Help Center/ Host Security Service/ API Reference/ API Description/ Intrusion Detection/ Querying the Alarm Whitelist
Updated on 2025-09-22 GMT+08:00
View PDF

Querying the Alarm Whitelist

Function

This API is used to query the alarm whitelist.

URI

GET /v5/{project_id}/event/white-list/alarm

Table 1 Path Parameters

Parameter

Mandatory

Type

Description

project_id

Yes

String

Project ID
Table 2 Query Parameters

Parameter

Mandatory

Type

Description

enterprise_project_id

No

String

Enterprise project ID. To query all enterprise projects, set this parameter to all_granted_eps.

hash

No

String

Hash value of the event whitelist description (SHA256 algorithm)

event_type

No

Integer

Event type. Its value can be:

  • 1001: malware

  • 1010 : Rootkit

  • 1011: ransomware

    • 1015 : Web shell

    • 1017: reverse shell

    • 2001: Common vulnerability exploit

    • 2047: redis vulnerability exploit

    • 2048: Hadoop vulnerability exploit

    • 2049: MySQL vulnerability exploit

    • 3002: file privilege escalation

    • 3003: process privilege escalation

    • 3004: critical file change

    • 3005: file/directory change

    • 3007: abnormal process behavior

    • 3015: high-risk command execution

    • 3018: abnormal shell

    • 3027: suspicious crontab task

    • 4002: brute-force attack

    • 4004: abnormal login

    • 4006: Invalid system account

offset

No

Integer

Offset, which specifies the start position of the record to be returned. The value must be a number no less than 0.

limit

No

Integer

Number of records displayed on each page.

Request Parameters

Table 3 Request header parameters

Parameter

Mandatory

Type

Description

X-Auth-Token

Yes

String

IAM token.

It can be obtained by calling the IAM API used to obtain an IAM token. The value of X-Subject-Token in the response header is a token.

region

Yes

String

Region ID

Response Parameters

Status code: 200

Table 4 Response body parameters

Parameter

Type

Description

total_num

Integer

Total number

event_type_list

Array of integers

Types of events that can be filtered

data_list

Array of AlarmWhiteListResponseInfo objects

Alarm whitelist details
Table 5 AlarmWhiteListResponseInfo

Parameter

Type

Description

enterprise_project_name

String

Enterprise project name

hash

String

Hash value of the event whitelist description (SHA256 algorithm)

description

String

Description

event_type

Integer

Intrusion type. Its value can be:

  • 1001: Malware

  • 1010: Rootkit

  • 1011: Ransomware

  • 1015: Web shell

  • 1017: Reverse shell

  • 2001: Common vulnerability exploit

  • 3002: File privilege escalation

  • 3003: Process privilege escalation

  • 3004: Important file change

  • 3005: File/Directory change

  • 3007: Abnormal process behavior

  • 3015: High-risk command execution

  • 3018: Abnormal shell

  • 3027: Suspicious crontab tasks

  • 4002: Brute-force attack

  • 4004: Abnormal login

  • 4006: Invalid system account

update_time

Long

Time when the event whitelist is updated, in milliseconds.

Example Requests

Query the first 10 alarm whitelists whose enterprise project is xxx.

GET https://{endpoint}/v5/{project_id}/event/white-list/alarm?limit=10&offset=0&enterprise_project_id=xxx

Example Responses

Status code: 200

Alarm whitelist

{
  "data_list" : [ {
    "enterprise_project_name" : "All projects",
    "event_type" : 1001,
    "hash" : "9ab079e5398cba3a368ccffbd478f54c5ec3edadf6284ec049a73c36419f1178",
    "description" : "/opt/cloud/3rdComponent/install/jre-8u201/bin/java",
    "update_time" : 1665715677307
  } ],
  "event_type_list" : [ 1001 ],
  "total_num" : 1
}

Status Codes

Status Code

Description

200

Alarm whitelist

Error Codes

See Error Codes.

Parent Topic: Intrusion Detection