description' => 'Notifications are subject to frequency and time limits. A maximum of two notifications are sent to each user per day, and only between 08:00 and 20:00.',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'list',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ListDataSources',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DataSource', 'arn' => 'acs:yundun-sas::{#accountId}:datasource/*'],
+                        ],
+                    ],
+                ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
         ],
-        'DeleteNormalizationRule' => [
-            'summary' => '删除标准化规则',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'ListDetectionRules' => [
+            'summary' => 'Retrieves a list of detection rules.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'write',
+            'operationType' => 'read',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'delete',
+                'operationType' => 'list',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsasASHGE7'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The region where the Data Management center of threat analysis is located. Select a region based on the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
+                ],
+                [
+                    'name' => 'DetectionRuleName',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The name of the detection rule.', 'type' => 'string', 'required' => false, 'example' => 'Detect Discovery Behavior for Local Systems Groups', 'title' => ''],
+                ],
+                [
+                    'name' => 'DetectionRuleId',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The ID of the detection rule.', 'type' => 'string', 'required' => false, 'example' => 'dr-ppa85gfw69tgwkys****', 'title' => ''],
+                ],
+                [
+                    'name' => 'DetectionRuleIds',
+                    'in' => 'formData',
+                    'style' => 'simple',
                     'schema' => [
-                        'description' => '',
-                        'type' => 'string',
+                        'description' => 'The list of detection rule IDs.',
+                        'type' => 'array',
+                        'items' => ['description' => 'The ID of the detection rule.', 'type' => 'string', 'required' => false, 'example' => 'dr-ppa85gfw69tgwkys****'."\n", 'title' => ''],
                         'required' => false,
-                        'example' => 'zh。',
+                        'title' => '',
+                        'example' => '',
                     ],
                 ],
                 [
+                    'name' => 'DetectionRuleType',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The type of the detection rule. Valid values:'."\n"
+                        ."\n"
+                        .'- preset: a built-in detection rule.'."\n"
+                        ."\n"
+                        .'- custom: a custom detection rule.'."\n"
+                        ."\n"
+                        .'- custom\\_template: a rule template.', 'type' => 'string', 'required' => false, 'example' => 'preset', 'title' => ''],
+                ],
+                [
+                    'name' => 'DetectionRuleStatus',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The status of the detection rule.', 'type' => 'string', 'required' => false, 'example' => 'enabled', 'title' => ''],
+                ],
+                [
+                    'name' => 'AlertType',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The alert type.', 'type' => 'string', 'required' => false, 'example' => 'siem_rule_type_alert_storm', 'title' => ''],
+                ],
+                [
+                    'name' => 'AlertLevel',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The threat level of the alert. Valid values:'."\n"
+                        ."\n"
+                        .'- 5: critical.'."\n"
+                        ."\n"
+                        .'- 4: important.'."\n"
+                        ."\n"
+                        .'- 3: medium.'."\n"
+                        ."\n"
+                        .'- 2: low.'."\n"
+                        ."\n"
+                        .'- 1: informational.', 'type' => 'string', 'required' => false, 'example' => '1', 'title' => ''],
+                ],
+                [
+                    'name' => 'AlertTacticId',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The alert tactic phase.', 'type' => 'string', 'required' => false, 'example' => 'TA0042', 'title' => ''],
+                ],
+                [
+                    'name' => 'AlertAttCk',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The ATT\\&CK technique of the alert.', 'type' => 'string', 'required' => false, 'example' => 'Discovery', 'title' => ''],
+                ],
+                [
+                    'name' => 'IncidentAggregationType',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The event aggregation type. Valid values:'."\n"
+                        ."\n"
+                        .'- none: No events are generated.'."\n"
+                        ."\n"
+                        .'- graph\\_compute: graph computing (supported by predefined rules).'."\n"
+                        ."\n"
+                        .'- expert: expert rule.'."\n"
+                        ."\n"
+                        .'- passthrough: alert passthrough (one-to-one).'."\n"
+                        ."\n"
+                        .'- window: aggregation of similar alerts (by window).', 'type' => 'string', 'required' => false, 'example' => 'graph_compute', 'title' => ''],
+                ],
+                [
+                    'name' => 'LogCategoryId',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The ID of the log normalization category.', 'type' => 'string', 'required' => false, 'example' => 'NETWORK_CATEGORY', 'title' => ''],
+                ],
+                [
+                    'name' => 'LogSchemaId',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The ID of the log normalization schema.', 'type' => 'string', 'required' => false, 'example' => 'API_RISK_ACTIVITY', 'title' => ''],
+                ],
+                [
+                    'name' => 'DetectionExpressionType',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The type of the detection rule expression.', 'type' => 'string', 'required' => false, 'example' => 'playbook', 'title' => ''],
+                ],
+                [
+                    'name' => 'OrderFieldName',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The field to sort by. Valid values:'."\n"
+                        ."\n"
+                        .'- GmtCreate: the creation time.'."\n"
+                        ."\n"
+                        .'- GmtModified: the update time.', 'type' => 'string', 'required' => false, 'example' => 'GmtModified', 'title' => ''],
+                ],
+                [
+                    'name' => 'OrderDirection',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The sort order. Valid values:'."\n"
+                        ."\n"
+                        .'- **asc**: ascending order. This is the default value.'."\n"
+                        ."\n"
+                        .'- **desc**: descending order.', 'type' => 'string', 'required' => false, 'example' => 'asc', 'title' => ''],
+                ],
+                [
+                    'name' => 'PageNumber',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The pagination parameter. This specifies the current page number.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'minimum' => '1', 'example' => '1', 'title' => ''],
+                ],
+                [
+                    'name' => 'PageSize',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The pagination parameter. This specifies the number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'maximum' => '100', 'minimum' => '1', 'example' => '100', 'title' => ''],
+                ],
+                [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
+                    'schema' => ['description' => 'The user ID that the administrator uses to switch to the perspective of another member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''],
                 ],
                 [
-                    'name' => 'NormalizationRuleId',
+                    'name' => 'MaxResults',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'nr-z0b2ssjteut85uoh9nzp。',
-                    ],
+                    'schema' => ['description' => 'The maximum number of data entries to read.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '50', 'title' => ''],
+                ],
+                [
+                    'name' => 'NextToken',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The token that is used to start the next query.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'Schema of Response',
-                        'description' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。',
-                            ],
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '508DCFFD-4508-54BF-A8A0-E97A0FA6****', 'title' => ''],
+                            'DetectionRules' => [
+                                'description' => 'The list of detection rules.',
+                                'type' => 'array',
+                                'items' => [
+                                    'type' => 'object',
+                                    'properties' => [
+                                        'CreateTime' => ['description' => 'The creation time.', 'type' => 'integer', 'format' => 'int64', 'example' => '2023-03-21 13:47:01', 'title' => ''],
+                                        'UpdateTime' => ['description' => 'The update time.', 'type' => 'integer', 'format' => 'int64', 'example' => '2023-04-16 10:51:00', 'title' => ''],
+                                        'DetectionRuleId' => ['description' => 'The ID of the detection rule.', 'type' => 'string', 'example' => 'jndi-attack-success_http_netstat', 'title' => ''],
+                                        'DetectionRuleName' => ['description' => 'The name of the detection rule.', 'type' => 'string', 'example' => 'Detect Discovery Behavior for Local Systems Groups'."\n", 'title' => ''],
+                                        'DetectionRuleDescription' => ['description' => 'The description of the detection rule.', 'type' => 'string', 'example' => 'Check the enumeration behavior of local system groups. An attacker may attempt to find the Local Systems group and its permission settings.', 'title' => ''],
+                                        'DetectionRuleType' => ['description' => 'The type of the detection rule. Valid values:'."\n"
+                                            ."\n"
+                                            .'- preset: a built-in detection rule.'."\n"
+                                            ."\n"
+                                            .'- custom: a custom detection rule.'."\n"
+                                            ."\n"
+                                            .'- custom\\_template: a rule template.', 'type' => 'string', 'example' => 'custom', 'title' => ''],
+                                        'DetectionRuleStatus' => ['description' => 'The status of the detection rule. Valid values:'."\n"
+                                            ."\n"
+                                            .'- enabled: The rule is enabled.'."\n"
+                                            ."\n"
+                                            .'- disabled: The rule is disabled.'."\n"
+                                            ."\n"
+                                            .'- testing: The rule is being tested.', 'type' => 'string', 'example' => 'enabled', 'title' => ''],
+                                        'DetectionExpressionType' => ['description' => 'The type of the detection rule expression.', 'type' => 'string', 'example' => 'playbook', 'title' => ''],
+                                        'DetectionExpressionContent' => ['description' => 'The content of the detection rule expression.', 'type' => 'string', 'example' => '*|set session mode=scan;SELECT * FROM log'."\n"
+                                            .'WHERE schema = \'PROCESS_START_ACTIVITY\''."\n"
+                                            .'AND ('."\n"
+                                            .'    proc_path LIKE \'%/groups\''."\n"
+                                            .'    OR ('."\n"
+                                            .'        ('."\n"
+                                            .'            proc_path LIKE \'%/cat\''."\n"
+                                            .'            OR proc_path LIKE \'%/head\''."\n"
+                                            .'            OR proc_path LIKE \'%/tail\''."\n"
+                                            .'            OR proc_path LIKE \'%/more\''."\n"
+                                            .'        )'."\n"
+                                            .'        AND cmdline LIKE \'%/etc/group%\''."\n"
+                                            .'    )'."\n"
+                                            .')', 'title' => ''],
+                                        'LogCategoryId' => ['description' => 'The ID of the log normalization category.', 'type' => 'string', 'example' => 'NETWORK_CATEGORY', 'title' => ''],
+                                        'LogSchemaId' => ['description' => 'The ID of the log normalization schema.', 'type' => 'string', 'example' => 'API_RISK_ACTIVITY', 'title' => ''],
+                                        'AlertSchemaId' => ['description' => 'The ID of the alert template for the detection rule. Valid values:'."\n"
+                                            ."\n"
+                                            .'- ALERT\\_ACTIVITY: other alerts.'."\n"
+                                            ."\n"
+                                            .'- EDR\\_ALERT\\_ACTIVITY: Endpoint Detection and Response (EDR) alerts.'."\n"
+                                            ."\n"
+                                            .'- FIREWALL\\_ALERT\\_ACTIVITY: firewall alerts.'."\n"
+                                            ."\n"
+                                            .'- WAF\\_ALERT\\_ACTIVITY: Web Application Firewall (WAF) alerts.', 'type' => 'string', 'example' => 'ALERT_ACTIVITY', 'title' => ''],
+                                        'ScheduleType' => ['description' => 'The scheduling type. Valid values:'."\n"
+                                            ."\n"
+                                            .'- fixed\\_rate: fixed interval'."\n"
+                                            ."\n"
+                                            .'- cron: cron expression', 'type' => 'string', 'example' => 'fixed_rate', 'title' => ''],
+                                        'ScheduleExpression' => ['description' => 'The cron expression for scheduling. This parameter is required when ScheduleType is set to cron.', 'type' => 'string', 'example' => '5m', 'title' => ''],
+                                        'ScheduleMaxRetries' => ['description' => 'The maximum number of retries after a timeout. The value can be from 1 to 100.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''],
+                                        'ScheduleBeginTime' => ['description' => 'The start time of the scheduling. This is a 13-digit timestamp.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''],
+                                        'ScheduleWindow' => ['description' => 'The length of the scheduling window.', 'type' => 'string', 'example' => '5m', 'title' => ''],
+                                        'ScheduleMaxTimeout' => ['description' => 'The maximum timeout period, in seconds. The value can be from 60 to 1800.', 'type' => 'integer', 'format' => 'int32', 'example' => '60', 'title' => ''],
+                                        'AlertType' => ['description' => 'The alert type.', 'type' => 'string', 'example' => 'WebShell', 'title' => ''],
+                                        'AlertLevel' => ['description' => 'The threat level of the alert. Valid values:'."\n"
+                                            ."\n"
+                                            .'- 5: critical.'."\n"
+                                            ."\n"
+                                            .'- 4: important.'."\n"
+                                            ."\n"
+                                            .'- 3: medium.'."\n"
+                                            ."\n"
+                                            .'- 2: low.'."\n"
+                                            ."\n"
+                                            .'- 1: informational.', 'type' => 'string', 'example' => '1', 'title' => ''],
+                                        'AlertTacticId' => ['description' => 'The alert tactic phase.', 'type' => 'string', 'example' => 'TA0042', 'title' => ''],
+                                        'AlertAttCk' => ['description' => 'The ATT\\&CK technique of the alert.', 'type' => 'string', 'example' => 'Discovery', 'title' => ''],
+                                        'AlertThresholdPeriod' => ['description' => 'The length of the alert threshold period.', 'type' => 'string', 'example' => '5m', 'title' => ''],
+                                        'AlertThresholdCount' => ['description' => 'The number of alert thresholds.', 'type' => 'integer', 'format' => 'int32', 'example' => '10', 'title' => ''],
+                                        'AlertThresholdGroup' => ['description' => 'The list of alert threshold fields, separated by commas.', 'type' => 'string', 'example' => 'alert_type,ip', 'title' => ''],
+                                        'IncidentAggregationType' => ['description' => 'The event aggregation type. Valid values:'."\n"
+                                            ."\n"
+                                            .'- none: No events are generated.'."\n"
+                                            ."\n"
+                                            .'- graph\\_compute: graph computing (supported by predefined rules).'."\n"
+                                            ."\n"
+                                            .'- expert: expert rule.'."\n"
+                                            ."\n"
+                                            .'- passthrough: alert passthrough (one-to-one).'."\n"
+                                            ."\n"
+                                            .'- window: aggregation of similar alerts (by window).', 'type' => 'string', 'example' => 'passthrough', 'title' => ''],
+                                        'IncidentAggregationExpression' => ['description' => 'The configuration of the event aggregation period.', 'type' => 'string', 'example' => '5m', 'title' => ''],
+                                        'PlaybookUuid' => ['description' => 'The UUID of the playbook.', 'type' => 'string', 'example' => 'dde983ed-eb56-45ea-ac2e-3b12b2a9****', 'title' => ''],
+                                        'PlaybookParameters' => ['description' => 'The custom parameters of the playbook.', 'type' => 'string', 'example' => '{'."\n"
+                                            .'    "ip": {'."\n"
+                                            .'        "ip": "124.23.*.*"'."\n"
+                                            .'    }'."\n"
+                                            .'}', 'title' => ''],
+                                        'Playbook' => [
+                                            'description' => 'The configuration of the playbook.',
+                                            'type' => 'object',
+                                            'properties' => [
+                                                'Flow' => ['description' => 'The flow configuration of the playbook.', 'type' => 'string', 'example' => '['."\n"
+                                                    .'    {'."\n"
+                                                    .'        "id": "EndEvent_1fqpq4h",'."\n"
+                                                    .'        "zIndex": 1,'."\n"
+                                                    .'        "data": {'."\n"
+                                                    .'            "nodeType": "endEvent",'."\n"
+                                                    .'            "appType": "basic",'."\n"
+                                                    .'            "valueData": {'."\n"
+                                                    ."\n"
+                                                    .'            },'."\n"
+                                                    .'            "icon": "icon-radio-off-full"'."\n"
+                                                    .'        },'."\n"
+                                                    .'        "position": {'."\n"
+                                                    .'            "x": 1369,'."\n"
+                                                    .'            "y": 174'."\n"
+                                                    .'        }'."\n"
+                                                    .'    }'."\n"
+                                                    .']', 'title' => ''],
+                                                'Config' => ['description' => 'The configuration of the input parameters for invoking the playbook.', 'type' => 'string', 'example' => '['."\n"
+                                                    .'    {'."\n"
+                                                    .'        "name": "expireDay",'."\n"
+                                                    .'        "dataType": "Integer",'."\n"
+                                                    .'        "required": true,'."\n"
+                                                    .'        "isArray": false,'."\n"
+                                                    .'        "example": "7",'."\n"
+                                                    .'        "description": "desc",'."\n"
+                                                    .'        "typeName": "Integer",'."\n"
+                                                    .'        "dataClass": "normal",'."\n"
+                                                    .'        "stanchDefaultValue": "7"'."\n"
+                                                    .'    }'."\n"
+                                                    .']', 'title' => ''],
+                                            ],
+                                            'title' => '',
+                                            'example' => '',
+                                        ],
+                                        'EntityMappings' => [
+                                            'description' => 'The entity mapping configuration.',
+                                            'type' => 'array',
+                                            'items' => [
+                                                'description' => 'The entity mapping configuration.',
+                                                'type' => 'object',
+                                                'properties' => [
+                                                    'NormalizationSchemaId' => ['description' => 'The entity type ID.', 'type' => 'string', 'example' => 'ip', 'title' => ''],
+                                                    'NormalizationFieldMappings' => [
+                                                        'description' => 'The entity mapping configuration.',
+                                                        'type' => 'array',
+                                                        'items' => [
+                                                            'type' => 'object',
+                                                            'properties' => [
+                                                                'NormalizationFieldName' => ['description' => 'The standard entity field.', 'type' => 'string', 'example' => 'src_ip', 'title' => ''],
+                                                                'MappingFieldName' => ['description' => 'The mapped field.', 'type' => 'string', 'example' => 'ip', 'title' => ''],
+                                                                'NormalizationFieldType' => ['description' => 'The data type of the standard entity field.', 'type' => 'string', 'example' => 'vachar', 'title' => ''],
+                                                            ],
+                                                            'description' => 'The entity mapping configuration.',
+                                                            'title' => '',
+                                                            'example' => '',
+                                                        ],
+                                                        'title' => '',
+                                                        'example' => '',
+                                                    ],
+                                                ],
+                                                'title' => '',
+                                                'example' => '',
+                                            ],
+                                            'title' => '',
+                                            'example' => '',
+                                        ],
+                                        'AlertName' => ['description' => 'The alert name. You can use $$ to reference the output fields of the query.', 'type' => 'string', 'example' => 'Detected high-frequency multi-type network attacks from $src_ip$', 'title' => ''],
+                                        'AlertDescription' => ['description' => 'The alert description. You can use $$ to reference the output fields of the query.', 'type' => 'string', 'example' => 'Alert from: $product_code$, detected network attack from $src_ip$, affected assets include: $dst_ip$', 'title' => ''],
+                                        'AlertTypeMapping' => ['type' => 'string', 'description' => '', 'title' => '', 'example' => ''],
+                                        'AlertLevelMapping' => ['type' => 'string', 'description' => '', 'title' => '', 'example' => ''],
+                                        'AlertAttCkMapping' => ['type' => 'string', 'description' => '', 'title' => '', 'example' => ''],
+                                    ],
+                                    'description' => 'The detection rule.',
+                                    'title' => '',
+                                    'example' => '',
+                                ],
+                                'title' => '',
+                                'example' => '',
+                            ],
+                            'PageNumber' => ['description' => 'The pagination parameter. This specifies the current page number.', 'type' => 'integer', 'format' => 'int32', 'example' => '2', 'title' => ''],
+                            'PageSize' => ['description' => 'The pagination parameter. This specifies the number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10', 'title' => ''],
+                            'TotalCount' => ['description' => 'The total number of records.', 'type' => 'integer', 'format' => 'int32', 'example' => '6', 'title' => ''],
+                            'MaxResults' => ['description' => 'The maximum number of data entries to read.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''],
+                            'NextToken' => ['description' => 'The token that is used to start the next query.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
-        ],
-        'ValidateNormalizationRule' => [
-            'summary' => '校验规则和数据',
-            'methods' => [
-                'post',
-                'get',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'ListDetectionRules',
+            'description' => 'Notifications are subject to frequency and time limits. Each user can receive a maximum of two notifications per day. These notifications are sent only between 08:00 and 20:00.',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
             ],
-            'schemes' => [
-                'https',
+            'ramActions' => [
+                [
+                    'operationType' => 'list',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ListDetectionRules',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DetectionRule', 'arn' => 'acs:yundun-sas::{#accountId}:detection/*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"508DCFFD-4508-54BF-A8A0-E97A0FA6****\\",\\n  \\"DetectionRules\\": [\\n    {\\n      \\"CreateTime\\": 0,\\n      \\"UpdateTime\\": 0,\\n      \\"DetectionRuleId\\": \\"jndi-attack-success_http_netstat\\",\\n      \\"DetectionRuleName\\": \\"Detect Discovery Behavior for Local Systems Groups\\\\n\\",\\n      \\"DetectionRuleDescription\\": \\"Check the enumeration behavior of local system groups. An attacker may attempt to find the Local Systems group and its permission settings.\\",\\n      \\"DetectionRuleType\\": \\"custom\\",\\n      \\"DetectionRuleStatus\\": \\"enabled\\",\\n      \\"DetectionExpressionType\\": \\"playbook\\",\\n      \\"DetectionExpressionContent\\": \\"*|set session mode=scan;SELECT * FROM log\\\\nWHERE schema = \'PROCESS_START_ACTIVITY\'\\\\nAND (\\\\n    proc_path LIKE \'%/groups\'\\\\n    OR (\\\\n        (\\\\n            proc_path LIKE \'%/cat\'\\\\n            OR proc_path LIKE \'%/head\'\\\\n            OR proc_path LIKE \'%/tail\'\\\\n            OR proc_path LIKE \'%/more\'\\\\n        )\\\\n        AND cmdline LIKE \'%/etc/group%\'\\\\n    )\\\\n)\\",\\n      \\"LogCategoryId\\": \\"NETWORK_CATEGORY\\",\\n      \\"LogSchemaId\\": \\"API_RISK_ACTIVITY\\",\\n      \\"AlertSchemaId\\": \\"ALERT_ACTIVITY\\",\\n      \\"ScheduleType\\": \\"fixed_rate\\",\\n      \\"ScheduleExpression\\": \\"5m\\",\\n      \\"ScheduleMaxRetries\\": 1,\\n      \\"ScheduleBeginTime\\": 1733269771123,\\n      \\"ScheduleWindow\\": \\"5m\\",\\n      \\"ScheduleMaxTimeout\\": 60,\\n      \\"AlertType\\": \\"WebShell\\",\\n      \\"AlertLevel\\": \\"1\\",\\n      \\"AlertTacticId\\": \\"TA0042\\",\\n      \\"AlertAttCk\\": \\"Discovery\\",\\n      \\"AlertThresholdPeriod\\": \\"5m\\",\\n      \\"AlertThresholdCount\\": 10,\\n      \\"AlertThresholdGroup\\": \\"alert_type,ip\\",\\n      \\"IncidentAggregationType\\": \\"passthrough\\",\\n      \\"IncidentAggregationExpression\\": \\"5m\\",\\n      \\"PlaybookUuid\\": \\"dde983ed-eb56-45ea-ac2e-3b12b2a9****\\",\\n      \\"PlaybookParameters\\": \\"{\\\\n    \\\\\\"ip\\\\\\": {\\\\n        \\\\\\"ip\\\\\\": \\\\\\"124.23.*.*\\\\\\"\\\\n    }\\\\n}\\",\\n      \\"Playbook\\": {\\n        \\"Flow\\": \\"[\\\\n    {\\\\n        \\\\\\"id\\\\\\": \\\\\\"EndEvent_1fqpq4h\\\\\\",\\\\n        \\\\\\"zIndex\\\\\\": 1,\\\\n        \\\\\\"data\\\\\\": {\\\\n            \\\\\\"nodeType\\\\\\": \\\\\\"endEvent\\\\\\",\\\\n            \\\\\\"appType\\\\\\": \\\\\\"basic\\\\\\",\\\\n            \\\\\\"valueData\\\\\\": {\\\\n\\\\n            },\\\\n            \\\\\\"icon\\\\\\": \\\\\\"icon-radio-off-full\\\\\\"\\\\n        },\\\\n        \\\\\\"position\\\\\\": {\\\\n            \\\\\\"x\\\\\\": 1369,\\\\n            \\\\\\"y\\\\\\": 174\\\\n        }\\\\n    }\\\\n]\\",\\n        \\"Config\\": \\"[\\\\n    {\\\\n        \\\\\\"name\\\\\\": \\\\\\"expireDay\\\\\\",\\\\n        \\\\\\"dataType\\\\\\": \\\\\\"Integer\\\\\\",\\\\n        \\\\\\"required\\\\\\": true,\\\\n        \\\\\\"isArray\\\\\\": false,\\\\n        \\\\\\"example\\\\\\": \\\\\\"7\\\\\\",\\\\n        \\\\\\"description\\\\\\": \\\\\\"desc\\\\\\",\\\\n        \\\\\\"typeName\\\\\\": \\\\\\"Integer\\\\\\",\\\\n        \\\\\\"dataClass\\\\\\": \\\\\\"normal\\\\\\",\\\\n        \\\\\\"stanchDefaultValue\\\\\\": \\\\\\"7\\\\\\"\\\\n    }\\\\n]\\"\\n      },\\n      \\"EntityMappings\\": [\\n        {\\n          \\"NormalizationSchemaId\\": \\"ip\\",\\n          \\"NormalizationFieldMappings\\": [\\n            {\\n              \\"NormalizationFieldName\\": \\"src_ip\\",\\n              \\"MappingFieldName\\": \\"ip\\",\\n              \\"NormalizationFieldType\\": \\"vachar\\"\\n            }\\n          ]\\n        }\\n      ],\\n      \\"AlertName\\": \\"Detected high-frequency multi-type network attacks from $src_ip$\\",\\n      \\"AlertDescription\\": \\"Alert from: $product_code$, detected network attack from $src_ip$, affected assets include: $dst_ip$\\",\\n      \\"AlertTypeMapping\\": \\"\\",\\n      \\"AlertLevelMapping\\": \\"\\",\\n      \\"AlertAttCkMapping\\": \\"\\"\\n    }\\n  ],\\n  \\"PageNumber\\": 2,\\n  \\"PageSize\\": 10,\\n  \\"TotalCount\\": 6,\\n  \\"MaxResults\\": 50,\\n  \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\"\\n}","type":"json"}]',
+        ],
+        'ListIncidents' => [
+            'methods' => ['get', 'post'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'readAndWrite',
+            'operationType' => 'read',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'none',
+                'operationType' => 'list',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsasASHGE7'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The data management center of the threat detection and response feature. Specify this parameter based on the region where your assets reside. Valid values:'."\n"
+                        .'- cn-hangzhou: Chinese mainland.'."\n"
+                        .'- ap-southeast-1: Outside the Chinese mainland.', 'type' => 'string', 'example' => 'cn-hangzhou', 'required' => false, 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        .'- **en**: English.', 'type' => 'string', 'example' => 'zh', 'required' => false, 'title' => ''],
+                ],
+                [
+                    'name' => 'IncidentName',
+                    'in' => 'query',
+                    'schema' => ['description' => 'The name of the event.', 'type' => 'string', 'example' => 'ECS unusual log in', 'required' => false, 'title' => ''],
+                ],
+                [
+                    'name' => 'IncidentUuids',
+                    'in' => 'query',
+                    'style' => 'simple',
                     'schema' => [
-                        'description' => '',
-                        'type' => 'string',
+                        'description' => 'The list of event UUIDs, separated by commas (,).',
+                        'type' => 'array',
+                        'items' => ['description' => 'The list of event UUIDs, separated by commas (,).', 'type' => 'string', 'example' => '85ea4241-798f-4684-a876-65d4f0c3****,90ea4241-798f-4684-a876-65d4f0c3****'."\n"
+                            ."\n", 'required' => false, 'title' => ''],
                         'required' => false,
-                        'example' => 'zh。',
+                        'title' => '',
+                        'example' => '',
                     ],
                 ],
                 [
-                    'name' => 'RoleFor',
+                    'name' => 'IncidentStatus',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
+                    'schema' => ['description' => 'The status of the event. Valid values:'."\n"
+                        .'- 0: unhandled.'."\n"
+                        .'- 1: handling.'."\n"
+                        .'- 5: handling failed.'."\n"
+                        .'- 10: handled.', 'type' => 'integer', 'format' => 'int32', 'example' => '0', 'required' => false, 'title' => ''],
                 ],
                 [
-                    'name' => 'Data',
+                    'name' => 'ThreatLevel',
                     'in' => 'formData',
+                    'style' => 'repeatList',
                     'schema' => [
-                        'description' => '',
-                        'type' => 'string',
+                        'description' => 'The threat level. Valid values:'."\n"
+                            .'- 5: critical.'."\n"
+                            .'- 4: high.'."\n"
+                            .'- 3: medium.'."\n"
+                            .'- 2: low.'."\n"
+                            .'- 1: informational.',
+                        'type' => 'array',
+                        'items' => ['description' => 'The threat level. Valid values:'."\n"
+                            .'- 5: critical.'."\n"
+                            .'- 4: high.'."\n"
+                            .'- 3: medium.'."\n"
+                            .'- 2: low.'."\n"
+                            .'- 1: informational.', 'type' => 'string', 'example' => '2', 'required' => false, 'title' => ''],
                         'required' => false,
-                        'example' => '123456。',
+                        'maxItems' => 100,
+                        'example' => '5',
+                        'title' => '',
                     ],
                 ],
                 [
-                    'name' => 'NormalizationCategoryId',
+                    'name' => 'RelateAssetId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'NETWORK_CATEGORY。',
-                    ],
+                    'schema' => ['description' => 'The ID of the asset associated with the event.', 'type' => 'string', 'example' => '6c740667-80b2-476d-8924-2e706feb****'."\n", 'required' => false, 'title' => ''],
                 ],
                 [
-                    'name' => 'NormalizationSchemaId',
+                    'name' => 'RelateEntityId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'HTTP_ACTIVITY。',
-                    ],
+                    'schema' => ['description' => 'The ID of the entity associated with the event.', 'type' => 'string', 'example' => 'b920ed22259f5412099e97dfda96****', 'required' => false, 'title' => ''],
                 ],
                 [
-                    'name' => 'VendorId',
+                    'name' => 'IncidentTags',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '厂商ID。',
-                        'type' => 'string',
-                        'example' => 'alibaba_cloud',
-                    ],
+                    'schema' => ['description' => 'The tags of the event.', 'type' => 'string', 'example' => '[{\\"data_source\\":[\\"sas\\"]}]', 'title' => '', 'required' => false],
                 ],
                 [
-                    'name' => 'ProductId',
+                    'name' => 'AlertUuid',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '产品ID。',
-                        'type' => 'string',
-                        'example' => 'alibaba_cloud_sas',
-                    ],
+                    'schema' => ['description' => 'The alert ID.', 'type' => 'string', 'example' => 'sas_71e24437d2797ce8fc59692905a4****', 'required' => false, 'title' => ''],
                 ],
                 [
-                    'name' => 'ExtendFieldStoreMode',
+                    'name' => 'StartTime',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '扩展字段存储模式，取值：flat、pack、reject。',
-                        'type' => 'string',
-                        'example' => 'flat',
-                    ],
+                    'schema' => ['description' => 'The start time as a timestamp in milliseconds (ms).', 'type' => 'integer', 'format' => 'int64', 'example' => '1690102943000', 'required' => false, 'title' => ''],
                 ],
                 [
-                    'name' => 'NormalizationRuleMode',
+                    'name' => 'EndTime',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '标准化规则模式。取值：both、realtime',
-                        'type' => 'string',
-                        'example' => 'realtime',
-                    ],
+                    'schema' => ['description' => 'The end time as a timestamp in milliseconds (ms).', 'type' => 'integer', 'format' => 'int64', 'example' => '1749090526055', 'required' => false, 'title' => ''],
                 ],
                 [
-                    'name' => 'LogSample',
+                    'name' => 'OrderFieldName',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The field name used to sort the list. Valid values:'."\n"
+                        .'- GmtModified: event update time (default).'."\n"
+                        .'- ThreatScore: threat score.', 'type' => 'string', 'example' => 'GmtModified', 'required' => false, 'title' => ''],
+                ],
+                [
+                    'name' => 'OrderDirection',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The sort order. Valid values:'."\n"
+                        .'- **desc** (default): descending order.'."\n"
+                        .'- **asc**: ascending order.', 'type' => 'string', 'example' => 'desc', 'required' => false, 'title' => ''],
+                ],
+                [
+                    'name' => 'PageNumber',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The page number.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'minimum' => '1', 'example' => '1', 'title' => ''],
+                ],
+                [
+                    'name' => 'PageSize',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'maximum' => '100', 'minimum' => '1', 'example' => '10', 'title' => ''],
+                ],
+                [
+                    'name' => 'RoleFor',
                     'in' => 'formData',
+                    'schema' => ['description' => 'The user ID of the member to which the administrator switches the view.', 'type' => 'integer', 'format' => 'int64', 'example' => '113091674488****', 'required' => false, 'title' => ''],
+                ],
+                [
+                    'name' => 'RoleType',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The view type. Valid values:'."\n"
+                        .'- 0: the view of the current Alibaba Cloud account.'."\n"
+                        .'- 1: the view of all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'required' => false, 'title' => ''],
+                ],
+                [
+                    'name' => 'MaxResults',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The maximum number of entries to return in this request.', 'type' => 'integer', 'format' => 'int32', 'example' => '10', 'required' => false, 'title' => ''],
+                ],
+                [
+                    'name' => 'NextToken',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The pagination token for the next query. Leave this parameter empty for the first query or if no more results exist. If more results exist, set this parameter to the NextToken value returned by the previous API call.', 'type' => 'string', 'example' => 'AAAAASLVeIxed4466E0LVmGkzwS6hJKd9DGVGMDRM6Lu****', 'required' => false, 'title' => ''],
+                ],
+                [
+                    'name' => 'Owners',
+                    'in' => 'formData',
+                    'style' => 'repeatList',
                     'schema' => [
-                        'title' => '日志样例，JSON格式。',
-                        'type' => 'string',
-                        'example' => '{"aaa":"bbb","xxx":"yyy"}',
+                        'title' => '',
+                        'description' => 'The UID of the account that owns the event.',
+                        'type' => 'array',
+                        'items' => ['title' => '', 'description' => 'The UID of the account that owns the event.', 'type' => 'string', 'example' => '1234567890xxxxxx', 'required' => false],
+                        'required' => false,
+                        'maxItems' => 100,
+                        'example' => '',
                     ],
                 ],
                 [
-                    'name' => 'NormalizationRuleExpression',
+                    'name' => 'IncidentStatusList',
                     'in' => 'formData',
+                    'style' => 'repeatList',
                     'schema' => [
-                        'title' => '标准化规则表达式。',
-                        'type' => 'string',
-                        'example' => '*',
+                        'type' => 'array',
+                        'items' => ['type' => 'string', 'example' => '1', 'description' => '', 'title' => ''],
+                        'example' => '[0,1,5]',
+                        'maxItems' => 100,
+                        'description' => '',
+                        'title' => '',
                     ],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'Schema of Response',
-                        'description' => '',
+                        'title' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'title' => 'Id of the request',
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。',
-                            ],
-                            'ValidateResult' => [
-                                'description' => '',
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''],
+                            'Incidents' => [
+                                'description' => 'The list of events.',
                                 'type' => 'array',
                                 'items' => [
-                                    'description' => '',
+                                    'description' => 'The event.',
                                     'type' => 'object',
                                     'properties' => [
-                                        'FieldName' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'host。',
-                                        ],
-                                        'FieldValue' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'ze。',
-                                        ],
-                                        'NormalizationFieldName' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'host。',
-                                        ],
-                                        'NormalizationFieldRequired' => [
-                                            'description' => '',
-                                            'type' => 'boolean',
-                                            'example' => 'true。',
-                                        ],
-                                        'Result' => [
-                                            'description' => '',
-                                            'type' => 'integer',
-                                            'format' => 'int32',
-                                            'example' => '1。',
-                                        ],
-                                        'Message' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'success。',
-                                        ],
-                                        'NormalizationFieldType' => [
-                                            'title' => '标准字段类型，支持text、long、double、json四种类型。',
-                                            'type' => 'string',
-                                            'example' => 'text',
-                                        ],
-                                        'NormalizationFieldFrom' => [
-                                            'title' => '标准字段来源，preset-内置，custom-自定义。',
-                                            'type' => 'string',
-                                            'example' => 'preset',
-                                        ],
-                                        'NormalizationFieldReserved' => [
-                                            'title' => '是否是系统内置的标准字段名。',
-                                            'type' => 'boolean',
-                                        ],
-                                        'NormalizationFieldValidationStatus' => [
-                                            'title' => '标准字段校验状态，取值：pass、fail。',
-                                            'type' => 'string',
-                                            'example' => 'pass',
-                                        ],
-                                        'NormalizationFieldValidationReason' => [
-                                            'title' => '标准字段校验失败原因。',
-                                            'type' => 'string',
-                                            'example' => 'OperationDenied.TheValueIsRequired',
-                                        ],
-                                        'LogFieldName' => [
-                                            'title' => '日志字段名。',
-                                            'type' => 'string',
-                                            'example' => 'aaa',
-                                        ],
-                                        'LogFieldValue' => [
-                                            'title' => '日志字段值。',
-                                            'type' => 'string',
-                                            'example' => 'bbb',
-                                        ],
-                                    ],
+                                        'IncidentName' => ['description' => 'The name of the event.', 'type' => 'string', 'example' => 'ECS unusual log in', 'title' => ''],
+                                        'ThreatLevel' => ['description' => 'The threat level. Valid values:'."\n"
+                                            .'- 5: critical.'."\n"
+                                            .'- 4: high.'."\n"
+                                            .'- 3: medium.'."\n"
+                                            .'- 2: low.'."\n"
+                                            .'- 1: informational.', 'type' => 'string', 'example' => '2', 'title' => ''],
+                                        'IncidentStatus' => ['description' => 'The status of the event. Valid values:'."\n"
+                                            .'- 0: unhandled.'."\n"
+                                            .'- 1: handling.'."\n"
+                                            .'- 5: handling failed.'."\n"
+                                            .'- 10: handled.', 'type' => 'integer', 'format' => 'int32', 'example' => '0', 'title' => ''],
+                                        'Owner' => ['title' => '', 'description' => 'The UID of the account that owns the event.', 'type' => 'string', 'example' => '1234567890xxxxxx'],
+                                        'CreateTime' => ['description' => 'The creation time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1603248483000', 'title' => ''],
+                                        'UpdateTime' => ['description' => 'The update time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1603248483000', 'title' => ''],
+                                        'RelateAssetCount' => ['description' => 'The number of assets associated with the event.', 'type' => 'integer', 'format' => 'int32', 'example' => '4', 'title' => ''],
+                                        'IncidentUuid' => ['description' => 'The UUID of the event.', 'type' => 'string', 'example' => 'dbb1d7211c9285c862aa89385098****', 'title' => ''],
+                                        'IncidentRemark' => ['description' => 'The remarks of the event.', 'type' => 'string', 'example' => 'remark', 'title' => ''],
+                                        'RelateAlertCount' => ['description' => 'The number of alerts associated with the event.', 'type' => 'integer', 'format' => 'int32', 'example' => '3', 'title' => ''],
+                                        'IncidentTags' => ['title' => '', 'description' => 'The tags of the event.', 'type' => 'string', 'example' => '["sys:data_source:siem","sys:trigger_type:auto"]'],
+                                        'DetectionRuleId' => ['description' => 'The ID of the detection rule.', 'type' => 'string', 'example' => 'dr-qo5ww6ux0uc28*****', 'title' => ''],
+                                        'ResponseTime' => ['description' => 'The response time, in milliseconds (ms).', 'type' => 'integer', 'format' => 'int64', 'example' => '1603248483000', 'title' => ''],
+                                        'AlertInfos' => ['type' => 'string', 'description' => '', 'title' => '', 'example' => ''],
+                                        'EntityInfos' => ['type' => 'string', 'description' => '', 'title' => '', 'example' => ''],
+                                        'IncidentDescription' => ['type' => 'string', 'description' => '', 'title' => '', 'example' => ''],
+                                        'AttckTactics' => ['type' => 'string', 'description' => '', 'title' => '', 'example' => ''],
+                                    ],
+                                    'title' => '',
+                                    'example' => '',
                                 ],
-                            ],
+                                'title' => '',
+                                'example' => '',
+                            ],
+                            'PageNumber' => ['description' => 'The page number.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''],
+                            'PageSize' => ['description' => 'The number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10', 'title' => ''],
+                            'TotalCount' => ['description' => 'The total number of records.', 'type' => 'integer', 'format' => 'int32', 'example' => '57', 'title' => ''],
+                            'MaxResults' => ['description' => 'The maximum number of entries to return in this request.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''],
+                            'NextToken' => ['description' => 'The pagination token for the next query. Leave this parameter empty for the first query or if no more results exist. If more results exist, set this parameter to the NextToken value returned by the previous API call.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"ValidateResult\\": [\\n    {\\n      \\"FieldName\\": \\"host\\",\\n      \\"FieldValue\\": \\"ze\\",\\n      \\"NormalizationFieldName\\": \\"host\\",\\n      \\"NormalizationFieldRequired\\": true,\\n      \\"Result\\": 1,\\n      \\"Message\\": \\"success\\",\\n      \\"NormalizationFieldType\\": \\"text\\",\\n      \\"NormalizationFieldFrom\\": \\"preset\\",\\n      \\"NormalizationFieldReserved\\": true,\\n      \\"NormalizationFieldValidationStatus\\": \\"pass\\",\\n      \\"NormalizationFieldValidationReason\\": \\"OperationDenied.TheValueIsRequired\\",\\n      \\"LogFieldName\\": \\"aaa\\",\\n      \\"LogFieldValue\\": \\"bbb\\"\\n    }\\n  ]\\n}","type":"json"}]',
-        ],
-        'GetNormalizationRule' => [
-            'summary' => '获取标准化规则',
-            'methods' => [
-                'post',
-                'get',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'Retrieve event list',
+            'summary' => 'Retrieves a list of events.',
+            'description' => 'Notifications are subject to frequency and time restrictions.'."\n"
+                .'Each user can receive a maximum of two notifications per day between 08:00 and 20:00. No notifications are sent outside this time window.',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [
+                    ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListIncidents'],
+                ],
             ],
-            'schemes' => [
-                'https',
+            'ramActions' => [
+                [
+                    'operationType' => 'list',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ListIncidents',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'Incident', 'arn' => 'acs:yundun-sas::{#accountId}:incident/*'],
+                        ],
+                    ],
+                ],
             ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"Incidents\\": [\\n    {\\n      \\"IncidentName\\": \\"ECS unusual log in\\",\\n      \\"ThreatLevel\\": \\"2\\",\\n      \\"IncidentStatus\\": 0,\\n      \\"Owner\\": \\"1234567890xxxxxx\\",\\n      \\"CreateTime\\": 1603248483000,\\n      \\"UpdateTime\\": 1603248483000,\\n      \\"RelateAssetCount\\": 4,\\n      \\"IncidentUuid\\": \\"dbb1d7211c9285c862aa89385098****\\",\\n      \\"IncidentRemark\\": \\"remark\\",\\n      \\"RelateAlertCount\\": 3,\\n      \\"IncidentTags\\": \\"[\\\\\\"sys:data_source:siem\\\\\\",\\\\\\"sys:trigger_type:auto\\\\\\"]\\",\\n      \\"DetectionRuleId\\": \\"dr-qo5ww6ux0uc28*****\\",\\n      \\"ResponseTime\\": 1603248483000,\\n      \\"AlertInfos\\": \\"\\",\\n      \\"EntityInfos\\": \\"\\",\\n      \\"IncidentDescription\\": \\"\\",\\n      \\"AttckTactics\\": \\"\\"\\n    }\\n  ],\\n  \\"PageNumber\\": 1,\\n  \\"PageSize\\": 10,\\n  \\"TotalCount\\": 57,\\n  \\"MaxResults\\": 50,\\n  \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\"\\n}","type":"json"}]',
+        ],
+        'ListLogProjects' => [
+            'summary' => 'Lists log projects.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'read',
+            'operationType' => 'readAndWrite',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'get',
+                'operationType' => 'list',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The region where the Data Management hub for threat analysis is located. Select the region of the Data Management hub based on the region of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
-                    ],
+                    'schema' => ['description' => 'The language of the response messages. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
+                    'schema' => ['description' => 'The ID of the member account in the resource directory.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
                 [
-                    'name' => 'NormalizationRuleId',
+                    'name' => 'LogUserId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'nr-z0b2ssjteut85uoh9nzp。',
-                    ],
+                    'schema' => ['description' => 'The user ID for data access.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
+                ],
+                [
+                    'name' => 'LogRegionId',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The ID of the log storage region.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
+                ],
+                [
+                    'name' => 'MaxResults',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The maximum number of entries to return on this call.', 'type' => 'integer', 'format' => 'int32', 'minimum' => '0', 'required' => false, 'example' => '50', 'title' => ''],
+                ],
+                [
+                    'name' => 'NextToken',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The token that is used to retrieve the next page of results. You do not need to specify this parameter for the first call. To retrieve the next page of results, set this parameter to the NextToken value that was returned from the previous call.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'Schema of Response',
-                        'description' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。',
-                            ],
-                            'NormalizationRule' => [
-                                'description' => '',
-                                'type' => 'object',
-                                'properties' => [
-                                    'CreateTime' => [
-                                        'description' => '',
-                                        'type' => 'integer',
-                                        'format' => 'int64',
-                                        'example' => '1733269771123。',
-                                    ],
-                                    'UpdateTime' => [
-                                        'description' => '',
-                                        'type' => 'integer',
-                                        'format' => 'int64',
-                                        'example' => '1733269771123。',
-                                    ],
-                                    'NormalizationRuleId' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'nr-z0b2ssjteut85uoh9nzp。',
-                                    ],
-                                    'NormalizationRuleName' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'normalization_rule_Z57np。',
-                                    ],
-                                    'NormalizationRuleType' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'predefined。',
-                                    ],
-                                    'NormalizationRuleFormat' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'SPL。',
-                                    ],
-                                    'NormalizationRuleDescription' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'normalization_rule_Z57np。',
-                                    ],
-                                    'NormalizationRuleVersion' => [
-                                        'description' => '',
-                                        'type' => 'integer',
-                                        'example' => 'V1。',
-                                        'format' => 'int32',
-                                    ],
-                                    'NormalizationRuleExpression' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => '* | pack-fields -include=\'[\\s\\S]+\' as extend_content。',
-                                    ],
-                                    'NormalizationRuleStatus' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'started。',
-                                    ],
-                                    'NormalizationCategoryId' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'NETWORK_CATEGORY。',
-                                    ],
-                                    'NormalizationSchemaId' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'HTTP_ACTIVITY。',
-                                    ],
-                                    'VendorId' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'alibaba_cloud。',
-                                    ],
-                                    'ProductId' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'alibaba_cloud_sas。',
-                                    ],
-                                    'NormalizationRuleMode' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'both。',
-                                    ],
-                                    'ExtendContentPacked' => [
-                                        'type' => 'string',
-                                    ],
-                                    'OrderField' => [
-                                        'type' => 'string',
-                                    ],
-                                    'NormalizationRuleIds' => [
-                                        'type' => 'array',
-                                        'items' => [
-                                            'type' => 'string',
-                                        ],
-                                    ],
-                                    'ExtendFieldStoreMode' => [
-                                        'title' => '扩展字段存储模式，flat-原样接入，reject-不接入，pack-打包到extend_content字段。',
-                                        'type' => 'string',
-                                        'example' => 'flat',
-                                    ],
-                                ],
+                            'RequestId' => ['title' => 'Id of the request', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
+                            'LogProjects' => [
+                                'description' => 'The list of Simple Log Service projects.',
+                                'type' => 'array',
+                                'items' => ['description' => 'The Simple Log Service project.', 'type' => 'string', 'example' => 'aliyun-cloudsiem-channel-173326*******-cn-beijing', 'title' => ''],
+                                'title' => '',
+                                'example' => '',
                             ],
+                            'MaxResults' => ['description' => 'The maximum number of entries returned on this call.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''],
+                            'NextToken' => ['description' => 'The token that is used to retrieve the next page of results. If this parameter is not returned, no more results are available.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
+                            'TotalCount' => ['description' => 'The total number of records.', 'type' => 'integer', 'format' => 'int32', 'example' => '57', 'title' => ''],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"LogProjects\\": [\\n    \\"aliyun-cloudsiem-channel-173326*******-cn-beijing\\"\\n  ],\\n  \\"MaxResults\\": 50,\\n  \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\",\\n  \\"TotalCount\\": 57\\n}","type":"json"}]',
+            'title' => 'ListLogProjects',
+            'description' => 'The JsonConfig request parameter is a complex JSON configuration. A supporting tool class is available to simplify this configuration. For an example, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'list',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ListLogProjects',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"NormalizationRule\\": {\\n    \\"CreateTime\\": 1733269771123,\\n    \\"UpdateTime\\": 1733269771123,\\n    \\"NormalizationRuleId\\": \\"nr-z0b2ssjteut85uoh9nzp\\",\\n    \\"NormalizationRuleName\\": \\"normalization_rule_Z57np\\",\\n    \\"NormalizationRuleType\\": \\"predefined\\",\\n    \\"NormalizationRuleFormat\\": \\"SPL\\",\\n    \\"NormalizationRuleDescription\\": \\"normalization_rule_Z57np\\",\\n    \\"NormalizationRuleVersion\\": 0,\\n    \\"NormalizationRuleExpression\\": \\"* | pack-fields -include=\'[\\\\\\\\s\\\\\\\\S]+\' as extend_content\\",\\n    \\"NormalizationRuleStatus\\": \\"started\\",\\n    \\"NormalizationCategoryId\\": \\"NETWORK_CATEGORY\\",\\n    \\"NormalizationSchemaId\\": \\"HTTP_ACTIVITY\\",\\n    \\"VendorId\\": \\"alibaba_cloud\\",\\n    \\"ProductId\\": \\"alibaba_cloud_sas\\",\\n    \\"NormalizationRuleMode\\": \\"both\\",\\n    \\"ExtendContentPacked\\": \\"enabled\\",\\n    \\"OrderField\\": \\"GmtModified\\",\\n    \\"NormalizationRuleIds\\": [\\n      \\"nr-z0b2ssjteut85uoh9nzp\\"\\n    ],\\n    \\"ExtendFieldStoreMode\\": \\"flat\\"\\n  }\\n}","type":"json"}]',
         ],
-        'GetNormalizationSchema' => [
-            'summary' => '获取Schema信息以及字段',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'ListLogRegions' => [
+            'summary' => 'Retrieves all regions.',
+            'path' => '',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
@@ -7696,309 +7565,188 @@
                 'operationType' => 'get',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
+                'tenantRelevance' => 'publicInformation',
             ],
             'parameters' => [
                 [
-                    'name' => 'RegionId',
+                    'name' => 'Lang',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The language of the response message. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
+                ],
+                [
+                    'name' => 'RoleFor',
                     'in' => 'formData',
+                    'schema' => ['description' => 'The user ID of the member whose perspective the administrator wants to use.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
+                ],
+            ],
+            'responses' => [
+                200 => [
                     'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
+                        'title' => 'Schema of Response',
+                        'description' => 'The response body.',
+                        'type' => 'object',
+                        'properties' => [
+                            'RequestId' => ['title' => 'Id of the request', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
+                            'LogRegions' => [
+                                'description' => 'A list of log storage region IDs.',
+                                'type' => 'array',
+                                'items' => ['description' => 'The log storage region ID.', 'type' => 'string', 'example' => 'cn-hangzhou', 'title' => ''],
+                                'title' => '',
+                                'example' => '',
+                            ],
+                        ],
+                        'example' => '',
                     ],
                 ],
+            ],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"LogRegions\\": [\\n    \\"cn-hangzhou\\"\\n  ]\\n}","type":"json"}]',
+            'title' => 'ListLogRegions',
+            'description' => 'The \\`JsonConfig\\` request parameter is a complex JSON configuration. A supporting tool class provides configuration examples. For more information, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ListLogRegions',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
+            ],
+        ],
+        'ListLogStores' => [
+            'summary' => 'Retrieves a list of Logstores.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
+            'security' => [
+                [
+                    'AK' => [],
+                ],
+            ],
+            'operationType' => 'readAndWrite',
+            'deprecated' => false,
+            'systemTags' => [
+                'operationType' => 'list',
+                'riskType' => 'none',
+                'chargeType' => 'free',
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
+            ],
+            'parameters' => [
+                [
+                    'name' => 'RegionId',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The region of the Data Management center. Select the region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
+                ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
-                    ],
+                    'schema' => ['description' => 'The language of the response message. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member whose permissions are assumed by the administrator.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
                 [
-                    'name' => 'NormalizationSchemaType',
+                    'name' => 'LogUserId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'log。',
-                    ],
+                    'schema' => ['description' => 'The ID of the user who ingests the data.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
                 [
-                    'name' => 'NormalizationSchemaId',
+                    'name' => 'LogRegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'HTTP_ACTIVITY。',
-                    ],
+                    'schema' => ['description' => 'The ID of the log storage region.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
+                ],
+                [
+                    'name' => 'LogProjectName',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The name of the Simple Log Service project.', 'type' => 'string', 'required' => false, 'example' => 'aliyun-cloudsiem-data-173326*******-cn-hangzhou', 'title' => ''],
+                ],
+                [
+                    'name' => 'MaxResults',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The maximum number of entries to return on this call.', 'type' => 'integer', 'format' => 'int32', 'minimum' => '0', 'required' => false, 'example' => '50', 'title' => ''],
+                ],
+                [
+                    'name' => 'NextToken',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The token that is used to start the next query. You do not need to specify this parameter for the first query. If a subsequent query is required, set the value to the NextToken value that is returned from the previous API call.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'Schema of Response',
-                        'description' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。',
-                            ],
-                            'NormalizationSchema' => [
-                                'description' => '',
-                                'type' => 'object',
-                                'properties' => [
-                                    'NormalizationSchemaId' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'HTTP_ACTIVITY。',
-                                    ],
-                                    'NormalizationSchemaName' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'normalization_rule_Z57np。',
-                                    ],
-                                    'NormalizationCategoryId' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'NETWORK_CATEGORY。',
-                                    ],
-                                    'NormalizationFields' => [
-                                        'description' => '',
-                                        'type' => 'array',
-                                        'items' => [
-                                            'description' => '',
-                                            'type' => 'object',
-                                            'properties' => [
-                                                'NormalizationFieldName' => [
-                                                    'description' => '',
-                                                    'type' => 'string',
-                                                    'example' => 'cloud_user。',
-                                                    'title' => '标准字段名。',
-                                                ],
-                                                'NormalizationFieldType' => [
-                                                    'description' => '',
-                                                    'type' => 'string',
-                                                    'example' => 'varchar。',
-                                                    'title' => '标准字段类型，支持text、long、double、json四种类型。',
-                                                ],
-                                                'NormalizationFieldRequired' => [
-                                                    'title' => '是否为必填字段',
-                                                    'type' => 'boolean',
-                                                ],
-                                                'NormalizationFieldDescription' => [
-                                                    'description' => '',
-                                                    'type' => 'string',
-                                                    'example' => 'cloud_user。',
-                                                    'title' => '标准字段描述。',
-                                                ],
-                                                'NormalizationFieldExample' => [
-                                                    'description' => '',
-                                                    'type' => 'string',
-                                                    'example' => '173326*******。',
-                                                    'title' => '标准字段示例。',
-                                                ],
-                                                'NormalizationFieldReserved' => [
-                                                    'description' => '',
-                                                    'type' => 'boolean',
-                                                    'example' => 'true。',
-                                                    'title' => '是否是系统内置的标准字段名。',
-                                                ],
-                                                'NormalizationFieldFrom' => [
-                                                    'title' => '标准字段来源，preset-内置，custom-自定义。',
-                                                    'type' => 'string',
-                                                    'example' => 'preset',
-                                                ],
-                                                'NormalizationFieldTokenize' => [
-                                                    'title' => '标准字段是否分词。',
-                                                    'type' => 'boolean',
-                                                ],
-                                                'NormalizationFieldJsonIndexAll' => [
-                                                    'title' => 'json类型的标准字段是否针对所有key建立索引。',
-                                                    'type' => 'boolean',
-                                                ],
-                                                'NormalizationFieldJsonKeys' => [
-                                                    'title' => 'json类型的标准字段key列表。',
-                                                    'type' => 'array',
-                                                    'items' => [
-                                                        'title' => 'json类型的标准字段key。',
-                                                        'type' => 'object',
-                                                        'properties' => [
-                                                            'NormalizationFieldName' => [
-                                                                'title' => 'json类型的标准字段key名称。',
-                                                                'type' => 'string',
-                                                                'example' => 'cloud_code',
-                                                            ],
-                                                            'NormalizationFieldType' => [
-                                                                'title' => 'json类型的标准字段key类型。',
-                                                                'type' => 'string',
-                                                                'example' => 'varchar',
-                                                            ],
-                                                            'NormalizationFieldRequired' => [
-                                                                'title' => 'json类型的标准字段key是否必填。',
-                                                                'type' => 'boolean',
-                                                            ],
-                                                            'NormalizationFieldDescription' => [
-                                                                'title' => 'json类型的标准字段key描述。',
-                                                                'type' => 'string',
-                                                                'example' => '云code，枚举值：\\n<br>● alibaba_cloud\\n<br>● huawei_cloud\\n<br>● tencent_cloud',
-                                                            ],
-                                                            'NormalizationFieldExample' => [
-                                                                'title' => 'json类型的标准字段key示例。',
-                                                                'type' => 'string',
-                                                                'example' => 'alibaba_cloud',
-                                                            ],
-                                                            'NormalizationFieldFrom' => [
-                                                                'title' => 'json类型的标准字段key来源。',
-                                                                'type' => 'string',
-                                                                'example' => 'preset',
-                                                            ],
-                                                            'NormalizationFieldTokenize' => [
-                                                                'title' => 'json类型的标准字段key是否分词。',
-                                                                'type' => 'boolean',
-                                                            ],
-                                                            'NormalizationFieldReserved' => [
-                                                                'title' => '是否是系统内置的标准字段名。',
-                                                                'type' => 'boolean',
-                                                            ],
-                                                            'CreateTime' => [
-                                                                'title' => '创建时间。',
-                                                                'type' => 'integer',
-                                                                'format' => 'int64',
-                                                                'example' => '1736386610000',
-                                                            ],
-                                                            'UpdateTime' => [
-                                                                'title' => '更新时间。',
-                                                                'type' => 'integer',
-                                                                'format' => 'int64',
-                                                                'example' => '1736386610000',
-                                                            ],
-                                                        ],
-                                                    ],
-                                                ],
-                                                'CreateTime' => [
-                                                    'title' => '创建时间。',
-                                                    'type' => 'integer',
-                                                    'format' => 'int64',
-                                                    'example' => '1736386610000',
-                                                ],
-                                                'UpdateTime' => [
-                                                    'title' => '更新时间。',
-                                                    'type' => 'integer',
-                                                    'format' => 'int64',
-                                                    'example' => '1736386610000',
-                                                ],
-                                                'NormalizationFieldRequirement' => [
-                                                    'description' => '',
-                                                    'type' => 'boolean',
-                                                    'example' => 'true。',
-                                                ],
-                                            ],
-                                        ],
-                                    ],
-                                    'TargetLogStore' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'network-activity。',
-                                        'title' => '日志服务 LogStore。',
-                                    ],
-                                    'TargetStoreView' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'network_activity。',
-                                        'title' => '日志服务 StoreView。',
-                                    ],
-                                    'NormalizationSchemaType' => [
-                                        'title' => '标准结构类型，preset-预定义，custom-自定义',
-                                        'type' => 'string',
-                                        'example' => 'preset',
-                                    ],
-                                    'UpdateTime' => [
-                                        'title' => '更新时间。',
-                                        'type' => 'integer',
-                                        'format' => 'int64',
-                                        'example' => '1733269771123',
-                                    ],
-                                    'CreateTime' => [
-                                        'title' => '创建时间。',
-                                        'type' => 'integer',
-                                        'format' => 'int64',
-                                        'example' => '1733269771123',
-                                    ],
-                                    'NormalizationSchemaReferences' => [
-                                        'title' => '标准化结构引用列表。',
-                                        'type' => 'array',
-                                        'items' => [
-                                            'title' => '标准化结构引用。',
-                                            'type' => 'object',
-                                            'properties' => [
-                                                'NormalizationRuleId' => [
-                                                    'title' => '标准化规则ID。',
-                                                    'type' => 'string',
-                                                    'example' => 'alibaba_cloud_cfw_flow_rule',
-                                                ],
-                                            ],
-                                        ],
-                                    ],
-                                    'NormalizationSchemaFrom' => [
-                                        'title' => '标准化结构来源：preset-预定义，custom-自定义。',
-                                        'type' => 'string',
-                                        'example' => 'preset',
-                                    ],
-                                    'NormalizationSchemaDescription' => [
-                                        'title' => '标准化结构描述。',
-                                        'type' => 'string',
-                                        'example' => '网络五元组日志',
-                                    ],
-                                ],
+                            'RequestId' => ['title' => 'Id of the request', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
+                            'LogStores' => [
+                                'description' => 'The list of Simple Log Service Logstores.',
+                                'type' => 'array',
+                                'items' => ['description' => 'A Simple Log Service Logstore.', 'type' => 'string', 'example' => 'wadaaaa', 'title' => ''],
+                                'title' => '',
+                                'example' => '',
                             ],
+                            'MaxResults' => ['description' => 'The maximum number of entries returned on this call.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''],
+                            'NextToken' => ['description' => 'The token that is used to start the next query. If this parameter is empty, no subsequent query is required.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
+                            'TotalCount' => ['description' => 'The total number of records.', 'type' => 'integer', 'format' => 'int32', 'example' => '57', 'title' => ''],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"LogStores\\": [\\n    \\"wadaaaa\\"\\n  ],\\n  \\"MaxResults\\": 50,\\n  \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\",\\n  \\"TotalCount\\": 57\\n}","type":"json"}]',
+            'title' => 'ListLogStores',
+            'description' => 'The notification frequency is limited. Each user can receive up to two notifications per day between 08:00 and 20:00. No notifications are sent outside this time frame.',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'list',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ListLogStores',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"NormalizationSchema\\": {\\n    \\"NormalizationSchemaId\\": \\"HTTP_ACTIVITY\\",\\n    \\"NormalizationSchemaName\\": \\"normalization_rule_Z57np\\",\\n    \\"NormalizationCategoryId\\": \\"NETWORK_CATEGORY\\",\\n    \\"NormalizationFields\\": [\\n      {\\n        \\"NormalizationFieldName\\": \\"cloud_user\\",\\n        \\"NormalizationFieldType\\": \\"varchar\\",\\n        \\"NormalizationFieldRequired\\": true,\\n        \\"NormalizationFieldDescription\\": \\"cloud_user\\",\\n        \\"NormalizationFieldExample\\": \\"173326*******\\",\\n        \\"NormalizationFieldReserved\\": true,\\n        \\"NormalizationFieldFrom\\": \\"preset\\",\\n        \\"NormalizationFieldTokenize\\": true,\\n        \\"NormalizationFieldJsonIndexAll\\": true,\\n        \\"NormalizationFieldJsonKeys\\": [\\n          {\\n            \\"NormalizationFieldName\\": \\"cloud_code\\",\\n            \\"NormalizationFieldType\\": \\"varchar\\",\\n            \\"NormalizationFieldRequired\\": true,\\n            \\"NormalizationFieldDescription\\": \\"云code，枚举值：\\\\\\\\n<br>● alibaba_cloud\\\\\\\\n<br>● huawei_cloud\\\\\\\\n<br>● tencent_cloud\\",\\n            \\"NormalizationFieldExample\\": \\"alibaba_cloud\\",\\n            \\"NormalizationFieldFrom\\": \\"preset\\",\\n            \\"NormalizationFieldTokenize\\": true,\\n            \\"NormalizationFieldReserved\\": true,\\n            \\"CreateTime\\": 1736386610000,\\n            \\"UpdateTime\\": 1736386610000\\n          }\\n        ],\\n        \\"CreateTime\\": 1736386610000,\\n        \\"UpdateTime\\": 1736386610000,\\n        \\"NormalizationFieldRequirement\\": true\\n      }\\n    ],\\n    \\"TargetLogStore\\": \\"network-activity\\",\\n    \\"TargetStoreView\\": \\"network_activity\\",\\n    \\"NormalizationSchemaType\\": \\"log\\",\\n    \\"UpdateTime\\": 1733269771123,\\n    \\"CreateTime\\": 1733269771123,\\n    \\"NormalizationSchemaReferences\\": [\\n      {\\n        \\"NormalizationRuleId\\": \\"alibaba_cloud_cfw_flow_rule\\"\\n      }\\n    ],\\n    \\"NormalizationSchemaFrom\\": \\"preset\\",\\n    \\"NormalizationSchemaDescription\\": \\"网络五元组日志\\"\\n  }\\n}","type":"json"}]',
         ],
-        'GetNormalizationRuleVersion' => [
-            'summary' => '获取标准化规则指定版本信息',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'ListNormalizationCategories' => [
+            'summary' => 'Lists normalization categories.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
@@ -8007,363 +7755,343 @@
             'operationType' => 'read',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'get',
+                'operationType' => 'list',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The region of the Data Management center for threat analysis. Select the region for the Data Management center based on the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Assets are in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member. An administrator can use this parameter to switch to the perspective of this member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
                 [
-                    'name' => 'NormalizationRuleId',
+                    'name' => 'NormalizationCategoryType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'nr-z0b2ssjteut85uoh9nzp。',
-                    ],
+                    'schema' => ['description' => 'The type of the normalization rule category. Valid values:'."\n"
+                        ."\n"
+                        .'- log'."\n"
+                        ."\n"
+                        .'- entity', 'type' => 'string', 'required' => false, 'example' => 'entity', 'title' => ''],
                 ],
                 [
-                    'name' => 'NormalizationRuleVersion',
+                    'name' => 'MaxResults',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1。',
-                    ],
+                    'schema' => ['description' => 'The maximum number of entries to return on each page.', 'type' => 'integer', 'format' => 'int32', 'minimum' => '0', 'required' => false, 'example' => '50', 'title' => ''],
+                ],
+                [
+                    'name' => 'NextToken',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The token that is used to retrieve the next page of results. Set this parameter to the NextToken value returned in the previous API call to retrieve the next page of results. You do not need to specify this parameter for the first query.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'Schema of Response',
-                        'description' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。',
-                            ],
-                            'NormalizationRuleVersion' => [
-                                'description' => '',
-                                'type' => 'object',
-                                'properties' => [
-                                    'CreateTime' => [
-                                        'description' => '',
-                                        'type' => 'integer',
-                                        'format' => 'int64',
-                                        'example' => '1733269771123。',
-                                    ],
-                                    'UpdateTime' => [
-                                        'description' => '',
-                                        'type' => 'integer',
-                                        'format' => 'int64',
-                                        'example' => '1733269771123。',
-                                    ],
-                                    'NormalizationRuleId' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'nr-z0b2ssjteut85uoh9nzp。',
-                                    ],
-                                    'NormalizationRuleName' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'normalization_rule_Z57np。',
-                                    ],
-                                    'NormalizationRuleType' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'predefined。',
-                                    ],
-                                    'NormalizationRuleFormat' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'SPL。',
-                                    ],
-                                    'NormalizationRuleDescription' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'normalization_rule_Z57np。',
-                                    ],
-                                    'NormalizationRuleVersion' => [
-                                        'description' => '',
-                                        'type' => 'integer',
-                                        'example' => 'V1。',
-                                        'format' => 'int32',
-                                    ],
-                                    'NormalizationRuleExpression' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => '* | pack-fields -include=\'[\\s\\S]+\' as extend_content。',
-                                    ],
-                                    'NormalizationRuleStatus' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'started。',
-                                    ],
-                                    'NormalizationCategoryId' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'NETWORK_CATEGORY。',
-                                    ],
-                                    'NormalizationSchemaId' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'HTTP_ACTIVITY。',
-                                    ],
-                                    'VendorId' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'alibaba_cloud。',
-                                    ],
-                                    'ProductId' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'alibaba_cloud_sas。',
-                                    ],
-                                    'NormalizationRuleVersionName' => [
-                                        'type' => 'string',
-                                    ],
-                                    'RegionId' => [
-                                        'type' => 'string',
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''],
+                            'NormalizationCategories' => [
+                                'description' => 'A list of normalization categories.',
+                                'type' => 'array',
+                                'items' => [
+                                    'description' => 'A normalization category.',
+                                    'type' => 'object',
+                                    'properties' => [
+                                        'NormalizationCategoryId' => ['description' => 'The ID of the normalization category.', 'type' => 'string', 'example' => 'COMMON_CATEGORY', 'title' => ''],
+                                        'NormalizationCategoryName' => ['description' => 'The name of the normalization category.', 'type' => 'string', 'example' => 'COMMON_CATEGORY', 'title' => ''],
                                     ],
+                                    'title' => '',
+                                    'example' => '',
                                 ],
+                                'title' => '',
+                                'example' => '',
                             ],
+                            'MaxResults' => ['description' => 'The maximum number of entries returned on the current page.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''],
+                            'NextToken' => ['description' => 'The token that is used to retrieve the next page of results. If the response does not contain this parameter, no more results are available.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
+                            'TotalCount' => ['description' => 'The total number of entries.', 'type' => 'integer', 'format' => 'int32', 'example' => '57', 'title' => ''],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"NormalizationCategories\\": [\\n    {\\n      \\"NormalizationCategoryId\\": \\"COMMON_CATEGORY\\",\\n      \\"NormalizationCategoryName\\": \\"COMMON_CATEGORY\\"\\n    }\\n  ],\\n  \\"MaxResults\\": 50,\\n  \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\",\\n  \\"TotalCount\\": 57\\n}","type":"json"}]',
+            'title' => 'ListNormalizationCategories',
+            'description' => 'Notifications are subject to frequency and time limits. Each user can receive a maximum of two notifications per day between 08:00 and 20:00.',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'list',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ListNormalizationCategories',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"NormalizationRuleVersion\\": {\\n    \\"CreateTime\\": 1733269771123,\\n    \\"UpdateTime\\": 1733269771123,\\n    \\"NormalizationRuleId\\": \\"nr-z0b2ssjteut85uoh9nzp\\",\\n    \\"NormalizationRuleName\\": \\"normalization_rule_Z57np\\",\\n    \\"NormalizationRuleType\\": \\"predefined\\",\\n    \\"NormalizationRuleFormat\\": \\"SPL\\",\\n    \\"NormalizationRuleDescription\\": \\"normalization_rule_Z57np\\",\\n    \\"NormalizationRuleVersion\\": 0,\\n    \\"NormalizationRuleExpression\\": \\"* | pack-fields -include=\'[\\\\\\\\s\\\\\\\\S]+\' as extend_content\\",\\n    \\"NormalizationRuleStatus\\": \\"started\\",\\n    \\"NormalizationCategoryId\\": \\"NETWORK_CATEGORY\\",\\n    \\"NormalizationSchemaId\\": \\"HTTP_ACTIVITY\\",\\n    \\"VendorId\\": \\"alibaba_cloud\\",\\n    \\"ProductId\\": \\"alibaba_cloud_sas\\",\\n    \\"NormalizationRuleVersionName\\": \\"v1\\",\\n    \\"RegionId\\": \\"cn-hangzhou\\"\\n  }\\n}","type":"json"}]',
         ],
-        'DeleteNormalizationRuleVersion' => [
-            'summary' => '删除标准化规则版本',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'ListNormalizationFields' => [
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'write',
+            'operationType' => 'read',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'delete',
+                'operationType' => 'list',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the region where your assets reside. Valid values:'."\n"
+                        .'- cn-hangzhou: Your assets reside in the Chinese mainland.'."\n"
+                        .'- ap-southeast-1: Your assets reside outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
+                    'schema' => ['description' => 'The ID of the member to which the administrator switches the view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
                 [
-                    'name' => 'NormalizationRuleId',
+                    'name' => 'Name',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'nr-z0b2ssjteut85uoh9nzp。',
-                    ],
+                    'schema' => ['description' => 'The field name.', 'type' => 'string', 'required' => false, 'example' => 'category', 'title' => ''],
                 ],
                 [
-                    'name' => 'NormalizationRuleVersion',
+                    'name' => 'MaxResults',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1。',
-                    ],
+                    'schema' => ['description' => 'The maximum number of entries to return in this request.', 'type' => 'integer', 'format' => 'int32', 'minimum' => '0', 'required' => false, 'example' => '50', 'title' => ''],
+                ],
+                [
+                    'name' => 'NextToken',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'Specifies whether a next query token exists. You do not need to specify this parameter for the first query or if no next query exists. If a next query exists, set this parameter to the NextToken value returned by the previous API call.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
+                ],
+                [
+                    'name' => 'NormalizationFieldSource',
+                    'in' => 'formData',
+                    'schema' => ['type' => 'string', 'example' => 'native', 'description' => '', 'title' => ''],
+                ],
+                [
+                    'name' => 'NormalizationSchemaType',
+                    'in' => 'formData',
+                    'schema' => ['type' => 'string', 'example' => 'log', 'description' => '', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'Schema of Response',
-                        'description' => '',
+                        'title' => '',
+                        'description' => 'The response struct.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。',
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''],
+                            'NormalizationFields' => [
+                                'description' => 'The list of normalization fields.',
+                                'type' => 'array',
+                                'items' => [
+                                    'description' => 'The normalization field.',
+                                    'type' => 'object',
+                                    'properties' => [
+                                        'NormalizationFieldName' => ['description' => 'The name of the normalization field.', 'type' => 'string', 'example' => 'cloud_user', 'title' => ''],
+                                        'NormalizationFieldType' => ['description' => 'The type of the normalization field. Valid values:'."\n"
+                                            .'- varchar'."\n"
+                                            .'- bigint'."\n"
+                                            .'- double.', 'type' => 'string', 'example' => 'varchar', 'title' => ''],
+                                        'NormalizationFieldRequired' => ['title' => '', 'description' => 'Indicates whether the normalization field key is required.', 'type' => 'boolean', 'example' => ''],
+                                        'NormalizationFieldDescription' => ['description' => 'The description of the normalization field.', 'type' => 'string', 'example' => 'cloud_user', 'title' => ''],
+                                        'NormalizationFieldExample' => ['description' => 'The example value of the normalization field.', 'type' => 'string', 'example' => '173326*******', 'title' => ''],
+                                        'NormalizationCategoryId' => ['description' => 'The ID of the normalization category.', 'type' => 'string', 'example' => 'NETWORK_CATEGORY', 'title' => ''],
+                                        'NormalizationSchemaId' => ['description' => 'The ID of the normalization schema.', 'type' => 'string', 'example' => 'NETWORK_SESSION_ACTIVITY', 'title' => ''],
+                                        'NormalizationFieldReserved' => ['description' => 'Indicates whether the normalization field is reserved.', 'type' => 'boolean', 'example' => 'true', 'title' => ''],
+                                        'NormalizationFieldFrom' => ['title' => '', 'description' => 'The source of the normalization field key of the JSON type.', 'type' => 'string', 'example' => 'preset'],
+                                        'NormalizationFieldTokenize' => ['title' => '', 'description' => 'Indicates whether the normalization field is tokenized.', 'type' => 'boolean', 'example' => ''],
+                                        'NormalizationFieldJsonIndexAll' => ['title' => '', 'description' => 'Indicates whether indexes are created for all keys of the JSON-type normalization field.', 'type' => 'boolean', 'example' => ''],
+                                        'NormalizationFieldJsonKeys' => [
+                                            'title' => '',
+                                            'description' => 'The list of keys for the JSON-type normalization field.',
+                                            'type' => 'array',
+                                            'items' => [
+                                                'title' => '',
+                                                'description' => 'The key of the JSON-type normalization field.',
+                                                'type' => 'object',
+                                                'properties' => [
+                                                    'NormalizationFieldName' => ['title' => '', 'description' => 'The name of the JSON-type normalization field key.', 'type' => 'string', 'example' => 'alert_level'],
+                                                    'NormalizationFieldType' => ['title' => '', 'description' => 'The type of the JSON-type normalization field key.', 'type' => 'string', 'example' => 'text'],
+                                                    'NormalizationFieldRequired' => ['title' => '', 'description' => 'Indicates whether the JSON-type normalization field key is required.', 'type' => 'boolean', 'example' => ''],
+                                                    'NormalizationFieldDescription' => ['title' => '', 'description' => 'The description of the JSON-type normalization field key.', 'type' => 'string', 'example' => 'alert_level'],
+                                                    'NormalizationFieldExample' => ['title' => '', 'description' => 'The example value of the JSON-type normalization field key.', 'type' => 'string', 'example' => '1'],
+                                                    'NormalizationFieldFrom' => ['title' => '', 'description' => 'The source of the normalization field key of the JSON type.', 'type' => 'string', 'example' => 'preset'],
+                                                    'NormalizationFieldTokenize' => ['title' => '', 'description' => 'Indicates whether the JSON-type normalization field key is tokenized.', 'type' => 'boolean', 'example' => ''],
+                                                    'NormalizationFieldReserved' => ['title' => '', 'description' => 'Indicates whether the normalization field key is a built-in system field key.', 'type' => 'boolean', 'example' => ''],
+                                                    'CreateTime' => ['title' => '', 'description' => 'The creation time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1736386610000'],
+                                                    'UpdateTime' => ['title' => '', 'description' => 'The update time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1736386610000'],
+                                                ],
+                                                'example' => '',
+                                            ],
+                                            'example' => '',
+                                        ],
+                                        'CreateTime' => ['title' => '', 'description' => 'The creation time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1736386610000'],
+                                        'UpdateTime' => ['title' => '', 'description' => 'The update time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1736386610000'],
+                                        'NormalizationFieldRequirement' => ['description' => 'Indicates whether the normalization field is required.', 'type' => 'boolean', 'example' => 'true', 'title' => ''],
+                                        'NormalizationSecurityDomainId' => ['type' => 'string', 'example' => 'NETWORK_AND_WEB_SECURITY', 'description' => '', 'title' => ''],
+                                    ],
+                                    'title' => '',
+                                    'example' => '',
+                                ],
+                                'title' => '',
+                                'example' => '',
                             ],
+                            'MaxResults' => ['description' => 'The maximum number of entries to return in this request.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''],
+                            'NextToken' => ['description' => 'Specifies whether a next query token exists. You do not need to specify this parameter for the first query or if no next query exists. If a next query exists, set this parameter to the NextToken value returned by the previous API call.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
+                            'TotalCount' => ['description' => 'The total number of records.', 'type' => 'integer', 'format' => 'int32', 'example' => '57', 'title' => ''],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
+                ],
+            ],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'Retrieve normalization field list',
+            'summary' => 'Retrieves a list of normalization fields.',
+            'description' => 'The input parameter JsonConfig is a complex JSON configuration. A utility class is provided to help with specific configuration examples. For more information, see [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'list',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ListNormalizationFields',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
                     ],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"NormalizationFields\\": [\\n    {\\n      \\"NormalizationFieldName\\": \\"cloud_user\\",\\n      \\"NormalizationFieldType\\": \\"varchar\\",\\n      \\"NormalizationFieldRequired\\": false,\\n      \\"NormalizationFieldDescription\\": \\"cloud_user\\",\\n      \\"NormalizationFieldExample\\": \\"173326*******\\",\\n      \\"NormalizationCategoryId\\": \\"NETWORK_CATEGORY\\",\\n      \\"NormalizationSchemaId\\": \\"NETWORK_SESSION_ACTIVITY\\",\\n      \\"NormalizationFieldReserved\\": true,\\n      \\"NormalizationFieldFrom\\": \\"preset\\",\\n      \\"NormalizationFieldTokenize\\": false,\\n      \\"NormalizationFieldJsonIndexAll\\": false,\\n      \\"NormalizationFieldJsonKeys\\": [\\n        {\\n          \\"NormalizationFieldName\\": \\"alert_level\\",\\n          \\"NormalizationFieldType\\": \\"text\\",\\n          \\"NormalizationFieldRequired\\": false,\\n          \\"NormalizationFieldDescription\\": \\"alert_level\\",\\n          \\"NormalizationFieldExample\\": \\"1\\",\\n          \\"NormalizationFieldFrom\\": \\"preset\\",\\n          \\"NormalizationFieldTokenize\\": false,\\n          \\"NormalizationFieldReserved\\": false,\\n          \\"CreateTime\\": 1736386610000,\\n          \\"UpdateTime\\": 1736386610000\\n        }\\n      ],\\n      \\"CreateTime\\": 1736386610000,\\n      \\"UpdateTime\\": 1736386610000,\\n      \\"NormalizationFieldRequirement\\": true,\\n      \\"NormalizationSecurityDomainId\\": \\"NETWORK_AND_WEB_SECURITY\\"\\n    }\\n  ],\\n  \\"MaxResults\\": 50,\\n  \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\",\\n  \\"TotalCount\\": 57\\n}","type":"json"}]',
         ],
-        'SetDefaultNormalizationRuleVersion' => [
-            'summary' => '设置标准化规则默认版本',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'ListNormalizationRuleCapacities' => [
+            'summary' => 'Lists the security capabilities of normalization rules.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'write',
+            'operationType' => 'read',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'none',
+                'operationType' => 'list',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The region of the threat analysis Data Management Center. Select the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
+                    'schema' => ['description' => 'The user ID that an administrator uses to switch to a member\'s perspective.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
                 [
-                    'name' => 'NormalizationRuleVersion',
+                    'name' => 'NormalizationRuleId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => 'V1。',
-                    ],
+                    'schema' => ['description' => 'The ID of the normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'nr-z0b2ssjteut85uoh9nzp', 'title' => ''],
                 ],
                 [
-                    'name' => 'NormalizationRuleId',
+                    'name' => 'MaxResults',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The maximum number of entries to return on each page.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'minimum' => '0', 'example' => '50', 'title' => ''],
+                ],
+                [
+                    'name' => 'NextToken',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The token to start the next query. Leave this parameter empty for the first query. If the response is truncated, use the \\`NextToken\\` value from the previous response.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
+                ],
+                [
+                    'name' => 'NormalizationRuleIds',
                     'in' => 'formData',
+                    'style' => 'simple',
                     'schema' => [
-                        'description' => '',
-                        'type' => 'string',
+                        'description' => 'A list of normalization rule IDs.',
+                        'type' => 'array',
+                        'items' => ['description' => 'The ID of the normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'nr-z0b2ssjteut85uoh9nzp', 'title' => ''],
                         'required' => false,
-                        'example' => 'nr-z0b2ssjteut85uoh9nzp。',
+                        'title' => '',
+                        'example' => '',
                     ],
                 ],
             ],
@@ -8371,119 +8099,83 @@
                 200 => [
                     'schema' => [
                         'title' => 'Schema of Response',
-                        'description' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。',
-                            ],
-                            'NormalizationRuleVersion' => [
-                                'description' => '',
-                                'type' => 'object',
-                                'properties' => [
-                                    'CreateTime' => [
-                                        'description' => '',
-                                        'type' => 'integer',
-                                        'format' => 'int64',
-                                        'example' => '1733269771123。',
-                                    ],
-                                    'UpdateTime' => [
-                                        'description' => '',
-                                        'type' => 'integer',
-                                        'format' => 'int64',
-                                        'example' => '1733269771123。',
-                                    ],
-                                    'NormalizationRuleId' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'nr-z0b2ssjteut85uoh9nzp。',
-                                    ],
-                                    'NormalizationRuleName' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'normalization_rule_Z57np。',
-                                    ],
-                                    'NormalizationRuleType' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'predefined。',
-                                    ],
-                                    'NormalizationRuleFormat' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'SPL。',
-                                    ],
-                                    'NormalizationRuleDescription' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'normalization_rule_Z57np。',
-                                    ],
-                                    'NormalizationRuleVersion' => [
-                                        'description' => '',
-                                        'type' => 'integer',
-                                        'example' => 'V1。',
-                                        'format' => 'int32',
-                                    ],
-                                    'NormalizationRuleExpression' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => '* | pack-fields -include=\'[\\s\\S]+\' as extend_content。',
-                                    ],
-                                    'NormalizationRuleStatus' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'started。',
-                                    ],
-                                    'NormalizationCategoryId' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'NETWORK_CATEGORY。',
-                                    ],
-                                    'NormalizationSchemaId' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'HTTP_ACTIVITY。',
-                                    ],
-                                    'VendorId' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'alibaba_cloud。',
-                                    ],
-                                    'ProductId' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'alibaba_cloud_sas。',
+                            'RequestId' => ['description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''],
+                            'NormalizationRuleCapacities' => [
+                                'description' => 'The list of security capabilities that are associated with the normalization rules.',
+                                'type' => 'array',
+                                'items' => [
+                                    'description' => 'The security capability that is associated with the normalization rule.',
+                                    'type' => 'object',
+                                    'properties' => [
+                                        'CapacityType' => ['description' => 'The type of the security capability. Valid values:'."\n"
+                                            ."\n"
+                                            .'- detection\\_preset\\_rule: predefined analysis rule.'."\n"
+                                            ."\n"
+                                            .'- detection\\_custom\\_rule: custom analysis rule.'."\n"
+                                            ."\n"
+                                            .'- incident\\_investigation: security event handling.'."\n"
+                                            ."\n"
+                                            .'- soar\\_playbooks: predefined playbook.', 'type' => 'string', 'example' => 'detection_preset_rule', 'title' => ''],
+                                        'Capacities' => [
+                                            'description' => 'The list of security capabilities.',
+                                            'type' => 'array',
+                                            'items' => ['description' => 'The security capability.', 'type' => 'string', 'example' => 'NETWORK_SESSION_ACTIVITY', 'title' => ''],
+                                            'title' => '',
+                                            'example' => '',
+                                        ],
+                                        'NormalizationRuleId' => ['description' => 'The ID of the normalization rule.', 'type' => 'string', 'example' => 'nr-z0b2ssjteut85uoh9nzp', 'title' => ''],
                                     ],
+                                    'title' => '',
+                                    'example' => '',
                                 ],
-                            ],
+                                'title' => '',
+                                'example' => '',
+                            ],
+                            'PageNumber' => ['description' => 'The page number.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''],
+                            'PageSize' => ['description' => 'The number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10', 'title' => ''],
+                            'TotalCount' => ['description' => 'The total number of entries.', 'type' => 'integer', 'format' => 'int32', 'example' => '57', 'title' => ''],
+                            'TotalPage' => ['description' => 'The total number of pages.', 'type' => 'integer', 'format' => 'int32', 'example' => '3', 'title' => ''],
+                            'MaxResults' => ['description' => 'The maximum number of entries returned.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''],
+                            'NextToken' => ['description' => 'The token for the next query. If the response is truncated, use this token in your next request to retrieve the next page of results. If this parameter is empty, all results have been returned.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"NormalizationRuleCapacities\\": [\\n    {\\n      \\"CapacityType\\": \\"detection_preset_rule\\",\\n      \\"Capacities\\": [\\n        \\"NETWORK_SESSION_ACTIVITY\\"\\n      ],\\n      \\"NormalizationRuleId\\": \\"nr-z0b2ssjteut85uoh9nzp\\"\\n    }\\n  ],\\n  \\"PageNumber\\": 1,\\n  \\"PageSize\\": 10,\\n  \\"TotalCount\\": 57,\\n  \\"TotalPage\\": 3,\\n  \\"MaxResults\\": 50,\\n  \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\"\\n}","type":"json"}]',
+            'title' => 'ListNormalizationRuleCapacities',
+            'description' => 'The \\`JsonConfig\\` request parameter is a complex JSON configuration. A helper tool class is provided with configuration examples. For more information, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'list',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ListNormalizationRuleCapacities',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"NormalizationRuleVersion\\": {\\n    \\"CreateTime\\": 1733269771123,\\n    \\"UpdateTime\\": 1733269771123,\\n    \\"NormalizationRuleId\\": \\"nr-z0b2ssjteut85uoh9nzp\\",\\n    \\"NormalizationRuleName\\": \\"normalization_rule_Z57np\\",\\n    \\"NormalizationRuleType\\": \\"predefined\\",\\n    \\"NormalizationRuleFormat\\": \\"SPL\\",\\n    \\"NormalizationRuleDescription\\": \\"normalization_rule_Z57np\\",\\n    \\"NormalizationRuleVersion\\": 0,\\n    \\"NormalizationRuleExpression\\": \\"* | pack-fields -include=\'[\\\\\\\\s\\\\\\\\S]+\' as extend_content\\",\\n    \\"NormalizationRuleStatus\\": \\"started\\",\\n    \\"NormalizationCategoryId\\": \\"NETWORK_CATEGORY\\",\\n    \\"NormalizationSchemaId\\": \\"HTTP_ACTIVITY\\",\\n    \\"VendorId\\": \\"alibaba_cloud\\",\\n    \\"ProductId\\": \\"alibaba_cloud_sas\\"\\n  }\\n}","type":"json"}]',
         ],
         'ListNormalizationRuleVersions' => [
-            'summary' => '获取标准化规则版本列表',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
-            ],
+            'summary' => 'Queries a list of normalization rule versions.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
@@ -8495,168 +8187,114 @@
                 'operationType' => 'list',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The region where the Data Management Center for threat analysis is located. Select the region for the Management Center based on the region of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in a region outside Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
-                    ],
+                    'schema' => ['description' => 'The language of the response messages. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member. An administrator can use this parameter to switch to the perspective of this member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
                 [
                     'name' => 'NormalizationRuleId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'nr-z0b2ssjteut85uoh9nzp。',
-                    ],
+                    'schema' => ['description' => 'The ID of the normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'nr-z0b2ssjteut85uoh9nzp', 'title' => ''],
                 ],
                 [
                     'name' => 'MaxResults',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'minimum' => '0',
-                        'example' => '50。',
-                    ],
+                    'schema' => ['description' => 'The maximum number of entries to return for the current request.', 'type' => 'integer', 'format' => 'int32', 'minimum' => '0', 'required' => false, 'example' => '50', 'title' => ''],
                 ],
                 [
                     'name' => 'NextToken',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****。',
-                    ],
+                    'schema' => ['description' => 'The token that is used to retrieve the next page of results. You do not need to specify this parameter for the first request. If a next page exists, set this parameter to the value of NextToken that is returned from the last call.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'Schema of Response',
-                        'description' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。',
-                            ],
+                            'RequestId' => ['description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''],
                             'NormalizationRuleVersions' => [
-                                'description' => '',
+                                'description' => 'The list of normalization rule versions.',
                                 'type' => 'array',
                                 'items' => [
-                                    'description' => '',
+                                    'description' => 'The normalization rule version.',
                                     'type' => 'object',
                                     'properties' => [
-                                        'CreateTime' => [
-                                            'description' => '',
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '1733269771123。',
-                                        ],
-                                        'UpdateTime' => [
-                                            'description' => '',
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '1733269771123。',
-                                        ],
-                                        'NormalizationRuleId' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'nr-z0b2ssjteut85uoh9nzp。',
-                                        ],
-                                        'NormalizationRuleVersion' => [
-                                            'description' => '',
-                                            'type' => 'integer',
-                                            'example' => 'V1。',
-                                            'format' => 'int32',
-                                        ],
-                                        'NormalizationRuleExpression' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => '* | pack-fields -include=\'[\\s\\S]+\' as extend_content。',
-                                        ],
-                                    ],
+                                        'CreateTime' => ['description' => 'The time when the version was created.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''],
+                                        'UpdateTime' => ['description' => 'The time when the version was updated.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''],
+                                        'NormalizationRuleId' => ['description' => 'The ID of the normalization rule.', 'type' => 'string', 'example' => 'nr-z0b2ssjteut85uoh9nzp', 'title' => ''],
+                                        'NormalizationRuleVersion' => ['description' => 'The version of the normalization rule.', 'type' => 'integer', 'format' => 'int32', 'example' => 'V1', 'title' => ''],
+                                        'NormalizationRuleExpression' => ['description' => 'The expression of the normalization rule.', 'type' => 'string', 'example' => '* | pack-fields -include=\'[\\s\\S]+\' as extend_content', 'title' => ''],
+                                    ],
+                                    'title' => '',
+                                    'example' => '',
                                 ],
+                                'title' => '',
+                                'example' => '',
                             ],
-                            'MaxResults' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '50。',
-                            ],
-                            'NextToken' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****。',
-                            ],
-                            'TotalCount' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '57。',
-                            ],
+                            'MaxResults' => ['description' => 'The maximum number of entries returned on each page.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''],
+                            'NextToken' => ['description' => 'The pagination token that is used in the next request to retrieve a new page of results. If the NextToken parameter is empty, no more results are available.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
+                            'TotalCount' => ['description' => 'The total number of records.', 'type' => 'integer', 'format' => 'int32', 'example' => '57', 'title' => ''],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
+            'staticInfo' => ['returnType' => 'synchronous'],
             'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"NormalizationRuleVersions\\": [\\n    {\\n      \\"CreateTime\\": 1733269771123,\\n      \\"UpdateTime\\": 1733269771123,\\n      \\"NormalizationRuleId\\": \\"nr-z0b2ssjteut85uoh9nzp\\",\\n      \\"NormalizationRuleVersion\\": 0,\\n      \\"NormalizationRuleExpression\\": \\"* | pack-fields -include=\'[\\\\\\\\s\\\\\\\\S]+\' as extend_content\\"\\n    }\\n  ],\\n  \\"MaxResults\\": 50,\\n  \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\",\\n  \\"TotalCount\\": 57\\n}","type":"json"}]',
+            'title' => 'ListNormalizationRuleVersions',
+            'description' => 'The JsonConfig input parameter is a complex JSON configuration. A supporting tool class is available and provides configuration examples. For more information, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'list',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ListNormalizationRuleVersions',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'NormalizationRuleVersion', 'arn' => 'acs:yundun-sas::{#accountId}:normalizationruleversion/*'],
+                        ],
+                    ],
+                ],
+            ],
         ],
         'ListNormalizationRules' => [
-            'summary' => '获取标准化规则列表',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
-            ],
+            'summary' => 'Retrieves a list of normalization rules.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
@@ -8668,366 +8306,216 @@
                 'operationType' => 'list',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The region where the data management center of the threat analysis feature resides. Specify this parameter based on the region where your assets reside. Valid values:'."\n"
+                        .'- cn-hangzhou: the Chinese mainland.'."\n"
+                        .'- ap-southeast-1: outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member to which the administrator switches the view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
                 [
                     'name' => 'NormalizationRuleIds',
                     'in' => 'formData',
                     'style' => 'simple',
                     'schema' => [
-                        'description' => '',
+                        'description' => 'The list of normalization rule IDs.',
                         'type' => 'array',
-                        'items' => [
-                            'description' => '',
-                            'type' => 'string',
-                            'required' => false,
-                            'example' => 'nr-z0b2ssjteut85uoh9nzp。',
-                        ],
+                        'items' => ['description' => 'The normalization rule ID.', 'type' => 'string', 'required' => false, 'example' => 'nr-z0b2ssjteut85uoh9nzp', 'title' => ''],
                         'required' => false,
+                        'title' => '',
+                        'example' => '',
                     ],
                 ],
                 [
                     'name' => 'NormalizationRuleName',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'normalization_rule_Z57np。',
-                    ],
+                    'schema' => ['description' => 'The name of the normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'normalization_rule_Z57np', 'title' => ''],
                 ],
                 [
                     'name' => 'NormalizationRuleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'predefined。',
-                    ],
+                    'schema' => ['description' => 'The type of the normalization rule. Valid values:'."\n"
+                        .'- predefined: predefined normalization rule.'."\n"
+                        .'- custom: custom normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'predefined', 'title' => ''],
                 ],
                 [
                     'name' => 'NormalizationCategoryId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'NETWORK_CATEGORY。',
-                    ],
+                    'schema' => ['description' => 'The category ID of the normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'NETWORK_CATEGORY', 'title' => ''],
                 ],
                 [
                     'name' => 'NormalizationSchemaId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'HTTP_ACTIVITY。',
-                    ],
+                    'schema' => ['description' => 'The normalization schema ID.', 'type' => 'string', 'required' => false, 'example' => 'HTTP_ACTIVITY', 'title' => ''],
                 ],
                 [
                     'name' => 'VendorId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'alibaba_cloud。',
-                    ],
+                    'schema' => ['description' => 'The vendor ID associated with the normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud', 'title' => ''],
                 ],
                 [
                     'name' => 'ProductId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'alibaba_cloud_sas。',
-                    ],
+                    'schema' => ['description' => 'The product ID.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_sas', 'title' => ''],
+                ],
+                [
+                    'name' => 'NormalizationSecurityDomainId',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'type' => 'string', 'example' => 'NETWORK_AND_WEB_SECURITY', 'description' => ''],
                 ],
                 [
                     'name' => 'PageNumber',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '3。',
-                    ],
+                    'schema' => ['description' => 'The page number of the current page.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '3', 'title' => ''],
                 ],
                 [
                     'name' => 'PageSize',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '10。',
-                    ],
+                    'schema' => ['description' => 'The number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '10', 'title' => ''],
                 ],
                 [
                     'name' => 'OrderField',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'UpdateTime。',
-                    ],
+                    'schema' => ['description' => 'The field used for sorting.', 'type' => 'string', 'required' => false, 'example' => 'UpdateTime', 'title' => ''],
                 ],
                 [
                     'name' => 'OrderType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'desc。',
-                    ],
+                    'schema' => ['description' => 'The sort order. Valid values:'."\n"
+                        .'- desc'."\n"
+                        .'- asc.', 'type' => 'string', 'required' => false, 'example' => 'desc', 'title' => ''],
                 ],
                 [
                     'name' => 'MaxResults',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'minimum' => '0',
-                        'example' => '50。',
-                    ],
+                    'schema' => ['description' => 'The maximum number of entries to return in this request.', 'type' => 'integer', 'format' => 'int32', 'minimum' => '0', 'required' => false, 'example' => '50', 'title' => ''],
                 ],
                 [
                     'name' => 'NextToken',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****。',
-                    ],
+                    'schema' => ['description' => 'The pagination token for the next query. Leave this parameter empty for the first query or if no more results exist. If more results exist, set this parameter to the NextToken value returned by the previous API call.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'Schema of Response',
-                        'description' => '',
+                        'title' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。',
-                            ],
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''],
                             'NormalizationRules' => [
-                                'description' => '',
+                                'description' => 'The list of normalization rules.',
                                 'type' => 'array',
                                 'items' => [
-                                    'description' => '',
+                                    'description' => 'The normalization rule.',
                                     'type' => 'object',
                                     'properties' => [
-                                        'CreateTime' => [
-                                            'description' => '',
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '1733269771123。',
-                                        ],
-                                        'UpdateTime' => [
-                                            'description' => '',
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '1733269771123。',
-                                        ],
-                                        'NormalizationRuleId' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'nr-z0b2ssjteut85uoh9nzp。',
-                                        ],
-                                        'NormalizationRuleName' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'normalization_rule_Z57np。',
-                                        ],
-                                        'NormalizationRuleType' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'predefined。',
-                                        ],
-                                        'NormalizationRuleFormat' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'SPL。',
-                                        ],
-                                        'NormalizationRuleDescription' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'normalization_rule_Z57np。',
-                                        ],
-                                        'NormalizationRuleVersion' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'V1。',
-                                        ],
-                                        'NormalizationRuleExpression' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => '* | pack-fields -include=\'[\\s\\S]+\' as extend_content。',
-                                        ],
-                                        'NormalizationRuleStatus' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'started。',
-                                        ],
-                                        'NormalizationCategoryId' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'NETWORK_CATEGORY。',
-                                        ],
-                                        'NormalizationSchemaId' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'HTTP_ACTIVITY。',
-                                        ],
-                                        'VendorId' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'alibaba_cloud。',
-                                        ],
-                                        'ProductId' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'alibaba_cloud_sas。',
-                                        ],
+                                        'CreateTime' => ['description' => 'The creation time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''],
+                                        'UpdateTime' => ['description' => 'The update time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''],
+                                        'NormalizationRuleId' => ['description' => 'The normalization rule ID.', 'type' => 'string', 'example' => 'nr-z0b2ssjteut85uoh9nzp', 'title' => ''],
+                                        'NormalizationRuleName' => ['description' => 'The name of the normalization rule.', 'type' => 'string', 'example' => 'normalization_rule_Z57np', 'title' => ''],
+                                        'NormalizationRuleType' => ['description' => 'The type of the normalization rule. Valid values:'."\n"
+                                            .'- predefined: predefined normalization rule.'."\n"
+                                            .'- custom: custom normalization rule.', 'type' => 'string', 'example' => 'predefined', 'title' => ''],
+                                        'NormalizationRuleFormat' => ['description' => 'The format of the normalization rule.', 'type' => 'string', 'example' => 'SPL', 'title' => ''],
+                                        'NormalizationRuleDescription' => ['description' => 'The description of the normalization rule.', 'type' => 'string', 'example' => 'normalization_rule_Z57np', 'title' => ''],
+                                        'NormalizationRuleVersion' => ['description' => 'The current version of the normalization rule.', 'type' => 'string', 'example' => 'V1', 'title' => ''],
+                                        'NormalizationRuleExpression' => ['description' => 'The expression of the normalization rule.', 'type' => 'string', 'example' => '* | pack-fields -include=\'[\\s\\S]+\' as extend_content', 'title' => ''],
+                                        'NormalizationRuleStatus' => ['description' => 'The status of the normalization rule.', 'type' => 'string', 'example' => 'started', 'title' => ''],
+                                        'NormalizationCategoryId' => ['description' => 'The category ID of the normalization rule.', 'type' => 'string', 'example' => 'NETWORK_CATEGORY', 'title' => ''],
+                                        'NormalizationSchemaId' => ['description' => 'The normalization schema ID.', 'type' => 'string', 'example' => 'HTTP_ACTIVITY', 'title' => ''],
+                                        'VendorId' => ['description' => 'The vendor ID associated with the normalization rule.', 'type' => 'string', 'example' => 'alibaba_cloud', 'title' => ''],
+                                        'ProductId' => ['description' => 'The product ID.', 'type' => 'string', 'example' => 'alibaba_cloud_sas', 'title' => ''],
                                         'NormalizationRuleReferences' => [
-                                            'description' => '',
+                                            'description' => 'The list of associated ingestion policies.',
                                             'type' => 'array',
                                             'items' => [
-                                                'description' => '',
+                                                'description' => 'The associated ingestion policy.',
                                                 'type' => 'object',
                                                 'properties' => [
-                                                    'DataIngestionId' => [
-                                                        'description' => '',
-                                                        'type' => 'string',
-                                                        'example' => 'alibaba_cloud_bot_flow_ingestion_173326*******。',
-                                                    ],
+                                                    'DataIngestionId' => ['description' => 'The data ingestion ID.', 'type' => 'string', 'example' => 'alibaba_cloud_bot_flow_ingestion_173326*******', 'title' => ''],
                                                 ],
+                                                'title' => '',
+                                                'example' => '',
                                             ],
-                                        ],
-                                        'NormalizationRuleMode' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'both。',
-                                        ],
-                                        'ExtendContentPacked' => [
-                                            'type' => 'string',
-                                        ],
-                                        'ExtendFieldStoreMode' => [
-                                            'title' => '扩展字段存储模式，flat-原样接入，reject-不接入，pack-打包到extend_content字段。',
-                                            'type' => 'string',
-                                            'example' => 'flat',
-                                        ],
-                                    ],
+                                            'title' => '',
+                                            'example' => '',
+                                        ],
+                                        'NormalizationRuleMode' => ['description' => 'The mode of the normalization rule. Valid values:'."\n"
+                                            .'- both'."\n"
+                                            .'- scan'."\n"
+                                            .'- realtime.', 'type' => 'string', 'example' => 'both', 'title' => ''],
+                                        'ExtendContentPacked' => ['description' => 'Specifies whether non-standard fields are packed into the extend_content field. Valid values:'."\n"
+                                            .'- enabled: Enabled.'."\n"
+                                            .'- disabled: Disabled.', 'type' => 'string', 'example' => 'enabled', 'title' => ''],
+                                        'ExtendFieldStoreMode' => ['title' => '', 'description' => 'The storage mode for extended fields. Valid values: flat (ingest as-is), reject (do not ingest), and pack (pack into the extend_content field).', 'type' => 'string', 'example' => 'flat'],
+                                        'NormalizationSecurityDomainId' => ['title' => '', 'type' => 'string', 'example' => 'NETWORK_AND_WEB_SECURITY', 'description' => ''],
+                                        'NormalizationFieldSource' => ['title' => '', 'type' => 'string', 'example' => 'normalized', 'description' => ''],
+                                    ],
+                                    'title' => '',
+                                    'example' => '',
                                 ],
-                            ],
-                            'PageNumber' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '1。',
-                            ],
-                            'PageSize' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '2。',
-                            ],
-                            'TotalCount' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '5。',
-                            ],
-                            'TotalPage' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '1。',
-                            ],
-                            'MaxResults' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '50。',
-                            ],
-                            'NextToken' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****。',
-                            ],
+                                'title' => '',
+                                'example' => '',
+                            ],
+                            'PageNumber' => ['description' => 'The page number of the current page.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''],
+                            'PageSize' => ['description' => 'The number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '2', 'title' => ''],
+                            'TotalCount' => ['description' => 'The total number of records.', 'type' => 'integer', 'format' => 'int32', 'example' => '5', 'title' => ''],
+                            'TotalPage' => ['description' => 'The total number of pages.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''],
+                            'MaxResults' => ['description' => 'The maximum number of entries to return in this request.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''],
+                            'NextToken' => ['description' => 'The pagination token for the next query. Leave this parameter empty for the first query or if no more results exist. If more results exist, set this parameter to the NextToken value returned by the previous API call.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
+                ],
+            ],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'Retrieve normalization rules',
+            'description' => 'Notifications are subject to frequency and time restrictions.'."\n"
+                .'Each user can receive a maximum of two notifications per day between 08:00 and 20:00. No notifications are sent outside this time window.',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'list',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ListNormalizationRules',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'NormalizationRule', 'arn' => 'acs:yundun-sas::{#accountId}:normalizationrule/*'],
+                        ],
                     ],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"NormalizationRules\\": [\\n    {\\n      \\"CreateTime\\": 1733269771123,\\n      \\"UpdateTime\\": 1733269771123,\\n      \\"NormalizationRuleId\\": \\"nr-z0b2ssjteut85uoh9nzp\\",\\n      \\"NormalizationRuleName\\": \\"normalization_rule_Z57np\\",\\n      \\"NormalizationRuleType\\": \\"predefined\\",\\n      \\"NormalizationRuleFormat\\": \\"SPL\\",\\n      \\"NormalizationRuleDescription\\": \\"normalization_rule_Z57np\\",\\n      \\"NormalizationRuleVersion\\": \\"V1\\",\\n      \\"NormalizationRuleExpression\\": \\"* | pack-fields -include=\'[\\\\\\\\s\\\\\\\\S]+\' as extend_content\\",\\n      \\"NormalizationRuleStatus\\": \\"started\\",\\n      \\"NormalizationCategoryId\\": \\"NETWORK_CATEGORY\\",\\n      \\"NormalizationSchemaId\\": \\"HTTP_ACTIVITY\\",\\n      \\"VendorId\\": \\"alibaba_cloud\\",\\n      \\"ProductId\\": \\"alibaba_cloud_sas\\",\\n      \\"NormalizationRuleReferences\\": [\\n        {\\n          \\"DataIngestionId\\": \\"alibaba_cloud_bot_flow_ingestion_173326*******\\"\\n        }\\n      ],\\n      \\"NormalizationRuleMode\\": \\"both\\",\\n      \\"ExtendContentPacked\\": \\"enabled\\",\\n      \\"ExtendFieldStoreMode\\": \\"flat\\"\\n    }\\n  ],\\n  \\"PageNumber\\": 1,\\n  \\"PageSize\\": 2,\\n  \\"TotalCount\\": 5,\\n  \\"TotalPage\\": 1,\\n  \\"MaxResults\\": 50,\\n  \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\"\\n}","type":"json"}]',
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"NormalizationRules\\": [\\n    {\\n      \\"CreateTime\\": 1733269771123,\\n      \\"UpdateTime\\": 1733269771123,\\n      \\"NormalizationRuleId\\": \\"nr-z0b2ssjteut85uoh9nzp\\",\\n      \\"NormalizationRuleName\\": \\"normalization_rule_Z57np\\",\\n      \\"NormalizationRuleType\\": \\"predefined\\",\\n      \\"NormalizationRuleFormat\\": \\"SPL\\",\\n      \\"NormalizationRuleDescription\\": \\"normalization_rule_Z57np\\",\\n      \\"NormalizationRuleVersion\\": \\"V1\\",\\n      \\"NormalizationRuleExpression\\": \\"* | pack-fields -include=\'[\\\\\\\\s\\\\\\\\S]+\' as extend_content\\",\\n      \\"NormalizationRuleStatus\\": \\"started\\",\\n      \\"NormalizationCategoryId\\": \\"NETWORK_CATEGORY\\",\\n      \\"NormalizationSchemaId\\": \\"HTTP_ACTIVITY\\",\\n      \\"VendorId\\": \\"alibaba_cloud\\",\\n      \\"ProductId\\": \\"alibaba_cloud_sas\\",\\n      \\"NormalizationRuleReferences\\": [\\n        {\\n          \\"DataIngestionId\\": \\"alibaba_cloud_bot_flow_ingestion_173326*******\\"\\n        }\\n      ],\\n      \\"NormalizationRuleMode\\": \\"both\\",\\n      \\"ExtendContentPacked\\": \\"enabled\\",\\n      \\"ExtendFieldStoreMode\\": \\"flat\\",\\n      \\"NormalizationSecurityDomainId\\": \\"NETWORK_AND_WEB_SECURITY\\",\\n      \\"NormalizationFieldSource\\": \\"normalized\\"\\n    }\\n  ],\\n  \\"PageNumber\\": 1,\\n  \\"PageSize\\": 2,\\n  \\"TotalCount\\": 5,\\n  \\"TotalPage\\": 1,\\n  \\"MaxResults\\": 50,\\n  \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\"\\n}","type":"json"}]',
         ],
-        'ListNormalizationFields' => [
-            'summary' => '获取标准化日志所有字段',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'ListNormalizationSchemas' => [
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
@@ -9039,268 +8527,148 @@
                 'operationType' => 'list',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The region where the threat analysis data management center is located. Specify the management center based on the region of your assets. Valid values:'."\n"
+                        .'- cn-hangzhou: the asset is in the Chinese mainland.'."\n"
+                        .'- ap-southeast-1: the asset is outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
-                    ],
+                    'schema' => ['description' => 'The language of the request and response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
+                    'schema' => ['description' => 'The user ID that the administrator switches to when viewing as another member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
                 [
-                    'name' => 'Name',
+                    'name' => 'NormalizationSchemaType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'category。',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The normalization schema type. Valid values:'."\n"
+                        .'- log: log.'."\n"
+                        .'- entity: entity.', 'type' => 'string', 'example' => 'entity', 'required' => false],
+                ],
+                [
+                    'name' => 'NormalizationCategoryId',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The ID of the normalization rule category.', 'type' => 'string', 'required' => false, 'example' => 'NETWORK_CATEGORY', 'title' => ''],
+                ],
+                [
+                    'name' => 'NormalizationSecurityDomainId',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The security domain ID.', 'type' => 'string', 'example' => 'NETWORK_AND_WEB_SECURITY', 'required' => false],
                 ],
                 [
                     'name' => 'MaxResults',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'minimum' => '0',
-                        'example' => '50。',
-                    ],
+                    'schema' => ['description' => 'The maximum number of entries to return in this request.', 'type' => 'integer', 'format' => 'int32', 'minimum' => '0', 'required' => false, 'example' => '50', 'title' => ''],
                 ],
                 [
                     'name' => 'NextToken',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****。',
-                    ],
+                    'schema' => ['description' => 'The pagination token for the next query. Leave this parameter empty for the first query or if no more results exist. If more results exist, set this parameter to the NextToken value returned by the previous API call.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
+                ],
+                [
+                    'name' => 'NormalizationFieldSource',
+                    'in' => 'formData',
+                    'schema' => ['title' => '', 'description' => 'The field source filter. Valid values: normalized / native.', 'type' => 'string', 'example' => 'normalized', 'required' => false],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'Schema of Response',
-                        'description' => '',
+                        'title' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。',
-                            ],
-                            'NormalizationFields' => [
-                                'description' => '',
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''],
+                            'NormalizationSchemas' => [
+                                'description' => 'The list of normalization schemas.',
                                 'type' => 'array',
                                 'items' => [
-                                    'description' => '',
+                                    'description' => 'The normalization schema.',
                                     'type' => 'object',
                                     'properties' => [
-                                        'NormalizationFieldName' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'cloud_user。',
-                                        ],
-                                        'NormalizationFieldType' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'varchar。',
-                                        ],
-                                        'NormalizationFieldRequired' => [
-                                            'title' => '标准字段key是否必填。',
-                                            'type' => 'boolean',
-                                        ],
-                                        'NormalizationFieldDescription' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'cloud_user。',
-                                        ],
-                                        'NormalizationFieldExample' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => '173326*******。',
-                                        ],
-                                        'NormalizationCategoryId' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'NETWORK_CATEGORY。',
-                                        ],
-                                        'NormalizationSchemaId' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'NETWORK_SESSION_ACTIVITY。',
-                                        ],
-                                        'NormalizationFieldReserved' => [
-                                            'description' => '',
-                                            'type' => 'boolean',
-                                            'example' => 'true。',
-                                        ],
-                                        'NormalizationFieldFrom' => [
-                                            'title' => 'json类型的标准字段key来源。',
-                                            'type' => 'string',
-                                            'example' => 'preset',
-                                        ],
-                                        'NormalizationFieldTokenize' => [
-                                            'title' => '标准字段是否分词。',
-                                            'type' => 'boolean',
-                                        ],
-                                        'NormalizationFieldJsonIndexAll' => [
-                                            'title' => 'json类型的标准字段是否针对所有key建立索引。',
-                                            'type' => 'boolean',
-                                        ],
-                                        'NormalizationFieldJsonKeys' => [
-                                            'title' => 'json类型的标准字段key列表。',
+                                        'NormalizationSchemaId' => ['description' => 'The ID of the normalization schema.', 'type' => 'string', 'example' => 'HTTP_ACTIVITY', 'title' => ''],
+                                        'NormalizationSchemaName' => ['description' => 'The name of the normalization schema.', 'type' => 'string', 'example' => 'normalization_rule_Z57np', 'title' => ''],
+                                        'NormalizationCategoryId' => ['description' => 'The ID of the normalization rule category.', 'type' => 'string', 'example' => 'NETWORK_CATEGORY', 'title' => ''],
+                                        'NormalizationSchemaTargetLogStore' => ['description' => 'The LogStore to which the normalization output is written.', 'type' => 'string', 'example' => 'network-activity', 'title' => ''],
+                                        'CreateTime' => ['title' => '', 'description' => 'The creation time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1736386610000'],
+                                        'UpdateTime' => ['title' => '', 'description' => 'The update time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1736386610000'],
+                                        'NormalizationSchemaDescription' => ['title' => '', 'description' => 'The description of the normalization schema.', 'type' => 'string', 'example' => 'Network flow log'],
+                                        'NormalizationSchemaFrom' => ['title' => '', 'description' => 'The source of the normalization schema. Valid values: preset (predefined) and custom (user-defined).', 'type' => 'string', 'example' => 'preset'],
+                                        'TargetLogStore' => ['title' => '', 'description' => 'The Simple Log Service LogStore.', 'type' => 'string', 'example' => 'network-activity'],
+                                        'TargetStoreView' => ['title' => '', 'description' => 'The Simple Log Service StoreView.', 'type' => 'string', 'example' => 'network-activity'],
+                                        'VendorId' => ['title' => '', 'description' => 'The vendor ID.', 'type' => 'string', 'example' => 'alibaba'],
+                                        'ProductId' => ['title' => '', 'description' => 'The product ID.', 'type' => 'string', 'example' => 'sas'],
+                                        'NormalizationSecurityDomainId' => ['title' => '', 'description' => 'The security domain ID.', 'type' => 'string', 'example' => 'NETWORK_AND_WEB_SECURITY'],
+                                        'NormalizationSchemaType' => ['title' => '', 'description' => 'The normalization schema type.', 'type' => 'string', 'example' => 'log'],
+                                        'NormalizationFieldSource' => ['title' => '', 'description' => 'The field source. Valid values:'."\n"
+                                            .'normalized: normalized field.'."\n"
+                                            .'native: native field.', 'type' => 'string', 'example' => 'normalized'],
+                                        'RecommendEntities' => [
                                             'type' => 'array',
-                                            'items' => [
-                                                'title' => 'json类型的标准字段key。',
-                                                'type' => 'object',
-                                                'properties' => [
-                                                    'NormalizationFieldName' => [
-                                                        'title' => 'json类型的标准字段key名称。',
-                                                        'type' => 'string',
-                                                        'example' => 'alert_name',
-                                                    ],
-                                                    'NormalizationFieldType' => [
-                                                        'title' => 'json类型的标准字段key类型。',
-                                                        'type' => 'string',
-                                                        'example' => 'text',
-                                                    ],
-                                                    'NormalizationFieldRequired' => [
-                                                        'title' => 'json类型的标准字段key是否必填。',
-                                                        'type' => 'boolean',
-                                                    ],
-                                                    'NormalizationFieldDescription' => [
-                                                        'title' => 'json类型的标准字段key描述。',
-                                                        'type' => 'string',
-                                                        'example' => '告警等级',
-                                                    ],
-                                                    'NormalizationFieldExample' => [
-                                                        'title' => 'json类型的标准字段key示例。',
-                                                        'type' => 'string',
-                                                        'example' => '枚举值：1、2、3、4、5',
-                                                    ],
-                                                    'NormalizationFieldFrom' => [
-                                                        'title' => 'json类型的标准字段key来源。',
-                                                        'type' => 'string',
-                                                        'example' => 'preset',
-                                                    ],
-                                                    'NormalizationFieldTokenize' => [
-                                                        'title' => 'json类型的标准字段key是否分词。',
-                                                        'type' => 'boolean',
-                                                    ],
-                                                    'NormalizationFieldReserved' => [
-                                                        'title' => '是否是系统内置的标准字段key。',
-                                                        'type' => 'boolean',
-                                                    ],
-                                                    'CreateTime' => [
-                                                        'title' => '创建时间。',
-                                                        'type' => 'integer',
-                                                        'format' => 'int64',
-                                                        'example' => '1736386610000',
-                                                    ],
-                                                    'UpdateTime' => [
-                                                        'title' => '更新时间。',
-                                                        'type' => 'integer',
-                                                        'format' => 'int64',
-                                                        'example' => '1736386610000',
-                                                    ],
-                                                ],
-                                            ],
-                                        ],
-                                        'CreateTime' => [
-                                            'title' => '创建时间。',
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '1736386610000',
-                                        ],
-                                        'UpdateTime' => [
-                                            'title' => '更新时间。',
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '1736386610000',
-                                        ],
-                                        'NormalizationFieldRequirement' => [
+                                            'items' => ['type' => 'string', 'description' => '', 'title' => '', 'example' => ''],
                                             'description' => '',
-                                            'type' => 'boolean',
-                                            'example' => 'true。',
+                                            'title' => '',
+                                            'example' => '',
                                         ],
                                     ],
+                                    'title' => '',
+                                    'example' => '',
                                 ],
+                                'title' => '',
+                                'example' => '',
                             ],
-                            'MaxResults' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '50。',
-                            ],
-                            'NextToken' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****。',
-                            ],
-                            'TotalCount' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '57。',
-                            ],
+                            'MaxResults' => ['title' => '', 'description' => 'The maximum number of entries to return in this request.', 'type' => 'integer', 'format' => 'int32', 'example' => '50'],
+                            'NextToken' => ['description' => 'The pagination token for the next query. Leave this parameter empty for the first query or if no more results exist. If more results exist, set this parameter to the NextToken value returned by the previous API call.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
+                            'TotalCount' => ['description' => 'The total number of records.', 'type' => 'integer', 'format' => 'int32', 'example' => '57', 'title' => ''],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
+                ],
+            ],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'Retrieve normalization schema list',
+            'summary' => 'Retrieves a list of normalization schemas.',
+            'description' => 'The input parameter JsonConfig is a complex JSON configuration. A utility class with specific configuration examples is provided. For more information, refer to [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'list',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ListNormalizationSchemas',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'NormalizationSchema', 'arn' => 'acs:yundun-sas::{#accountId}:normalizationschema/*'],
+                        ],
                     ],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"NormalizationFields\\": [\\n    {\\n      \\"NormalizationFieldName\\": \\"cloud_user\\",\\n      \\"NormalizationFieldType\\": \\"varchar\\",\\n      \\"NormalizationFieldRequired\\": true,\\n      \\"NormalizationFieldDescription\\": \\"cloud_user\\",\\n      \\"NormalizationFieldExample\\": \\"173326*******\\",\\n      \\"NormalizationCategoryId\\": \\"NETWORK_CATEGORY\\",\\n      \\"NormalizationSchemaId\\": \\"NETWORK_SESSION_ACTIVITY\\",\\n      \\"NormalizationFieldReserved\\": true,\\n      \\"NormalizationFieldFrom\\": \\"preset\\",\\n      \\"NormalizationFieldTokenize\\": true,\\n      \\"NormalizationFieldJsonIndexAll\\": true,\\n      \\"NormalizationFieldJsonKeys\\": [\\n        {\\n          \\"NormalizationFieldName\\": \\"alert_level\\",\\n          \\"NormalizationFieldType\\": \\"text\\",\\n          \\"NormalizationFieldRequired\\": true,\\n          \\"NormalizationFieldDescription\\": \\"alert_level\\",\\n          \\"NormalizationFieldExample\\": \\"1\\",\\n          \\"NormalizationFieldFrom\\": \\"preset\\",\\n          \\"NormalizationFieldTokenize\\": true,\\n          \\"NormalizationFieldReserved\\": true,\\n          \\"CreateTime\\": 1736386610000,\\n          \\"UpdateTime\\": 1736386610000\\n        }\\n      ],\\n      \\"CreateTime\\": 1736386610000,\\n      \\"UpdateTime\\": 1736386610000,\\n      \\"NormalizationFieldRequirement\\": true\\n    }\\n  ],\\n  \\"MaxResults\\": 50,\\n  \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\",\\n  \\"TotalCount\\": 57\\n}","type":"json"}]',
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"NormalizationSchemas\\": [\\n    {\\n      \\"NormalizationSchemaId\\": \\"HTTP_ACTIVITY\\",\\n      \\"NormalizationSchemaName\\": \\"normalization_rule_Z57np\\",\\n      \\"NormalizationCategoryId\\": \\"NETWORK_CATEGORY\\",\\n      \\"NormalizationSchemaTargetLogStore\\": \\"network-activity\\",\\n      \\"CreateTime\\": 1736386610000,\\n      \\"UpdateTime\\": 1736386610000,\\n      \\"NormalizationSchemaDescription\\": \\"Network flow log\\",\\n      \\"NormalizationSchemaFrom\\": \\"preset\\",\\n      \\"TargetLogStore\\": \\"network-activity\\",\\n      \\"TargetStoreView\\": \\"network-activity\\",\\n      \\"VendorId\\": \\"alibaba\\",\\n      \\"ProductId\\": \\"sas\\",\\n      \\"NormalizationSecurityDomainId\\": \\"NETWORK_AND_WEB_SECURITY\\",\\n      \\"NormalizationSchemaType\\": \\"log\\",\\n      \\"NormalizationFieldSource\\": \\"normalized\\",\\n      \\"RecommendEntities\\": [\\n        \\"\\"\\n      ]\\n    }\\n  ],\\n  \\"MaxResults\\": 50,\\n  \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\",\\n  \\"TotalCount\\": 57\\n}","type":"json"}]',
         ],
-        'ListNormalizationCategories' => [
-            'summary' => '获取标准化目录',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'ListNormalizationSecurityDomains' => [
+            'path' => '',
+            'methods' => ['get', 'post'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
@@ -9312,150 +8680,249 @@
                 'operationType' => 'list',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The region where the threat detection and response data management center is located. Specify the management center based on the region of your assets. Valid values:'."\n"
+                        .'- cn-hangzhou: the asset is in the Chinese mainland.'."\n"
+                        .'- ap-southeast-1: the asset is outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
+                    'schema' => ['description' => 'The user ID of the member to which the administrator switches the view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''],
+                ],
+                [
+                    'name' => 'MaxResults',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The maximum number of results to return when you use the NextToken-based pagination method. Valid values: 1 to 100. Default value: 50.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '50', 'title' => ''],
+                ],
+                [
+                    'name' => 'NextToken',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The pagination token for the next query. Leave this parameter empty for the first query or if no more results exist. If more results exist, set this parameter to the NextToken value returned by the previous API call.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
+                ],
+            ],
+            'responses' => [
+                200 => [
                     'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
+                        'title' => '',
+                        'description' => 'Schema of Response',
+                        'type' => 'object',
+                        'properties' => [
+                            'RequestId' => ['title' => '', 'description' => 'Id of the request', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
+                            'NormalizationSecurityDomains' => [
+                                'description' => 'The list of security domains.',
+                                'type' => 'array',
+                                'items' => [
+                                    'type' => 'object',
+                                    'properties' => [
+                                        'NormalizationSecurityDomainId' => ['description' => 'The security domain ID.', 'type' => 'string', 'example' => 'OTHER', 'title' => ''],
+                                        'NormalizationSecurityDomainName' => ['description' => 'The security domain name.', 'type' => 'string', 'example' => 'net', 'title' => ''],
+                                    ],
+                                    'description' => '',
+                                    'title' => '',
+                                    'example' => '',
+                                ],
+                                'title' => '',
+                                'example' => '',
+                            ],
+                            'MaxResults' => ['description' => 'The maximum number of entries returned in this query.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''],
+                            'NextToken' => ['description' => 'The pagination token for the next query. Leave this parameter empty for the first query or if no more results exist. If more results exist, set this parameter to the NextToken value returned by the previous API call.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
+                            'TotalCount' => ['description' => 'The total number of records.', 'type' => 'integer', 'format' => 'int32', 'example' => '57', 'title' => ''],
+                        ],
+                        'example' => '',
                     ],
                 ],
+            ],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'Get security domain list',
+            'summary' => 'Retrieves a list of security domains.',
+            'description' => 'The input parameter JsonConfig is a complex JSON configuration. A utility class is provided to help with specific configuration examples. For more information, refer to [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"NormalizationSecurityDomains\\": [\\n    {\\n      \\"NormalizationSecurityDomainId\\": \\"OTHER\\",\\n      \\"NormalizationSecurityDomainName\\": \\"net\\"\\n    }\\n  ],\\n  \\"MaxResults\\": 50,\\n  \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\",\\n  \\"TotalCount\\": 57\\n}","type":"json"}]',
+        ],
+        'ListProducts' => [
+            'summary' => 'Retrieves a list of products.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
+            'security' => [
                 [
-                    'name' => 'NormalizationCategoryType',
+                    'AK' => [],
+                ],
+            ],
+            'operationType' => 'read',
+            'deprecated' => false,
+            'systemTags' => [
+                'operationType' => 'list',
+                'riskType' => 'none',
+                'chargeType' => 'free',
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
+            ],
+            'parameters' => [
+                [
+                    'name' => 'RegionId',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The region of the Data Management center for threat analysis. Select the region for the Management Hub based on the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
+                ],
+                [
+                    'name' => 'Lang',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
+                ],
+                [
+                    'name' => 'RoleFor',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The user ID of the member. An administrator can specify this parameter to switch to the perspective of this member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
+                ],
+                [
+                    'name' => 'ProductIds',
                     'in' => 'formData',
+                    'style' => 'simple',
                     'schema' => [
-                        'description' => '',
-                        'type' => 'string',
+                        'description' => 'The list of product IDs.',
+                        'type' => 'array',
+                        'items' => ['description' => 'The product ID.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_sas', 'title' => ''],
                         'required' => false,
-                        'example' => 'entity。',
+                        'title' => '',
+                        'example' => '',
                     ],
                 ],
                 [
+                    'name' => 'ProductName',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The product name.', 'type' => 'string', 'required' => false, 'example' => 'sas', 'title' => ''],
+                ],
+                [
+                    'name' => 'ProductType',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The product type. Valid values:'."\n"
+                        ."\n"
+                        .'- preset'."\n"
+                        ."\n"
+                        .'- custom', 'type' => 'string', 'required' => false, 'example' => 'preset', 'title' => ''],
+                ],
+                [
+                    'name' => 'VendorId',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The vendor ID.', 'type' => 'string', 'required' => false, 'example' => 'vd-qlsw5eocx94w9', 'title' => ''],
+                ],
+                [
                     'name' => 'MaxResults',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'minimum' => '0',
-                        'example' => '50。',
-                    ],
+                    'schema' => ['description' => 'The maximum number of entries to return.', 'type' => 'integer', 'format' => 'int32', 'minimum' => '0', 'required' => false, 'example' => '50', 'title' => ''],
                 ],
                 [
                     'name' => 'NextToken',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****。',
-                    ],
+                    'schema' => ['description' => 'The token that is used to start the next query. You do not need to specify this parameter for the first query. For subsequent queries, set this parameter to the \\`NextToken\\` value that is returned from the previous API call.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'Schema of Response',
-                        'description' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。',
-                            ],
-                            'NormalizationCategories' => [
-                                'description' => '',
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''],
+                            'Products' => [
+                                'description' => 'The list of products.',
                                 'type' => 'array',
                                 'items' => [
-                                    'description' => '',
+                                    'description' => 'The product.',
                                     'type' => 'object',
                                     'properties' => [
-                                        'NormalizationCategoryId' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'COMMON_CATEGORY。',
-                                        ],
-                                        'NormalizationCategoryName' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'COMMON_CATEGORY。',
-                                        ],
-                                    ],
+                                        'CreateTime' => ['description' => 'The time when the product was created.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''],
+                                        'UpdateTime' => ['description' => 'The time when the product was updated.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''],
+                                        'ProductId' => ['description' => 'The product ID.', 'type' => 'string', 'example' => 'alibaba_cloud_sas', 'title' => ''],
+                                        'ProductAlias' => ['description' => 'The product alias.', 'type' => 'string', 'example' => 'alibaba_cloud_sas', 'title' => ''],
+                                        'ProductName' => ['description' => 'This parameter is deprecated.', 'type' => 'string', 'example' => 'sas', 'title' => ''],
+                                        'ProductType' => ['description' => 'The product type. Valid values:'."\n"
+                                            ."\n"
+                                            .'- preset'."\n"
+                                            ."\n"
+                                            .'- custom', 'type' => 'string', 'example' => 'preset', 'title' => ''],
+                                        'VendorId' => ['description' => 'The vendor ID.', 'type' => 'string', 'example' => 'vd-qlsw5eocx94w9', 'title' => ''],
+                                        'VendorName' => ['description' => 'The vendor name.', 'type' => 'string', 'example' => '111', 'title' => ''],
+                                        'DataIngestionStatus' => ['description' => 'The data ingestion status. Valid values:'."\n"
+                                            ."\n"
+                                            .'- true: enabled.'."\n"
+                                            ."\n"
+                                            .'- false: disabled.', 'type' => 'boolean', 'example' => 'enabled', 'title' => ''],
+                                        'TotalDataIngestionCount' => ['description' => 'The total number of data ingestion configurations.', 'type' => 'integer', 'format' => 'int32', 'example' => '10', 'title' => ''],
+                                        'EnabledDataIngestionCount' => ['description' => 'The number of enabled data ingestion configurations.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''],
+                                        'AllowAddDataIngestion' => ['description' => 'Indicates whether data collection configurations can be added.', 'type' => 'boolean', 'example' => 'true', 'title' => ''],
+                                        'AbnormalDataIngestionCount' => ['description' => 'The number of abnormal data ingestion configurations.', 'type' => 'integer', 'format' => 'int32', 'example' => '2', 'title' => ''],
+                                        'ActiveTime' => ['description' => 'The activation time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''],
+                                    ],
+                                    'title' => '',
+                                    'example' => '',
                                 ],
+                                'title' => '',
+                                'example' => '',
                             ],
-                            'MaxResults' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '50。',
-                            ],
-                            'NextToken' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****。',
-                            ],
-                            'TotalCount' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '57。',
-                            ],
+                            'MaxResults' => ['description' => 'The maximum number of entries returned.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''],
+                            'NextToken' => ['description' => 'The token that is used to retrieve the next page of results. If the value of this parameter is not empty, more results are available. You can use this token in the next request to retrieve the next page of results.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
+                            'TotalCount' => ['description' => 'The total number of entries returned.', 'type' => 'integer', 'format' => 'int32', 'example' => '57', 'title' => ''],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"Products\\": [\\n    {\\n      \\"CreateTime\\": 1733269771123,\\n      \\"UpdateTime\\": 1733269771123,\\n      \\"ProductId\\": \\"alibaba_cloud_sas\\",\\n      \\"ProductAlias\\": \\"alibaba_cloud_sas\\",\\n      \\"ProductName\\": \\"sas\\",\\n      \\"ProductType\\": \\"preset\\",\\n      \\"VendorId\\": \\"vd-qlsw5eocx94w9\\",\\n      \\"VendorName\\": \\"111\\",\\n      \\"DataIngestionStatus\\": true,\\n      \\"TotalDataIngestionCount\\": 10,\\n      \\"EnabledDataIngestionCount\\": 1,\\n      \\"AllowAddDataIngestion\\": true,\\n      \\"AbnormalDataIngestionCount\\": 2,\\n      \\"ActiveTime\\": 1733269771123\\n    }\\n  ],\\n  \\"MaxResults\\": 50,\\n  \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\",\\n  \\"TotalCount\\": 57\\n}","type":"json"}]',
+            'title' => 'ListProducts',
+            'description' => 'The \\`JsonConfig\\` request parameter is a complex JSON configuration. A supporting tool class is provided that contains configuration examples. For more information, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'list',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ListProducts',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'Product', 'arn' => 'acs:yundun-sas::{#accountId}:product/*'],
+                        ],
+                    ],
+                ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"NormalizationCategories\\": [\\n    {\\n      \\"NormalizationCategoryId\\": \\"COMMON_CATEGORY\\",\\n      \\"NormalizationCategoryName\\": \\"COMMON_CATEGORY\\"\\n    }\\n  ],\\n  \\"MaxResults\\": 50,\\n  \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\",\\n  \\"TotalCount\\": 57\\n}","type":"json"}]',
         ],
-        'ListNormalizationRuleCapacities' => [
-            'summary' => '获取规则的安全能力',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'ListQueryViews' => [
+            'summary' => 'Retrieves a list of query views.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
@@ -9467,193 +8934,117 @@
                 'operationType' => 'list',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas731ZAS'],
+                'tenantRelevance' => 'tenant',
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'in' => 'query',
+                    'schema' => ['description' => 'The region where the threat analysis data management center is located. Specify the management center based on the region of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets belong to the Chinese mainland or Hong Kong (China).'."\n"
+                        .'- ap-southeast-1: Your assets belong to regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
-                    'name' => 'RoleFor',
+                    'name' => 'QueryViewScene',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
+                    'schema' => ['description' => 'The scene to which the query view belongs.', 'type' => 'string', 'required' => false, 'example' => 'Alert', 'title' => ''],
                 ],
                 [
-                    'name' => 'NormalizationRuleId',
+                    'name' => 'QueryViewType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'nr-z0b2ssjteut85uoh9nzp。',
-                    ],
+                    'schema' => ['description' => 'The view type. If this parameter is left empty, all views are returned.', 'type' => 'string', 'required' => false, 'example' => 'preset', 'title' => ''],
                 ],
                 [
-                    'name' => 'MaxResults',
+                    'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'minimum' => '0',
-                        'example' => '50。',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member to which the administrator switches the view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''],
                 ],
                 [
-                    'name' => 'NextToken',
+                    'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****。',
-                    ],
+                    'schema' => ['description' => 'The view type.'."\n"
+                        ."\n"
+                        .'- 0: the view of the current Alibaba Cloud account.'."\n"
+                        .'- 1: the view of all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1', 'title' => ''],
                 ],
                 [
-                    'name' => 'NormalizationRuleIds',
+                    'name' => 'MaxResults',
                     'in' => 'formData',
-                    'style' => 'simple',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'array',
-                        'items' => [
-                            'description' => '',
-                            'type' => 'string',
-                            'required' => false,
-                            'example' => 'nr-z0b2ssjteut85uoh9nzp。',
-                        ],
-                        'required' => false,
-                    ],
+                    'schema' => ['description' => 'The maximum number of results to return per request when using the NextToken-based pagination. Valid values: 1 to 100. Default value: 50.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '50', 'title' => ''],
+                ],
+                [
+                    'name' => 'NextToken',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The pagination token for the next query. You do not need to specify this parameter for the first query or if no more results exist. If more results exist, set this parameter to the NextToken value returned by the previous API call.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'Schema of Response',
-                        'description' => '',
+                        'title' => '',
+                        'description' => 'Schema of Response',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。',
-                            ],
-                            'NormalizationRuleCapacities' => [
-                                'description' => '',
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', 'title' => ''],
+                            'QueryViews' => [
+                                'description' => 'The list of query views.',
                                 'type' => 'array',
                                 'items' => [
-                                    'description' => '',
+                                    'description' => 'The query view.',
                                     'type' => 'object',
                                     'properties' => [
-                                        'CapacityType' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'detection_preset_rule。',
-                                        ],
-                                        'Capacities' => [
-                                            'description' => '',
-                                            'type' => 'array',
-                                            'items' => [
-                                                'description' => '',
-                                                'type' => 'string',
-                                                'example' => 'NETWORK_SESSION_ACTIVITY。',
-                                            ],
-                                        ],
-                                        'NormalizationRuleId' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'nr-z0b2ssjteut85uoh9nzp。',
-                                        ],
-                                    ],
+                                        'QueryViewId' => ['description' => 'The unique identifier of the query view.', 'type' => 'string', 'example' => 'qv-a1b2c3d4e5f6g7h8****', 'title' => ''],
+                                        'QueryViewScene' => ['description' => 'The scene to which the view belongs.', 'type' => 'string', 'example' => 'Alert', 'title' => ''],
+                                        'QueryViewName' => ['description' => 'The view name.', 'type' => 'string', 'example' => 'alert', 'title' => ''],
+                                        'QueryViewCriteria' => ['description' => 'The alert filter statement of the view.', 'type' => 'string', 'example' => 'module_code: alibaba_cloud_sas_custom_rule', 'title' => ''],
+                                        'QueryViewType' => ['description' => 'The view type.', 'type' => 'string', 'example' => 'preset', 'title' => ''],
+                                        'QueryViewFields' => ['description' => 'The list of displayed fields.', 'type' => 'string', 'example' => '["alert_name_cn","alert_type_cn","entity_list","alert_level","alert_status","start_time","end_time"]', 'title' => ''],
+                                        'QueryViewStatus' => ['description' => 'The view status.', 'type' => 'string', 'example' => '2', 'title' => ''],
+                                        'QueryViewOrder' => ['description' => 'The display order.', 'type' => 'string', 'example' => '1', 'title' => ''],
+                                        'QueryViewCondition' => ['description' => 'The custom query condition of the view.', 'type' => 'string', 'example' => 'preset', 'title' => ''],
+                                    ],
+                                    'title' => '',
+                                    'example' => '',
                                 ],
+                                'title' => '',
+                                'example' => '',
                             ],
-                            'PageNumber' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '1。',
-                            ],
-                            'PageSize' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '10。',
-                            ],
-                            'TotalCount' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '57。',
-                            ],
-                            'TotalPage' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '3。',
-                            ],
-                            'MaxResults' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '50。',
-                            ],
-                            'NextToken' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****。',
-                            ],
+                            'MaxResults' => ['description' => 'The maximum number of results to return per request when using the NextToken-based pagination. Valid values: 1 to 100. Default value: 50.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''],
+                            'NextToken' => ['description' => 'The pagination token for the next query. You do not need to specify this parameter for the first query or if no more results exist. If more results exist, set this parameter to the NextToken value returned by the previous API call.', 'type' => 'string', 'example' => 'AAAAASLVeIxed4466E0LVmGkzwS6hJKd9DGVGMDRM6Lu****', 'title' => ''],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'Retrieve query view list',
+            'description' => 'The input parameter JsonConfig is a complex JSON configuration. A utility class is provided to help with specific configuration examples. For more information, refer to [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"NormalizationRuleCapacities\\": [\\n    {\\n      \\"CapacityType\\": \\"detection_preset_rule\\",\\n      \\"Capacities\\": [\\n        \\"NETWORK_SESSION_ACTIVITY\\"\\n      ],\\n      \\"NormalizationRuleId\\": \\"nr-z0b2ssjteut85uoh9nzp\\"\\n    }\\n  ],\\n  \\"PageNumber\\": 1,\\n  \\"PageSize\\": 10,\\n  \\"TotalCount\\": 57,\\n  \\"TotalPage\\": 3,\\n  \\"MaxResults\\": 50,\\n  \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\"\\n}","type":"json"}]',
+            'ramActions' => [],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n  \\"QueryViews\\": [\\n    {\\n      \\"QueryViewId\\": \\"qv-a1b2c3d4e5f6g7h8****\\",\\n      \\"QueryViewScene\\": \\"Alert\\",\\n      \\"QueryViewName\\": \\"alert\\",\\n      \\"QueryViewCriteria\\": \\"module_code: alibaba_cloud_sas_custom_rule\\",\\n      \\"QueryViewType\\": \\"preset\\",\\n      \\"QueryViewFields\\": \\"[\\\\\\"alert_name_cn\\\\\\",\\\\\\"alert_type_cn\\\\\\",\\\\\\"entity_list\\\\\\",\\\\\\"alert_level\\\\\\",\\\\\\"alert_status\\\\\\",\\\\\\"start_time\\\\\\",\\\\\\"end_time\\\\\\"]\\",\\n      \\"QueryViewStatus\\": \\"2\\",\\n      \\"QueryViewOrder\\": \\"1\\",\\n      \\"QueryViewCondition\\": \\"preset\\"\\n    }\\n  ],\\n  \\"MaxResults\\": 50,\\n  \\"NextToken\\": \\"AAAAASLVeIxed4466E0LVmGkzwS6hJKd9DGVGMDRM6Lu****\\"\\n}","type":"json"}]',
         ],
-        'ListNormalizationSchemas' => [
-            'summary' => '获取标准化类目',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'ListResponseRuleFields' => [
+            'summary' => 'Retrieves the field list of automated response rules.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
@@ -9665,612 +9056,569 @@
                 'operationType' => 'list',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsasASHGE7'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou。',
-                    ],
+                    'schema' => ['description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the region where your assets reside. Valid values:'."\n"
+                        .'- cn-hangzhou: Chinese mainland.'."\n"
+                        .'- ap-southeast-1: outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh。',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '173326*******。',
-                    ],
-                ],
-                [
-                    'name' => 'NormalizationSchemaType',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'entity。',
-                    ],
+                    'schema' => ['description' => 'The ID of the member to which the administrator switches the view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''],
                 ],
                 [
-                    'name' => 'NormalizationCategoryId',
+                    'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'NETWORK_CATEGORY。',
-                    ],
+                    'schema' => ['description' => 'The view type. Valid values:'."\n"
+                        ."\n"
+                        .'- 0: the view of the current Alibaba Cloud account.'."\n"
+                        .'- 1: the view of all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1', 'title' => ''],
                 ],
                 [
                     'name' => 'MaxResults',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'minimum' => '0',
-                        'example' => '50。',
-                    ],
+                    'schema' => ['description' => 'The maximum number of entries to return in this request.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '50', 'title' => ''],
                 ],
                 [
                     'name' => 'NextToken',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****。',
-                    ],
+                    'schema' => ['description' => 'The pagination token that marks the position from which to start reading. Leave this parameter empty to read from the beginning.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'Schema of Response',
-                        'description' => '',
+                        'title' => '',
+                        'description' => 'Schema of Response',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****。',
-                            ],
-                            'NormalizationSchemas' => [
-                                'description' => '',
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''],
+                            'ListResponseRuleFields' => [
+                                'description' => 'The list of response rule fields.',
                                 'type' => 'array',
                                 'items' => [
-                                    'description' => '',
                                     'type' => 'object',
                                     'properties' => [
-                                        'NormalizationSchemaId' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'HTTP_ACTIVITY。',
-                                        ],
-                                        'NormalizationSchemaName' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'normalization_rule_Z57np。',
-                                        ],
-                                        'NormalizationCategoryId' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'NETWORK_CATEGORY。',
-                                        ],
-                                        'NormalizationSchemaTargetLogStore' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'network-activity。',
-                                        ],
-                                        'CreateTime' => [
-                                            'title' => '创建时间。',
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '1736386610000',
-                                        ],
-                                        'UpdateTime' => [
-                                            'title' => '更新时间。',
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '1736386610000',
-                                        ],
-                                        'NormalizationSchemaDescription' => [
-                                            'title' => '标准结构描述。',
-                                            'type' => 'string',
-                                            'example' => '网络五元组日志',
-                                        ],
-                                        'NormalizationSchemaFrom' => [
-                                            'title' => '标准化结构来源：preset-预定义，custom-自定义。',
-                                            'type' => 'string',
-                                            'example' => 'preset',
-                                        ],
-                                        'TargetLogStore' => [
-                                            'title' => '日志服务 LogStore。',
-                                            'type' => 'string',
-                                            'example' => 'network-activity',
+                                        'Field' => ['description' => 'The whitelisted field.', 'type' => 'string', 'example' => 'appname', 'title' => ''],
+                                        'FieldName' => ['description' => 'The name of the rule field.', 'type' => 'string', 'example' => 'OriginIP,ConsoleLog,CPUTime,Duration,ErrorCode,ErrorMessage,ResponseSize,ResponseStatus,RoutineName,ClientRequestID,LogTimestamp,FetchStatus,SubRequestID', 'title' => ''],
+                                        'DataType' => ['description' => 'The data type of the automated response rule condition field.', 'type' => 'string', 'example' => 'ip', 'title' => ''],
+                                        'FieldNormalization' => ['description' => 'The normalization object type to which the field belongs.', 'type' => 'string', 'example' => 'alert', 'title' => ''],
+                                        'SupportOperators' => [
+                                            'description' => 'The English descriptions of the operators.',
+                                            'type' => 'array',
+                                            'items' => [
+                                                'description' => 'The English descriptions of the operators.',
+                                                'type' => 'object',
+                                                'properties' => [
+                                                    'Operator' => ['description' => 'The aggregation method for the dispatch rule condition. Valid values:'."\n"
+                                                        ."\n"
+                                                        .'- `=`: equal to'."\n"
+                                                        .'- `<>`: not equal to'."\n"
+                                                        .'- `in`: contains'."\n"
+                                                        .'- `not in`: does not contain'."\n"
+                                                        .'- `REGEXP`: matches the regular expression'."\n"
+                                                        .'- `NOT REGEXP`: does not match the regular expression', 'type' => 'string', 'example' => 'BETWEEN', 'title' => ''],
+                                                    'OperatorName' => ['description' => 'The display name of the operator.', 'type' => 'string', 'example' => 'autotest-operator', 'title' => ''],
+                                                    'SupportDataType' => ['description' => 'The data types supported by the current operator, separated by commas.', 'type' => 'string', 'example' => 'ip', 'title' => ''],
+                                                    'HasRightValue' => ['description' => 'Indicates whether a right-side value is required. Valid values:'."\n"
+                                                        .'- true: Required.'."\n"
+                                                        .'- false: Not required.', 'type' => 'string', 'example' => 'true', 'title' => ''],
+                                                    'Index' => ['description' => 'The position of the operator in the operator list.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''],
+                                                ],
+                                                'title' => '',
+                                                'example' => '',
+                                            ],
+                                            'title' => '',
+                                            'example' => '',
                                         ],
-                                        'TargetStoreView' => [
-                                            'title' => '日志服务 StoreView。',
-                                            'type' => 'string',
-                                            'example' => 'network-activity',
+                                        'RightValue' => [
+                                            'description' => 'The list of optional enumeration values for the field. This parameter is not returned if no enumeration values are available.',
+                                            'type' => 'array',
+                                            'items' => [
+                                                'description' => 'The enumeration value.',
+                                                'type' => 'object',
+                                                'properties' => [
+                                                    'Value' => ['description' => 'The right-side value.', 'type' => 'string', 'example' => 'dev_selectdb_cluster', 'title' => ''],
+                                                    'ValueName' => ['description' => 'The display name of the enumeration value.', 'type' => 'string', 'example' => 'high', 'title' => ''],
+                                                ],
+                                                'title' => '',
+                                                'example' => '',
+                                            ],
+                                            'title' => '',
+                                            'example' => '',
                                         ],
                                     ],
+                                    'description' => '',
+                                    'title' => '',
+                                    'example' => '',
                                 ],
+                                'title' => '',
+                                'example' => '',
                             ],
-                            'MaxResults' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '50。',
-                            ],
-                            'NextToken' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****。',
-                            ],
-                            'TotalCount' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '57。',
-                            ],
+                            'MaxResults' => ['description' => 'The maximum number of entries to return in this request.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''],
+                            'NextToken' => ['description' => 'The pagination token for the next query. Valid values: leave this parameter empty for the first query or if no more results exist. If a next query exists, set this parameter to the NextToken value returned by the previous API call.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'Retrieve automated response rule fields',
+            'description' => 'Notifications are subject to frequency and time restrictions.'."\n"
+                .'Each user receives a maximum of two notifications per day between 08:00 and 20:00. No notifications are sent outside this time range.',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"NormalizationSchemas\\": [\\n    {\\n      \\"NormalizationSchemaId\\": \\"HTTP_ACTIVITY\\",\\n      \\"NormalizationSchemaName\\": \\"normalization_rule_Z57np\\",\\n      \\"NormalizationCategoryId\\": \\"NETWORK_CATEGORY\\",\\n      \\"NormalizationSchemaTargetLogStore\\": \\"network-activity\\",\\n      \\"CreateTime\\": 1736386610000,\\n      \\"UpdateTime\\": 1736386610000,\\n      \\"NormalizationSchemaDescription\\": \\"Network flow log\\",\\n      \\"NormalizationSchemaFrom\\": \\"preset\\",\\n      \\"TargetLogStore\\": \\"network-activity\\",\\n      \\"TargetStoreView\\": \\"network-activity\\"\\n    }\\n  ],\\n  \\"MaxResults\\": 50,\\n  \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\",\\n  \\"TotalCount\\": 57\\n}","type":"json"}]',
+            'ramActions' => [],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"ListResponseRuleFields\\": [\\n    {\\n      \\"Field\\": \\"appname\\",\\n      \\"FieldName\\": \\"OriginIP,ConsoleLog,CPUTime,Duration,ErrorCode,ErrorMessage,ResponseSize,ResponseStatus,RoutineName,ClientRequestID,LogTimestamp,FetchStatus,SubRequestID\\",\\n      \\"DataType\\": \\"ip\\",\\n      \\"FieldNormalization\\": \\"alert\\",\\n      \\"SupportOperators\\": [\\n        {\\n          \\"Operator\\": \\"BETWEEN\\",\\n          \\"OperatorName\\": \\"autotest-operator\\",\\n          \\"SupportDataType\\": \\"ip\\",\\n          \\"HasRightValue\\": \\"true\\",\\n          \\"Index\\": 1\\n        }\\n      ],\\n      \\"RightValue\\": [\\n        {\\n          \\"Value\\": \\"dev_selectdb_cluster\\",\\n          \\"ValueName\\": \\"high\\"\\n        }\\n      ]\\n    }\\n  ],\\n  \\"MaxResults\\": 50,\\n  \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\"\\n}","type":"json"}]',
         ],
-        'CreateDataSet' => [
-            'summary' => '创建数据集',
-            'methods' => [
-                'post',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'ListResponseRules' => [
+            'summary' => 'Paginated query of auto-response rules',
+            'path' => '',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'write',
+            'operationType' => 'read',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'create',
+                'operationType' => 'list',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsasASHGE7',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas104PTS'],
             ],
             'parameters' => [
                 [
+                    'name' => 'NextToken',
+                    'in' => 'formData',
+                    'allowEmptyValue' => true,
+                    'schema' => ['description' => 'The token used to retrieve the next page of results. If you leave this parameter empty, the first page of results is returned.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'AAAAASLVeIxed4466E0LVmGkzwS6hJKd9DGVGMDRM6Lu****'],
+                ],
+                [
+                    'name' => 'MaxResults',
+                    'in' => 'formData',
+                    'allowEmptyValue' => true,
+                    'schema' => ['description' => 'The maximum number of entries to return.', 'type' => 'integer', 'format' => 'int32', 'title' => '', 'required' => false, 'example' => '50'],
+                ],
+                [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['description' => 'The region of the data management center for threat analysis. Select the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- `cn-hangzhou`: Your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- `ap-southeast-1`: Your assets are in international regions.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese'."\n"
+                        ."\n"
+                        .'- **en**: English', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataSetName',
+                    'name' => 'ResponseRuleName',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'lmftest',
-                        'maxLength' => 100,
-                    ],
+                    'schema' => ['description' => 'The name of the automated response rule.', 'type' => 'string', 'required' => false, 'example' => 'Send Notification When Generating Urgent Incident'."\n", 'title' => ''],
                 ],
                 [
-                    'name' => 'DataSetDescription',
+                    'name' => 'ResponseRuleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'lmftest contains ip list',
-                        'maxLength' => 1000,
-                    ],
+                    'schema' => ['description' => 'The type of the automated response rule. Valid values:'."\n"
+                        ."\n"
+                        .'- `preset`: A preset rule.'."\n"
+                        ."\n"
+                        .'- `custom`: A custom rule.', 'type' => 'string', 'required' => false, 'example' => 'custom', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataSetFieldKeyName',
+                    'name' => 'ResponseRuleStatus',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'ip',
-                    ],
+                    'schema' => ['description' => 'The status of the automated response rule. Valid values:'."\n"
+                        ."\n"
+                        .'- `0`: disabled'."\n"
+                        ."\n"
+                        .'- `100`: enabled', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '0', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataSetFileName',
+                    'name' => 'ResponseActionType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'cloudsiem-dataset/1358117679873357_17433*****.csv',
-                    ],
+                    'schema' => ['description' => 'The action of the automated response rule. Valid values:'."\n"
+                        ."\n"
+                        .'- `doPlaybook`: Executes a playbook.'."\n"
+                        ."\n"
+                        .'- `changeEventStatus`: Updates the status of an event.'."\n"
+                        ."\n"
+                        .'- `changeThreatLevel`: Updates the threat level of an event.'."\n"
+                        ."\n"
+                        .'- `addEventTag`: Adds a tag to an event.'."\n"
+                        ."\n"
+                        .'- `deleteEventTag`: Removes a tag from an event.'."\n"
+                        ."\n"
+                        .'- `alertWhitelist`: Adds an alert to the allowlist.', 'type' => 'string', 'required' => false, 'example' => 'doPlaybook', 'title' => ''],
                 ],
                 [
-                    'name' => 'IpWhitelistRecognizers',
+                    'name' => 'ResponseTriggerType',
                     'in' => 'formData',
-                    'style' => 'flat',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'array',
-                        'items' => [
-                            'type' => 'object',
-                            'properties' => [
-                                'IpWhitelistRecognizerType' => [
-                                    'description' => '',
-                                    'type' => 'string',
-                                    'required' => false,
-                                    'example' => 'waf_back_source_ip',
-                                ],
-                                'AutoRecognizeStatus' => [
-                                    'description' => '',
-                                    'type' => 'string',
-                                    'required' => false,
-                                    'example' => 'enabled',
-                                ],
-                                'RecognizeScope' => [
-                                    'description' => '',
-                                    'type' => 'string',
-                                    'required' => false,
-                                    'example' => 'current_account',
-                                ],
-                            ],
-                            'required' => false,
-                        ],
-                        'required' => false,
-                    ],
+                    'schema' => ['description' => 'The trigger type of the automated response rule. Valid values:'."\n"
+                        ."\n"
+                        .'- `event`: An event is generated.'."\n"
+                        ."\n"
+                        .'- `event_update`: An event is updated.'."\n"
+                        ."\n"
+                        .'- `alert`: An alert is generated.', 'type' => 'string', 'required' => false, 'example' => 'event', 'title' => ''],
                 ],
                 [
-                    'name' => 'RoleFor',
+                    'name' => 'PageNumber',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The page number.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'example' => '1', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataSetStatus',
+                    'name' => 'PageSize',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'integer',
-                        'format' => 'int32',
-                    ],
+                    'schema' => ['description' => 'The number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'example' => '10', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataSetType',
+                    'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'string',
-                    ],
+                    'schema' => ['description' => 'The ID of a member. An administrator can use this parameter to view data as the specified member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
+                ],
+                [
+                    'name' => 'RoleType',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The view type. Valid values:'."\n"
+                        ."\n"
+                        .'- `0`: Displays data from the current Alibaba Cloud account.'."\n"
+                        ."\n"
+                        .'- `1`: Displays data from all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'Schema of Response',
-                        'description' => 'Schema of Response',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
-                            ],
-                            'DataSetRecordStatistic' => [
-                                'description' => '',
-                                'type' => 'object',
-                                'properties' => [
-                                    'NewDataSetRecordCount' => [
-                                        'description' => '',
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '6',
-                                    ],
-                                    'DataSetId' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'dataset-qt0n8246gs9nackg****',
+                            'TotalCount' => ['description' => 'The total number of entries that match the query conditions. This parameter is optional and may not always be returned.', 'type' => 'integer', 'format' => 'int32', 'title' => '', 'example' => '57'],
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'title' => '', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
+                            'NextToken' => ['description' => 'The position where the current query ends. If this parameter is empty, all data is returned.', 'type' => 'string', 'required' => true, 'title' => '', 'example' => 'AAAAASLVeIxed4466E0LVmGkzwS6hJKd9DGVGMDRM6Lu****'],
+                            'MaxResults' => ['description' => 'The maximum number of entries returned for the current request.', 'type' => 'integer', 'format' => 'int32', 'title' => '', 'example' => '50'],
+                            'PageNumber' => ['description' => 'The page number.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''],
+                            'PageSize' => ['description' => 'The number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10', 'title' => ''],
+                            'ResponseRules' => [
+                                'type' => 'array',
+                                'items' => [
+                                    'type' => 'object',
+                                    'properties' => [
+                                        'ResponseRuleId' => ['description' => 'The ID of the automated response rule.', 'type' => 'string', 'example' => '403235', 'title' => ''],
+                                        'ResponseRuleType' => ['description' => 'The type of the response rule. Valid values:'."\n"
+                                            ."\n"
+                                            .'- `preset`: a predefined rule.'."\n"
+                                            ."\n"
+                                            .'- `custom`: a custom rule.', 'type' => 'string', 'example' => 'custom', 'title' => ''],
+                                        'ResponseRuleStatus' => ['description' => 'The status of the automated response rule. Valid values:'."\n"
+                                            ."\n"
+                                            .'- `0`: disabled.'."\n"
+                                            ."\n"
+                                            .'- `100`: enabled.', 'type' => 'integer', 'format' => 'int32', 'example' => '0', 'title' => ''],
+                                        'ResponseActionConfig' => ['description' => 'The configuration of the action that is performed if the automated response rule is triggered.', 'type' => 'string', 'example' => '[{"actionType":"doPlaybook","playbookName":"block waf IP","playbookUuid":"system_aliyun_waf_whole_process_book","disposeParam":{"period":"7d"}}]', 'title' => ''],
+                                        'ResponseActionType' => ['description' => 'The type of the action. Valid values:'."\n"
+                                            ."\n"
+                                            .'- `doPlaybook`: executes a playbook.'."\n"
+                                            ."\n"
+                                            .'- `changeEventStatus`: changes the status of an event.'."\n"
+                                            ."\n"
+                                            .'- `changeThreatLevel`: changes the threat level of an event.'."\n"
+                                            ."\n"
+                                            .'- `addEventTag`: adds a tag to an event.'."\n"
+                                            ."\n"
+                                            .'- `deleteEventTag`: removes a tag from an event.'."\n"
+                                            ."\n"
+                                            .'- `alertWhitelist`: adds an alert to the whitelist.', 'type' => 'string', 'example' => 'doPlaybook', 'title' => ''],
+                                        'ResponseExecutionCondition' => ['description' => 'The trigger condition of the rule.', 'type' => 'string', 'example' => '[{"left":{"value":"threat_level"},"operator":"equals","right":{"value":"suspicious"}}]', 'title' => ''],
+                                        'ResponseRuleName' => ['description' => 'The name of the automated response rule.', 'type' => 'string', 'example' => 'Send Notification When Generating Urgent Incident'."\n", 'title' => ''],
+                                        'ResponseTriggerType' => ['description' => 'The trigger type of the automated response rule. Valid values:'."\n"
+                                            ."\n"
+                                            .'- `event`: triggered when an event occurs.'."\n"
+                                            ."\n"
+                                            .'- `event_update`: triggered when an event is updated.'."\n"
+                                            ."\n"
+                                            .'- `alert`: triggered when an alert is generated.', 'type' => 'string', 'example' => 'event', 'title' => ''],
+                                        'ResponseRulePriority' => ['description' => 'The priority of the automated response rule.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''],
+                                        'UpdateTime' => ['description' => 'The time when the rule was updated.', 'type' => 'integer', 'format' => 'int64', 'example' => '1769843323000', 'title' => ''],
+                                        'CreateTime' => ['description' => 'The time when the rule was created.', 'type' => 'integer', 'format' => 'int64', 'example' => '1769843323000', 'title' => ''],
                                     ],
+                                    'description' => '',
+                                    'title' => '',
+                                    'example' => '',
                                 ],
+                                'description' => 'The list of automated response rules.',
+                                'title' => '',
+                                'example' => '',
                             ],
                         ],
+                        'title' => '',
+                        'description' => 'The response object.',
+                        'example' => '',
                     ],
                 ],
             ],
-            'errorCodes' => [
-                400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
-                ],
-            ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'ListResponseRules',
+            'description' => 'Each user can receive up to two notifications per day between 08:00 and 20:00.',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n  \\"DataSetRecordStatistic\\": {\\n    \\"NewDataSetRecordCount\\": 6,\\n    \\"DataSetId\\": \\"dataset-qt0n8246gs9nackg****\\"\\n  }\\n}","type":"json"}]',
+            'ramActions' => [],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"TotalCount\\": 57,\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n  \\"NextToken\\": \\"AAAAASLVeIxed4466E0LVmGkzwS6hJKd9DGVGMDRM6Lu****\\",\\n  \\"MaxResults\\": 50,\\n  \\"PageNumber\\": 1,\\n  \\"PageSize\\": 10,\\n  \\"ResponseRules\\": [\\n    {\\n      \\"ResponseRuleId\\": \\"403235\\",\\n      \\"ResponseRuleType\\": \\"custom\\",\\n      \\"ResponseRuleStatus\\": 0,\\n      \\"ResponseActionConfig\\": \\"[{\\\\\\"actionType\\\\\\":\\\\\\"doPlaybook\\\\\\",\\\\\\"playbookName\\\\\\":\\\\\\"block waf IP\\\\\\",\\\\\\"playbookUuid\\\\\\":\\\\\\"system_aliyun_waf_whole_process_book\\\\\\",\\\\\\"disposeParam\\\\\\":{\\\\\\"period\\\\\\":\\\\\\"7d\\\\\\"}}]\\",\\n      \\"ResponseActionType\\": \\"doPlaybook\\",\\n      \\"ResponseExecutionCondition\\": \\"[{\\\\\\"left\\\\\\":{\\\\\\"value\\\\\\":\\\\\\"threat_level\\\\\\"},\\\\\\"operator\\\\\\":\\\\\\"equals\\\\\\",\\\\\\"right\\\\\\":{\\\\\\"value\\\\\\":\\\\\\"suspicious\\\\\\"}}]\\",\\n      \\"ResponseRuleName\\": \\"Send Notification When Generating Urgent Incident\\\\n\\",\\n      \\"ResponseTriggerType\\": \\"event\\",\\n      \\"ResponseRulePriority\\": 1,\\n      \\"UpdateTime\\": 1769843323000,\\n      \\"CreateTime\\": 1769843323000\\n    }\\n  ]\\n}","type":"json"}]',
         ],
-        'UpdateDataSet' => [
-            'summary' => '更新数据集',
-            'methods' => [
-                'post',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'ListTags' => [
+            'summary' => 'Queries a list of tags.',
+            'methods' => ['get', 'post'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'write',
+            'operationType' => 'read',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'update',
+                'operationType' => 'list',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsasASHGE7',
-                ],
+                'abilityTreeNodes' => ['FEATUREsasASHGE7'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['description' => 'The region where the threat analysis data management center is located. Specify the management center based on the region of your assets. Valid values:'."\n"
+                        .'- cn-hangzhou: the asset is in the Chinese mainland.'."\n"
+                        .'- ap-southeast-1: the asset is outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataSetId',
+                    'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'dataset-10iy8mbifnb4gniv****',
-                    ],
+                    'schema' => ['description' => 'The user ID that the administrator switches to when viewing as another member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataSetDescription',
+                    'name' => 'RoleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'lmftest desc',
-                        'maxLength' => 1000,
-                    ],
+                    'schema' => ['description' => 'The view type. Valid values:'."\n"
+                        .'- 0: the view of the current Alibaba Cloud account.'."\n"
+                        .'- 1: the view of all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1', 'title' => ''],
                 ],
                 [
-                    'name' => 'IpWhitelistRecognizers',
+                    'name' => 'TargetUuid',
                     'in' => 'formData',
-                    'style' => 'flat',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'array',
-                        'items' => [
-                            'description' => '',
-                            'type' => 'object',
-                            'properties' => [
-                                'IpWhitelistRecognizerType' => [
-                                    'description' => '',
-                                    'type' => 'string',
-                                    'required' => false,
-                                    'example' => 'cdn_back_source_ip',
-                                ],
-                                'AutoRecognizeStatus' => [
-                                    'description' => '',
-                                    'type' => 'string',
-                                    'required' => false,
-                                    'example' => 'enabled',
-                                ],
-                                'RecognizeScope' => [
-                                    'description' => '',
-                                    'type' => 'string',
-                                    'required' => false,
-                                    'example' => 'current_account',
-                                ],
-                            ],
-                            'required' => false,
-                        ],
-                        'required' => false,
-                    ],
+                    'schema' => ['description' => 'The UUID of the target asset.', 'type' => 'string', 'required' => false, 'example' => 'a1b2c3-****', 'title' => ''],
                 ],
                 [
-                    'name' => 'RoleFor',
+                    'name' => 'TargetType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The scan object type. Valid values:'."\n"
+                        ."\n"
+                        .'- **1**: snapshot '."\n"
+                        .'- **2**: image', 'type' => 'string', 'required' => false, 'example' => 'AliUId', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataSetName',
+                    'name' => 'TargetRelation',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'string',
-                    ],
+                    'schema' => ['description' => 'The target relationship.', 'type' => 'string', 'required' => false, 'example' => '{"incident_uuid":"3fce2d3b65fc2bd05cac6d******"}', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataSetFileName',
+                    'name' => 'NextToken',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'string',
-                    ],
+                    'schema' => ['description' => 'The pagination token for the next query. Leave this parameter empty for the first query or if no more results exist. If a next query is available, set this parameter to the NextToken value returned by the previous API call.', 'type' => 'string', 'required' => false, 'example' => 'AAAAASLVeIxed4466E0LVmGkzwS6hJKd9DGVGMDRM6Lu****', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataSetStatus',
+                    'name' => 'MaxResults',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'integer',
-                        'format' => 'int32',
-                    ],
+                    'schema' => ['description' => 'The maximum number of results to return when using NextToken-based pagination. Valid values: 1 to 100. Default value: 50.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '50', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'Schema of Response',
-                        'description' => '',
+                        'title' => '',
+                        'description' => 'Schema of Response',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => 'DE7E77A9-BFAD-5EAA-9B48-A96760E9DF0B',
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', 'title' => ''],
+                            'Tags' => [
+                                'description' => 'The entity tags. The value is a JSON array string in the following format:'."\n"
+                                    ."\n"
+                                    .'`"[{"tagKey1":"tagValue1"},{"tagKey2":"tagValue2"}]"`',
+                                'type' => 'array',
+                                'items' => [
+                                    'description' => 'The entity tags. The value is a JSON array string in the following format:'."\n"
+                                        ."\n"
+                                        .'`"[{"tagKey1":"tagValue1"},{"tagKey2":"tagValue2"}]"`',
+                                    'type' => 'object',
+                                    'properties' => [
+                                        'Tag' => ['description' => 'The key of the tag to query. You can specify multiple keys. N is a positive integer.', 'type' => 'string', 'example' => 'False', 'title' => ''],
+                                        'Count' => ['description' => 'The number of quick queries returned on the current page.', 'type' => 'integer', 'format' => 'int64', 'example' => '8', 'title' => ''],
+                                    ],
+                                    'title' => '',
+                                    'example' => '',
+                                ],
+                                'title' => '',
+                                'example' => '',
                             ],
+                            'MaxResults' => ['description' => 'The maximum number of results to return when using NextToken-based pagination. Valid values: 1 to 100. Default value: 50.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''],
+                            'NextToken' => ['description' => 'The pagination token for the next query. Leave this parameter empty for the first query or if no more results exist. If a next query is available, set this parameter to the NextToken value returned by the previous API call.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'Query tag list',
+            'description' => 'The input parameter JsonConfig is a complex JSON configuration. A utility class is provided to help with specific configuration examples. For more information, refer to [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"DE7E77A9-BFAD-5EAA-9B48-A96760E9DF0B\\"\\n}","type":"json"}]',
+            'ramActions' => [],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n  \\"Tags\\": [\\n    {\\n      \\"Tag\\": \\"False\\",\\n      \\"Count\\": 8\\n    }\\n  ],\\n  \\"MaxResults\\": 50,\\n  \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\"\\n}","type":"json"}]',
         ],
-        'DeleteDataSet' => [
-            'summary' => '删除数据集',
-            'methods' => [
-                'post',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'ListTrafficStatistics' => [
+            'summary' => 'Retrieves a list of traffic statistics.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'write',
+            'operationType' => 'readAndWrite',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'delete',
+                'operationType' => 'get',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsasASHGE7',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['description' => 'The region of the Data Management center for threat analysis. Select a region based on the location of your asset. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your asset is in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your asset is outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
+                    'schema' => ['description' => 'The language of the response messages. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
+                ],
+                [
+                    'name' => 'RoleFor',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The user ID of a member. This parameter is used by an administrator to switch to the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
+                ],
+                [
+                    'name' => 'TrafficStatisticPeriod',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The statistical period.', 'type' => 'string', 'required' => false, 'example' => '30', 'title' => ''],
+                ],
+                [
+                    'name' => 'TrafficStatisticPeriodType',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The statistic granularity. Valid values:'."\n"
+                        ."\n"
+                        .'- day: day. This is the default value.'."\n"
+                        ."\n"
+                        .'- hour: hour.', 'type' => 'string', 'required' => false, 'example' => 'day', 'title' => ''],
+                ],
+                [
+                    'name' => 'TrafficStatisticType',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The statistic dimension. Valid values:'."\n"
+                        ."\n"
+                        .'- Region'."\n"
+                        ."\n"
+                        .'- Product'."\n"
+                        ."\n"
+                        .'- DataIngetion'."\n"
+                        ."\n"
+                        .'- logUserId', 'type' => 'string', 'required' => false, 'example' => 'Region', 'title' => ''],
+                ],
+                [
+                    'name' => 'ProductId',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The product ID.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_sas', 'title' => ''],
+                ],
+                [
+                    'name' => 'TrafficType',
+                    'in' => 'formData',
                     'schema' => [
-                        'description' => '',
+                        'description' => 'The type of the log traffic.',
+                        'enumValueTitles' => ['commonLogTraffic' => 'commonLogTraffic', 'agentAnalysisLogTraffic' => 'agentAnalysisLogTraffic'],
                         'type' => 'string',
+                        'example' => 'agentAnalysisLogTraffic',
+                        'default' => 'commonLogTraffic',
+                        'title' => '',
                         'required' => false,
-                        'example' => 'zh',
                     ],
                 ],
                 [
-                    'name' => 'DataSetId',
+                    'name' => 'RegionTag',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'dataset-10iy8mbifnb4gniv****',
-                    ],
+                    'schema' => ['description' => 'The region.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1', 'title' => ''],
                 ],
                 [
-                    'name' => 'RoleFor',
+                    'name' => 'LogUserIds',
                     'in' => 'formData',
+                    'style' => 'simple',
                     'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
+                        'description' => 'A list of user IDs for batch data ingestion.',
+                        'type' => 'array',
+                        'items' => ['description' => 'A user ID for batch data ingestion.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                         'required' => false,
-                        'example' => '113091674488****',
+                        'title' => '',
+                        'example' => '',
                     ],
                 ],
             ],
@@ -10278,40 +9626,78 @@
                 200 => [
                     'schema' => [
                         'title' => 'Schema of Response',
-                        'description' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
+                            'RequestId' => ['title' => 'Id of the request', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
+                            'TrafficStatistics' => [
+                                'description' => 'The list of traffic statistics.',
+                                'type' => 'array',
+                                'items' => [
+                                    'description' => 'The traffic statistics.',
+                                    'type' => 'object',
+                                    'properties' => [
+                                        'TrafficStatisticTarget' => ['description' => 'The statistic target.', 'type' => 'string', 'example' => 'all', 'title' => ''],
+                                        'TrafficStatisticData' => [
+                                            'description' => 'The statistics information.',
+                                            'type' => 'array',
+                                            'items' => [
+                                                'description' => 'The traffic information.',
+                                                'type' => 'object',
+                                                'properties' => [
+                                                    'TrafficStatisticTime' => ['description' => 'The statistic time.', 'type' => 'integer', 'format' => 'int64', 'example' => '20250815', 'title' => ''],
+                                                    'TrafficStatisticValue' => ['description' => 'The statistic value.', 'type' => 'number', 'format' => 'double', 'example' => '1.699814', 'title' => ''],
+                                                ],
+                                                'title' => '',
+                                                'example' => '',
+                                            ],
+                                            'title' => '',
+                                            'example' => '',
+                                        ],
+                                    ],
+                                    'title' => '',
+                                    'example' => '',
+                                ],
+                                'title' => '',
+                                'example' => '',
                             ],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"TrafficStatistics\\": [\\n    {\\n      \\"TrafficStatisticTarget\\": \\"all\\",\\n      \\"TrafficStatisticData\\": [\\n        {\\n          \\"TrafficStatisticTime\\": 20250815,\\n          \\"TrafficStatisticValue\\": 1.699814\\n        }\\n      ]\\n    }\\n  ]\\n}","type":"json"}]',
+            'title' => 'ListTrafficStatistics',
+            'description' => 'The JsonConfig input parameter is a complex JSON configuration. A supporting tool class with configuration examples is provided. For more information, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ListTrafficStatistics',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
         ],
-        'ListDataSets' => [
-            'summary' => '获取数据集列表',
-            'methods' => [
-                'get',
-                'post',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'ListUpgradeItems' => [
+            'summary' => 'Retrieves a list of upgrade items.',
+            'path' => '',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
@@ -10323,354 +9709,245 @@
                 'operationType' => 'list',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsasASHGE7',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
-                    'name' => 'RegionId',
+                    'name' => 'MaxResults',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['description' => 'The maximum number of entries to return.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'minimum' => '0', 'example' => '50', 'title' => ''],
                 ],
                 [
-                    'name' => 'Lang',
+                    'name' => 'NextToken',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh',
-                    ],
+                    'schema' => ['description' => 'The token that is used to retrieve the next page of results. Leave this parameter empty for the first request. To retrieve the next page, set this parameter to the NextToken value from the previous response.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataSetId',
+                    'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'dataset-qt0n8246gs9nackg****',
-                    ],
+                    'schema' => ['description' => 'The region where the Data Management center is located. Select a region based on where your assets are. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataSetName',
+                    'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'lmftest',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataSetStatus',
+                    'name' => 'RoleFor',
                     'in' => 'formData',
+                    'schema' => ['description' => 'The user ID of the member. An administrator can use this parameter to switch to the member\'s view.', 'type' => 'string', 'required' => false, 'example' => '113091674488****', 'title' => ''],
+                ],
+            ],
+            'responses' => [
+                200 => [
                     'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'required' => false,
-                        'example' => '0',
-                        'format' => 'int32',
+                        'title' => 'Schema of Response',
+                        'description' => 'The response body.',
+                        'type' => 'object',
+                        'properties' => [
+                            'RequestId' => ['title' => 'Id of the request', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
+                            'UpgradeItems' => [
+                                'description' => 'The list of upgrade items.',
+                                'type' => 'array',
+                                'items' => [
+                                    'description' => 'An upgrade item.',
+                                    'type' => 'object',
+                                    'properties' => [
+                                        'UpgradeItemId' => ['description' => 'The ID of the upgrade item.', 'type' => 'string', 'example' => 'data_storage_2_upgrade', 'title' => ''],
+                                    ],
+                                    'title' => '',
+                                    'example' => '',
+                                ],
+                                'title' => '',
+                                'example' => '',
+                            ],
+                            'NextToken' => ['description' => 'The token that is used to retrieve the next page of results. If the value is not empty, more results are available.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
+                            'MaxResults' => ['description' => 'The maximum number of entries returned on the current page.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''],
+                            'TotalCount' => ['description' => 'The total number of entries.', 'type' => 'integer', 'format' => 'int32', 'example' => '57', 'title' => ''],
+                        ],
+                        'example' => '',
                     ],
                 ],
-                [
-                    'name' => 'OrderFieldName',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'GmtCreate',
+            ],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"UpgradeItems\\": [\\n    {\\n      \\"UpgradeItemId\\": \\"data_storage_2_upgrade\\"\\n    }\\n  ],\\n  \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\",\\n  \\"MaxResults\\": 50,\\n  \\"TotalCount\\": 57\\n}","type":"json"}]',
+            'title' => 'ListUpgradeItems',
+            'description' => 'The JsonConfig request parameter is a complex JSON configuration. A supporting tool class provides examples for this configuration. For more information, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'list',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ListUpgradeItems',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
                     ],
                 ],
+            ],
+        ],
+        'ListVendors' => [
+            'summary' => 'Retrieves a list of vendors.',
+            'path' => '',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
+            'security' => [
                 [
-                    'name' => 'OrderDirection',
+                    'AK' => [],
+                ],
+            ],
+            'operationType' => 'read',
+            'deprecated' => false,
+            'systemTags' => [
+                'operationType' => 'list',
+                'riskType' => 'none',
+                'chargeType' => 'free',
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
+            ],
+            'parameters' => [
+                [
+                    'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'asc',
-                    ],
+                    'schema' => ['description' => 'The region where the Data Management center for threat analysis is located. Select a region for the Management Hub based on the region where your asset resides. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your asset is in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your asset is outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
-                    'name' => 'PageNumber',
+                    'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'minimum' => '1',
-                        'example' => '1',
-                    ],
+                    'schema' => ['description' => 'The language of the response message. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'en'."\n", 'title' => ''],
                 ],
                 [
-                    'name' => 'PageSize',
+                    'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'maximum' => '100',
-                        'minimum' => '1',
-                        'example' => '10',
-                    ],
+                    'schema' => ['description' => 'The user ID of a member. An administrator can use this ID to switch to the member\'s perspective.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******'."\n", 'title' => ''],
                 ],
                 [
-                    'name' => 'DataSetIds',
+                    'name' => 'VendorIds',
                     'in' => 'formData',
                     'style' => 'simple',
                     'schema' => [
-                        'description' => '',
+                        'description' => 'A list of vendors.',
                         'type' => 'array',
-                        'items' => [
-                            'description' => '',
-                            'type' => 'string',
-                            'required' => false,
-                            'example' => '["dataset-1lz4nf2x08mklchy****"]',
-                        ],
+                        'items' => ['description' => 'The vendor ID.', 'type' => 'string', 'required' => false, 'example' => 'vd-qlsw5eocx94w9', 'title' => ''],
                         'required' => false,
-                        'maxItems' => 50,
+                        'title' => '',
+                        'example' => '',
                     ],
                 ],
                 [
-                    'name' => 'RoleFor',
+                    'name' => 'VendorName',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The vendor name.', 'type' => 'string', 'required' => false, 'example' => '111', 'title' => ''],
                 ],
                 [
-                    'name' => 'MaxResults',
+                    'name' => 'VendorType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '50',
-                    ],
+                    'schema' => ['description' => 'The vendor type. Valid values:'."\n"
+                        ."\n"
+                        .'- preset'."\n"
+                        ."\n"
+                        .'- custom', 'type' => 'string', 'required' => false, 'example' => 'preset', 'title' => ''],
                 ],
                 [
-                    'name' => 'NextToken',
+                    'name' => 'MaxResults',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****',
-                    ],
+                    'schema' => ['description' => 'The maximum number of entries to return for this request.', 'type' => 'integer', 'format' => 'int32', 'minimum' => '0', 'required' => false, 'example' => '50', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataSetType',
+                    'name' => 'NextToken',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'custom',
-                    ],
+                    'schema' => ['description' => 'The token that is used to retrieve the next page of results. If this is your first query or if no next page exists, you do not need to specify this parameter. If a next page exists, set the value to the NextToken value that is returned in the last response.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'Schema of Response',
-                        'description' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '157CFBB5-B56F-566F-8991-B3C51799****',
-                            ],
-                            'DataSets' => [
-                                'description' => '',
+                            'RequestId' => ['description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''],
+                            'Vendors' => [
+                                'description' => 'The vendors.',
                                 'type' => 'array',
                                 'items' => [
+                                    'description' => 'The vendor.',
                                     'type' => 'object',
                                     'properties' => [
-                                        'CreateTime' => [
-                                            'description' => '',
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '1713787368000',
-                                        ],
-                                        'UpdateTime' => [
-                                            'description' => '',
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '1713787368000',
-                                        ],
-                                        'DataSetId' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'dataset-t8ha6p7k61rmniqw****',
-                                        ],
-                                        'DataSetName' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'lmftest',
-                                        ],
-                                        'DataSetDescription' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'lmftest desc',
-                                        ],
-                                        'DataSetFieldNames' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => '["ip","region"]',
-                                        ],
-                                        'DataSetFieldKeyName' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'ip',
-                                        ],
-                                        'DataSetFileName' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'cloudsiem-dataset/1358117679873357_174338773****.csv',
-                                        ],
-                                        'DataSetStatus' => [
-                                            'description' => '',
-                                            'type' => 'integer',
-                                            'format' => 'int32',
-                                            'example' => '1',
-                                        ],
-                                        'DataSetReferences' => [
-                                            'description' => '',
-                                            'type' => 'array',
-                                            'items' => [
-                                                'type' => 'object',
-                                                'properties' => [
-                                                    'DataSetId' => [
-                                                        'description' => '',
-                                                        'type' => 'string',
-                                                        'example' => 'dataset-nhcrmjpx1zsorlaq****',
-                                                    ],
-                                                    'DataSetReferenceType' => [
-                                                        'description' => '',
-                                                        'type' => 'string',
-                                                        'example' => 'playbook',
-                                                    ],
-                                                    'DataSetReferenceId' => [
-                                                        'description' => '',
-                                                        'type' => 'string',
-                                                        'example' => '456232',
-                                                    ],
-                                                    'DataSetReferenceName' => [
-                                                        'description' => '',
-                                                        'type' => 'string',
-                                                        'example' => 'playbook_name',
-                                                    ],
-                                                ],
-                                            ],
-                                        ],
-                                        'DataSetType' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'preset',
-                                        ],
-                                        'IpWhitelistRecognizers' => [
-                                            'description' => '',
-                                            'type' => 'array',
-                                            'items' => [
-                                                'type' => 'object',
-                                                'properties' => [
-                                                    'IpWhitelistRecognizerType' => [
-                                                        'description' => '',
-                                                        'type' => 'string',
-                                                        'example' => 'waf_back_source_ip',
-                                                    ],
-                                                    'AutoRecognizeStatus' => [
-                                                        'description' => '',
-                                                        'type' => 'string',
-                                                        'example' => 'enabled',
-                                                    ],
-                                                    'RecognizeScope' => [
-                                                        'description' => '',
-                                                        'type' => 'string',
-                                                        'example' => 'current_account',
-                                                    ],
-                                                    'UpdateTime' => [
-                                                        'description' => '',
-                                                        'type' => 'integer',
-                                                        'format' => 'int64',
-                                                        'example' => '1713787368000',
-                                                    ],
-                                                ],
-                                            ],
-                                        ],
-                                    ],
+                                        'CreateTime' => ['description' => 'The creation time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''],
+                                        'UpdateTime' => ['description' => 'The update time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''],
+                                        'VendorId' => ['description' => 'The vendor ID.', 'type' => 'string', 'example' => 'vd-qlsw5eocx94w9', 'title' => ''],
+                                        'VendorName' => ['description' => 'The vendor name.', 'type' => 'string', 'example' => '111', 'title' => ''],
+                                        'VendorType' => ['description' => 'The vendor type. Valid values:'."\n"
+                                            ."\n"
+                                            .'- preset'."\n"
+                                            ."\n"
+                                            .'- custom', 'type' => 'string', 'example' => 'preset', 'title' => ''],
+                                    ],
+                                    'title' => '',
+                                    'example' => '',
                                 ],
+                                'title' => '',
+                                'example' => '',
                             ],
-                            'PageNumber' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '1',
-                            ],
-                            'PageSize' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '10',
-                            ],
-                            'TotalCount' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '57',
-                            ],
-                            'MaxResults' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '50',
-                            ],
-                            'NextToken' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****',
-                            ],
+                            'MaxResults' => ['description' => 'The maximum number of entries returned for this request.', 'type' => 'integer', 'format' => 'int32', 'minimum' => '0', 'example' => '50', 'title' => ''],
+                            'NextToken' => ['description' => 'The token that is used to retrieve the next page of results. If this is your first query or if no next page exists, you do not need to specify this parameter. If a next page exists, set the value to the NextToken value that is returned in the last response.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''],
+                            'TotalCount' => ['description' => 'The total number of records.', 'type' => 'integer', 'format' => 'int32', 'example' => '57', 'title' => ''],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"Vendors\\": [\\n    {\\n      \\"CreateTime\\": 1733269771123,\\n      \\"UpdateTime\\": 1733269771123,\\n      \\"VendorId\\": \\"vd-qlsw5eocx94w9\\",\\n      \\"VendorName\\": \\"111\\",\\n      \\"VendorType\\": \\"preset\\"\\n    }\\n  ],\\n  \\"MaxResults\\": 50,\\n  \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\",\\n  \\"TotalCount\\": 57\\n}","type":"json"}]',
+            'title' => 'ListVendors',
+            'description' => 'The frequency and time of notifications are limited. Each user can receive a maximum of two notifications per day, which are sent only between 08:00 and 20:00.',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'list',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ListVendors',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'Vendor', 'arn' => 'acs:yundun-sas::{#accountId}:vendor/*'],
+                        ],
+                    ],
+                ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"157CFBB5-B56F-566F-8991-B3C51799****\\",\\n  \\"DataSets\\": [\\n    {\\n      \\"CreateTime\\": 1713787368000,\\n      \\"UpdateTime\\": 1713787368000,\\n      \\"DataSetId\\": \\"dataset-t8ha6p7k61rmniqw****\\",\\n      \\"DataSetName\\": \\"lmftest\\",\\n      \\"DataSetDescription\\": \\"lmftest desc\\",\\n      \\"DataSetFieldNames\\": \\"[\\\\\\"ip\\\\\\",\\\\\\"region\\\\\\"]\\",\\n      \\"DataSetFieldKeyName\\": \\"ip\\",\\n      \\"DataSetFileName\\": \\"cloudsiem-dataset/1358117679873357_174338773****.csv\\",\\n      \\"DataSetStatus\\": 1,\\n      \\"DataSetReferences\\": [\\n        {\\n          \\"DataSetId\\": \\"dataset-nhcrmjpx1zsorlaq****\\",\\n          \\"DataSetReferenceType\\": \\"playbook\\",\\n          \\"DataSetReferenceId\\": \\"456232\\",\\n          \\"DataSetReferenceName\\": \\"playbook_name\\"\\n        }\\n      ],\\n      \\"DataSetType\\": \\"preset\\",\\n      \\"IpWhitelistRecognizers\\": [\\n        {\\n          \\"IpWhitelistRecognizerType\\": \\"waf_back_source_ip\\",\\n          \\"AutoRecognizeStatus\\": \\"enabled\\",\\n          \\"RecognizeScope\\": \\"current_account\\",\\n          \\"UpdateTime\\": 1713787368000\\n        }\\n      ]\\n    }\\n  ],\\n  \\"PageNumber\\": 1,\\n  \\"PageSize\\": 10,\\n  \\"TotalCount\\": 57,\\n  \\"MaxResults\\": 50,\\n  \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\"\\n}","type":"json"}]',
         ],
-        'UpdateDataSetRecord' => [
-            'summary' => '更新数据集记录',
-            'methods' => [
-                'post',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'RefreshDataSource' => [
+            'methods' => ['post'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
@@ -10682,129 +9959,273 @@
                 'operationType' => 'update',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsasASHGE7',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
+                'autoTest' => true,
+                'tenantRelevance' => 'tenant',
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['description' => 'The region where the Data Management Center for threat analysis is located. Select the region of the Data Management Center based on the region of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh',
-                    ],
+                    'schema' => ['description' => 'The language of the messages. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese'."\n"
+                        ."\n"
+                        .'- **en**: English', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataSetId',
+                    'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'dataset-10iy8mbifnb4gniv****',
-                    ],
+                    'schema' => ['description' => 'The user ID of a member. An administrator can use this parameter to switch to the perspective of the specified member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataSetRecords',
+                    'name' => 'DataSourceId',
                     'in' => 'formData',
+                    'schema' => ['description' => 'The ID of the data source.', 'type' => 'string', 'required' => false, 'example' => 'ds-jl67vixpe1scwysgyu3x', 'title' => ''],
+                ],
+            ],
+            'responses' => [
+                200 => [
                     'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '[{\\"ip\\":\\"1.1.1.1\\",\\"userid\\":\\"1234\\",\\"name\\":\\"a12401\\"},'."\n"
-                            .' {\\"ip\\":\\"2.2.2.2\\",\\"userid\\":\\"33333\\",\\"name\\":\\"a12401\\"}]',
+                        'type' => 'object',
+                        'properties' => [
+                            'RequestId' => ['description' => 'Id of the request', 'type' => 'string', 'title' => '', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
+                        ],
+                        'title' => '',
+                        'description' => 'Schema of Response',
+                        'example' => '',
+                    ],
+                ],
+            ],
+            'errorCodes' => [],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'RefreshDataSource',
+            'summary' => 'Refreshes a data source.',
+            'description' => 'There are limits on the frequency and time of notifications. Each user can receive a maximum of two notifications per day between 08:00 and 20:00. Notifications are not sent outside of this time frame.',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'update',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:RefreshDataSource',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DataSource', 'arn' => 'acs:yundun-sas::{#accountId}:datasource/{#DataSourceId}'],
+                        ],
                     ],
                 ],
+            ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
+        ],
+        'ResetDataStorage' => [
+            'summary' => 'Resets the log storage for a user.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
+            'security' => [
                 [
-                    'name' => 'DataSetFileName',
+                    'AK' => [],
+                ],
+            ],
+            'operationType' => 'readAndWrite',
+            'deprecated' => false,
+            'systemTags' => [
+                'operationType' => 'update',
+                'riskType' => 'none',
+                'chargeType' => 'free',
+                'abilityTreeNodes' => ['FEATUREsasRXJ9SY'],
+                'autoTest' => true,
+                'tenantRelevance' => 'tenant',
+            ],
+            'parameters' => [
+                [
+                    'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cloudsiem-dataset/1358117679873357_174338773****.csv',
-                    ],
+                    'schema' => ['description' => 'The region of the Data Management center. Select a region for the Data Management center based on the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: The assets are in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: The assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
+                ],
+                [
+                    'name' => 'Lang',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
+                    'schema' => ['description' => 'The user ID of a member. An administrator uses this ID to switch to the member\'s perspective.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''],
+                ],
+            ],
+            'responses' => [
+                200 => [
                     'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
+                        'title' => 'BaseResponse',
+                        'description' => 'The response body.',
+                        'type' => 'object',
+                        'properties' => [
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''],
+                        ],
+                        'example' => '',
+                    ],
+                ],
+            ],
+            'errorCodes' => [],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+            'title' => 'ResetDataStorage',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'update',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ResetDataStorage',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
                     ],
                 ],
             ],
+        ],
+        'SetDefaultNormalizationRuleVersion' => [
+            'summary' => 'Sets the default version of a normalization rule.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
+            'security' => [
+                [
+                    'AK' => [],
+                ],
+            ],
+            'operationType' => 'write',
+            'deprecated' => false,
+            'systemTags' => [
+                'operationType' => 'none',
+                'riskType' => 'none',
+                'chargeType' => 'free',
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
+            ],
+            'parameters' => [
+                [
+                    'name' => 'RegionId',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The data management center of the threat analysis feature. Specify this parameter based on the region where your assets reside. Valid values:'."\n"
+                        .'- cn-hangzhou: Your assets reside in the Chinese mainland.'."\n"
+                        .'- ap-southeast-1: Your assets reside outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
+                ],
+                [
+                    'name' => 'Lang',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
+                ],
+                [
+                    'name' => 'RoleFor',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The user ID of the member to which the administrator switches the view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
+                ],
+                [
+                    'name' => 'NormalizationRuleVersion',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The normalization rule version.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => 'V1', 'title' => ''],
+                ],
+                [
+                    'name' => 'NormalizationRuleId',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The normalization rule ID.', 'type' => 'string', 'required' => false, 'example' => 'nr-z0b2ssjteut85uoh9nzp', 'title' => ''],
+                ],
+            ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'Schema of Response',
-                        'description' => '',
+                        'title' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
-                            ],
-                            'DataSetRecordStatistic' => [
-                                'description' => '',
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''],
+                            'NormalizationRuleVersion' => [
+                                'description' => 'The normalization rule version.',
                                 'type' => 'object',
                                 'properties' => [
-                                    'NewDataSetRecordCount' => [
-                                        'description' => '',
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '12',
-                                    ],
-                                    'UpdateDataSetRecordCount' => [
-                                        'description' => '',
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '4',
-                                    ],
+                                    'CreateTime' => ['description' => 'The creation time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''],
+                                    'UpdateTime' => ['description' => 'The update time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''],
+                                    'NormalizationRuleId' => ['description' => 'The normalization rule ID.', 'type' => 'string', 'example' => 'nr-z0b2ssjteut85uoh9nzp', 'title' => ''],
+                                    'NormalizationRuleName' => ['description' => 'The normalization rule name.', 'type' => 'string', 'example' => 'normalization_rule_Z57np', 'title' => ''],
+                                    'NormalizationRuleType' => ['description' => 'The normalization rule type. Valid values:'."\n"
+                                        .'- predefined: predefined normalization rule.'."\n"
+                                        .'- custom: custom normalization rule.', 'type' => 'string', 'example' => 'predefined', 'title' => ''],
+                                    'NormalizationRuleFormat' => ['description' => 'The normalization rule format.', 'type' => 'string', 'example' => 'SPL', 'title' => ''],
+                                    'NormalizationRuleDescription' => ['description' => 'The normalization rule description.', 'type' => 'string', 'example' => 'normalization_rule_Z57np', 'title' => ''],
+                                    'NormalizationRuleVersion' => ['description' => 'The current version of the normalization rule.', 'type' => 'integer', 'format' => 'int32', 'example' => 'V1', 'title' => ''],
+                                    'NormalizationRuleExpression' => ['description' => 'The normalization rule expression.', 'type' => 'string', 'example' => '* | pack-fields -include=\'[\\s\\S]+\' as extend_content', 'title' => ''],
+                                    'NormalizationRuleStatus' => ['description' => 'The normalization rule status.', 'type' => 'string', 'example' => 'started', 'title' => ''],
+                                    'NormalizationCategoryId' => ['description' => 'The normalization rule category ID.', 'type' => 'string', 'example' => 'NETWORK_CATEGORY', 'title' => ''],
+                                    'NormalizationSchemaId' => ['description' => 'The normalization schema ID.', 'type' => 'string', 'example' => 'HTTP_ACTIVITY', 'title' => ''],
+                                    'VendorId' => ['description' => 'The vendor ID associated with the normalization rule.', 'type' => 'string', 'example' => 'alibaba_cloud', 'title' => ''],
+                                    'ProductId' => ['description' => 'The product ID.', 'type' => 'string', 'example' => 'alibaba_cloud_sas', 'title' => ''],
+                                    'NormalizationSecurityDomainId' => ['title' => '', 'type' => 'string', 'example' => 'NETWORK_AND_WEB_SECURITY', 'description' => ''],
                                 ],
+                                'title' => '',
+                                'example' => '',
                             ],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
+                ],
+            ],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'Set the default version of a normalization rule',
+            'description' => 'Notifications are subject to frequency and time restrictions.'."\n"
+                .'Each user can receive a maximum of two notifications per day between 08:00 and 20:00. No notifications are sent outside this time window.',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'none',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:SetDefaultNormalizationRuleVersion',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'NormalizationRule', 'arn' => 'acs:yundun-sas::{#accountId}:normalizationrule/{#NormalizationRuleId}'],
+                        ],
                     ],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n  \\"DataSetRecordStatistic\\": {\\n    \\"NewDataSetRecordCount\\": 12,\\n    \\"UpdateDataSetRecordCount\\": 4\\n  }\\n}","type":"json"}]',
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"NormalizationRuleVersion\\": {\\n    \\"CreateTime\\": 1733269771123,\\n    \\"UpdateTime\\": 1733269771123,\\n    \\"NormalizationRuleId\\": \\"nr-z0b2ssjteut85uoh9nzp\\",\\n    \\"NormalizationRuleName\\": \\"normalization_rule_Z57np\\",\\n    \\"NormalizationRuleType\\": \\"predefined\\",\\n    \\"NormalizationRuleFormat\\": \\"SPL\\",\\n    \\"NormalizationRuleDescription\\": \\"normalization_rule_Z57np\\",\\n    \\"NormalizationRuleVersion\\": 0,\\n    \\"NormalizationRuleExpression\\": \\"* | pack-fields -include=\'[\\\\\\\\s\\\\\\\\S]+\' as extend_content\\",\\n    \\"NormalizationRuleStatus\\": \\"started\\",\\n    \\"NormalizationCategoryId\\": \\"NETWORK_CATEGORY\\",\\n    \\"NormalizationSchemaId\\": \\"HTTP_ACTIVITY\\",\\n    \\"VendorId\\": \\"alibaba_cloud\\",\\n    \\"ProductId\\": \\"alibaba_cloud_sas\\",\\n    \\"NormalizationSecurityDomainId\\": \\"NETWORK_AND_WEB_SECURITY\\"\\n  }\\n}","type":"json"}]',
         ],
-        'DeleteDataSetRecord' => [
-            'summary' => '删除数据集记录',
-            'methods' => [
-                'post',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'UpdateAlert' => [
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
@@ -10813,317 +10234,356 @@
             'operationType' => 'write',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'delete',
+                'operationType' => 'update',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsasASHGE7',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas731ZAS'],
+                'tenantRelevance' => 'tenant',
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['description' => 'The data management center of the threat analysis feature. Specify this parameter based on the region where your assets reside. Valid values:'."\n"
+                        .'- cn-hangzhou: the Chinese mainland and Hong Kong (China).'."\n"
+                        .'- ap-southeast-1: regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataSetId',
+                    'name' => 'AlertUuid',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'dataset-10iy8mbifnb4gniv****',
-                    ],
+                    'schema' => ['description' => 'The alert ID associated with the event.', 'type' => 'string', 'required' => false, 'example' => 'sas_71e24437d2797ce8fc59692905a4****', 'title' => ''],
                 ],
                 [
-                    'name' => 'DataSetRecordIds',
+                    'name' => 'AlertStatus',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => '[1,2,3,4]',
-                    ],
+                    'schema' => ['description' => 'The alert status.', 'type' => 'string', 'required' => false, 'example' => '1', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The ID of the user to which the administrator switches the view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''],
+                ],
+                [
+                    'name' => 'RoleType',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The view type. Valid values:'."\n"
+                        ."\n"
+                        .'- 0: the current Alibaba Cloud account view.'."\n"
+                        .'- 1: the view of all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '1', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'Schema of Response',
-                        'description' => '',
+                        'title' => '',
+                        'description' => 'Schema of Response',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****',
-                            ],
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'Update an alert',
+            'summary' => 'Updates an alert.',
+            'description' => 'Notifications are subject to frequency and time restrictions.'."\n"
+                .'Each user receives a maximum of two notifications per day between 08:00 and 20:00. No notifications are sent outside this time range.',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
             ],
+            'ramActions' => [],
             'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
         ],
-        'ListDataSetRecords' => [
-            'summary' => '获取数据集记录列表',
-            'methods' => [
-                'get',
-                'post',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'UpdateAutoDisposeConfig' => [
+            'summary' => 'Updates the auto-dispose configuration.',
+            'path' => '',
+            'methods' => ['post'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'read',
+            'operationType' => 'readAndWrite',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'list',
+                'operationType' => 'update',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsasASHGE7',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas731ZAS'],
+                'tenantRelevance' => 'tenant',
             ],
             'parameters' => [
                 [
-                    'name' => 'RegionId',
+                    'name' => 'AutoDecisionStatus',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['description' => 'Specifies whether to enable auto decision. Valid values:'."\n"
+                        ."\n"
+                        .'- `enabled`: Enables auto decision.'."\n"
+                        ."\n"
+                        .'- `disabled`: Disables auto decision.', 'type' => 'string', 'required' => true, 'example' => 'enabled', 'title' => ''],
+                ],
+                [
+                    'name' => 'ProductCode',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The code for the cloud product.', 'type' => 'string', 'required' => true, 'example' => 'alibaba_cloud_sas', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
+                    'schema' => ['description' => 'The language of the response message. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => true, 'example' => 'zh', 'title' => ''],
+                ],
+            ],
+            'responses' => [
+                200 => [
                     'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh',
+                        'type' => 'object',
+                        'properties' => [
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'title' => '', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
+                        ],
+                        'title' => '',
+                        'description' => 'The response body.',
+                        'example' => '',
                     ],
                 ],
+            ],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'UpdateAutoDisposeConfig',
+            'description' => 'The `JsonConfig` parameter is a complex JSON configuration. See the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java) for helper utility classes and configuration examples.',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+        ],
+        'UpdateAutoDisposeRecord' => [
+            'summary' => 'Updates an automatic alert analysis record.',
+            'path' => '',
+            'methods' => ['post'],
+            'schemes' => ['https'],
+            'security' => [
                 [
-                    'name' => 'DataSetId',
+                    'AK' => [],
+                ],
+            ],
+            'operationType' => 'readAndWrite',
+            'deprecated' => false,
+            'systemTags' => [
+                'operationType' => 'update',
+                'riskType' => 'none',
+                'chargeType' => 'free',
+                'abilityTreeNodes' => ['FEATUREsas731ZAS'],
+                'tenantRelevance' => 'tenant',
+            ],
+            'parameters' => [
+                [
+                    'name' => 'AutoDisposeRecordId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'dataset-nhcrmjpx1zsorlaq****',
-                    ],
+                    'schema' => ['description' => 'The unique ID of the analysis record.', 'type' => 'string', 'required' => true, 'example' => '4227e0cdc4b7efb45ce7ff09758****', 'title' => ''],
                 ],
                 [
-                    'name' => 'PageNumber',
+                    'name' => 'AutoDecisionConclusion',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => true,
-                        'minimum' => '1',
-                        'example' => '1',
-                    ],
+                    'schema' => ['description' => 'The conclusion of the automatic alert analysis.', 'type' => 'string', 'required' => false, 'example' => '疑似误报', 'title' => ''],
                 ],
                 [
-                    'name' => 'PageSize',
+                    'name' => 'Lang',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => true, 'example' => 'zh', 'title' => ''],
+                ],
+                [
+                    'name' => 'AutoDecisionEntityList',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The list of entities for analysis.', 'type' => 'string', 'required' => false, 'example' => '[{"entityType":"file","entityName":"/path/file.file","entityUuid":"b7efb45ce7ff09758****","disposalMethod":"delete","playbookUuid":"9213bhdjagdja****"}]', 'title' => ''],
+                ],
+                [
+                    'name' => 'AutoDecisionResult',
                     'in' => 'formData',
+                    'schema' => ['description' => 'The analysis result.', 'type' => 'string', 'required' => false, 'example' => 'success', 'title' => ''],
+                ],
+            ],
+            'responses' => [
+                200 => [
                     'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => true,
-                        'maximum' => '100',
-                        'minimum' => '1',
-                        'example' => '10',
+                        'type' => 'object',
+                        'properties' => [
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'title' => '', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'],
+                        ],
+                        'title' => '',
+                        'description' => 'The returned data.',
+                        'example' => '',
                     ],
                 ],
+            ],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'UpdateAutoDisposeRecord',
+            'description' => 'The AutoDecisionEntityList parameter is a JSON-formatted string. A helper class is available to simplify its creation. For an example, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
+        ],
+        'UpdateDataBatchIngestion' => [
+            'summary' => 'Updates a batch data ingestion task.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
+            'security' => [
+                [
+                    'AK' => [],
+                ],
+            ],
+            'operationType' => 'read',
+            'deprecated' => false,
+            'systemTags' => [
+                'operationType' => 'get',
+                'riskType' => 'none',
+                'chargeType' => 'free',
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
+            ],
+            'parameters' => [
+                [
+                    'name' => 'RegionId',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The region of the Data Management hub for threat analysis. Select a region for the management hub based on the region of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
+                ],
+                [
+                    'name' => 'Lang',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
+                ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member whose perspective the administrator wants to switch to.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
                 [
-                    'name' => 'MaxResults',
+                    'name' => 'LogUserIds',
                     'in' => 'formData',
+                    'style' => 'simple',
                     'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int32',
+                        'description' => 'The list of user IDs for batch data ingestion.',
+                        'type' => 'array',
+                        'items' => ['description' => 'The user ID for batch data ingestion.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                         'required' => false,
-                        'example' => '50',
+                        'title' => '',
+                        'example' => '',
                     ],
                 ],
                 [
-                    'name' => 'NextToken',
+                    'name' => 'AutoScanNew',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'Specifies whether to automatically discover new users.'."\n"
+                        ."\n"
+                        .'- enabled: Enables the feature.'."\n"
+                        ."\n"
+                        .'- disabled: Disables the feature.', 'type' => 'string', 'required' => false, 'example' => 'enabled', 'title' => ''],
+                ],
+                [
+                    'name' => 'DataIngestionIds',
                     'in' => 'formData',
+                    'style' => 'simple',
                     'schema' => [
-                        'description' => '',
-                        'type' => 'string',
+                        'description' => 'The list of ingestion policy IDs.',
+                        'type' => 'array',
+                        'items' => ['description' => 'The ingestion policy ID.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_actiontrail_event_ingestion_173326*******', 'title' => ''],
                         'required' => false,
-                        'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****',
+                        'title' => '',
+                        'example' => '',
                     ],
                 ],
+                [
+                    'name' => 'DataSourceRecognizeEnabled',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'Specifies whether to automatically discover new Logstores.', 'type' => 'boolean', 'required' => false, 'example' => 'true', 'title' => ''],
+                ],
+                [
+                    'name' => 'DataBatchIngestionMode',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The mode for batch data ingestion. Valid values:'."\n"
+                        ."\n"
+                        .'- full'."\n"
+                        ."\n"
+                        .'- increment', 'type' => 'string', 'required' => false, 'example' => 'full', 'title' => ''],
+                ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'Schema of Response',
-                        'description' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
-                            ],
-                            'DataSetRecords' => [
-                                'description' => '',
-                                'type' => 'array',
-                                'items' => [
-                                    'description' => '',
-                                    'type' => 'object',
-                                    'properties' => [
-                                        'CreateTime' => [
-                                            'description' => '',
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '1658974643000',
-                                        ],
-                                        'UpdateTime' => [
-                                            'description' => '',
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '1658974643000',
-                                        ],
-                                        'DataSetId' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'dataset-t8ha6p7k61rmniqw****',
-                                        ],
-                                        'DataSetName' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'lmftest',
-                                        ],
-                                        'DataSetRecordId' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => '124566',
-                                        ],
-                                        'DataSetRecordValues' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => '{"ip":"10.0.*.*/8","region":"shanghai"}',
-                                        ],
-                                    ],
-                                ],
-                            ],
-                            'PageNumber' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '1',
-                            ],
-                            'PageSize' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '10',
-                            ],
-                            'TotalCount' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '57',
-                            ],
-                            'MaxResults' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '50',
-                            ],
-                            'NextToken' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****',
-                            ],
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+            'title' => 'UpdateDataBatchIngestion',
+            'description' => 'The JsonConfig request parameter is a complex JSON configuration. A supporting tool class that contains configuration examples is provided to help you. For more information, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'get',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:UpdateDataBatchIngestion',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n  \\"DataSetRecords\\": [\\n    {\\n      \\"CreateTime\\": 1658974643000,\\n      \\"UpdateTime\\": 1658974643000,\\n      \\"DataSetId\\": \\"dataset-t8ha6p7k61rmniqw****\\",\\n      \\"DataSetName\\": \\"lmftest\\",\\n      \\"DataSetRecordId\\": \\"124566\\",\\n      \\"DataSetRecordValues\\": \\"{\\\\\\"ip\\\\\\":\\\\\\"10.0.*.*/8\\\\\\",\\\\\\"region\\\\\\":\\\\\\"shanghai\\\\\\"}\\"\\n    }\\n  ],\\n  \\"PageNumber\\": 1,\\n  \\"PageSize\\": 10,\\n  \\"TotalCount\\": 57,\\n  \\"MaxResults\\": 50,\\n  \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\"\\n}","type":"json"}]',
         ],
-        'CreateDetectionRule' => [
-            'summary' => '创建检测规则',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'UpdateDataIngestion' => [
+            'summary' => 'Updates a data ingestion policy.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
@@ -11132,438 +10592,476 @@
             'operationType' => 'write',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'create',
+                'operationType' => 'update',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsasASHGE7',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['description' => 'The region of the Data Management center for threat analysis. Select the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: The assets are in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: The assets are in a region outside China.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'cn-hangzhou'],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh',
-                    ],
+                    'schema' => ['description' => 'The language of the response messages. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'zh'],
                 ],
                 [
-                    'name' => 'DetectionRuleName',
+                    'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'dr-ha1i09ob3zmqrs85****',
-                        'maxLength' => 100,
-                    ],
+                    'schema' => ['description' => 'The user ID of a member. An administrator can perform operations on behalf of this member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '173326*******'],
                 ],
                 [
-                    'name' => 'DetectionRuleDescription',
+                    'name' => 'DataIngestionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'dr-123',
-                        'maxLength' => 2000,
-                    ],
+                    'schema' => ['description' => 'The data ingestion ID.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'alibaba_cloud_actiontrail_event_ingestion_173326*******'],
                 ],
                 [
-                    'name' => 'DetectionRuleType',
+                    'name' => 'DataIngestionMode',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'custom',
-                        'enum' => [
-                            'custom',
-                        ],
-                    ],
+                    'schema' => ['description' => 'The data ingestion mode. Valid values:'."\n"
+                        ."\n"
+                        .'- realtime'."\n"
+                        ."\n"
+                        .'- scan', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'realtime'],
                 ],
                 [
-                    'name' => 'DetectionRuleStatus',
+                    'name' => 'DataSourceId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '0',
-                    ],
+                    'schema' => ['description' => 'The data source ID.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'alibaba_cloud_actiontrail_event_log_173326*******'],
                 ],
                 [
-                    'name' => 'AlertType',
+                    'name' => 'NormalizationRuleId',
                     'in' => 'formData',
+                    'schema' => ['description' => 'The normalization rule ID.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'alibaba_cloud_actiontrail_event_rule'],
+                ],
+            ],
+            'responses' => [
+                200 => [
                     'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'WebShell',
+                        'title' => 'Schema of Response',
+                        'description' => 'The response body.',
+                        'type' => 'object',
+                        'properties' => [
+                            'RequestId' => ['title' => 'Id of the request', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
+                        ],
+                        'example' => '',
                     ],
                 ],
-                [
-                    'name' => 'AlertLevel',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => '1',
-                        'enum' => [
-                            '1',
-                            '2',
-                            '3',
-                            '4',
-                            '5',
+            ],
+            'errorCodes' => [
+                400 => [
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
+                ],
+            ],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+            'title' => 'UpdateDataIngestion',
+            'description' => 'Notifications are subject to frequency and time limits. A maximum of two notifications are sent to each user per day between 08:00 and 20:00.',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'update',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:UpdateDataIngestion',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DataIngestion', 'arn' => 'acs:yundun-sas::{#accountId}:dataingestion/{#DataIngestionId}'],
                         ],
                     ],
                 ],
+            ],
+        ],
+        'UpdateDataIngestionTemplate' => [
+            'summary' => 'Updates a data ingestion template.',
+            'path' => '',
+            'methods' => ['get', 'post'],
+            'schemes' => ['https'],
+            'security' => [
                 [
-                    'name' => 'AlertTacticId',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'TA0042',
-                    ],
+                    'AK' => [],
                 ],
+            ],
+            'operationType' => 'write',
+            'deprecated' => false,
+            'systemTags' => [
+                'operationType' => 'update',
+                'riskType' => 'none',
+                'chargeType' => 'free',
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
+                'tenantRelevance' => 'tenant',
+            ],
+            'parameters' => [
                 [
-                    'name' => 'AlertAttCk',
+                    'name' => 'DataIngestionTemplateId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'Discovery',
-                    ],
+                    'schema' => ['description' => 'The ID of the data ingestion template.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_actiontrail_event_ingestion_173326*******', 'title' => ''],
                 ],
                 [
-                    'name' => 'DetectionExpressionType',
+                    'name' => 'DataIngestionTemplateName',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'enumValueTitles' => [
-                            'sql' => 'sql',
-                            'playbook' => 'playbook',
-                        ],
-                        'example' => 'sql',
-                        'enum' => [
-                            'sql',
-                            'graphical',
-                            'playbook',
-                        ],
-                    ],
+                    'schema' => ['description' => 'The name of the data source template.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_actiontrail_event_ingestion_173326*******', 'title' => ''],
                 ],
                 [
-                    'name' => 'DetectionExpressionContent',
+                    'name' => 'NormalizationRuleId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '*|set session mode=scan;SELECT * FROM log'."\n"
-                            .'WHERE schema = \'PROCESS_START_ACTIVITY\''."\n"
-                            .'AND ('."\n"
-                            .'    proc_path LIKE \'%/groups\''."\n"
-                            .'    OR ('."\n"
-                            .'        ('."\n"
-                            .'            proc_path LIKE \'%/cat\''."\n"
-                            .'            OR proc_path LIKE \'%/head\''."\n"
-                            .'            OR proc_path LIKE \'%/tail\''."\n"
-                            .'            OR proc_path LIKE \'%/more\''."\n"
-                            .'        )'."\n"
-                            .'        AND cmdline LIKE \'%/etc/group%\''."\n"
-                            .'    )'."\n"
-                            .')'."\n",
-                    ],
+                    'schema' => ['description' => 'The ID of the normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_actiontrail_event_rule', 'title' => ''],
                 ],
                 [
-                    'name' => 'LogCategoryId',
+                    'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'NETWORK_CATEGORY',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
-                    'name' => 'LogSchemaId',
+                    'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'API_RISK_ACTIVITY',
-                    ],
+                    'schema' => ['description' => 'The region where the Data Management center for threat analysis is located. Select a region for the management center based on the region of your asset. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: The asset is in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: The asset is outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
-                    'name' => 'AlertSchemaId',
+                    'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'ALERT_ACTIVITY',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member. This parameter is used by an administrator to switch to the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
                 [
-                    'name' => 'ScheduleType',
+                    'name' => 'DataIngestionStatus',
                     'in' => 'formData',
+                    'schema' => ['description' => 'The status of data ingestion. Valid values:'."\n"
+                        ."\n"
+                        .'- enabled: Enabled.'."\n"
+                        ."\n"
+                        .'- disabled: Disabled.', 'type' => 'string', 'required' => false, 'example' => 'enabled', 'title' => ''],
+                ],
+            ],
+            'responses' => [
+                200 => [
                     'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'fixed_rate',
-                        'enum' => [
-                            'fixed_rate',
-                            'cron',
+                        'title' => 'Schema of Response',
+                        'description' => 'The response body.',
+                        'type' => 'object',
+                        'properties' => [
+                            'RequestId' => ['title' => 'Id of the request', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
-                [
-                    'name' => 'ScheduleExpression',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '0/5 * * * *',
+            ],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+            'title' => 'UpdateDataIngestionTemplate',
+            'description' => 'Frequency and time limits apply to notifications. Each user can receive a maximum of two notifications per day between 08:00 and 20:00. Notifications are not sent outside of this time period.',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'update',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:UpdateDataIngestionTemplate',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DataIngestionTemplate', 'arn' => 'acs:yundun-sas::{#accountId}:dataingestiontemplate/{#DataIngestionTemplateId}'],
+                        ],
                     ],
                 ],
+            ],
+        ],
+        'UpdateDataSet' => [
+            'summary' => 'Updates a dataset.',
+            'methods' => ['post'],
+            'schemes' => ['https'],
+            'security' => [
                 [
-                    'name' => 'ScheduleMaxRetries',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'AK' => [],
                 ],
+            ],
+            'operationType' => 'write',
+            'deprecated' => false,
+            'systemTags' => [
+                'operationType' => 'update',
+                'riskType' => 'none',
+                'chargeType' => 'free',
+                'abilityTreeNodes' => ['FEATUREsasASHGE7'],
+            ],
+            'parameters' => [
                 [
-                    'name' => 'ScheduleBeginTime',
+                    'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '1733269771123',
-                    ],
+                    'schema' => ['description' => 'The region where the Data Management center for threat analysis is located. Select a region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Assets are in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Assets are in a region outside China.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'cn-hangzhou'],
                 ],
                 [
-                    'name' => 'ScheduleWindow',
+                    'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '5m',
-                    ],
+                    'schema' => ['description' => 'The language of the response message. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'zh'],
                 ],
                 [
-                    'name' => 'ScheduleMaxTimeout',
+                    'name' => 'DataSetId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '60',
-                    ],
+                    'schema' => ['description' => 'The ID of the dataset.', 'type' => 'string', 'required' => true, 'title' => '', 'example' => 'dataset-10iy8mbifnb4gniv****'],
                 ],
                 [
-                    'name' => 'AlertThresholdPeriod',
+                    'name' => 'DataSetDescription',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '5m',
-                    ],
+                    'schema' => ['description' => 'The description of the dataset.', 'type' => 'string', 'required' => false, 'maxLength' => 1000, 'title' => '', 'example' => 'lmftest desc'],
                 ],
                 [
-                    'name' => 'AlertThresholdCount',
+                    'name' => 'IpWhitelistRecognizers',
                     'in' => 'formData',
+                    'style' => 'flat',
                     'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int32',
+                        'description' => 'The IP address types that the recognizer can detect.',
+                        'type' => 'array',
+                        'items' => [
+                            'description' => 'The IP address types that the recognizer can detect.',
+                            'type' => 'object',
+                            'properties' => [
+                                'IpWhitelistRecognizerType' => ['description' => 'The IP address type that the recognizer can detect. Valid values:'."\n"
+                                    ."\n"
+                                    .'- sas\\_vulnerability\\_scanner\\_ip: The IP addresses of the Security Center web vulnerability scanner.'."\n"
+                                    ."\n"
+                                    .'- waf\\_back\\_source\\_ip: The back-to-origin IP addresses of Web Application Firewall (WAF).'."\n"
+                                    ."\n"
+                                    .'- ddos\\_back\\_source\\_ip: The back-to-origin IP addresses of Anti-DDoS.'."\n"
+                                    ."\n"
+                                    .'- esa\\_back\\_source\\_ip: The back-to-origin IP addresses of Edge Security Acceleration (ESA) nodes.'."\n"
+                                    ."\n"
+                                    .'- ecs\\_public\\_ip: The public IP addresses of Elastic Compute Service (ECS) instances.'."\n"
+                                    ."\n"
+                                    .'- slb\\_public\\_ip: The public IP addresses of Server Load Balancer (SLB).'."\n"
+                                    ."\n"
+                                    .'- vpc\\_eip: The elastic IP addresses (EIPs).'."\n"
+                                    ."\n"
+                                    .'- cdn\\_back\\_source\\_ip: The back-to-origin IP addresses of Alibaba Cloud CDN.'."\n"
+                                    ."\n"
+                                    .'- ga\\_back\\_source\\_ip: The back-to-origin IP addresses of Global Accelerator (GA).', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'cdn_back_source_ip'],
+                                'AutoRecognizeStatus' => ['description' => 'The automatic detection status. Valid values:'."\n"
+                                    ."\n"
+                                    .'- enabled: Enabled.'."\n"
+                                    ."\n"
+                                    .'- disabled: Disabled.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'enabled'],
+                                'RecognizeScope' => ['description' => 'The detection scope. Valid values:'."\n"
+                                    ."\n"
+                                    .'- current\\_account: The current account only.'."\n"
+                                    ."\n"
+                                    .'- rd\\_accounts: Multiple accounts are enabled.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'current_account'],
+                            ],
+                            'required' => false,
+                            'title' => '',
+                            'example' => '',
+                        ],
                         'required' => false,
-                        'example' => '10',
+                        'title' => '',
+                        'example' => '',
                     ],
                 ],
                 [
-                    'name' => 'AlertThresholdGroup',
+                    'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'alert_type,ip',
-                    ],
+                    'schema' => ['description' => 'The user ID of a member. An administrator can use this parameter to switch to the member\'s view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'],
                 ],
                 [
-                    'name' => 'IncidentAggregationType',
+                    'name' => 'DataSetName',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'window',
-                    ],
+                    'schema' => ['type' => 'string', 'description' => 'The name of the dataset.', 'title' => '', 'required' => false, 'example' => 'lmftest'],
                 ],
                 [
-                    'name' => 'IncidentAggregationExpression',
+                    'name' => 'DataSetFileName',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '5m',
-                    ],
+                    'schema' => ['type' => 'string', 'description' => 'The name of the uploaded dataset file.', 'title' => '', 'required' => false, 'example' => 'cloudsiem-dataset/1358117679873357_1743387731614.csv'],
                 ],
                 [
-                    'name' => 'PlaybookUuid',
+                    'name' => 'DataSetStatus',
                     'in' => 'formData',
+                    'schema' => ['type' => 'integer', 'format' => 'int32', 'description' => 'The status of the dataset. Valid values:'."\n"
+                        ."\n"
+                        .'- 0: Delete.'."\n"
+                        ."\n"
+                        .'- 1: Enable.', 'title' => '', 'required' => false, 'example' => '1'],
+                ],
+            ],
+            'responses' => [
+                200 => [
                     'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'system_aliyun_clb_process_book',
+                        'title' => 'Schema of Response',
+                        'description' => 'The response body.',
+                        'type' => 'object',
+                        'properties' => [
+                            'RequestId' => ['description' => 'The ID of the request.', 'type' => 'string', 'title' => '', 'example' => 'DE7E77A9-BFAD-5EAA-9B48-A96760E9DF0B'],
+                        ],
+                        'example' => '',
                     ],
                 ],
-                [
-                    'name' => 'PlaybookParameters',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '{'."\n"
-                            .'    "ip": {'."\n"
-                            .'        "ip": "124.23.*.*"'."\n"
-                            .'    }'."\n"
-                            .'}',
+            ],
+            'errorCodes' => [
+                400 => [
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
+                ],
+            ],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"DE7E77A9-BFAD-5EAA-9B48-A96760E9DF0B\\"\\n}","type":"json"}]',
+            'title' => 'UpdateDataSet',
+            'description' => 'Notifications are limited by frequency and time. Each user can receive a maximum of two notifications per day between 08:00 and 20:00. Notifications are not sent outside this time range.',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'update',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:UpdateDataSet',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DataSet', 'arn' => 'acs:yundun-sas::{#accountId}:dataset/{#DataSetId}'],
+                        ],
                     ],
                 ],
+            ],
+        ],
+        'UpdateDataSetRecord' => [
+            'summary' => 'Updates dataset records.',
+            'methods' => ['post'],
+            'schemes' => ['https'],
+            'security' => [
+                [
+                    'AK' => [],
+                ],
+            ],
+            'operationType' => 'write',
+            'deprecated' => false,
+            'systemTags' => [
+                'operationType' => 'update',
+                'riskType' => 'none',
+                'chargeType' => 'free',
+                'abilityTreeNodes' => ['FEATUREsasASHGE7'],
+            ],
+            'parameters' => [
                 [
-                    'name' => 'RoleFor',
+                    'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The region where the Data Management center for threat analysis is located. Select a region for the management center based on the region of your asset. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: The asset is in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: The asset is in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
-                    'name' => 'EntityMappings',
+                    'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '[{\\"NormalizationSchemaId\\":\\"host\\",\\"NormalizationFieldMappings\\":[{\\"NormalizationFieldName\\":\\"uuid\\",\\"MappingFieldName\\":\\"host\\",\\"NormalizationFieldType\\":\\"varchar\\"}]}]',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
-                    'name' => 'DetectionRuleTemplateId',
+                    'name' => 'DataSetId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '检测规则模板ID。',
-                        'type' => 'string',
-                        'example' => 'cfw-out-ip_aegis-netstat',
-                    ],
+                    'schema' => ['description' => 'The ID of the dataset.', 'type' => 'string', 'required' => true, 'example' => 'dataset-10iy8mbifnb4gniv****', 'title' => ''],
                 ],
                 [
-                    'name' => 'DetectionRuleTemplateVersion',
+                    'name' => 'DataSetRecords',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '检测规则模板版本。',
-                        'type' => 'string',
-                        'example' => 'v1.0.0',
-                    ],
+                    'schema' => ['description' => 'The content of the dataset records, in JSON array format.', 'type' => 'string', 'required' => false, 'example' => '[{\\"ip\\":\\"1.1.1.1\\",\\"userid\\":\\"1234\\",\\"name\\":\\"a12401\\"},'."\n"
+                        .' {\\"ip\\":\\"2.2.2.2\\",\\"userid\\":\\"33333\\",\\"name\\":\\"a12401\\"}]', 'title' => ''],
                 ],
                 [
-                    'name' => 'AlertName',
+                    'name' => 'DataSetFileName',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '告警名称，支持使用$$引用查询输出字段',
-                        'type' => 'string',
-                    ],
+                    'schema' => ['description' => 'The name of the uploaded dataset file.', 'type' => 'string', 'required' => false, 'example' => 'cloudsiem-dataset/1358117679873357_174338773****.csv', 'title' => ''],
                 ],
                 [
-                    'name' => 'AlertDescription',
+                    'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '告警描述，支持使用$$引用查询输出字段',
-                        'type' => 'string',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member. An administrator can use this parameter to switch to the perspective of a specific member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'Schema of Response',
-                        'description' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '5CC09D0C-1CD7-54BD-A853-DCB2D945****',
-                            ],
-                            'DetectionRuleId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => 'dr-ha1i09ob3zmqrs85****',
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', 'title' => ''],
+                            'DataSetRecordStatistic' => [
+                                'description' => 'The result of the dataset update.',
+                                'type' => 'object',
+                                'properties' => [
+                                    'NewDataSetRecordCount' => ['description' => 'The number of new dataset records.', 'type' => 'integer', 'format' => 'int32', 'example' => '12', 'title' => ''],
+                                    'UpdateDataSetRecordCount' => ['description' => 'The number of updated dataset records.', 'type' => 'integer', 'format' => 'int32', 'example' => '4', 'title' => ''],
+                                ],
+                                'title' => '',
+                                'example' => '',
                             ],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n  \\"DataSetRecordStatistic\\": {\\n    \\"NewDataSetRecordCount\\": 12,\\n    \\"UpdateDataSetRecordCount\\": 4\\n  }\\n}","type":"json"}]',
+            'title' => 'UpdateDataSetRecord',
+            'description' => 'Notifications are subject to frequency and time limits. Each user can receive a maximum of two notifications per day between 08:00 and 20:00.',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'update',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:UpdateDataSetRecord',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"5CC09D0C-1CD7-54BD-A853-DCB2D945****\\",\\n  \\"DetectionRuleId\\": \\"dr-ha1i09ob3zmqrs85****\\"\\n}","type":"json"}]',
         ],
-        'UpdateDetectionRule' => [
-            'summary' => '更新检测规则',
-            'methods' => [
-                'post',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'UpdateDataSource' => [
+            'summary' => 'Updates a data source.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
@@ -11575,398 +11073,476 @@
                 'operationType' => 'update',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsasASHGE7',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['description' => 'The region of the Data Management center for threat analysis. Select a region based on the location of the assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Assets are in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh',
-                    ],
+                    'schema' => ['description' => 'The language of the response messages. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
-                    'name' => 'DetectionRuleId',
+                    'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'jndi-attack-success_http_dns',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member whose perspective the administrator switches to.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
                 [
-                    'name' => 'DetectionRuleName',
+                    'name' => 'DataSourceId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'CTDR Port Scan Behavior',
-                        'maxLength' => 100,
-                    ],
+                    'schema' => ['description' => 'The ID of the data source.', 'type' => 'string', 'required' => false, 'example' => 'ds-014frtpy28m5ct2eoyo1', 'title' => ''],
                 ],
                 [
-                    'name' => 'DetectionRuleDescription',
+                    'name' => 'DataSourceName',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'Check the enumeration behavior of local system groups. An attacker may attempt to find the Local Systems group and its permission settings.',
-                        'maxLength' => 2000,
-                    ],
+                    'schema' => ['description' => 'The name of the data source.', 'type' => 'string', 'required' => false, 'example' => 'ActiontrailLog', 'title' => ''],
                 ],
                 [
-                    'name' => 'DetectionRuleType',
+                    'name' => 'LogUserId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'custom',
-                        'enum' => [
-                            'custom',
-                            'preset',
-                            'custom_template',
-                        ],
-                    ],
+                    'schema' => ['description' => 'The user ID for data access.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
                 [
-                    'name' => 'DetectionRuleStatus',
+                    'name' => 'DataSourceStores',
                     'in' => 'formData',
+                    'style' => 'flat',
                     'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'enabled',
-                        'enum' => [
-                            'disabled',
-                            'enabled',
-                            'testing',
+                        'description' => 'The list of Simple Log Service Logstores.',
+                        'type' => 'array',
+                        'items' => [
+                            'type' => 'object',
+                            'properties' => [
+                                'LogRegionId' => ['description' => 'The ID of the log storage region.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
+                                'LogProjectName' => ['description' => 'The name of the Simple Log Service project.', 'type' => 'string', 'required' => false, 'example' => 'aliyun-cloudsiem-data-173326*******-cn-hangzhou', 'title' => ''],
+                                'LogStoreName' => ['description' => 'The name of the Simple Log Service Logstore.', 'type' => 'string', 'required' => false, 'example' => 'cn-rds-sqlaudit', 'title' => ''],
+                                'DataSourceStoreFrom' => ['description' => 'The source of the data. Valid values:'."\n"
+                                    ."\n"
+                                    .'- center'."\n"
+                                    ."\n"
+                                    .'- custom', 'type' => 'string', 'required' => false, 'example' => 'custom', 'title' => ''],
+                                'DataSourceStoreId' => ['description' => 'The ID of the log storage.', 'type' => 'string', 'required' => false, 'example' => '1', 'title' => ''],
+                            ],
+                            'required' => false,
+                            'description' => 'A Simple Log Service Logstore.',
+                            'title' => '',
+                            'example' => '',
                         ],
+                        'required' => false,
+                        'title' => '',
+                        'example' => '',
                     ],
                 ],
                 [
-                    'name' => 'AlertType',
+                    'name' => 'DataSourceRecognizeEnabled',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'siem_rule_type_alert_storm',
-                    ],
+                    'schema' => ['description' => 'Specifies whether to automatically discover new Logstores.', 'type' => 'boolean', 'required' => false, 'example' => 'true', 'title' => ''],
                 ],
                 [
-                    'name' => 'AlertLevel',
+                    'name' => 'DataSourceFrom',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['description' => 'The source of the data. Valid values:'."\n"
+                        ."\n"
+                        .'- center'."\n"
+                        ."\n"
+                        .'- custom', 'type' => 'string', 'required' => false, 'example' => 'custom', 'title' => ''],
                 ],
                 [
-                    'name' => 'AlertTacticId',
+                    'name' => 'OrderField',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'TA0042',
-                    ],
+                    'schema' => ['description' => 'The field to use for sorting the rule list. Valid values:'."\n"
+                        ."\n"
+                        .'- GmtModified: Sorts the list by modification time.'."\n"
+                        ."\n"
+                        .'- Id: Sorts the list by rule ID. This is the default value.', 'type' => 'string', 'required' => false, 'example' => 'Id', 'title' => ''],
                 ],
                 [
-                    'name' => 'AlertAttCk',
+                    'name' => 'LogStoreName',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'Discovery',
-                    ],
+                    'schema' => ['description' => 'The name of the Simple Log Service Logstore.', 'type' => 'string', 'required' => false, 'example' => 'cn-rds-sqlaudit', 'title' => ''],
                 ],
                 [
-                    'name' => 'DetectionExpressionType',
+                    'name' => 'LogProjectName',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'sql',
-                    ],
+                    'schema' => ['description' => 'The name of the Simple Log Service project.', 'type' => 'string', 'required' => false, 'example' => 'aliyun-cloudsiem-data-173326*******-cn-hangzhou', 'title' => ''],
                 ],
                 [
-                    'name' => 'DetectionExpressionContent',
+                    'name' => 'LogRegionId',
                     'in' => 'formData',
+                    'schema' => ['description' => 'The ID of the log storage region.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
+                ],
+            ],
+            'responses' => [
+                200 => [
                     'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '*|set session mode=scan;SELECT * FROM log'."\n"
-                            .'WHERE schema = \'PROCESS_START_ACTIVITY\''."\n"
-                            .'AND ('."\n"
-                            .'    proc_path LIKE \'%/groups\''."\n"
-                            .'    OR ('."\n"
-                            .'        ('."\n"
-                            .'            proc_path LIKE \'%/cat\''."\n"
-                            .'            OR proc_path LIKE \'%/head\''."\n"
-                            .'            OR proc_path LIKE \'%/tail\''."\n"
-                            .'            OR proc_path LIKE \'%/more\''."\n"
-                            .'        )'."\n"
-                            .'        AND cmdline LIKE \'%/etc/group%\''."\n"
-                            .'    )'."\n"
-                            .')',
+                        'title' => 'Schema of Response',
+                        'description' => 'The response body.',
+                        'type' => 'object',
+                        'properties' => [
+                            'RequestId' => ['title' => 'Id of the request', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
+                        ],
+                        'example' => '',
+                    ],
+                ],
+            ],
+            'errorCodes' => [
+                400 => [
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
+                ],
+            ],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+            'title' => 'UpdateDataSource',
+            'description' => 'The JsonConfig input parameter is a complex JSON configuration. A supporting tool class provides configuration examples. For more information, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'update',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:UpdateDataSource',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DataSource', 'arn' => 'acs:yundun-sas::{#accountId}:datasource/{#DataSourceId}'],
+                        ],
                     ],
                 ],
+            ],
+        ],
+        'UpdateDataSourceTemplate' => [
+            'summary' => 'Modifies a data source template.',
+            'path' => '',
+            'methods' => ['get', 'post'],
+            'schemes' => ['https'],
+            'security' => [
                 [
-                    'name' => 'LogCategoryId',
+                    'AK' => [],
+                ],
+            ],
+            'operationType' => 'write',
+            'deprecated' => false,
+            'systemTags' => [
+                'operationType' => 'update',
+                'riskType' => 'none',
+                'chargeType' => 'free',
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
+                'tenantRelevance' => 'tenant',
+            ],
+            'parameters' => [
+                [
+                    'name' => 'DataSourceTemplateId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'NETWORK_CATEGORY',
-                    ],
+                    'schema' => ['description' => 'The ID of the data source template.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_actiontrail_event_ingestion'."\n", 'title' => ''],
                 ],
                 [
-                    'name' => 'LogSchemaId',
+                    'name' => 'DataSourceTemplateName',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'API_RISK_ACTIVITY',
-                    ],
+                    'schema' => ['description' => 'The name of the data source template.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_actiontrail_event_ingestion'."\n", 'title' => ''],
                 ],
                 [
-                    'name' => 'AlertSchemaId',
+                    'name' => 'LogUserIds',
                     'in' => 'formData',
+                    'style' => 'simple',
                     'schema' => [
-                        'description' => '',
-                        'type' => 'string',
+                        'description' => 'The list of user IDs for batch data access.',
+                        'type' => 'array',
+                        'items' => ['description' => 'The user ID for batch data access.', 'type' => 'string', 'required' => false, 'example' => '173326*******', 'title' => ''],
                         'required' => false,
-                        'example' => 'ALERT_ACTIVITY',
+                        'title' => '',
+                        'example' => '',
                     ],
                 ],
                 [
-                    'name' => 'ScheduleType',
+                    'name' => 'LogRegionIds',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'fixed_rate',
-                    ],
+                    'schema' => ['description' => 'The list of IDs of log storage regions.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
-                    'name' => 'ScheduleExpression',
+                    'name' => 'LogProjectPattern',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '1h',
-                    ],
+                    'schema' => ['description' => 'The matching rule for the names of Simple Log Service projects.', 'type' => 'string', 'required' => false, 'example' => 'aliyun-cloudsiem-data-173326*******', 'title' => ''],
                 ],
                 [
-                    'name' => 'ScheduleMaxRetries',
+                    'name' => 'LogStorePattern',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['description' => 'The matching rule for the names of Simple Log Service Logstores.', 'type' => 'string', 'required' => false, 'example' => 'audit-activity', 'title' => ''],
                 ],
                 [
-                    'name' => 'ScheduleBeginTime',
+                    'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '1733269771123',
-                    ],
+                    'schema' => ['description' => 'The language of the response message. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
-                    'name' => 'ScheduleWindow',
+                    'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '5m',
-                    ],
+                    'schema' => ['description' => 'The region where the Management Hub of threat analysis is located. Select a region based on the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Assets are in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Assets are outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
-                    'name' => 'ScheduleMaxTimeout',
+                    'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '60',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member. This parameter lets an administrator switch to the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
                 [
-                    'name' => 'AlertThresholdPeriod',
+                    'name' => 'AutoScanNew',
                     'in' => 'formData',
+                    'schema' => ['description' => 'Specifies whether to automatically discover new users.'."\n"
+                        ."\n"
+                        .'- enabled: Enabled.'."\n"
+                        ."\n"
+                        .'- disabled: Disabled.', 'type' => 'string', 'required' => false, 'example' => 'enabled', 'title' => ''],
+                ],
+                [
+                    'name' => 'DataSourceRecognizeEnabled',
+                    'in' => 'query',
+                    'schema' => ['description' => 'Specifies whether to automatically discover new data sources.', 'type' => 'boolean', 'required' => false, 'example' => 'true', 'title' => ''],
+                ],
+            ],
+            'responses' => [
+                200 => [
                     'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '5m',
+                        'title' => 'Schema of Response',
+                        'description' => 'The response body.',
+                        'type' => 'object',
+                        'properties' => [
+                            'RequestId' => ['title' => 'Id of the request', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
+                        ],
+                        'example' => '',
+                    ],
+                ],
+            ],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+            'title' => 'UpdateDataSourceTemplate',
+            'description' => 'The JsonConfig input parameter accepts a complex JSON configuration. To simplify this process, a supporting tool class is available. For more information, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'update',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:UpdateDataSourceTemplate',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DataSourceTemplate', 'arn' => 'acs:yundun-sas::{#accountId}:datasourcetemplate/{#DataSourceTemplateId}'],
+                        ],
                     ],
                 ],
+            ],
+        ],
+        'UpdateDataStorage' => [
+            'summary' => 'Changes the log storage region for Log Management.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
+            'security' => [
                 [
-                    'name' => 'AlertThresholdCount',
+                    'AK' => [],
+                ],
+            ],
+            'operationType' => 'write',
+            'deprecated' => false,
+            'systemTags' => [
+                'operationType' => 'update',
+                'riskType' => 'none',
+                'chargeType' => 'free',
+                'abilityTreeNodes' => ['FEATUREsasRXJ9SY'],
+                'tenantRelevance' => 'publicInformation',
+            ],
+            'parameters' => [
+                [
+                    'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '10',
-                    ],
+                    'schema' => ['description' => 'The region where the Data Management center for threat analysis is located. This region must be the same as the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: The assets are in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: The assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
-                    'name' => 'AlertThresholdGroup',
+                    'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'alert_type,ip',
-                    ],
+                    'schema' => ['description' => 'The language of the response message. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
-                    'name' => 'IncidentAggregationType',
+                    'name' => 'DataStorageRegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'window',
-                    ],
+                    'schema' => ['description' => 'The log storage region.', 'type' => 'string', 'required' => true, 'example' => 'cn-shanghai', 'title' => ''],
                 ],
                 [
-                    'name' => 'IncidentAggregationExpression',
+                    'name' => 'DeliveryStatus',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '60m',
-                    ],
+                    'schema' => ['description' => 'The global switch for log delivery in Log Management. This parameter is not yet available. Valid values:'."\n"
+                        ."\n"
+                        .'- enable: Enables global delivery.'."\n"
+                        ."\n"
+                        .'- disable: Disables global delivery.', 'type' => 'string', 'required' => false, 'maxLength' => 1000, 'example' => 'enable', 'title' => ''],
                 ],
                 [
-                    'name' => 'PlaybookParameters',
+                    'name' => 'RoleFor',
                     'in' => 'formData',
+                    'schema' => ['description' => 'The user ID of a member. An administrator can specify this parameter to switch to the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''],
+                ],
+            ],
+            'responses' => [
+                200 => [
                     'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '{'."\n"
-                            .'    "ip": {'."\n"
-                            .'        "ip": "124.23.*.*"'."\n"
-                            .'    }'."\n"
-                            .'}',
+                        'title' => 'BaseResponse',
+                        'description' => 'The response body.',
+                        'type' => 'object',
+                        'properties' => [
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => 'EA7FC160-8D86-5ABE-A08A-7962FDC1****', 'title' => ''],
+                        ],
+                        'example' => '',
+                    ],
+                ],
+            ],
+            'errorCodes' => [],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"EA7FC160-8D86-5ABE-A08A-7962FDC1****\\"\\n}","type":"json"}]',
+            'title' => 'UpdateDataStorage',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'update',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:UpdateDataStorage',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
                     ],
                 ],
+            ],
+        ],
+        'UpdateDataStorageDelivery' => [
+            'summary' => 'Updates the status of log delivery.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
+            'security' => [
                 [
-                    'name' => 'PlaybookUuid',
+                    'AK' => [],
+                ],
+            ],
+            'operationType' => 'write',
+            'deprecated' => false,
+            'systemTags' => [
+                'operationType' => 'update',
+                'riskType' => 'none',
+                'chargeType' => 'free',
+                'abilityTreeNodes' => ['FEATUREsasRXJ9SY'],
+                'autoTest' => true,
+                'tenantRelevance' => 'tenant',
+            ],
+            'parameters' => [
+                [
+                    'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '31568394-7a86-487c-b8ec-b3f42b59****',
-                    ],
+                    'schema' => ['description' => 'The region where the Data Management hub for Threat Analysis is located. Select the region of the management hub based on the region of your asset. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your asset is in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your asset is in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
-                    'name' => 'EntityMappings',
+                    'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '[{\\"NormalizationSchemaId\\":\\"host\\",\\"NormalizationFieldMappings\\":[{\\"NormalizationFieldName\\":\\"uuid\\",\\"MappingFieldName\\":\\"host\\",\\"NormalizationFieldType\\":\\"varchar\\"}]}]',
-                    ],
+                    'schema' => ['description' => 'The language of the response message. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
-                    'name' => 'AlertName',
+                    'name' => 'LogCode',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '告警名称，支持使用$$引用查询输出字段',
-                        'type' => 'string',
-                    ],
+                    'schema' => ['description' => 'The log code.', 'type' => 'string', 'required' => true, 'example' => 'aegis-log-login', 'title' => ''],
                 ],
                 [
-                    'name' => 'AlertDescription',
+                    'name' => 'LogDeliveryStatus',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '告警描述，支持使用$$引用查询输出字段',
-                        'type' => 'string',
-                    ],
+                    'schema' => ['description' => 'The status of log delivery. Valid values:'."\n"
+                        ."\n"
+                        .'- enable: Enables log delivery.'."\n"
+                        ."\n"
+                        .'- disable: Disables log delivery.', 'type' => 'string', 'required' => false, 'maxLength' => 1000, 'example' => 'enable', 'title' => ''],
+                ],
+                [
+                    'name' => 'RoleFor',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The user ID of the member. This parameter is used when an administrator switches to the perspective of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'Schema of Response',
-                        'description' => '',
+                        'title' => 'BaseResponse',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => 'B88A2D41-87B8-537E-A7D3-3416A39F****',
-                            ],
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6D7FBF4A-5B95-5760-8B5A-BF8983D4****', 'title' => ''],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
-            'errorCodes' => [
-                400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
+            'errorCodes' => [],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6D7FBF4A-5B95-5760-8B5A-BF8983D4****\\"\\n}","type":"json"}]',
+            'title' => 'UpdateDataStorageDelivery',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'update',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:UpdateDataStorageDelivery',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
                     ],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"B88A2D41-87B8-537E-A7D3-3416A39F****\\"\\n}","type":"json"}]',
         ],
-        'DeleteDetectionRule' => [
-            'summary' => '删除检测规则',
-            'methods' => [
-                'post',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'UpdateDataStorageTtl' => [
+            'summary' => 'Modifies the storage duration for logs.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
@@ -11975,1404 +11551,829 @@
             'operationType' => 'write',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'delete',
+                'operationType' => 'update',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsasASHGE7',
-                ],
+                'abilityTreeNodes' => ['FEATUREsasRXJ9SY'],
+                'autoTest' => true,
+                'tenantRelevance' => 'tenant',
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['description' => 'The region of the Data Management Center for threat analysis. Select a region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: The Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Regions outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
-                    'name' => 'DetectionRuleId',
+                    'name' => 'LogStoreName',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'dr-53np4nguf5jmh1vc****',
-                    ],
+                    'schema' => ['description' => 'The name of the Logstore for threat analysis.', 'type' => 'string', 'required' => false, 'maxLength' => 1000, 'example' => 'network-activity', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member whose perspective the administrator assumes.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''],
+                ],
+                [
+                    'name' => 'LogStoreTtl',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The storage duration of the Logstore.', 'type' => 'string', 'required' => false, 'example' => '180', 'title' => ''],
+                ],
+                [
+                    'name' => 'LogStoreHotTtl',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The storage duration for hot storage in Simple Log Service.', 'type' => 'string', 'required' => false, 'example' => '180', 'title' => ''],
+                ],
+                [
+                    'name' => 'LogStoreColdTtl',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The storage duration for cold storage in Simple Log Service. This setting is not yet available.', 'type' => 'string', 'required' => false, 'example' => '0', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'Schema of Response',
-                        'description' => '',
+                        'title' => 'BaseResponse',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
-                            ],
+                            'RequestId' => ['description' => 'The ID of the request.', 'type' => 'string', 'example' => 'D92E4FCF-4584-5E50-9C02-26B79A9C****', 'title' => ''],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
-            'errorCodes' => [
-                400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
+            'errorCodes' => [],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"D92E4FCF-4584-5E50-9C02-26B79A9C****\\"\\n}","type":"json"}]',
+            'title' => 'UpdateDataStorageTtl',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'update',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:UpdateDataStorageTtl',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
                     ],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]',
         ],
-        'ListDetectionRules' => [
-            'summary' => '获取检测规则列表',
-            'methods' => [
-                'post',
-                'get',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'UpdateDetectionRule' => [
+            'methods' => ['post'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'read',
+            'operationType' => 'write',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'list',
+                'operationType' => 'update',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsasASHGE7',
-                ],
+                'abilityTreeNodes' => ['FEATUREsasASHGE7'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['description' => 'The region of the Data Management center for Threat Analysis. Select the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: The Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Regions outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
-                    'name' => 'DetectionRuleName',
+                    'name' => 'DetectionRuleId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'Detect Discovery Behavior for Local Systems Groups',
-                    ],
+                    'schema' => ['description' => 'The ID of the detection rule.', 'type' => 'string', 'required' => true, 'maxLength' => 128, 'example' => 'jndi-attack-success_http_dns', 'title' => ''],
                 ],
                 [
-                    'name' => 'DetectionRuleId',
+                    'name' => 'DetectionRuleName',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'dr-ppa85gfw69tgwkys****',
-                    ],
+                    'schema' => ['description' => 'The name of the detection rule.', 'type' => 'string', 'required' => false, 'example' => 'CTDR Port Scan Behavior', 'maxLength' => 100, 'title' => ''],
                 ],
                 [
-                    'name' => 'DetectionRuleIds',
+                    'name' => 'DetectionRuleDescription',
                     'in' => 'formData',
-                    'style' => 'simple',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'array',
-                        'items' => [
-                            'description' => '',
-                            'type' => 'string',
-                            'required' => false,
-                            'example' => 'dr-ppa85gfw69tgwkys****'."\n",
-                        ],
-                        'required' => false,
-                    ],
+                    'schema' => ['description' => 'The description of the detection rule.', 'type' => 'string', 'maxLength' => 2000, 'required' => false, 'example' => 'Check the enumeration behavior of local system groups. An attacker may attempt to find the Local Systems group and its permission settings.', 'title' => ''],
                 ],
                 [
                     'name' => 'DetectionRuleType',
                     'in' => 'formData',
                     'schema' => [
-                        'description' => '',
+                        'description' => 'The type of the detection rule. Valid values:'."\n"
+                            ."\n"
+                            .'- preset: a preset detection rule.'."\n"
+                            ."\n"
+                            .'- custom: a custom detection rule.'."\n"
+                            ."\n"
+                            .'- custom\\_template: a rule template.',
                         'type' => 'string',
-                        'required' => false,
-                        'example' => 'preset',
+                        'required' => true,
+                        'enum' => ['custom', 'preset', 'custom_template'],
+                        'example' => 'custom',
+                        'title' => '',
                     ],
                 ],
                 [
                     'name' => 'DetectionRuleStatus',
                     'in' => 'formData',
                     'schema' => [
-                        'description' => '',
+                        'description' => 'The status of the detection rule.',
                         'type' => 'string',
+                        'enum' => ['disabled', 'enabled', 'testing'],
                         'required' => false,
                         'example' => 'enabled',
+                        'title' => '',
                     ],
                 ],
                 [
                     'name' => 'AlertType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'siem_rule_type_alert_storm',
-                    ],
+                    'schema' => ['description' => 'The type of the alert.', 'type' => 'string', 'required' => false, 'example' => 'siem_rule_type_alert_storm', 'title' => ''],
                 ],
                 [
                     'name' => 'AlertLevel',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['description' => 'The threat level of the alert. Valid values:'."\n"
+                        ."\n"
+                        .'- 5: Critical.'."\n"
+                        ."\n"
+                        .'- 4: Important.'."\n"
+                        ."\n"
+                        .'- 3: Medium.'."\n"
+                        ."\n"
+                        .'- 2: Low.'."\n"
+                        ."\n"
+                        .'- 1: Informational.', 'type' => 'string', 'required' => false, 'example' => '1', 'title' => ''],
                 ],
                 [
                     'name' => 'AlertTacticId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'TA0042',
-                    ],
+                    'schema' => ['description' => 'The ATT\\&CK tactic ID of the alert.', 'type' => 'string', 'required' => false, 'example' => 'TA0042', 'title' => ''],
                 ],
                 [
                     'name' => 'AlertAttCk',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'Discovery',
-                    ],
+                    'schema' => ['description' => 'The ATT\\&CK tactic of the alert.', 'type' => 'string', 'required' => false, 'example' => 'Discovery', 'title' => ''],
                 ],
                 [
-                    'name' => 'IncidentAggregationType',
+                    'name' => 'DetectionExpressionType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'graph_compute',
-                    ],
+                    'schema' => ['description' => 'The type of the detection expression.', 'type' => 'string', 'required' => false, 'example' => 'sql', 'title' => ''],
+                ],
+                [
+                    'name' => 'DetectionExpressionContent',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The content of the detection expression.', 'type' => 'string', 'required' => false, 'example' => '*|set session mode=scan;SELECT * FROM log'."\n"
+                        .'WHERE schema = \'PROCESS_START_ACTIVITY\''."\n"
+                        .'AND ('."\n"
+                        .'    proc_path LIKE \'%/groups\''."\n"
+                        .'    OR ('."\n"
+                        .'        ('."\n"
+                        .'            proc_path LIKE \'%/cat\''."\n"
+                        .'            OR proc_path LIKE \'%/head\''."\n"
+                        .'            OR proc_path LIKE \'%/tail\''."\n"
+                        .'            OR proc_path LIKE \'%/more\''."\n"
+                        .'        )'."\n"
+                        .'        AND cmdline LIKE \'%/etc/group%\''."\n"
+                        .'    )'."\n"
+                        .')', 'title' => ''],
                 ],
                 [
                     'name' => 'LogCategoryId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'NETWORK_CATEGORY',
-                    ],
+                    'schema' => ['description' => 'The ID of the log normalization category.', 'type' => 'string', 'required' => false, 'example' => 'NETWORK_CATEGORY', 'title' => ''],
                 ],
                 [
                     'name' => 'LogSchemaId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'API_RISK_ACTIVITY',
-                    ],
+                    'schema' => ['description' => 'The ID of the log normalization schema.', 'type' => 'string', 'required' => false, 'example' => 'API_RISK_ACTIVITY', 'title' => ''],
                 ],
                 [
-                    'name' => 'DetectionExpressionType',
+                    'name' => 'AlertSchemaId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'playbook',
-                    ],
+                    'schema' => ['description' => 'The ID of the alert template for the detection rule.', 'type' => 'string', 'required' => false, 'example' => 'ALERT_ACTIVITY', 'title' => ''],
                 ],
                 [
-                    'name' => 'OrderFieldName',
+                    'name' => 'ScheduleType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'GmtModified',
-                    ],
+                    'schema' => ['description' => 'The scheduling type. Valid values:'."\n"
+                        ."\n"
+                        .'- fixed\\_rate: fixed interval.'."\n"
+                        ."\n"
+                        .'- cron: cron expression.', 'type' => 'string', 'required' => false, 'example' => 'fixed_rate', 'title' => ''],
                 ],
                 [
-                    'name' => 'OrderDirection',
+                    'name' => 'ScheduleExpression',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'asc',
-                    ],
+                    'schema' => ['description' => 'The cron expression for scheduling. This parameter is required when you set ScheduleType to cron.', 'type' => 'string', 'required' => false, 'example' => '1h', 'title' => ''],
                 ],
                 [
-                    'name' => 'PageNumber',
+                    'name' => 'ScheduleMaxRetries',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'minimum' => '1',
-                        'example' => '1',
-                    ],
+                    'schema' => ['description' => 'The maximum number of retries after a timeout. The value must be between 1 and 100.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1', 'title' => ''],
                 ],
                 [
-                    'name' => 'PageSize',
+                    'name' => 'ScheduleBeginTime',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'maximum' => '100',
-                        'minimum' => '1',
-                        'example' => '100',
-                    ],
+                    'schema' => ['description' => 'The start time for scheduling. This is a 13-digit UNIX timestamp.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '1733269771123', 'title' => ''],
                 ],
                 [
-                    'name' => 'RoleFor',
+                    'name' => 'ScheduleWindow',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The length of the scheduling window.', 'type' => 'string', 'required' => false, 'example' => '5m', 'title' => ''],
                 ],
                 [
-                    'name' => 'MaxResults',
+                    'name' => 'ScheduleMaxTimeout',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '50',
-                    ],
+                    'schema' => ['description' => 'The maximum timeout period. Unit: seconds. The value must be between 60 and 1800.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '60', 'title' => ''],
                 ],
                 [
-                    'name' => 'NextToken',
+                    'name' => 'AlertThresholdPeriod',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****',
-                    ],
+                    'schema' => ['description' => 'The period for the alert threshold.', 'type' => 'string', 'required' => false, 'example' => '5m', 'title' => ''],
+                ],
+                [
+                    'name' => 'AlertThresholdCount',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The number of alerts for the alert threshold.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '10', 'title' => ''],
+                ],
+                [
+                    'name' => 'AlertThresholdGroup',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The fields for the alert threshold. Separate multiple fields with commas.', 'type' => 'string', 'required' => false, 'example' => 'alert_type,ip', 'title' => ''],
+                ],
+                [
+                    'name' => 'IncidentAggregationType',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The type of event aggregation. Valid values:'."\n"
+                        ."\n"
+                        .'- none: Events are not generated.'."\n"
+                        ."\n"
+                        .'- graph\\_compute: graph computing (supported by predefined rules).'."\n"
+                        ."\n"
+                        .'- expert: expert rule.'."\n"
+                        ."\n"
+                        .'- passthrough: pass-through (one-to-one mapping with alerts).'."\n"
+                        ."\n"
+                        .'- window: window-based aggregation of similar events.', 'type' => 'string', 'required' => false, 'example' => 'window', 'title' => ''],
+                ],
+                [
+                    'name' => 'IncidentAggregationExpression',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The configuration of the event aggregation period.', 'type' => 'string', 'required' => false, 'example' => '60m', 'title' => ''],
+                ],
+                [
+                    'name' => 'PlaybookParameters',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The custom parameters for the playbook.', 'type' => 'string', 'required' => false, 'example' => '{'."\n"
+                        .'    "ip": {'."\n"
+                        .'        "ip": "124.23.*.*"'."\n"
+                        .'    }'."\n"
+                        .'}', 'title' => ''],
+                ],
+                [
+                    'name' => 'PlaybookUuid',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The unique ID of the playbook.', 'type' => 'string', 'required' => false, 'example' => '31568394-7a86-487c-b8ec-b3f42b59****', 'title' => ''],
+                ],
+                [
+                    'name' => 'EntityMappings',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The entity mapping configuration.', 'type' => 'string', 'required' => false, 'example' => '[{\\"NormalizationSchemaId\\":\\"host\\",\\"NormalizationFieldMappings\\":[{\\"NormalizationFieldName\\":\\"uuid\\",\\"MappingFieldName\\":\\"host\\",\\"NormalizationFieldType\\":\\"varchar\\"}]}]', 'title' => ''],
+                ],
+                [
+                    'name' => 'AlertName',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The name of the alert. You can use $$ to reference fields from the query output.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => 'Detected high-frequency multi-type network attacks from $src_ip$'],
+                ],
+                [
+                    'name' => 'AlertDescription',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The description of the alert. You can use $$ to reference fields from the query output.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => 'Alert from: $product_code$, detected network attack from $src_ip$, affected assets include: $dst_ip$'],
+                ],
+                [
+                    'name' => 'AlertTypeMapping',
+                    'in' => 'formData',
+                    'schema' => ['type' => 'string', 'description' => '', 'title' => '', 'example' => ''],
+                ],
+                [
+                    'name' => 'AlertLevelMapping',
+                    'in' => 'formData',
+                    'schema' => ['type' => 'string', 'description' => '', 'title' => '', 'example' => ''],
+                ],
+                [
+                    'name' => 'AlertAttCkMapping',
+                    'in' => 'formData',
+                    'schema' => ['type' => 'string', 'description' => '', 'title' => '', 'example' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'Schema of Response',
-                        'description' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '508DCFFD-4508-54BF-A8A0-E97A0FA6****',
-                            ],
-                            'DetectionRules' => [
-                                'description' => '',
-                                'type' => 'array',
-                                'items' => [
-                                    'type' => 'object',
-                                    'properties' => [
-                                        'CreateTime' => [
-                                            'description' => '',
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '2023-03-21 13:47:01',
-                                        ],
-                                        'UpdateTime' => [
-                                            'description' => '',
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '2023-04-16 10:51:00',
-                                        ],
-                                        'DetectionRuleId' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'jndi-attack-success_http_netstat',
-                                        ],
-                                        'DetectionRuleName' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'Detect Discovery Behavior for Local Systems Groups'."\n",
-                                        ],
-                                        'DetectionRuleDescription' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'Check the enumeration behavior of local system groups. An attacker may attempt to find the Local Systems group and its permission settings.',
-                                        ],
-                                        'DetectionRuleType' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'custom',
-                                        ],
-                                        'DetectionRuleStatus' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'enabled',
-                                        ],
-                                        'DetectionExpressionType' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'playbook',
-                                        ],
-                                        'DetectionExpressionContent' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => '*|set session mode=scan;SELECT * FROM log'."\n"
-                                                .'WHERE schema = \'PROCESS_START_ACTIVITY\''."\n"
-                                                .'AND ('."\n"
-                                                .'    proc_path LIKE \'%/groups\''."\n"
-                                                .'    OR ('."\n"
-                                                .'        ('."\n"
-                                                .'            proc_path LIKE \'%/cat\''."\n"
-                                                .'            OR proc_path LIKE \'%/head\''."\n"
-                                                .'            OR proc_path LIKE \'%/tail\''."\n"
-                                                .'            OR proc_path LIKE \'%/more\''."\n"
-                                                .'        )'."\n"
-                                                .'        AND cmdline LIKE \'%/etc/group%\''."\n"
-                                                .'    )'."\n"
-                                                .')',
-                                        ],
-                                        'LogCategoryId' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'NETWORK_CATEGORY',
-                                        ],
-                                        'LogSchemaId' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'API_RISK_ACTIVITY',
-                                        ],
-                                        'AlertSchemaId' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'ALERT_ACTIVITY',
-                                        ],
-                                        'ScheduleType' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'fixed_rate',
-                                        ],
-                                        'ScheduleExpression' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => '5m',
-                                        ],
-                                        'ScheduleMaxRetries' => [
-                                            'description' => '',
-                                            'type' => 'integer',
-                                            'format' => 'int32',
-                                            'example' => '1',
-                                        ],
-                                        'ScheduleBeginTime' => [
-                                            'description' => '',
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '1733269771123',
-                                        ],
-                                        'ScheduleWindow' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => '5m',
-                                        ],
-                                        'ScheduleMaxTimeout' => [
-                                            'description' => '',
-                                            'type' => 'integer',
-                                            'format' => 'int32',
-                                            'example' => '60',
-                                        ],
-                                        'AlertType' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'WebShell',
-                                        ],
-                                        'AlertLevel' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => '1',
-                                        ],
-                                        'AlertTacticId' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'TA0042',
-                                        ],
-                                        'AlertAttCk' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'Discovery',
-                                        ],
-                                        'AlertThresholdPeriod' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => '5m',
-                                        ],
-                                        'AlertThresholdCount' => [
-                                            'description' => '',
-                                            'type' => 'integer',
-                                            'format' => 'int32',
-                                            'example' => '10',
-                                        ],
-                                        'AlertThresholdGroup' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'alert_type,ip',
-                                        ],
-                                        'IncidentAggregationType' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'passthrough',
-                                        ],
-                                        'IncidentAggregationExpression' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => '5m',
-                                        ],
-                                        'PlaybookUuid' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'dde983ed-eb56-45ea-ac2e-3b12b2a9****',
-                                        ],
-                                        'PlaybookParameters' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => '{'."\n"
-                                                .'    "ip": {'."\n"
-                                                .'        "ip": "124.23.*.*"'."\n"
-                                                .'    }'."\n"
-                                                .'}',
-                                        ],
-                                        'Playbook' => [
-                                            'description' => '',
-                                            'type' => 'object',
-                                            'properties' => [
-                                                'Flow' => [
-                                                    'description' => '',
-                                                    'type' => 'string',
-                                                    'example' => '['."\n"
-                                                        .'    {'."\n"
-                                                        .'        "id": "EndEvent_1fqpq4h",'."\n"
-                                                        .'        "zIndex": 1,'."\n"
-                                                        .'        "data": {'."\n"
-                                                        .'            "nodeType": "endEvent",'."\n"
-                                                        .'            "appType": "basic",'."\n"
-                                                        .'            "valueData": {'."\n"
-                                                        ."\n"
-                                                        .'            },'."\n"
-                                                        .'            "icon": "icon-radio-off-full"'."\n"
-                                                        .'        },'."\n"
-                                                        .'        "position": {'."\n"
-                                                        .'            "x": 1369,'."\n"
-                                                        .'            "y": 174'."\n"
-                                                        .'        }'."\n"
-                                                        .'    }'."\n"
-                                                        .']',
-                                                ],
-                                                'Config' => [
-                                                    'description' => '',
-                                                    'type' => 'string',
-                                                    'example' => '['."\n"
-                                                        .'    {'."\n"
-                                                        .'        "name": "expireDay",'."\n"
-                                                        .'        "dataType": "Integer",'."\n"
-                                                        .'        "required": true,'."\n"
-                                                        .'        "isArray": false,'."\n"
-                                                        .'        "example": "7",'."\n"
-                                                        .'        "description": "desc",'."\n"
-                                                        .'        "typeName": "Integer",'."\n"
-                                                        .'        "dataClass": "normal",'."\n"
-                                                        .'        "stanchDefaultValue": "7"'."\n"
-                                                        .'    }'."\n"
-                                                        .']',
-                                                ],
-                                            ],
-                                        ],
-                                        'EntityMappings' => [
-                                            'description' => '',
-                                            'type' => 'array',
-                                            'items' => [
-                                                'description' => '',
-                                                'type' => 'object',
-                                                'properties' => [
-                                                    'NormalizationSchemaId' => [
-                                                        'description' => '',
-                                                        'type' => 'string',
-                                                        'example' => 'ip',
-                                                    ],
-                                                    'NormalizationFieldMappings' => [
-                                                        'description' => '',
-                                                        'type' => 'array',
-                                                        'items' => [
-                                                            'type' => 'object',
-                                                            'properties' => [
-                                                                'NormalizationFieldName' => [
-                                                                    'description' => '',
-                                                                    'type' => 'string',
-                                                                    'example' => 'src_ip',
-                                                                ],
-                                                                'MappingFieldName' => [
-                                                                    'description' => '',
-                                                                    'type' => 'string',
-                                                                    'example' => 'ip',
-                                                                ],
-                                                                'NormalizationFieldType' => [
-                                                                    'description' => '',
-                                                                    'type' => 'string',
-                                                                    'example' => 'vachar',
-                                                                ],
-                                                            ],
-                                                        ],
-                                                    ],
-                                                ],
-                                            ],
-                                        ],
-                                        'AlertName' => [
-                                            'type' => 'string',
-                                        ],
-                                        'AlertDescription' => [
-                                            'type' => 'string',
-                                        ],
-                                    ],
-                                ],
-                            ],
-                            'PageNumber' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '2',
-                            ],
-                            'PageSize' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '10',
-                            ],
-                            'TotalCount' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '6',
-                            ],
-                            'MaxResults' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '50',
-                            ],
-                            'NextToken' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****',
-                            ],
+                            'RequestId' => ['description' => 'The ID of the request.', 'type' => 'string', 'example' => 'B88A2D41-87B8-537E-A7D3-3416A39F****', 'title' => ''],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
+                ],
+            ],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'UpdateDetectionRule',
+            'summary' => 'Updates a detection rule.',
+            'description' => 'Because this operation uses complex request parameters, a supporting tool class is provided to assist with the JSON configuration. For an example, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'update',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:UpdateDetectionRule',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DetectionRule', 'arn' => 'acs:yundun-sas::{#accountId}:detection/{#DetectionRuleId}'],
+                        ],
                     ],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"508DCFFD-4508-54BF-A8A0-E97A0FA6****\\",\\n  \\"DetectionRules\\": [\\n    {\\n      \\"CreateTime\\": 0,\\n      \\"UpdateTime\\": 0,\\n      \\"DetectionRuleId\\": \\"jndi-attack-success_http_netstat\\",\\n      \\"DetectionRuleName\\": \\"Detect Discovery Behavior for Local Systems Groups\\\\n\\",\\n      \\"DetectionRuleDescription\\": \\"Check the enumeration behavior of local system groups. An attacker may attempt to find the Local Systems group and its permission settings.\\",\\n      \\"DetectionRuleType\\": \\"custom\\",\\n      \\"DetectionRuleStatus\\": \\"enabled\\",\\n      \\"DetectionExpressionType\\": \\"playbook\\",\\n      \\"DetectionExpressionContent\\": \\"*|set session mode=scan;SELECT * FROM log\\\\nWHERE schema = \'PROCESS_START_ACTIVITY\'\\\\nAND (\\\\n    proc_path LIKE \'%/groups\'\\\\n    OR (\\\\n        (\\\\n            proc_path LIKE \'%/cat\'\\\\n            OR proc_path LIKE \'%/head\'\\\\n            OR proc_path LIKE \'%/tail\'\\\\n            OR proc_path LIKE \'%/more\'\\\\n        )\\\\n        AND cmdline LIKE \'%/etc/group%\'\\\\n    )\\\\n)\\",\\n      \\"LogCategoryId\\": \\"NETWORK_CATEGORY\\",\\n      \\"LogSchemaId\\": \\"API_RISK_ACTIVITY\\",\\n      \\"AlertSchemaId\\": \\"ALERT_ACTIVITY\\",\\n      \\"ScheduleType\\": \\"fixed_rate\\",\\n      \\"ScheduleExpression\\": \\"5m\\",\\n      \\"ScheduleMaxRetries\\": 1,\\n      \\"ScheduleBeginTime\\": 1733269771123,\\n      \\"ScheduleWindow\\": \\"5m\\",\\n      \\"ScheduleMaxTimeout\\": 60,\\n      \\"AlertType\\": \\"WebShell\\",\\n      \\"AlertLevel\\": \\"1\\",\\n      \\"AlertTacticId\\": \\"TA0042\\",\\n      \\"AlertAttCk\\": \\"Discovery\\",\\n      \\"AlertThresholdPeriod\\": \\"5m\\",\\n      \\"AlertThresholdCount\\": 10,\\n      \\"AlertThresholdGroup\\": \\"alert_type,ip\\",\\n      \\"IncidentAggregationType\\": \\"passthrough\\",\\n      \\"IncidentAggregationExpression\\": \\"5m\\",\\n      \\"PlaybookUuid\\": \\"dde983ed-eb56-45ea-ac2e-3b12b2a9****\\",\\n      \\"PlaybookParameters\\": \\"{\\\\n    \\\\\\"ip\\\\\\": {\\\\n        \\\\\\"ip\\\\\\": \\\\\\"124.23.*.*\\\\\\"\\\\n    }\\\\n}\\",\\n      \\"Playbook\\": {\\n        \\"Flow\\": \\"[\\\\n    {\\\\n        \\\\\\"id\\\\\\": \\\\\\"EndEvent_1fqpq4h\\\\\\",\\\\n        \\\\\\"zIndex\\\\\\": 1,\\\\n        \\\\\\"data\\\\\\": {\\\\n            \\\\\\"nodeType\\\\\\": \\\\\\"endEvent\\\\\\",\\\\n            \\\\\\"appType\\\\\\": \\\\\\"basic\\\\\\",\\\\n            \\\\\\"valueData\\\\\\": {\\\\n\\\\n            },\\\\n            \\\\\\"icon\\\\\\": \\\\\\"icon-radio-off-full\\\\\\"\\\\n        },\\\\n        \\\\\\"position\\\\\\": {\\\\n            \\\\\\"x\\\\\\": 1369,\\\\n            \\\\\\"y\\\\\\": 174\\\\n        }\\\\n    }\\\\n]\\",\\n        \\"Config\\": \\"[\\\\n    {\\\\n        \\\\\\"name\\\\\\": \\\\\\"expireDay\\\\\\",\\\\n        \\\\\\"dataType\\\\\\": \\\\\\"Integer\\\\\\",\\\\n        \\\\\\"required\\\\\\": true,\\\\n        \\\\\\"isArray\\\\\\": false,\\\\n        \\\\\\"example\\\\\\": \\\\\\"7\\\\\\",\\\\n        \\\\\\"description\\\\\\": \\\\\\"desc\\\\\\",\\\\n        \\\\\\"typeName\\\\\\": \\\\\\"Integer\\\\\\",\\\\n        \\\\\\"dataClass\\\\\\": \\\\\\"normal\\\\\\",\\\\n        \\\\\\"stanchDefaultValue\\\\\\": \\\\\\"7\\\\\\"\\\\n    }\\\\n]\\"\\n      },\\n      \\"EntityMappings\\": [\\n        {\\n          \\"NormalizationSchemaId\\": \\"ip\\",\\n          \\"NormalizationFieldMappings\\": [\\n            {\\n              \\"NormalizationFieldName\\": \\"src_ip\\",\\n              \\"MappingFieldName\\": \\"ip\\",\\n              \\"NormalizationFieldType\\": \\"vachar\\"\\n            }\\n          ]\\n        }\\n      ],\\n      \\"AlertName\\": \\"Detected high-frequency multi-type network attacks from $src_ip$\\",\\n      \\"AlertDescription\\": \\"Alert from: $product_code$, detected network attack from $src_ip$, affected assets include: $dst_ip$\\"\\n    }\\n  ],\\n  \\"PageNumber\\": 2,\\n  \\"PageSize\\": 10,\\n  \\"TotalCount\\": 6,\\n  \\"MaxResults\\": 50,\\n  \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\"\\n}","type":"json"}]',
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"B88A2D41-87B8-537E-A7D3-3416A39F****\\"\\n}","type":"json"}]',
         ],
-        'GetDetectionStatistic' => [
-            'summary' => '更新检测规则',
-            'methods' => [
-                'get',
-                'post',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'UpdateNormalizationRule' => [
+            'summary' => 'Updates a normalization rule.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'read',
+            'operationType' => 'write',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'get',
+                'operationType' => 'update',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsasASHGE7',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['description' => 'The region where the Data Management center of threat analysis is located. Select a region based on the region where your assets are located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: an asset in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: an asset outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh',
-                    ],
+                    'schema' => ['description' => 'The language of the content within the request and response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The user ID of a member. This parameter is used when an administrator switches to the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
-            ],
-            'responses' => [
-                200 => [
-                    'schema' => [
-                        'title' => 'Schema of Response',
-                        'description' => '',
-                        'type' => 'object',
-                        'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6FB890AC-90B2-5EEA-845B-F7C86FB2****',
-                            ],
-                            'DetectionStatistic' => [
-                                'description' => '',
-                                'type' => 'object',
-                                'properties' => [
-                                    'DetectionRuleOnlineCount' => [
-                                        'description' => '',
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '10',
-                                    ],
-                                    'DetectionRuleTestCount' => [
-                                        'description' => '',
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '5',
-                                    ],
-                                    'DetectionRuleTemplateCount' => [
-                                        'description' => '',
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '20',
-                                    ],
-                                    'GraphComputeRuleCount' => [
-                                        'description' => '',
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '12',
-                                    ],
-                                    'WindowRuleCount' => [
-                                        'description' => '',
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '6',
-                                    ],
-                                    'PassthroughRuleCount' => [
-                                        'description' => '',
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '2',
-                                    ],
-                                ],
-                            ],
-                        ],
-                    ],
+                [
+                    'name' => 'NormalizationRuleId',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The ID of the normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'nr-z0b2ssjteut85uoh9nzp', 'title' => ''],
                 ],
-            ],
-            'errorCodes' => [
-                400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                [
+                    'name' => 'NormalizationRuleName',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The name of the normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'normalization_rule_Z57np', 'title' => ''],
                 ],
-            ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
-            ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6FB890AC-90B2-5EEA-845B-F7C86FB2****\\",\\n  \\"DetectionStatistic\\": {\\n    \\"DetectionRuleOnlineCount\\": 10,\\n    \\"DetectionRuleTestCount\\": 5,\\n    \\"DetectionRuleTemplateCount\\": 20,\\n    \\"GraphComputeRuleCount\\": 12,\\n    \\"WindowRuleCount\\": 6,\\n    \\"PassthroughRuleCount\\": 2\\n  }\\n}","type":"json"}]',
-        ],
-        'GetIncident' => [
-            'summary' => '获取事件列表',
-            'methods' => [
-                'get',
-                'post',
-            ],
-            'schemes' => [
-                'https',
-            ],
-            'security' => [
                 [
-                    'AK' => [],
+                    'name' => 'NormalizationRuleDescription',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The description of the normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'normalization_rule_Z57np', 'title' => ''],
                 ],
-            ],
-            'operationType' => 'read',
-            'deprecated' => false,
-            'systemTags' => [
-                'operationType' => 'get',
-                'riskType' => 'none',
-                'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsasASHGE7',
+                [
+                    'name' => 'NormalizationRuleFormat',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The format of the normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'SPL', 'title' => ''],
                 ],
-            ],
-            'parameters' => [
                 [
-                    'name' => 'RegionId',
+                    'name' => 'NormalizationRuleExpression',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['description' => 'The expression for the normalization rule.', 'type' => 'string', 'required' => false, 'example' => '* | pack-fields -include=\'[\\s\\S]+\' as extend_content', 'title' => ''],
                 ],
                 [
-                    'name' => 'Lang',
+                    'name' => 'NormalizationSchemaId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh',
-                    ],
+                    'schema' => ['description' => 'The ID of the normalization structure.', 'type' => 'string', 'required' => false, 'example' => 'HTTP_ACTIVITY', 'title' => ''],
                 ],
                 [
-                    'name' => 'IncidentUuid',
+                    'name' => 'VendorId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '85ea4241-798f-4684-a876-65d4f0c3****',
-                    ],
+                    'schema' => ['description' => 'The vendor ID that corresponds to the normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud', 'title' => ''],
                 ],
                 [
-                    'name' => 'RoleFor',
+                    'name' => 'ProductId',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The product ID.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_sas', 'title' => ''],
+                ],
+                [
+                    'name' => 'NormalizationRuleMode',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The mode of the normalization rule. Valid values:'."\n"
+                        ."\n"
+                        .'- both'."\n"
+                        ."\n"
+                        .'- scan'."\n"
+                        ."\n"
+                        .'- realtime', 'type' => 'string', 'required' => false, 'example' => 'both', 'title' => ''],
+                ],
+                [
+                    'name' => 'ExtendContentPacked',
                     'in' => 'formData',
+                    'schema' => ['description' => 'Specifies whether to package non-standard fields into the extend\\_content extension field. Valid values:'."\n"
+                        ."\n"
+                        .'- enabled: The feature is enabled.'."\n"
+                        ."\n"
+                        .'- disabled: The feature is disabled.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => 'enabled'],
+                ],
+                [
+                    'name' => 'OrderField',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The field to use for sorting the rule list. Valid values:'."\n"
+                        ."\n"
+                        .'- GmtModified: Sorts by modification time.'."\n"
+                        ."\n"
+                        .'- Id: Sorts by rule ID (default).', 'type' => 'string', 'required' => false, 'example' => 'Id', 'title' => ''],
+                ],
+                [
+                    'name' => 'NormalizationRuleType',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The type of the normalization rule. Valid values:'."\n"
+                        ."\n"
+                        .'- predefined: predefined normalization rule.'."\n"
+                        ."\n"
+                        .'- custom: custom normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'custom', 'title' => ''],
+                ],
+                [
+                    'name' => 'NormalizationRuleIds',
+                    'in' => 'formData',
+                    'style' => 'json',
                     'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
+                        'type' => 'array',
+                        'items' => ['description' => 'A list of normalization rule IDs.', 'type' => 'string', 'required' => false, 'example' => 'nr-68unzx95g5avl0n7aife,nr-lc2gzp4ysxksl0ke7l2q', 'title' => ''],
+                        'description' => 'The list of normalization rule IDs.',
+                        'title' => '',
+                        'example' => '',
                         'required' => false,
-                        'example' => '113091674488****',
                     ],
                 ],
+                [
+                    'name' => 'ExtendFieldStoreMode',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The storage mode for extension fields. Valid values: flat, pack, and reject.', 'type' => 'string', 'example' => 'flat', 'title' => '', 'required' => false],
+                ],
+                [
+                    'name' => 'NormalizationCategoryId',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The normalization category.', 'type' => 'string', 'example' => 'HOST_CATEGORY', 'title' => '', 'required' => false],
+                ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'Schema of Response',
-                        'description' => '',
+                        'title' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
-                            ],
-                            'Incident' => [
-                                'description' => '',
-                                'type' => 'object',
-                                'properties' => [
-                                    'CreateTime' => [
-                                        'description' => '',
-                                        'type' => 'integer',
-                                        'format' => 'int64',
-                                        'example' => '1757386075000',
-                                    ],
-                                    'UpdateTime' => [
-                                        'description' => '',
-                                        'type' => 'integer',
-                                        'format' => 'int64',
-                                        'example' => '1757386075000',
-                                    ],
-                                    'IncidentUuid' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => '85ea4241-798f-4684-a876-65d4f0c3****',
-                                    ],
-                                    'Owner' => [
-                                        'title' => '事件责任人',
-                                        'type' => 'string',
-                                        'example' => '1234567890xxxxxx',
-                                    ],
-                                    'IncidentDescription' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'Forti incident desc',
-                                    ],
-                                    'IncidentName' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'Forti',
-                                    ],
-                                    'ThreatLevel' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => '2',
-                                    ],
-                                    'IncidentAggregationType' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'window',
-                                    ],
-                                    'ThreatScore' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => '90',
-                                    ],
-                                    'DetectionRuleId' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'dr-fy2zvgiykjifbiim****',
-                                    ],
-                                    'RelateAlertCount' => [
-                                        'description' => '',
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '23',
-                                    ],
-                                    'RelateAssetCount' => [
-                                        'description' => '',
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '2',
-                                    ],
-                                    'IncidentRemark' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => 'Remark',
-                                    ],
-                                    'AttckTactics' => [
-                                        'description' => '',
-                                        'type' => 'any',
-                                        'example' => '{'."\n"
-                                            .'	"AttckTactics": ['."\n"
-                                            .'		{'."\n"
-                                            .'			"tacticName": "Reconnaissance",'."\n"
-                                            .'			"alertNum": 0,'."\n"
-                                            .'			"tacticId": "TA0040"'."\n"
-                                            .'		}'."\n"
-                                            .'	]'."\n"
-                                            .'}',
-                                    ],
-                                    'IncidentTags' => [
-                                        'description' => '',
-                                        'type' => 'string',
-                                        'example' => '["sys:data_source:waf"]',
-                                    ],
-                                    'RelateDataSourceIds' => [
-                                        'description' => '',
-                                        'type' => 'any',
-                                        'example' => '["siem"]',
-                                    ],
-                                    'RelateUserIds' => [
-                                        'description' => '',
-                                        'type' => 'any',
-                                        'example' => '["176618589410****","1130916744888****"]',
-                                    ],
-                                    'IncidentStatus' => [
-                                        'description' => '',
-                                        'type' => 'integer',
-                                        'format' => 'int32',
-                                        'example' => '0',
-                                    ],
-                                ],
-                            ],
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+            'title' => 'UpdateNormalizationRule',
+            'description' => 'The JsonConfig input parameter is a complex JSON configuration. For configuration examples, see the supporting tool class in the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'update',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:UpdateNormalizationRule',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'NormalizationRule', 'arn' => 'acs:yundun-sas::{#accountId}:normalizationrule/{#NormalizationRuleId}'],
+                        ],
+                    ],
+                ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n  \\"Incident\\": {\\n    \\"CreateTime\\": 1757386075000,\\n    \\"UpdateTime\\": 1757386075000,\\n    \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n    \\"Owner\\": \\"1234567890xxxxxx\\",\\n    \\"IncidentDescription\\": \\"Forti incident desc\\",\\n    \\"IncidentName\\": \\"Forti\\",\\n    \\"ThreatLevel\\": \\"2\\",\\n    \\"IncidentAggregationType\\": \\"window\\",\\n    \\"ThreatScore\\": \\"90\\",\\n    \\"DetectionRuleId\\": \\"dr-fy2zvgiykjifbiim****\\",\\n    \\"RelateAlertCount\\": 23,\\n    \\"RelateAssetCount\\": 2,\\n    \\"IncidentRemark\\": \\"Remark\\",\\n    \\"AttckTactics\\": \\"{\\\\n\\\\t\\\\\\"AttckTactics\\\\\\": [\\\\n\\\\t\\\\t{\\\\n\\\\t\\\\t\\\\t\\\\\\"tacticName\\\\\\": \\\\\\"Reconnaissance\\\\\\",\\\\n\\\\t\\\\t\\\\t\\\\\\"alertNum\\\\\\": 0,\\\\n\\\\t\\\\t\\\\t\\\\\\"tacticId\\\\\\": \\\\\\"TA0040\\\\\\"\\\\n\\\\t\\\\t}\\\\n\\\\t]\\\\n}\\",\\n    \\"IncidentTags\\": \\"[\\\\\\"sys:data_source:waf\\\\\\"]\\",\\n    \\"RelateDataSourceIds\\": \\"[\\\\\\"siem\\\\\\"]\\",\\n    \\"RelateUserIds\\": \\"[\\\\\\"176618589410****\\\\\\",\\\\\\"1130916744888****\\\\\\"]\\",\\n    \\"IncidentStatus\\": 0\\n  }\\n}","type":"json"}]',
         ],
-        'ListIncidents' => [
-            'summary' => '获取事件列表',
-            'methods' => [
-                'get',
-                'post',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'UpdateNormalizationSchema' => [
+            'methods' => ['post'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'read',
+            'operationType' => 'write',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'list',
+                'operationType' => 'update',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsasASHGE7',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['description' => 'The region where the threat analysis data management center resides. Specify the management center based on the region of your assets. Valid values:'."\n"
+                        .'- cn-hangzhou: Your assets reside in the Chinese mainland.'."\n"
+                        .'- ap-southeast-1: Your assets reside outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh',
-                    ],
-                ],
-                [
-                    'name' => 'IncidentName',
-                    'in' => 'query',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'ECS unusual log in',
-                    ],
-                ],
-                [
-                    'name' => 'IncidentUuids',
-                    'in' => 'query',
-                    'style' => 'simple',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'array',
-                        'items' => [
-                            'description' => '',
-                            'type' => 'string',
-                            'required' => false,
-                            'example' => '85ea4241-798f-4684-a876-65d4f0c3****,90ea4241-798f-4684-a876-65d4f0c3****'."\n"
-                                ."\n",
-                        ],
-                        'required' => false,
-                    ],
-                ],
-                [
-                    'name' => 'IncidentStatus',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '0',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
-                    'name' => 'ThreatLevel',
+                    'name' => 'RoleFor',
                     'in' => 'formData',
-                    'style' => 'repeatList',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'array',
-                        'items' => [
-                            'description' => '',
-                            'type' => 'string',
-                            'required' => false,
-                            'example' => '2',
-                        ],
-                        'required' => false,
-                        'maxItems' => 100,
-                    ],
+                    'schema' => ['description' => 'The user ID of the member to which the administrator switches the view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''],
                 ],
                 [
-                    'name' => 'RelateAssetId',
+                    'name' => 'NormalizationSchemaId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '6c740667-80b2-476d-8924-2e706feb****'."\n",
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The normalization schema ID.', 'type' => 'string', 'required' => true, 'example' => 'WAF_ALERT_ACTIVITY'],
                 ],
                 [
-                    'name' => 'RelateEntityId',
+                    'name' => 'NormalizationSchemaName',
                     'in' => 'formData',
-                    'schema' => [
-                        'type' => 'string',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The normalization schema name.', 'type' => 'string', 'required' => true, 'example' => 'ProcessQuery'],
                 ],
                 [
-                    'name' => 'IncidentTags',
+                    'name' => 'NormalizationSchemaType',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '[{\\"data_source\\":[\\"sas\\"]}]',
-                        'title' => '',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The normalization schema type. Valid values:'."\n"
+                        .'- log: Log.'."\n"
+                        .'- entity: Entity.', 'type' => 'string', 'required' => true, 'example' => 'log'],
                 ],
                 [
-                    'name' => 'AlertUuid',
+                    'name' => 'NormalizationSchemaDescription',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'sas_71e24437d2797ce8fc59692905a4****',
-                    ],
+                    'schema' => ['title' => '', 'description' => 'The normalization schema description.', 'type' => 'string', 'required' => false, 'example' => 'ProcessQuery'],
                 ],
                 [
-                    'name' => 'StartTime',
+                    'name' => 'NormalizationFields',
                     'in' => 'formData',
+                    'style' => 'repeatList',
                     'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
+                        'description' => 'The normalization fields.',
+                        'type' => 'array',
+                        'items' => [
+                            'title' => '',
+                            'description' => 'The normalization fields.',
+                            'type' => 'object',
+                            'properties' => [
+                                'NormalizationFieldName' => ['title' => '', 'description' => 'The normalization field name.', 'type' => 'string', 'required' => true, 'example' => 'cloud_user'],
+                                'NormalizationFieldType' => ['title' => '', 'description' => 'The normalization field type. Valid values: text, long, double, and json.', 'type' => 'string', 'required' => true, 'example' => 'varchar'],
+                                'NormalizationFieldRequired' => ['title' => '', 'description' => 'Specifies whether the normalization field is required.', 'type' => 'boolean', 'required' => false, 'example' => ''],
+                                'NormalizationFieldDescription' => ['title' => '', 'description' => 'The normalization field description.', 'type' => 'string', 'required' => false, 'example' => 'cloud_user'],
+                                'NormalizationFieldExample' => ['title' => '', 'description' => 'The normalization field example.', 'type' => 'string', 'required' => false, 'example' => '173326*******'],
+                                'NormalizationFieldFrom' => ['description' => 'The key source of the JSON-type normalization field.', 'type' => 'string', 'required' => false, 'example' => 'preset', 'title' => ''],
+                                'NormalizationFieldTokenize' => ['title' => '', 'description' => 'Specifies whether the normalization field is tokenized.', 'type' => 'boolean', 'required' => false, 'example' => ''],
+                                'NormalizationFieldJsonIndexAll' => ['title' => '', 'description' => 'Specifies whether indexes are created for all keys of the JSON-type normalization field.', 'type' => 'boolean', 'required' => false, 'example' => ''],
+                                'NormalizationFieldJsonKeys' => [
+                                    'title' => '',
+                                    'description' => 'The key list of the JSON-type normalization field.',
+                                    'type' => 'array',
+                                    'items' => [
+                                        'description' => 'The key of the JSON-type normalization field.',
+                                        'type' => 'object',
+                                        'properties' => [
+                                            'NormalizationFieldName' => ['title' => '', 'description' => 'The key name of the JSON-type normalization field.', 'type' => 'string', 'required' => true, 'example' => 'alert_name'],
+                                            'NormalizationFieldType' => ['title' => '', 'description' => 'The key type of the JSON-type normalization field. Valid values: text, long, double, and json.', 'type' => 'string', 'required' => true, 'example' => 'text'],
+                                            'NormalizationFieldRequired' => ['title' => '', 'description' => 'Specifies whether the key of the JSON-type normalization field is required.', 'type' => 'boolean', 'required' => false, 'example' => ''],
+                                            'NormalizationFieldDescription' => ['title' => '', 'description' => 'The key description of the JSON-type normalization field.', 'type' => 'string', 'required' => false, 'example' => 'alert level'],
+                                            'NormalizationFieldExample' => ['title' => '', 'description' => 'The key example of the JSON-type normalization field.', 'type' => 'string', 'required' => false, 'example' => 'Enum values: 1, 2, 3, 4, 5'],
+                                            'NormalizationFieldFrom' => ['description' => 'The key source of the JSON-type normalization field.', 'type' => 'string', 'required' => false, 'example' => 'preset', 'title' => ''],
+                                            'NormalizationFieldTokenize' => ['title' => '', 'description' => 'Specifies whether the key of the JSON-type normalization field is tokenized.', 'type' => 'boolean', 'required' => false, 'example' => 'true'],
+                                        ],
+                                        'required' => false,
+                                        'title' => '',
+                                        'example' => '',
+                                    ],
+                                    'required' => false,
+                                    'maxItems' => 50,
+                                    'example' => '',
+                                ],
+                            ],
+                            'required' => false,
+                            'example' => '',
+                        ],
                         'required' => false,
-                        'example' => '1690102943000',
+                        'maxItems' => 200,
+                        'title' => '',
+                        'example' => '',
                     ],
                 ],
-                [
-                    'name' => 'EndTime',
-                    'in' => 'formData',
+            ],
+            'responses' => [
+                200 => [
                     'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '1749090526055',
+                        'title' => '',
+                        'description' => 'Schema of Response',
+                        'type' => 'object',
+                        'properties' => [
+                            'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
+                        ],
+                        'example' => '',
                     ],
                 ],
-                [
-                    'name' => 'OrderFieldName',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'GmtModified',
+            ],
+            'errorCodes' => [],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'Update a normalization schema',
+            'summary' => 'Updates a normalization schema.',
+            'description' => 'The input parameter JsonConfig is a complex JSON configuration. A utility class is provided to help with specific configuration examples. For more information, refer to [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'update',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:UpdateNormalizationSchema',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'NormalizationSchema', 'arn' => 'acs:yundun-sas::{#accountId}:normalizationschema/{#NormalizationSchemaId}'],
+                        ],
                     ],
                 ],
+            ],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+        ],
+        'UpdateProduct' => [
+            'summary' => 'Updates a product.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
+            'security' => [
                 [
-                    'name' => 'OrderDirection',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'desc',
-                    ],
+                    'AK' => [],
                 ],
+            ],
+            'operationType' => 'write',
+            'deprecated' => false,
+            'systemTags' => [
+                'operationType' => 'update',
+                'riskType' => 'none',
+                'chargeType' => 'free',
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
+            ],
+            'parameters' => [
                 [
-                    'name' => 'PageNumber',
+                    'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => true,
-                        'minimum' => '1',
-                        'example' => '1',
-                    ],
+                    'schema' => ['description' => 'The region of the Data Management center for threat analysis. Select the region for the Data Management center based on the region of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: The Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Regions outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
-                    'name' => 'PageSize',
+                    'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => true,
-                        'maximum' => '100',
-                        'minimum' => '1',
-                        'example' => '10',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'en', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
-                ],
-                [
-                    'name' => 'RoleType',
-                    'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '1',
-                    ],
+                    'schema' => ['description' => 'The user ID of a member. An administrator can specify this parameter to switch to the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '1733269771123', 'title' => ''],
                 ],
                 [
-                    'name' => 'MaxResults',
+                    'name' => 'ProductId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int32',
-                        'required' => false,
-                        'example' => '10',
-                    ],
+                    'schema' => ['description' => 'The product ID.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_sas', 'title' => ''],
                 ],
                 [
-                    'name' => 'NextToken',
+                    'name' => 'ProductName',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'AAAAASLVeIxed4466E0LVmGkzwS6hJKd9DGVGMDRM6Lu****',
-                    ],
+                    'schema' => ['description' => 'The product name.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_sas', 'title' => ''],
                 ],
                 [
-                    'name' => 'Owners',
+                    'name' => 'VendorName',
                     'in' => 'formData',
-                    'style' => 'repeatList',
-                    'schema' => [
-                        'title' => '事件责任人账号uid',
-                        'type' => 'array',
-                        'items' => [
-                            'title' => '事件责任人账号uid',
-                            'type' => 'string',
-                            'example' => '1234567890xxxxxx',
-                        ],
-                        'maxItems' => 100,
-                    ],
+                    'schema' => ['description' => 'The vendor name.', 'type' => 'string', 'required' => false, 'example' => '111', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'Schema of Response',
-                        'description' => 'Schema of Response',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****',
-                            ],
-                            'Incidents' => [
-                                'description' => '',
-                                'type' => 'array',
-                                'items' => [
-                                    'type' => 'object',
-                                    'properties' => [
-                                        'IncidentName' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'ECS unusual log in',
-                                        ],
-                                        'ThreatLevel' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => '2',
-                                        ],
-                                        'IncidentStatus' => [
-                                            'description' => '',
-                                            'type' => 'integer',
-                                            'format' => 'int32',
-                                            'example' => '0',
-                                        ],
-                                        'Owner' => [
-                                            'title' => '事件责任人账号uid'."\n",
-                                            'type' => 'string',
-                                            'example' => '1234567890xxxxxx',
-                                        ],
-                                        'CreateTime' => [
-                                            'description' => '',
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '1603248483000',
-                                        ],
-                                        'UpdateTime' => [
-                                            'description' => '',
-                                            'type' => 'integer',
-                                            'format' => 'int64',
-                                            'example' => '1603248483000',
-                                        ],
-                                        'RelateAssetCount' => [
-                                            'description' => '',
-                                            'type' => 'integer',
-                                            'format' => 'int32',
-                                            'example' => '4',
-                                        ],
-                                        'IncidentUuid' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'dbb1d7211c9285c862aa89385098****',
-                                        ],
-                                        'IncidentRemark' => [
-                                            'description' => '',
-                                            'type' => 'string',
-                                            'example' => 'remark',
-                                        ],
-                                        'RelateAlertCount' => [
-                                            'description' => '',
-                                            'type' => 'integer',
-                                            'format' => 'int32',
-                                            'example' => '3',
-                                        ],
-                                        'IncidentTags' => [
-                                            'title' => '事件标签。',
-                                            'type' => 'string',
-                                            'example' => '["sys:data_source:siem","sys:trigger_type:auto"]',
-                                        ],
-                                        'DetectionRuleId' => [
-                                            'type' => 'string',
-                                        ],
-                                    ],
-                                ],
-                            ],
-                            'PageNumber' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '1',
-                            ],
-                            'PageSize' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '10',
-                            ],
-                            'TotalCount' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '57',
-                            ],
-                            'MaxResults' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '50',
-                            ],
-                            'NextToken' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****',
-                            ],
+                            'RequestId' => ['title' => 'Id of the request', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+            'title' => 'UpdateProduct',
+            'description' => 'The JsonConfig request parameter is a complex JSON configuration. For an example of a supporting tool class with configuration examples, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'update',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:UpdateProduct',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'Product', 'arn' => 'acs:yundun-sas::{#accountId}:product/{#ProductId}'],
+                        ],
+                    ],
+                ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"Incidents\\": [\\n    {\\n      \\"IncidentName\\": \\"ECS unusual log in\\",\\n      \\"ThreatLevel\\": \\"2\\",\\n      \\"IncidentStatus\\": 0,\\n      \\"Owner\\": \\"1234567890xxxxxx\\",\\n      \\"CreateTime\\": 1603248483000,\\n      \\"UpdateTime\\": 1603248483000,\\n      \\"RelateAssetCount\\": 4,\\n      \\"IncidentUuid\\": \\"dbb1d7211c9285c862aa89385098****\\",\\n      \\"IncidentRemark\\": \\"remark\\",\\n      \\"RelateAlertCount\\": 3,\\n      \\"IncidentTags\\": \\"[\\\\\\"sys:data_source:siem\\\\\\",\\\\\\"sys:trigger_type:auto\\\\\\"]\\",\\n      \\"DetectionRuleId\\": \\"dr-qo5ww6ux0uc28*****\\"\\n    }\\n  ],\\n  \\"PageNumber\\": 1,\\n  \\"PageSize\\": 10,\\n  \\"TotalCount\\": 57,\\n  \\"MaxResults\\": 50,\\n  \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\"\\n}","type":"json"}]',
         ],
-        'CreateExportTask' => [
-            'summary' => '创建导出任务',
-            'methods' => [
-                'post',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'UpdateResponseRule' => [
+            'methods' => ['post'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
@@ -13381,802 +12382,575 @@
             'operationType' => 'write',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'create',
+                'operationType' => 'update',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsasASHGE7',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas104PTS'],
             ],
             'parameters' => [
                 [
+                    'name' => 'NextToken',
+                    'in' => 'formData',
+                    'allowEmptyValue' => true,
+                    'schema' => ['description' => 'The token that is used to retrieve the next page of results. If you do not specify this parameter, the query starts from the first page.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****'],
+                ],
+                [
+                    'name' => 'MaxResults',
+                    'in' => 'formData',
+                    'allowEmptyValue' => true,
+                    'schema' => ['description' => 'The maximum number of results to return for a single request.', 'type' => 'integer', 'format' => 'int32', 'title' => '', 'required' => false, 'example' => '50'],
+                ],
+                [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['description' => 'The region where the data management center of Cloud SIEM is located. Select a region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- `cn-hangzhou`: China (Hangzhou). For assets in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- `ap-southeast-1`: Asia Pacific SE 1 (Singapore). For assets in overseas regions.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh',
-                    ],
+                    'schema' => ['description' => 'The language of the response messages. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
-                    'name' => 'ExportTaskParameter',
+                    'name' => 'ResponseRuleId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => '{'."\n"
-                            .'    "IncidentName": "name",'."\n"
-                            .'    "IncidentStatus": "1",'."\n"
-                            .'    "ThreatLevel":["1","2"],'."\n"
-                            .'    "IncidentUuids":"315EE627-39DC-560A-8DFD-CBF66AD9****"'."\n"
-                            .'}',
-                    ],
+                    'schema' => ['description' => 'The ID of the automatic response rule.', 'type' => 'string', 'required' => false, 'example' => '440918', 'title' => ''],
                 ],
                 [
-                    'name' => 'ExportTaskType',
+                    'name' => 'ResponseRuleName',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'incident_list',
-                    ],
+                    'schema' => ['description' => 'The name of the automatic response rule.', 'type' => 'string', 'required' => false, 'example' => 'Send Notification When Generating Urgent Incident', 'title' => ''],
                 ],
                 [
-                    'name' => 'RoleFor',
+                    'name' => 'ResponseRulePriority',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The execution priority of the automatic response rule.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1', 'title' => ''],
+                ],
+                [
+                    'name' => 'ResponseExecutionCondition',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The trigger conditions for the rule.', 'type' => 'string', 'required' => false, 'example' => '[{"left":{"value":"threat_level"},"operator":"equals","right":{"value":"suspicious"}}]', 'title' => ''],
+                ],
+                [
+                    'name' => 'ResponseActionType',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The action for the automatic response rule. Valid values:'."\n"
+                        ."\n"
+                        .'- `doPlaybook`: Executes a playbook.'."\n"
+                        ."\n"
+                        .'- `changeEventStatus`: Updates the event status.'."\n"
+                        ."\n"
+                        .'- `changeThreatLevel`: Updates the event threat level.'."\n"
+                        ."\n"
+                        .'- `addEventTag`: Adds an event tag.'."\n"
+                        ."\n"
+                        .'- `deleteEventTag`: Deletes an event tag.'."\n"
+                        ."\n"
+                        .'- `alertWhitelist`: Adds the alert to a whitelist.', 'type' => 'string', 'required' => false, 'example' => 'alertWhitelist', 'title' => ''],
+                ],
+                [
+                    'name' => 'ResponseTriggerType',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The trigger for the automatic response rule. Valid values:'."\n"
+                        ."\n"
+                        .'- `event`: The rule is triggered when an event occurs.'."\n"
+                        ."\n"
+                        .'- `event_update`: The rule is triggered when an event is updated.'."\n"
+                        ."\n"
+                        .'- `alert`: The rule is triggered when an alert is generated.', 'type' => 'string', 'required' => false, 'example' => 'event', 'title' => ''],
+                ],
+                [
+                    'name' => 'ResponseActionConfig',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The action configuration for the automatic response rule.', 'type' => 'string', 'required' => false, 'example' => '[{"actionType":"doPlaybook","playbookName":"block waf IP","playbookUuid":"system_aliyun_waf_whole_process_book","disposeParam":{"period":"7d"}}]', 'title' => ''],
+                ],
+                [
+                    'name' => 'ResponseRuleStatus',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The status of the rule. Valid values:'."\n"
+                        ."\n"
+                        .'- `0`: disabled'."\n"
+                        ."\n"
+                        .'- `100`: enabled', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '0', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
-                        'title' => 'Schema of Response',
-                        'description' => '',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****',
-                            ],
-                            'FileName' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => 'event_1193842352994186_17344888****.xlsx',
-                            ],
-                            'Id' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int64',
-                                'example' => '400151',
-                            ],
+                            'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'title' => '', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
+                            'ResponseRuleId' => ['description' => 'The ID of the automatic response rule.', 'type' => 'string', 'example' => '440918', 'title' => ''],
                         ],
+                        'title' => '',
+                        'description' => 'The response data.',
+                        'example' => '',
                     ],
                 ],
             ],
-            'errorCodes' => [
-                400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
-                ],
-            ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'title' => 'UpdateResponseRule',
+            'summary' => 'Updates an automatic response rule.',
+            'description' => 'Some request parameters require complex JSON configurations. We provide a helper utility class with configuration examples.',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"FileName\\": \\"event_1193842352994186_17344888****.xlsx\\",\\n  \\"Id\\": 400151\\n}","type":"json"}]',
+            'ramActions' => [],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"ResponseRuleId\\": \\"440918\\"\\n}","type":"json"}]',
         ],
-        'GetExportTask' => [
-            'summary' => '获取导出任务进度',
-            'methods' => [
-                'get',
-                'post',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'UpdateVendor' => [
+            'summary' => 'Updates a vendor.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'read',
+            'operationType' => 'write',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'get',
+                'operationType' => 'update',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsasASHGE7',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['description' => 'The region of the Data Management center for threat analysis. Select the region based on where your asset is located. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: The asset is in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: The asset is outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
-                    'name' => 'ExportId',
+                    'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '200013',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member. This parameter allows an administrator to switch to the perspective of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******'."\n", 'title' => ''],
                 ],
                 [
-                    'name' => 'RoleFor',
+                    'name' => 'VendorId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The ID of the vendor.', 'type' => 'string', 'required' => false, 'example' => 'vd-qlsw5eocx94w9', 'title' => ''],
+                ],
+                [
+                    'name' => 'VendorName',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The name of the vendor.', 'type' => 'string', 'required' => false, 'example' => '111', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'Schema of Response',
-                        'description' => '',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****',
-                            ],
-                            'FileName' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => 'event_1193842352994186_17344888****.xlsx',
-                            ],
-                            'Id' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int64',
-                                'example' => '400185',
-                            ],
-                            'ExportType' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => 'incident_list',
-                            ],
-                            'ExportStatus' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => 'success',
-                            ],
-                            'Progress' => [
-                                'description' => '',
-                                'type' => 'integer',
-                                'format' => 'int32',
-                                'example' => '66',
-                            ],
-                            'GmtCreate' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '1605076118000',
-                            ],
-                            'Link' => [
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => 'https://cloud-siem-user-dataset.oss-cn-shanghai.aliyuncs.com/export_file/17661858******5/event_17661858******5_175748****.xlsx',
-                            ],
+                            'RequestId' => ['title' => 'Id of the request', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
             'errorCodes' => [
                 400 => [
-                    [
-                        'errorCode' => 'IdempotentParameterMismatch',
-                        'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.',
-                    ],
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
                 ],
             ],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
+            'title' => 'UpdateVendor',
+            'description' => 'The delivery of notifications is limited by frequency and time. A user can receive a maximum of two notifications per day between 08:00 and 20:00. Notifications are not sent outside this time period.',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'update',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:UpdateVendor',
+                        'authLevel' => 'resource',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'Vendor', 'arn' => 'acs:yundun-sas::{#accountId}:vendor/{#VendortId}'],
+                        ],
+                    ],
+                ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n  \\"FileName\\": \\"event_1193842352994186_17344888****.xlsx\\",\\n  \\"Id\\": 400185,\\n  \\"ExportType\\": \\"incident_list\\",\\n  \\"ExportStatus\\": \\"success\\",\\n  \\"Progress\\": 66,\\n  \\"GmtCreate\\": \\"1605076118000\\",\\n  \\"Link\\": \\"https://cloud-siem-user-dataset.oss-cn-shanghai.aliyuncs.com/export_file/17661858******5/event_17661858******5_175748****.xlsx\\"\\n}","type":"json"}]',
         ],
-        'UpdateNormalizationSchema' => [
-            'summary' => '更新标准化结构',
-            'methods' => [
-                'post',
-            ],
-            'schemes' => [
-                'https',
-            ],
+        'ValidateLogStore' => [
+            'summary' => 'Verify log storage.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'write',
+            'operationType' => 'readAndWrite',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'update',
+                'operationType' => 'none',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
+                'tenantRelevance' => 'tenant',
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['description' => 'The region of the Data Management Center for threat analysis. Select a region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: The Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh',
-                    ],
+                    'schema' => ['description' => 'The language of the response. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
-                ],
-                [
-                    'name' => 'NormalizationSchemaType',
-                    'in' => 'formData',
-                    'schema' => [
-                        'title' => '标准化结构类型，当前仅支持log。',
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'log',
-                    ],
+                    'schema' => ['description' => 'The user ID of a member. This lets an administrator switch to the member\'s perspective.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
                 [
-                    'name' => 'NormalizationSchemaId',
+                    'name' => 'LogUserId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '标准化结构ID。',
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'WAF_ALERT_ACTIVITY',
-                    ],
+                    'schema' => ['description' => 'The user ID for data access.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
                 [
-                    'name' => 'NormalizationSchemaName',
+                    'name' => 'LogRegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '标准化结构名称。',
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'ProcessQuery',
-                    ],
+                    'schema' => ['description' => 'The ID of the log storage region.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
-                    'name' => 'NormalizationSchemaDescription',
+                    'name' => 'LogProjectName',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '标准化结构描述',
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'ProcessQuery',
-                    ],
+                    'schema' => ['description' => 'The name of the Simple Log Service project.', 'type' => 'string', 'required' => false, 'example' => 'aliyun-cloudsiem-data-173326*******-cn-hangzhou', 'title' => ''],
                 ],
                 [
-                    'name' => 'NormalizationFields',
+                    'name' => 'LogStoreName',
                     'in' => 'formData',
-                    'style' => 'repeatList',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'array',
-                        'items' => [
-                            'title' => '',
-                            'description' => '',
-                            'type' => 'object',
-                            'properties' => [
-                                'NormalizationFieldName' => [
-                                    'title' => '标准化字段名。',
-                                    'description' => '',
-                                    'type' => 'string',
-                                    'required' => true,
-                                    'example' => 'cloud_user',
-                                ],
-                                'NormalizationFieldType' => [
-                                    'title' => '标准字段类型，支持text、long、double、json四种类型。',
-                                    'description' => '',
-                                    'type' => 'string',
-                                    'required' => true,
-                                    'example' => 'varchar',
-                                ],
-                                'NormalizationFieldRequired' => [
-                                    'title' => '标准字段是否必填。',
-                                    'description' => '',
-                                    'type' => 'boolean',
-                                    'required' => false,
-                                ],
-                                'NormalizationFieldDescription' => [
-                                    'title' => '标准字段描述。',
-                                    'description' => '',
-                                    'type' => 'string',
-                                    'required' => false,
-                                    'example' => 'cloud_user',
-                                ],
-                                'NormalizationFieldExample' => [
-                                    'title' => '标准字段示例',
-                                    'description' => '',
-                                    'type' => 'string',
-                                    'required' => false,
-                                    'example' => '173326*******',
-                                ],
-                                'NormalizationFieldFrom' => [
-                                    'description' => '',
-                                    'type' => 'string',
-                                    'required' => false,
-                                    'example' => 'preset',
-                                ],
-                                'NormalizationFieldTokenize' => [
-                                    'title' => '标准字段是否分词。',
-                                    'description' => '',
-                                    'type' => 'boolean',
-                                    'required' => false,
-                                ],
-                                'NormalizationFieldJsonIndexAll' => [
-                                    'title' => 'json类型的标准字段是否针对所有key建立索引。',
-                                    'description' => '',
-                                    'type' => 'boolean',
-                                    'required' => false,
-                                ],
-                                'NormalizationFieldJsonKeys' => [
-                                    'title' => 'json类型的标准字段key列表。',
-                                    'description' => '',
-                                    'type' => 'array',
-                                    'items' => [
-                                        'description' => '',
-                                        'type' => 'object',
-                                        'properties' => [
-                                            'NormalizationFieldName' => [
-                                                'title' => 'json类型的标准字段key名称。',
-                                                'description' => '',
-                                                'type' => 'string',
-                                                'required' => true,
-                                                'example' => 'alert_name',
-                                            ],
-                                            'NormalizationFieldType' => [
-                                                'title' => 'json类型的标准字段key类型，支持text、long、double、json四种类型',
-                                                'description' => '',
-                                                'type' => 'string',
-                                                'required' => true,
-                                                'example' => 'text',
-                                            ],
-                                            'NormalizationFieldRequired' => [
-                                                'title' => 'json类型的标准字段key是否必填。',
-                                                'description' => '',
-                                                'type' => 'boolean',
-                                                'required' => false,
-                                            ],
-                                            'NormalizationFieldDescription' => [
-                                                'title' => 'json类型的标准字段key描述。',
-                                                'description' => '',
-                                                'type' => 'string',
-                                                'required' => false,
-                                                'example' => '',
-                                            ],
-                                            'NormalizationFieldExample' => [
-                                                'title' => 'json类型的标准字段key示例。',
-                                                'description' => '',
-                                                'type' => 'string',
-                                                'required' => false,
-                                                'example' => '',
-                                            ],
-                                            'NormalizationFieldFrom' => [
-                                                'description' => '',
-                                                'type' => 'string',
-                                                'required' => false,
-                                                'example' => 'preset',
-                                            ],
-                                            'NormalizationFieldTokenize' => [
-                                                'title' => 'json类型的标准字段key是否分词。',
-                                                'description' => '',
-                                                'type' => 'boolean',
-                                                'required' => false,
-                                                'example' => 'true',
-                                            ],
-                                        ],
-                                        'required' => false,
-                                    ],
-                                    'required' => false,
-                                    'maxItems' => 100,
-                                ],
-                            ],
-                            'required' => false,
-                        ],
-                        'required' => false,
-                        'maxItems' => 100,
-                    ],
+                    'schema' => ['description' => 'The name of the Simple Log Service Logstore.', 'type' => 'string', 'required' => false, 'example' => 'ssglauncher-log', 'title' => ''],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'Schema of Response',
-                        'description' => 'Schema of Response',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'title' => '请求消息 ID。',
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****',
-                            ],
+                            'RequestId' => ['title' => 'Id of the request', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
-            'errorCodes' => [],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'errorCodes' => [
+                400 => [
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
+                ],
             ],
+            'staticInfo' => ['returnType' => 'synchronous'],
             'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
-        ],
-        'CreateNormalizationSchema' => [
-            'summary' => '创建标准化结构',
-            'methods' => [
-                'post',
-            ],
-            'schemes' => [
-                'https',
+            'title' => 'ValidateLogStore',
+            'description' => 'The JsonConfig request parameter is a complex JSON configuration. A supporting tool class is provided to help you create the configuration. For a code sample, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'none',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:CheckLogStore',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
+        ],
+        'ValidateNormalizationRule' => [
+            'summary' => 'Validates a normalization rule.',
+            'methods' => ['post', 'get'],
+            'schemes' => ['https'],
             'security' => [
                 [
                     'AK' => [],
                 ],
             ],
-            'operationType' => 'write',
+            'operationType' => 'readAndWrite',
             'deprecated' => false,
             'systemTags' => [
-                'operationType' => 'create',
+                'operationType' => 'none',
                 'riskType' => 'none',
                 'chargeType' => 'free',
-                'abilityTreeNodes' => [
-                    'FEATUREsas5NAHBX',
-                ],
+                'abilityTreeNodes' => ['FEATUREsas5NAHBX'],
             ],
             'parameters' => [
                 [
                     'name' => 'RegionId',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'cn-hangzhou',
-                    ],
+                    'schema' => ['description' => 'The region where the Data Management center for threat analysis is deployed. Select the region based on the location of your assets. Valid values:'."\n"
+                        ."\n"
+                        .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n"
+                        ."\n"
+                        .'- ap-southeast-1: Your assets are in regions outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''],
                 ],
                 [
                     'name' => 'Lang',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'zh',
-                    ],
+                    'schema' => ['description' => 'The language of the response messages. Valid values:'."\n"
+                        ."\n"
+                        .'- **zh** (default): Chinese.'."\n"
+                        ."\n"
+                        .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''],
                 ],
                 [
                     'name' => 'RoleFor',
                     'in' => 'formData',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'integer',
-                        'format' => 'int64',
-                        'required' => false,
-                        'example' => '113091674488****',
-                    ],
+                    'schema' => ['description' => 'The user ID of the member. An administrator uses this parameter to switch to the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''],
                 ],
                 [
-                    'name' => 'NormalizationSchemaType',
+                    'name' => 'Data',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '标准化结构类型，当前仅支持log。',
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'log',
-                    ],
+                    'schema' => ['description' => 'The rule ID.', 'type' => 'string', 'required' => false, 'example' => '123456', 'title' => ''],
+                ],
+                [
+                    'name' => 'NormalizationCategoryId',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The normalization category of the rule.', 'type' => 'string', 'example' => 'NETWORK_CATEGORY', 'required' => false, 'title' => ''],
                 ],
                 [
                     'name' => 'NormalizationSchemaId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '标准化结构ID。',
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'PROCESS_QUERY_DNS_ACTIVITY',
-                    ],
+                    'schema' => ['description' => 'The ID of the normalization pattern for the rule.', 'type' => 'string', 'example' => 'HTTP_ACTIVITY', 'required' => false, 'title' => ''],
                 ],
                 [
-                    'name' => 'NormalizationSchemaName',
+                    'name' => 'VendorId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '标准化结构名称。',
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'ProcessQuery',
-                    ],
+                    'schema' => ['description' => 'The vendor ID.', 'type' => 'string', 'example' => 'alibaba_cloud', 'title' => '', 'required' => false],
                 ],
                 [
-                    'name' => 'NormalizationSchemaDescription',
+                    'name' => 'ProductId',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '标准化结构描述',
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => false,
-                        'example' => 'ProcessQuery',
-                    ],
+                    'schema' => ['description' => 'The product ID.', 'type' => 'string', 'example' => 'alibaba_cloud_sas', 'title' => '', 'required' => false],
                 ],
                 [
-                    'name' => 'NormalizationCategoryId',
+                    'name' => 'ExtendFieldStoreMode',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '标准化分类ID。',
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'NETWORK_CATEGORY',
-                    ],
+                    'schema' => ['description' => 'The storage mode for extended fields. Valid values: \\`flat\\`, \\`pack\\`, and \\`reject\\`.', 'type' => 'string', 'example' => 'flat', 'title' => '', 'required' => false],
                 ],
                 [
-                    'name' => 'TargetLogStore',
+                    'name' => 'NormalizationRuleMode',
                     'in' => 'formData',
-                    'schema' => [
-                        'title' => '日志服务 LogStore。',
-                        'description' => '',
-                        'type' => 'string',
-                        'required' => true,
-                        'example' => 'xxx-activity',
-                    ],
+                    'schema' => ['description' => 'The mode of the normalization rule. Valid values: \\`both\\` and \\`realtime\\`.', 'type' => 'string', 'example' => 'realtime', 'title' => '', 'required' => false],
                 ],
                 [
-                    'name' => 'NormalizationFields',
+                    'name' => 'LogSample',
                     'in' => 'formData',
-                    'style' => 'repeatList',
-                    'schema' => [
-                        'description' => '',
-                        'type' => 'array',
-                        'items' => [
-                            'title' => '',
-                            'description' => '',
-                            'type' => 'object',
-                            'properties' => [
-                                'NormalizationFieldName' => [
-                                    'title' => '标准化字段名。',
-                                    'description' => '',
-                                    'type' => 'string',
-                                    'required' => true,
-                                    'example' => 'cloud_user',
-                                ],
-                                'NormalizationFieldType' => [
-                                    'title' => '标准字段类型，支持text、long、double、json四种类型。',
-                                    'description' => '',
-                                    'type' => 'string',
-                                    'required' => true,
-                                    'example' => 'varchar',
-                                ],
-                                'NormalizationFieldRequired' => [
-                                    'title' => '标准字段是否必填。',
-                                    'description' => '',
-                                    'type' => 'boolean',
-                                    'required' => false,
-                                    'example' => 'true',
-                                ],
-                                'NormalizationFieldDescription' => [
-                                    'title' => '标准字段描述。',
-                                    'description' => '',
-                                    'type' => 'string',
-                                    'required' => false,
-                                    'example' => 'cloud_user',
-                                ],
-                                'NormalizationFieldFrom' => [
-                                    'description' => '',
-                                    'type' => 'string',
-                                    'required' => false,
-                                    'example' => 'preset',
-                                ],
-                                'NormalizationFieldExample' => [
-                                    'title' => '标准字段示例',
-                                    'description' => '',
-                                    'type' => 'string',
-                                    'required' => false,
-                                    'example' => '173326*******',
-                                ],
-                                'NormalizationFieldTokenize' => [
-                                    'title' => '标准字段是否分词。',
-                                    'description' => '',
-                                    'type' => 'boolean',
-                                    'required' => false,
-                                    'example' => 'true',
-                                ],
-                                'NormalizationFieldJsonIndexAll' => [
-                                    'title' => 'json类型的标准字段是否针对所有key建立索引。',
-                                    'description' => '',
-                                    'type' => 'boolean',
-                                    'required' => false,
-                                    'example' => 'true',
-                                ],
-                                'NormalizationFieldJsonKeys' => [
-                                    'title' => 'json类型的标准字段key列表。',
-                                    'description' => '',
-                                    'type' => 'array',
-                                    'items' => [
-                                        'description' => '',
-                                        'type' => 'object',
-                                        'properties' => [
-                                            'NormalizationFieldName' => [
-                                                'title' => 'json类型的标准字段key名称。',
-                                                'description' => '',
-                                                'type' => 'string',
-                                                'required' => true,
-                                                'example' => 'alert_name',
-                                            ],
-                                            'NormalizationFieldType' => [
-                                                'title' => 'json类型的标准字段key类型，支持text、long、double、json四种类型',
-                                                'description' => '',
-                                                'type' => 'string',
-                                                'required' => true,
-                                                'example' => 'text',
-                                            ],
-                                            'NormalizationFieldRequired' => [
-                                                'title' => 'json类型的标准字段key是否必填。',
-                                                'description' => '',
-                                                'type' => 'boolean',
-                                                'required' => false,
-                                                'example' => 'true',
-                                            ],
-                                            'NormalizationFieldDescription' => [
-                                                'title' => 'json类型的标准字段key描述。',
-                                                'description' => '',
-                                                'type' => 'string',
-                                                'required' => false,
-                                                'example' => '',
-                                            ],
-                                            'NormalizationFieldFrom' => [
-                                                'description' => '',
-                                                'type' => 'string',
-                                                'required' => false,
-                                                'example' => 'preset',
-                                            ],
-                                            'NormalizationFieldExample' => [
-                                                'title' => 'json类型的标准字段key示例。',
-                                                'description' => '',
-                                                'type' => 'string',
-                                                'required' => false,
-                                                'example' => '',
-                                            ],
-                                            'NormalizationFieldTokenize' => [
-                                                'title' => 'json类型的标准字段key是否分词。',
-                                                'description' => '',
-                                                'type' => 'boolean',
-                                                'required' => false,
-                                                'example' => 'true',
-                                            ],
-                                        ],
-                                        'required' => false,
-                                    ],
-                                    'required' => false,
-                                    'maxItems' => 100,
-                                ],
-                                'NormalizationFieldRequirement' => [
-                                    'description' => '',
-                                    'type' => 'boolean',
-                                    'required' => false,
-                                    'example' => 'true',
-                                ],
-                                'NormalizationFieldReserved' => [
-                                    'description' => '',
-                                    'type' => 'boolean',
-                                    'required' => false,
-                                    'example' => 'true',
-                                ],
-                            ],
-                            'required' => false,
-                        ],
-                        'required' => false,
-                        'maxItems' => 100,
-                    ],
+                    'schema' => ['description' => 'The sample log. The value must be in the JSON format.', 'type' => 'string', 'example' => '{"aaa":"bbb","xxx":"yyy"}', 'title' => '', 'required' => false],
+                ],
+                [
+                    'name' => 'NormalizationRuleExpression',
+                    'in' => 'formData',
+                    'schema' => ['description' => 'The expression for the normalization rule.', 'type' => 'string', 'example' => '*', 'title' => '', 'required' => false],
                 ],
             ],
             'responses' => [
                 200 => [
                     'schema' => [
                         'title' => 'Schema of Response',
-                        'description' => 'Schema of Response',
+                        'description' => 'The response body.',
                         'type' => 'object',
                         'properties' => [
-                            'RequestId' => [
-                                'title' => '请求消息 ID。',
-                                'description' => '',
-                                'type' => 'string',
-                                'example' => '6276D891-*****-55B2-87B9-74D413F7****',
+                            'RequestId' => ['title' => 'Id of the request', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'],
+                            'ValidateResult' => [
+                                'description' => 'The list of validation results.',
+                                'type' => 'array',
+                                'items' => [
+                                    'description' => 'The validation result.',
+                                    'type' => 'object',
+                                    'properties' => [
+                                        'FieldName' => ['description' => 'The field name.', 'type' => 'string', 'example' => 'host', 'title' => ''],
+                                        'FieldValue' => ['description' => 'The field value.', 'type' => 'string', 'example' => 'ze', 'title' => ''],
+                                        'NormalizationFieldName' => ['description' => 'The name of the normalized field.', 'type' => 'string', 'example' => 'host', 'title' => ''],
+                                        'NormalizationFieldRequired' => ['description' => 'Indicates whether the normalized field is required.', 'type' => 'boolean', 'example' => 'true', 'title' => ''],
+                                        'Result' => ['description' => 'The result of the validation. Valid values:'."\n"
+                                            ."\n"
+                                            .'- 1: The validation passed.'."\n"
+                                            ."\n"
+                                            .'- 0: A warning is returned.'."\n"
+                                            ."\n"
+                                            .'- -1: The validation failed.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''],
+                                        'Message' => ['description' => 'The reason for the validation result. Valid values:'."\n"
+                                            ."\n"
+                                            .'- OperationDenied.TheValueIsRequired: A required parameter is empty.'."\n"
+                                            ."\n"
+                                            .'- OperationDenied.TheValueIsNull: The parameter value is empty.'."\n"
+                                            ."\n"
+                                            .'- OperationDenied.TheEnumValueNotSupport: The field value is not within the valid enumeration.'."\n"
+                                            ."\n"
+                                            .'- OperationDenied.TheValueLessThanMin: The field value is less than the minimum value.'."\n"
+                                            ."\n"
+                                            .'- OperationDenied.TheValueMoreThanMax: The field value is greater than the maximum value.'."\n"
+                                            ."\n"
+                                            .'- OperationDenied.TheValueNotMatchRegularExpression: The field value does not match the regular expression.'."\n"
+                                            ."\n"
+                                            .'- success: The validation passed.', 'type' => 'string', 'example' => 'success', 'title' => ''],
+                                        'NormalizationFieldType' => ['description' => 'The type of the normalized field. Supported types: \\`text\\`, \\`long\\`, \\`double\\`, and \\`json\\`.', 'type' => 'string', 'example' => 'text', 'title' => ''],
+                                        'NormalizationFieldFrom' => ['description' => 'The source of the normalized field. Valid values: \\`preset\\` (built-in) and \\`custom\\`.', 'type' => 'string', 'example' => 'preset', 'title' => ''],
+                                        'NormalizationFieldReserved' => ['description' => 'Indicates whether the name of the normalized field is a built-in field name.', 'type' => 'boolean', 'title' => '', 'example' => ''],
+                                        'NormalizationFieldValidationStatus' => ['description' => 'The validation status of the normalized field. Valid values: \\`pass\\` and \\`fail\\`.', 'type' => 'string', 'example' => 'pass', 'title' => ''],
+                                        'NormalizationFieldValidationReason' => ['description' => 'The reason why the validation of the normalized field failed.', 'type' => 'string', 'example' => 'OperationDenied.TheValueIsRequired', 'title' => ''],
+                                        'LogFieldName' => ['description' => 'The name of the log field.', 'type' => 'string', 'example' => 'aaa', 'title' => ''],
+                                        'LogFieldValue' => ['description' => 'The value of the log field.', 'type' => 'string', 'example' => 'bbb', 'title' => ''],
+                                    ],
+                                    'title' => '',
+                                    'example' => '',
+                                ],
+                                'title' => '',
+                                'example' => '',
                             ],
                         ],
+                        'example' => '',
                     ],
                 ],
             ],
-            'errorCodes' => [],
-            'staticInfo' => [
-                'returnType' => 'synchronous',
+            'errorCodes' => [
+                400 => [
+                    ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''],
+                ],
+            ],
+            'staticInfo' => ['returnType' => 'synchronous'],
+            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n  \\"ValidateResult\\": [\\n    {\\n      \\"FieldName\\": \\"host\\",\\n      \\"FieldValue\\": \\"ze\\",\\n      \\"NormalizationFieldName\\": \\"host\\",\\n      \\"NormalizationFieldRequired\\": true,\\n      \\"Result\\": 1,\\n      \\"Message\\": \\"success\\",\\n      \\"NormalizationFieldType\\": \\"text\\",\\n      \\"NormalizationFieldFrom\\": \\"preset\\",\\n      \\"NormalizationFieldReserved\\": false,\\n      \\"NormalizationFieldValidationStatus\\": \\"pass\\",\\n      \\"NormalizationFieldValidationReason\\": \\"OperationDenied.TheValueIsRequired\\",\\n      \\"LogFieldName\\": \\"aaa\\",\\n      \\"LogFieldValue\\": \\"bbb\\"\\n    }\\n  ]\\n}","type":"json"}]',
+            'title' => 'ValidateNormalizationRule',
+            'description' => 'The JsonConfig input parameter is a complex JSON configuration. A supporting tool class provides configuration examples. For more information, see the [demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).',
+            'changeSet' => [],
+            'flowControl' => [
+                'flowControlList' => [],
+            ],
+            'ramActions' => [
+                [
+                    'operationType' => 'none',
+                    'ramAction' => [
+                        'action' => 'yundun-sas:ValidateNormalizationRule',
+                        'authLevel' => 'operate',
+                        'actionConditions' => [],
+                        'resources' => [
+                            ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                        ],
+                    ],
+                ],
             ],
-            'responseDemo' => '[{"errorExample":"","example":"{\\n  \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]',
         ],
     ],
     'endpoints' => [
-        [
-            'regionId' => 'cn-shanghai',
-            'endpoint' => 'cloud-siem.cn-shanghai.aliyuncs.com',
+        ['regionId' => 'cn-shanghai', 'regionName' => 'China (Shanghai)', 'areaId' => 'asiaPacific', 'areaName' => 'Asia Pacific', 'public' => 'cloud-siem.cn-shanghai.aliyuncs.com', 'endpoint' => 'cloud-siem.cn-shanghai.aliyuncs.com', 'vpc' => 'cloud-siem-vpc.cn-shanghai.aliyuncs.com'],
+        ['regionId' => 'ap-southeast-1', 'regionName' => 'Singapore', 'areaId' => 'asiaPacific', 'areaName' => 'Asia Pacific', 'public' => 'cloud-siem.ap-southeast-1.aliyuncs.com', 'endpoint' => 'cloud-siem.ap-southeast-1.aliyuncs.com', 'vpc' => 'cloud-siem-vpc.ap-southeast-1.aliyuncs.com'],
+    ],
+    'errorCodes' => [
+        ['code' => 'AccessKey.NotFound', 'message' => 'Access Key not found, please add access key for siem.', 'http_code' => 400, 'description' => ''],
+        ['code' => 'AssumeRoleError', 'message' => 'Specified role "AliyunServiceRoleForSasCloudSiem" is not exists.', 'http_code' => 400, 'description' => 'AliyunServiceRoleForSasCloudSiem associated role is missing.'],
+        ['code' => 'CloudSiemCustomizeRuleDuplicateRuleNameExcepiton', 'message' => 'The rule name is duplicated.', 'http_code' => 400, 'description' => 'Custom rule naming conflict.'],
+        ['code' => 'Datasets with associated references cannot be deleted', 'message' => 'Delete the dataset-related references before attempting to delete the current dataset.', 'http_code' => 400, 'description' => 'Delete the dataset-related references before attempting to delete the current dataset.'],
+        ['code' => 'Expired.Log', 'message' => 'CloudFireWall Alert Log is expired, please select CloudFireWall Real-Time Alert Log.', 'http_code' => 400, 'description' => ''],
+        ['code' => 'Forbidden.UserDenied.RdAccount', 'message' => 'Forbidden User.', 'http_code' => 403, 'description' => 'The current user is a resource directory user, please contact the administrator to add as a delegated administrator for threat analysis.'],
+        ['code' => 'ForbiddenAction', 'message' => 'Unknown error.', 'http_code' => 400, 'description' => 'Illegal operation.'],
+        ['code' => 'ForbiddenOperation', 'message' => 'Please stop log import task.', 'http_code' => 400, 'description' => ''],
+        ['code' => 'IllegalParameter', 'message' => 'The specified parameter %s is not valid, only support %s.', 'http_code' => 400, 'description' => 'Parameters'],
+        ['code' => 'InternalError', 'message' => 'The request processing has failed due to some unknown error.', 'http_code' => 500, 'description' => ''],
+        ['code' => 'InvalidOperation', 'message' => 'Accesskey %s already bound.', 'http_code' => 400, 'description' => 'AccessKey has been bound.'],
+        ['code' => 'InvalidOperation', 'message' => 'Access key %s already bound.', 'http_code' => 400, 'description' => 'AK has been bound to account%.'],
+        ['code' => 'InvalidParameter', 'message' => 'The specified parameter %s is not valid.', 'http_code' => 400, 'description' => 'Parameter is not valid, try again.'],
+        ['code' => 'InvalidUpdateRecord.Conflict', 'message' => 'Only one of selectedEntityList or unSelectedEntityList can be specified.', 'http_code' => 400, 'description' => 'User fails in performing automatic disposal'],
+        ['code' => 'Need.CfwFlowLog', 'message' => 'Cloud FireWall Real-Time Alert Log is dependency Cloud FireWall Flow Log. Please open Cloud FireWall Flow Log for account %s first.', 'http_code' => 400, 'description' => 'Real-time alert logs of Cloud Firewall depend on the flow logs of Cloud Firewall. You must first add the Cloud Firewall flow logs of account %s.'],
+        ['code' => 'NeedCfwFlowLog', 'message' => 'Cloud Firewall Traffic Log must be integrated first.', 'http_code' => 400, 'description' => 'Cloud Firewall Traffic Log must be integrated first.'],
+        ['code' => 'OrderExpired', 'message' => 'Siem Order Not Found.', 'http_code' => 403, 'description' => 'No valid threat analysis order.'],
+        ['code' => 'RamAssumeException', 'message' => 'The request processing has failed due to ram service error.', 'http_code' => 500, 'description' => 'The request processing has failed due to ram service error.'],
+        ['code' => 'Siem.Analysis.IllegalParameter', 'message' => 'Start time should less than or equal to end time.', 'http_code' => 400, 'description' => ''],
+        ['code' => 'Siem.Analysis.SQLError', 'message' => 'Analysis SQL is error.', 'http_code' => 400, 'description' => ''],
+        ['code' => 'Siem.Delivery.ErrorMapping', 'message' => 'The Mapping between productCode and logCode is error.', 'http_code' => 500, 'description' => ''],
+        ['code' => 'Siem.Delivery.ErrorProductCode', 'message' => 'ProductCode is error for this action.', 'http_code' => 500, 'description' => ''],
+        ['code' => 'Siem.Delivery.MissingProductCode', 'message' => 'ProductCode is mandatory for this action.', 'http_code' => 400, 'description' => ''],
+        ['code' => 'SIEM.Region.Duplicate', 'message' => 'The region can be set only once.', 'http_code' => 400, 'description' => 'Region can only be set once.'],
+        ['code' => 'Siem.Storage.Exception', 'message' => 'The request timed out, try again.', 'http_code' => 500, 'description' => ''],
+        ['code' => 'Siem.TTL.Limit', 'message' => 'TTL should be set 30 days at least.', 'http_code' => 400, 'description' => ''],
+        ['code' => 'Sls.Delivery.Error', 'message' => 'SLS service is unavailable.', 'http_code' => 500, 'description' => 'SLS service is unavailable.'],
+        ['code' => 'SLS.Index.Lost', 'message' => 'The SLS project initialization will take a few minutes, try again later.', 'http_code' => 400, 'description' => 'Log Service takes several minutes to create an index. Please try again later.'],
+        ['code' => 'SLS.Operation.Error', 'message' => 'SLS service is unavailable.', 'http_code' => 500, 'description' => ''],
+        ['code' => 'SLS.Project.Lost', 'message' => 'The SLS project initialization will take a few minutes, try again later.', 'http_code' => 400, 'description' => 'Log Service initialization takes several minutes. Please try again later.'],
+        ['code' => 'SLS.Ship.Error', 'message' => 'The Simple Log Service about data shipping is unavailable.', 'http_code' => 500, 'description' => ''],
+        ['code' => 'SLS.Sls4Service.Error', 'message' => 'The Simple Log Service about embedding console pages is unavailable.', 'http_code' => 500, 'description' => ''],
+        ['code' => 'UserDeliveryFailed', 'message' => 'failed in opening log delivery.', 'http_code' => 500, 'description' => 'Failed to open delivery.'],
+        ['code' => 'Siem.Delivery.ErrorMapping', 'message' => 'The Mapping between productCode and logCode is error.', 'http_code' => 400, 'description' => ''],
+        ['code' => 'Sls.Delivery.Error', 'message' => 'SLS service is unavailable.', 'http_code' => 400, 'description' => 'SLS service is unavailable.'],
+        ['code' => 'Siem.Delivery.ErrorProductCode', 'message' => 'ProductCode is error for this action.', 'http_code' => 400, 'description' => ''],
+    ],
+    'changeSet' => [],
+    'flowControl' => [
+        'flowControlList' => [
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListIncidents'],
+            ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'GetIncident'],
         ],
-        [
-            'regionId' => 'ap-southeast-1',
-            'endpoint' => 'cloud-siem.ap-southeast-1.aliyuncs.com',
+    ],
+    'ram' => [
+        'productCode' => 'ThreatDetection',
+        'productName' => 'Security Center',
+        'ramCodes' => ['threatdetection', 'yundun-aegis', 'yundun-sas'],
+        'ramLevel' => 'OPERATION',
+        'ramConditions' => [
+            [
+                'name' => 'acs:ResourceGroupId',
+                'schema' => ['type' => 'String', 'description' => '资源组ID'],
+            ],
+        ],
+        'ramActions' => [
+            [
+                'apiName' => 'GetAutoDisposeConfig',
+                'description' => '',
+                'operationType' => 'get',
+                'ramAction' => [
+                    'action' => 'yundun-aegis:GetAutoDisposeConfig',
+                    'authLevel' => 'operate',
+                    'actionConditions' => [],
+                    'resources' => [
+                        ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'],
+                    ],
+                ],
+            ],
         ],
+        'resourceTypes' => [],
     ],
 ];