创建安全态势感知配置
功能介绍
接口说明
应用服务器调用该接口创建安全态势感知配置。
限制
目前支持的安全配置项有:
配置名 | 默认告警级别 | 默认安全级别 | 设备维度 | 平台检测/设备上报 | 配置结构体 | 说明 |
---|---|---|---|---|---|---|
DEVICE_MEMORY_CHECK | CRITICAL | ADVANCE_SECURITY | 是 | 设备上报 | [{"key":"memory_threshold","value":80},{"key":"report_period","value":1}] | 设备内存泄漏检测,report_period:上报周期单位(小时) 取值范围[1, 24];memory_threshold内存检测阈值百分比,取值范围:[1, 100] |
DEVICE_PORT_CHECK | CRITICAL | ADVANCE_SECURITY | 是 | 设备上报 | [{"key":"safety_ports","value":[80,8080]},{"key":"report_period","value":1}] | 设备异常端口检测,report_period:上报周期单位(小时) 取值范围[1, 24];safety_ports:安全端口白名单,数组,取值范围:[1, 65535] |
DEVICE_CPU_USAGE_CHECK | CRITICAL | ADVANCE_SECURITY | 是 | 设备上报 | [{"key":"cpu_usage_threshold","value":80},{"key":"report_period","value":1}] | 设备CPU使用率检测,report_period:上报周期单位(小时) 取值范围[1, 24];cpu_usage_threshold:CPU检测阈值百分比,取值范围:[1, 100] |
DEVICE_DISK_SPACE_CHECK | CRITICAL | ADVANCE_SECURITY | 是 | 设备上报 | [{"key":"disk_space_threshold","value":80},{"key":"report_period","value":1}] | 设备磁盘使用率检测,report_period:上报周期单位(小时) 取值范围[1, 24];disk_space_threshold:磁盘检测阈值百分比,取值范围:[1, 100] |
DEVICE_BATTERY_PERCENTAGE_CHECK | CRITICAL | ADVANCE_SECURITY | 是 | 设备上报 | [{"key":"battery_percentage_threshold","value":20},{"key":"report_period","value":1}] | 设备电池电量检测,report_period:上报周期单位(小时) 取值范围[1, 24];battery_percentage_threshold:电池检测阈值百分比,取值范围:[1, 100] |
DEVICE_LOGIN_LOCAL_CHECK | MINOR | BASIC_SECURITY | 是 | 设备上报 | NA | 设备本地登录检测 |
DEVICE_MALICIOUS_IP_CHECK | MINOR | BASIC_SECURITY | 是 | 设备上报 | {"key":"safety_ips","value":["192.168.0.0/16"]} | 设备恶意ip检测 |
DEVICE_LOGIN_BRUTE_FORCE_CHECK | MINOR | BASIC_SECURITY | 是 | 设备上报 | NA | 设备暴力破解登录检测 |
DEVICE_FILE_TAMPER_CHECK | MINOR | BASIC_SECURITY | 是 | 设备上报 | NA | 设备本地文件篡改检测 |
INSECURE_TLS_PROTOCOL_CHECK | MAJOR | ULTIMATE_SECURITY | 是 | 平台检测 | NA | 设备使用不安全的TLS协议接入检测 |
INSECURE_CIPHER_SUITE_CHECK | MAJOR | ULTIMATE_SECURITY | 是 | 平台检测 | NA | 设备使用不安全TLS加密套件接入检测 |
CONNECT_MULTIPLE_TIMES_CHECK | CRITICAL | ULTIMATE_SECURITY | 是 | 平台检测 | NA | 设备单位时间内多次建链检测 |
SECRET_COMPLEXITY_CHECK | MAJOR | ULTIMATE_SECURITY | 是 | 平台检测 | NA | 设备弱密码检测 |
TLS_CONNECT_CHECK | MINOR | ULTIMATE_SECURITY | 是 | 平台检测 | NA | 设备是否使用TLS加密通讯协议检测 |
DEVICE_AUTH_FAIL_CHECK | CRITICAL | ULTIMATE_SECURITY | 是 | 平台检测 | NA | 设备鉴权失败检测 |
DEVICE_OFFLINE_CHECK | CRITICAL | ULTIMATE_SECURITY | 是 | 平台检测 | NA | 设备异常离线检测 |
调用方法
请参见如何调用API。
URI
POST /v5/iot/{project_id}/security-profiles
参数 |
是否必选 |
参数类型 |
描述 |
---|---|---|---|
project_id |
是 |
String |
参数说明:项目ID。获取方法请参见 获取项目ID 。 |
请求参数
参数 |
是否必选 |
参数类型 |
描述 |
---|---|---|---|
Instance-Id |
否 |
String |
参数说明:实例ID。物理多租下各实例的唯一标识,一般华为云租户无需携带该参数,仅在物理多租场景下从管理面访问API时需要携带该参数。您可以在IoTDA管理控制台界面,选择左侧导航栏“总览”页签查看当前实例的ID。 |
参数 |
是否必选 |
参数类型 |
描述 |
---|---|---|---|
security_type |
是 |
String |
安全态势感知配置类型 |
alarm_level |
否 |
String |
参数解释:安全态势感知告警级别。 约束限制:无。 取值范围:
默认取值:不涉及 |
security_level |
否 |
String |
参数解释:安全态势感知项所属安全风险级别。 约束限制:无。 取值范围:
默认取值:不涉及 |
enable |
否 |
Boolean |
安全态势感知项是否开启 |
profile |
否 |
Array of SecurityProfile objects |
安全态势感知项配置结构体,用于设备侧检测项下发给设备 |
profile_targets |
否 |
SecurityTarget object |
安全态势感知配置绑定对象结构体 |
响应参数
状态码:201
参数 |
参数类型 |
描述 |
---|---|---|
profile_id |
String |
安全态势感知配置id |
security_type |
String |
安全态势感知配置类型 |
alarm_level |
String |
参数解释:安全态势感知告警级别。 约束限制:无。 取值范围:
默认取值:不涉及 |
security_level |
String |
参数解释:安全态势感知项所属安全风险级别。 约束限制:无。 取值范围:
默认取值:不涉及 |
enable |
Boolean |
安全态势感知项是否开启 |
profile |
Array of SecurityProfile objects |
安全态势感知项配置结构体,用于设备侧检测项下发给设备 |
profile_targets |
SecurityTarget object |
安全态势感知配置绑定对象结构体 |
请求示例
POST https://{endpoint}/v5/iot/{project_id}/security-profiles { "security_type" : "DEVICE_MEMORY_CHECK", "alarm_level" : "CRITICAL", "security_level" : "BASIC_SECURITY", "enable" : true, "profile" : [ { "key" : "memory_threshold", "value" : 80 } ], "profile_targets" : { "target_type" : "PRODUCT", "target_ids" : [ "1d7616926636486cb05120018018cafc:67443bd4ad7db3647deb4f7a" ] } }
响应示例
状态码:201
Create
{ "profile_id" : "04ed32dc1b0025b52fe3c01a27c2babc", "security_type" : "DEVICE_MEMORY_CHECK", "alarm_level" : "CRITICAL", "security_level" : "BASIC_SECURITY", "enable" : true, "profile" : [ { "key" : "memory_threshold", "value" : 80 } ], "profile_targets" : { "target_type" : "PRODUCT", "target_ids" : [ "1d7616926636486cb05120018018cafc:67443bd4ad7db3647deb4f7a" ] } }
SDK代码示例
SDK代码示例如下。
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 |
package com.huaweicloud.sdk.test; import com.huaweicloud.sdk.core.auth.ICredential; import com.huaweicloud.sdk.core.auth.AbstractCredentials; import com.huaweicloud.sdk.core.auth.BasicCredentials; import com.huaweicloud.sdk.core.exception.ConnectionException; import com.huaweicloud.sdk.core.exception.RequestTimeoutException; import com.huaweicloud.sdk.core.exception.ServiceResponseException; import com.huaweicloud.sdk.core.region.Region; import com.huaweicloud.sdk.iotda.v5.*; import com.huaweicloud.sdk.iotda.v5.model.*; import java.util.List; import java.util.ArrayList; public class CreateSecurityProfileSolution { public static void main(String[] args) { // The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security. // In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment String ak = System.getenv("CLOUD_SDK_AK"); String sk = System.getenv("CLOUD_SDK_SK"); // ENDPOINT:请在控制台的"总览"界面的"平台接入地址"中查看“应用侧”的https接入地址。 String iotdaEndpoint = "<YOUR ENDPOINT>"; String projectId = "{project_id}"; ICredential auth = new BasicCredentials() .withProjectId(projectId) // 标准版/企业版需要使用衍生算法,基础版请删除配置"withDerivedPredicate"; .withDerivedPredicate(AbstractCredentials.DEFAULT_DERIVED_PREDICATE) // Used in derivative ak/sk authentication scenarios .withAk(ak) .withSk(sk); IoTDAClient client = IoTDAClient.newBuilder() .withCredential(auth) // 标准版/企业版:需自行创建Region对象,基础版:请使用IoTDARegion的region对象,如"withRegion(IoTDARegion.CN_NORTH_4)" .withRegion(new Region("cn-north-4", iotdaEndpoint)) .build(); CreateSecurityProfileRequest request = new CreateSecurityProfileRequest(); AddSecurityProfileDTO body = new AddSecurityProfileDTO(); List<String> listProfileTargetsTargetIds = new ArrayList<>(); listProfileTargetsTargetIds.add("1d7616926636486cb05120018018cafc:67443bd4ad7db3647deb4f7a"); SecurityTarget profileTargetsbody = new SecurityTarget(); profileTargetsbody.withTargetType("PRODUCT") .withTargetIds(listProfileTargetsTargetIds); List<SecurityProfile> listbodyProfile = new ArrayList<>(); listbodyProfile.add( new SecurityProfile() .withKey("memory_threshold") .withValue("80") ); body.withProfileTargets(profileTargetsbody); body.withProfile(listbodyProfile); body.withEnable(true); body.withSecurityLevel("BASIC_SECURITY"); body.withAlarmLevel("CRITICAL"); body.withSecurityType("DEVICE_MEMORY_CHECK"); request.withBody(body); try { CreateSecurityProfileResponse response = client.createSecurityProfile(request); System.out.println(response.toString()); } catch (ConnectionException e) { e.printStackTrace(); } catch (RequestTimeoutException e) { e.printStackTrace(); } catch (ServiceResponseException e) { e.printStackTrace(); System.out.println(e.getHttpStatusCode()); System.out.println(e.getRequestId()); System.out.println(e.getErrorCode()); System.out.println(e.getErrorMsg()); } } } |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 |
# coding: utf-8 import os from huaweicloudsdkcore.auth.credentials import BasicCredentials from huaweicloudsdkcore.auth.credentials import DerivedCredentials from huaweicloudsdkcore.region.region import Region as coreRegion from huaweicloudsdkcore.exceptions import exceptions from huaweicloudsdkiotda.v5 import * if __name__ == "__main__": # The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security. # In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment ak = os.environ["CLOUD_SDK_AK"] sk = os.environ["CLOUD_SDK_SK"] # ENDPOINT:请在控制台的"总览"界面的"平台接入地址"中查看“应用侧”的https接入地址,下面创建Client时需要使用自行创建的Region对象,基础版:请选择IoTDAClient中的Region对象 如: IoTDAClient.new_builder().with_region(IoTDARegion.CN_NORTH_4) endpoint = "<YOUR ENDPOINT>"; projectId = "{project_id}" credentials = BasicCredentials(ak, sk, projectId).with_derived_predicate(DerivedCredentials.get_default_derived_predicate()) client = IoTDAClient.new_builder() \ .with_credentials(credentials) \ .with_region(coreRegion(id="cn-north-4", endpoint=endpoint)) \ .build() try: request = CreateSecurityProfileRequest() listTargetIdsProfileTargets = [ "1d7616926636486cb05120018018cafc:67443bd4ad7db3647deb4f7a" ] profileTargetsbody = SecurityTarget( target_type="PRODUCT", target_ids=listTargetIdsProfileTargets ) listProfilebody = [ SecurityProfile( key="memory_threshold", value="80" ) ] request.body = AddSecurityProfileDTO( profile_targets=profileTargetsbody, profile=listProfilebody, enable=True, security_level="BASIC_SECURITY", alarm_level="CRITICAL", security_type="DEVICE_MEMORY_CHECK" ) response = client.create_security_profile(request) print(response) except exceptions.ClientRequestException as e: print(e.status_code) print(e.request_id) print(e.error_code) print(e.error_msg) |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 |
package main import ( "fmt" "github.com/huaweicloud/huaweicloud-sdk-go-v3/core/auth/basic" iotda "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/iotda/v5" "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/iotda/v5/model" region "github.com/huaweicloud/huaweicloud-sdk-go-v3/core/region" core_auth "github.com/huaweicloud/huaweicloud-sdk-go-v3/core/auth" ) func main() { // The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security. // In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment ak := os.Getenv("CLOUD_SDK_AK") sk := os.Getenv("CLOUD_SDK_SK") // endpoint:请在控制台的"总览"界面的"平台接入地址"中查看"应用侧"的https接入地址 endpoint := "<YOUR ENDPOINT>" projectId := "{project_id}" auth := basic.NewCredentialsBuilder(). WithAk(ak). WithSk(sk). WithProjectId(projectId). // 企业版/标准版需要使用衍生算法,基础版请删除该配置"WithDerivedPredicate" WithDerivedPredicate(core_auth.GetDefaultDerivedPredicate()). // Used in derivative ak/sk authentication scenarios Build() client := iotda.NewIoTDAClient( iotda.IoTDAClientBuilder(). // 标准版/企业版需要自行创建region,基础版使用IoTDARegion中的region对象 WithRegion(region.NewRegion("cn-north-4", endpoint)). WithCredential(auth). Build()) request := &model.CreateSecurityProfileRequest{} var listTargetIdsProfileTargets = []string{ "1d7616926636486cb05120018018cafc:67443bd4ad7db3647deb4f7a", } targetTypeProfileTargets:= "PRODUCT" profileTargetsbody := &model.SecurityTarget{ TargetType: &targetTypeProfileTargets, TargetIds: &listTargetIdsProfileTargets, } keyProfile:= "memory_threshold" valueProfile:= "80" var valueProfileInterface interface{} = valueProfile var listProfilebody = []model.SecurityProfile{ { Key: &keyProfile, Value: &valueProfileInterface, }, } enableAddSecurityProfileDto:= true securityLevelAddSecurityProfileDto:= "BASIC_SECURITY" alarmLevelAddSecurityProfileDto:= "CRITICAL" request.Body = &model.AddSecurityProfileDto{ ProfileTargets: profileTargetsbody, Profile: &listProfilebody, Enable: &enableAddSecurityProfileDto, SecurityLevel: &securityLevelAddSecurityProfileDto, AlarmLevel: &alarmLevelAddSecurityProfileDto, SecurityType: "DEVICE_MEMORY_CHECK", } response, err := client.CreateSecurityProfile(request) if err == nil { fmt.Printf("%+v\n", response) } else { fmt.Println(err) } } |
更多编程语言的SDK代码示例,请参见API Explorer的代码示例页签,可生成自动对应的SDK代码示例。
状态码
状态码 |
描述 |
---|---|
201 |
Create |
400 |
Bad Request |
403 |
Forbidden |
错误码
请参见错误码。