查询已隔离文件列表
功能介绍
查询已隔离文件列表
调用方法
请参见如何调用API。
URI
GET /v5/{project_id}/event/isolated-file
|
参数 |
是否必选 |
参数类型 |
描述 |
|---|---|---|---|
|
project_id |
是 |
String |
项目ID |
|
参数 |
是否必选 |
参数类型 |
描述 |
|---|---|---|---|
|
enterprise_project_id |
否 |
String |
主机所属的企业项目ID。 开通企业项目功能后才需要配置企业项目。 企业项目ID默认取值为“0”，表示默认企业项目。如果需要查询所有企业项目下的主机，请传参“all_granted_eps”。如果您只有某个企业项目的权限，则需要传递该企业项目ID，查询该企业项目下的主机，否则会因权限不足而报错。 |
|
file_path |
否 |
String |
文件路径 |
|
host_name |
否 |
String |
服务器名称 |
|
private_ip |
否 |
String |
服务器私有IP |
|
public_ip |
否 |
String |
服务器公网IP |
|
file_hash |
否 |
String |
文件hash,当前为sha256 |
|
asset_value |
否 |
String |
资产重要性，包含如下3种
|
|
offset |
否 |
Integer |
偏移量：指定返回记录的开始位置 |
|
limit |
否 |
Integer |
每页显示个数 |
|
isolation_status |
否 |
String |
隔离状态，包含如下:
|
|
last_days |
否 |
Integer |
查询时间范围天数，与自定义查询时间begin_time，end_time互斥 |
|
begin_time |
否 |
Long |
自定义查询时间，与查询时间范围天数互斥，查询时间段的起始时间，毫秒级时间戳，end_time减去begin_time小于等于2天，与查询时间范围天数互斥 |
|
end_time |
否 |
Long |
自定义时间，查询时间段的终止时间，毫秒级时间戳，end_time减去begin_time小于等于2天，与查询时间范围天数互斥 |
请求参数
|
参数 |
是否必选 |
参数类型 |
描述 |
|---|---|---|---|
|
X-Auth-Token |
是 |
String |
用户Token。 通过调用IAM服务获取用户Token接口获取（响应消息头中X-Subject-Token的值） |
|
region |
是 |
String |
Region ID |
响应参数
状态码：200
|
参数 |
参数类型 |
描述 |
|---|---|---|
|
total_num |
Integer |
总数 |
|
data_list |
Array of IsolatedFileResponseInfo objects |
已隔离文件详情 |
|
参数 |
参数类型 |
描述 |
|---|---|---|
|
os_type |
String |
操作系统类型，包含如下2种。
|
|
host_id |
String |
主机ID |
|
host_name |
String |
服务器名称 |
|
file_hash |
String |
文件哈希 |
|
file_path |
String |
文件路径 |
|
file_attr |
String |
文件属性 |
|
isolation_status |
String |
隔离状态，包含如下:
|
|
private_ip |
String |
服务器私有IP |
|
public_ip |
String |
弹性公网IP地址 |
|
asset_value |
String |
资产重要性，包含如下3种
|
|
update_time |
Integer |
更新时间，毫秒 |
|
agent_version |
String |
agent版本 |
|
isolate_source |
String |
隔离来源，包含如下:
|
|
event_name |
String |
事件名称 |
|
agent_event_info |
IsolateEventResponseInfo object |
隔离事件详情 |
|
antivirus_result_info |
AntivirusResultDetailInfo object |
病毒查杀结果详情 |
|
参数 |
参数类型 |
描述 |
|---|---|---|
|
event_id |
String |
事件ID |
|
event_class_id |
String |
事件分类，包含如下:
|
|
event_type |
Integer |
事件类型，包含如下:
|
|
event_name |
String |
事件名称 |
|
severity |
String |
威胁等级，包含如下:
|
|
container_name |
String |
容器实例名称，只有容器类型的告警有 |
|
image_name |
String |
镜像名称，只有容器类型的告警有 |
|
host_name |
String |
服务器名称 |
|
host_id |
String |
主机ID |
|
private_ip |
String |
服务器私有IP |
|
public_ip |
String |
弹性公网IP地址 |
|
os_type |
String |
操作系统类型，包含如下2种。
|
|
host_status |
String |
服务器状态，包含如下4种。
|
|
agent_status |
String |
Agent状态，包含如下5种。
|
|
protect_status |
String |
防护状态，包含如下2种。
|
|
asset_value |
String |
资产重要性，包含如下4种
|
|
attack_phase |
String |
攻击阶段，包含如下：
|
|
attack_tag |
String |
攻击标识，包含如下：
|
|
occur_time |
Integer |
发生时间，毫秒 |
|
recent_time |
Integer |
发生时间，毫秒 |
|
handle_time |
Integer |
处置时间，毫秒，已处理的告警才有 |
|
handle_status |
String |
处理状态，包含如下:
|
|
handle_method |
String |
处理方式，已处理的告警才有，包含如下:
|
|
handler |
String |
备注信息，已处理的告警才有 |
|
memo |
String |
手动处理的备注 |
|
operate_accept_list |
Array of strings |
支持的处理操作 |
|
operate_detail_list |
Array of EventDetailResponseInfo objects |
操作详情信息列表（页面不展示） |
|
forensic_info |
Object |
取证信息 |
|
resource_info |
Object |
资源信息 |
|
geo_info |
Object |
地理信息 |
|
network_info |
Object |
网络信息 |
|
app_info |
Object |
应用信息 |
|
system_info |
Object |
系统信息 |
|
malware_info |
Object |
恶意软件信息 |
|
extend_info |
Object |
扩展信息 |
|
recommendation |
String |
处置建议 |
|
att_ck |
String |
att_ck 标识 |
|
event_details |
String |
事件简述信息 |
|
confidence |
Integer |
置信度。当前只有情报和av类告警展示该字段。 |
|
process_info_list |
Object |
进程信息列表 |
|
user_info_list |
Object |
用户信息列表 |
|
file_info_list |
Object |
文件信息列表 |
|
registry_info_list |
Object |
注册表信息列表 |
|
cluster_info |
Object |
注册表信息列表 |
|
tag_list |
Array of strings |
标签列表 |
|
description |
String |
告警说明 |
|
event_abstract |
String |
告警摘要 |
|
event_count |
Integer |
事件发生次数 |
|
cluster_id |
String |
集群id |
|
参数 |
参数类型 |
描述 |
|---|---|---|
|
agent_id |
String |
Agent ID |
|
process_pid |
Integer |
进程id |
|
is_parent |
Boolean |
是否是父进程 |
|
file_hash |
String |
文件哈希 |
|
file_path |
String |
文件路径 |
|
file_attr |
String |
文件属性 |
|
private_ip |
String |
服务器私有IP |
|
login_ip |
String |
登录源IP |
|
login_user_name |
String |
登录用户名 |
|
keyword |
String |
告警事件关键字，仅用于告警白名单 |
|
hash |
String |
告警事件hash，仅用于告警白名单 |
|
参数 |
参数类型 |
描述 |
|---|---|---|
|
result_id |
String |
病毒查杀结果ID |
|
malware_name |
String |
病毒名称 |
|
file_path |
String |
文件路径 |
|
file_hash |
String |
文件哈希 |
|
file_size |
Integer |
文件大小 |
|
file_owner |
String |
文件属主 |
|
file_attr |
String |
文件属性 |
|
file_ctime |
Integer |
文件创建时间 |
|
file_mtime |
Integer |
文件更新时间 |
|
update_time |
Integer |
更新时间，毫秒 |
|
agent_id |
String |
Agent ID |
请求示例
查询前10条已隔离的文件列表
GET https://{endpoint}/v5/{project_id}/event/isolated-file?limit=10&offset=0&enterprise_project_id=xxx响应示例
状态码：200
请求已成功
{
"total_num" : 1409,
"data_list" : [ {
"host_id" : "b44***1be-4c28-4bf3-8070-fde5****6689",
"host_name" : "h00657476-linux-不要动不要删",
"private_ip" : "192.168.0.93",
"public_ip" : "100.93.10.247",
"asset_value" : "common",
"os_type" : "Linux",
"file_hash" : "32d62a995215243********a611134e9891b1264e222e55d78",
"file_path" : "/root/***e_Samples/****-CVE/39d46a0*****20c915db30d",
"isolation_status" : "isolated",
"file_attr" : "33261",
"update_time" : 1737512051632,
"agent_version" : "3.2.15.10",
"isolate_source" : "event",
"event_name" : "未分类恶意软件",
"agent_event_info" : {
"severity" : "High",
"recommendation" : "对于恶意程序告警事件，给您提出如下建议：\r\n1、收到告警，请您先判断相关文件/进程是否是业务正常文件/进程，如果确认为业务正常进程，请选择相应告警事件，点击“处理”，选择\"忽略\"或“加入告警白名单”；\r\n2、收到告警，请您先判断相关文件/进程是否是业务正常文件/进程，如果确认为恶意文件/程序，请选择相应告警事件，点击“处理”，选择\"隔离查杀\"或手动进行病毒清理；\r\n3、如果恶意程序导致了您的数据丢失，且您开通了CBR服务，可以尝试从CBR服务备份中恢复数据；\r\n4、为了防止再次被入侵，您可以通过HSS服务风险预防-漏洞管理中修复漏洞；",
"description" : "恶意程序告警是指计算机安全软件或系统检测到您的计算机或网络中存在恶意软件威胁时发出的警告。恶意软件是指“malicious software”（恶意软件）的简写形式，是一种计算机程序，它能够以多种途径感染合法用户的计算机并对其造成损害。恶意程序告警旨在提醒用户采取措施防范恶意软件威胁，保护计算机和网络安全。",
"event_id" : "ac04***86-d7a9-11ef-9fd1-fa1****8dea",
"event_class_id" : "av_1001",
"event_type" : 1001,
"event_name" : "未分类恶意软件",
"host_name" : "h00657476-linux-不要动不要删",
"host_id" : "b44d***be-4c28-4bf3-8070-fde59***c6689",
"attack_phase" : "installation",
"attack_tag" : "abnormal_behavior",
"occur_time" : 1737430920000,
"recent_time" : 1737465583543,
"handle_time" : 1737512072882,
"handle_status" : "handled",
"handle_method" : "isolate_and_kill",
"handler" : "scc_hss_g00840938_01",
"memo" : "本次处理了2个告警，作为记录便于查看。",
"resource_info" : {
"project_id" : "84b5266c14ae489fa6549827f032dc62",
"enterprise_project_id" : "0",
"region_name" : "cn-north-7",
"host_name" : "h00657476-linux-不要动不要删",
"host_ip" : "192.168.0.***",
"public_ip" : "1**.93.10.***",
"host_id" : "b4***1be-4c28-4bf3-8070-fde***6689",
"asset_value" : "common",
"cloud_id" : "",
"vm_name" : "h00657476-linux-不要动不要删",
"vm_uuid" : "b4***1be-4c28-4bf3-8070-fde5***6689",
"os_type" : "Linux",
"os_name" : "HCE OS",
"os_version" : "2.0",
"agent_version" : "3.2.15.10"
},
"malware_info" : {
"malware_family" : "Generic",
"severity" : 0
},
"att_ck" : "影响破坏",
"confidence" : 90,
"file_info_list" : [ {
"file_path" : "/root/******les/*****-CVE/39d46a0cd603*****db30d",
"file_hash" : "32d62a995215243f******34e9891b1264e222e55d78"
} ],
"event_abstract" : "主机 h00657476-linux-不要动不要删 在 2025-01-21 11:42:00 存在可疑恶意软件，置信度值： 中 ， 访问文件目录为 /root/Malware_Samples/Common-CVE/39d46a0cd60393e5571b720c915db30d 。",
"event_count" : 4
}
} ]
}SDK代码示例
SDK代码示例如下。
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 |
package com.huaweicloud.sdk.test;
import com.huaweicloud.sdk.core.auth.ICredential;
import com.huaweicloud.sdk.core.auth.BasicCredentials;
import com.huaweicloud.sdk.core.exception.ConnectionException;
import com.huaweicloud.sdk.core.exception.RequestTimeoutException;
import com.huaweicloud.sdk.core.exception.ServiceResponseException;
import com.huaweicloud.sdk.hss.v5.region.HssRegion;
import com.huaweicloud.sdk.hss.v5.*;
import com.huaweicloud.sdk.hss.v5.model.*;
public class ListIsolatedFileSolution {
public static void main(String[] args) {
// The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
// In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
String ak = System.getenv("CLOUD_SDK_AK");
String sk = System.getenv("CLOUD_SDK_SK");
String projectId = "{project_id}";
ICredential auth = new BasicCredentials()
.withProjectId(projectId)
.withAk(ak)
.withSk(sk);
HssClient client = HssClient.newBuilder()
.withCredential(auth)
.withRegion(HssRegion.valueOf("<YOUR REGION>"))
.build();
ListIsolatedFileRequest request = new ListIsolatedFileRequest();
try {
ListIsolatedFileResponse response = client.listIsolatedFile(request);
System.out.println(response.toString());
} catch (ConnectionException e) {
e.printStackTrace();
} catch (RequestTimeoutException e) {
e.printStackTrace();
} catch (ServiceResponseException e) {
e.printStackTrace();
System.out.println(e.getHttpStatusCode());
System.out.println(e.getRequestId());
System.out.println(e.getErrorCode());
System.out.println(e.getErrorMsg());
}
}
}
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 |
# coding: utf-8
import os
from huaweicloudsdkcore.auth.credentials import BasicCredentials
from huaweicloudsdkhss.v5.region.hss_region import HssRegion
from huaweicloudsdkcore.exceptions import exceptions
from huaweicloudsdkhss.v5 import *
if __name__ == "__main__":
# The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
# In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
ak = os.environ["CLOUD_SDK_AK"]
sk = os.environ["CLOUD_SDK_SK"]
projectId = "{project_id}"
credentials = BasicCredentials(ak, sk, projectId)
client = HssClient.new_builder() \
.with_credentials(credentials) \
.with_region(HssRegion.value_of("<YOUR REGION>")) \
.build()
try:
request = ListIsolatedFileRequest()
response = client.list_isolated_file(request)
print(response)
except exceptions.ClientRequestException as e:
print(e.status_code)
print(e.request_id)
print(e.error_code)
print(e.error_msg)
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 |
package main
import (
"fmt"
"github.com/huaweicloud/huaweicloud-sdk-go-v3/core/auth/basic"
hss "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/hss/v5"
"github.com/huaweicloud/huaweicloud-sdk-go-v3/services/hss/v5/model"
region "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/hss/v5/region"
)
func main() {
// The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
// In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
ak := os.Getenv("CLOUD_SDK_AK")
sk := os.Getenv("CLOUD_SDK_SK")
projectId := "{project_id}"
auth := basic.NewCredentialsBuilder().
WithAk(ak).
WithSk(sk).
WithProjectId(projectId).
Build()
client := hss.NewHssClient(
hss.HssClientBuilder().
WithRegion(region.ValueOf("<YOUR REGION>")).
WithCredential(auth).
Build())
request := &model.ListIsolatedFileRequest{}
response, err := client.ListIsolatedFile(request)
if err == nil {
fmt.Printf("%+v\n", response)
} else {
fmt.Println(err)
}
}
|
更多编程语言的SDK代码示例，请参见API Explorer的代码示例页签，可生成自动对应的SDK代码示例。
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 |
package com.huaweicloud.sdk.test;
import com.huaweicloud.sdk.core.auth.ICredential;
import com.huaweicloud.sdk.core.auth.BasicCredentials;
import com.huaweicloud.sdk.core.exception.ConnectionException;
import com.huaweicloud.sdk.core.exception.RequestTimeoutException;
import com.huaweicloud.sdk.core.exception.ServiceResponseException;
import com.huaweicloud.sdk.hss.v5.region.HssRegion;
import com.huaweicloud.sdk.hss.v5.*;
import com.huaweicloud.sdk.hss.v5.model.*;
public class ListIsolatedFileSolution {
public static void main(String[] args) {
// The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
// In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
String ak = System.getenv("CLOUD_SDK_AK");
String sk = System.getenv("CLOUD_SDK_SK");
String projectId = "{project_id}";
ICredential auth = new BasicCredentials()
.withProjectId(projectId)
.withAk(ak)
.withSk(sk);
HssClient client = HssClient.newBuilder()
.withCredential(auth)
.withRegion(HssRegion.valueOf("<YOUR REGION>"))
.build();
ListIsolatedFileRequest request = new ListIsolatedFileRequest();
try {
ListIsolatedFileResponse response = client.listIsolatedFile(request);
System.out.println(response.toString());
} catch (ConnectionException e) {
e.printStackTrace();
} catch (RequestTimeoutException e) {
e.printStackTrace();
} catch (ServiceResponseException e) {
e.printStackTrace();
System.out.println(e.getHttpStatusCode());
System.out.println(e.getRequestId());
System.out.println(e.getErrorCode());
System.out.println(e.getErrorMsg());
}
}
}
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 |
# coding: utf-8
import os
from huaweicloudsdkcore.auth.credentials import BasicCredentials
from huaweicloudsdkhss.v5.region.hss_region import HssRegion
from huaweicloudsdkcore.exceptions import exceptions
from huaweicloudsdkhss.v5 import *
if __name__ == "__main__":
# The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
# In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
ak = os.environ["CLOUD_SDK_AK"]
sk = os.environ["CLOUD_SDK_SK"]
projectId = "{project_id}"
credentials = BasicCredentials(ak, sk, projectId)
client = HssClient.new_builder() \
.with_credentials(credentials) \
.with_region(HssRegion.value_of("<YOUR REGION>")) \
.build()
try:
request = ListIsolatedFileRequest()
response = client.list_isolated_file(request)
print(response)
except exceptions.ClientRequestException as e:
print(e.status_code)
print(e.request_id)
print(e.error_code)
print(e.error_msg)
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 |
package main
import (
"fmt"
"github.com/huaweicloud/huaweicloud-sdk-go-v3/core/auth/basic"
hss "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/hss/v5"
"github.com/huaweicloud/huaweicloud-sdk-go-v3/services/hss/v5/model"
region "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/hss/v5/region"
)
func main() {
// The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
// In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
ak := os.Getenv("CLOUD_SDK_AK")
sk := os.Getenv("CLOUD_SDK_SK")
projectId := "{project_id}"
auth := basic.NewCredentialsBuilder().
WithAk(ak).
WithSk(sk).
WithProjectId(projectId).
Build()
client := hss.NewHssClient(
hss.HssClientBuilder().
WithRegion(region.ValueOf("<YOUR REGION>")).
WithCredential(auth).
Build())
request := &model.ListIsolatedFileRequest{}
response, err := client.ListIsolatedFile(request)
if err == nil {
fmt.Printf("%+v\n", response)
} else {
fmt.Println(err)
}
}
|
更多编程语言的SDK代码示例，请参见API Explorer的代码示例页签，可生成自动对应的SDK代码示例。
状态码
|
状态码 |
描述 |
|---|---|
|
200 |
请求已成功 |
错误码
请参见错误码。
