Obtaining Details of an Incident

project_id

Yes

String

Project ID.

workspace_id

Yes

String

Workspace ID

incident_id

Yes

String

Incident ID.

X-Auth-Token

Yes

String

User token.

It can be obtained by calling the IAM API used to obtain a user token. The value of X-Subject-Token in the response header is a token.

content-type

Yes

String

Content type.

code

String

Error code

message

String

Error Message

data

IncidentDetail object

Incident Detail

create_time

String

Recording time. The format is ISO 8601- YYYY-MM-DDTHH:mm:ss.ms+Timezone. Time zone where the incident occurred. If this parameter cannot be parsed, the default time zone GMT+8 is used.

data_object

Incident object

Incident entity information.

dataclass_ref

dataclass_ref object

Data class object.

format_version

Integer

Format version.

id

String

Unique identifier of an incident. The value is in UUID format and can contain a maximum of 36 characters.

project_id

String

ID of the current project.

update_time

String

Update time. The format is ISO 8601 -- YYYY-MM-DDTHH:mm:ss.ms+Timezone. Time zone where the alert occurred. If this parameter cannot be parsed, the default time zone GMT+8 is used.

version

Integer

Version.

workspace_id

String

ID of the current workspace.

version

String

Version of the data source of an incident. The version must be one officially released by the Cloud SSA service.

id

String

Unique identifier of an incident. The value is in UUID format and can contain a maximum of 36 characters.

domain_id

String

ID of the account (domain_id) to whom the data is delivered and hosted.

region_id

String

ID of the region where the account to whom the data is delivered and hosted belongs to.

workspace_id

String

ID of the current workspace.

labels

String

Tag (display only)

environment

environment object

Coordinates of the environment where the incident was generated.

data_source

data_source object

Source the data is first reported.

first_observed_time

String

First discovery time. The format is ISO 8601- YYYY-MM-DDTHH:mm:ss.ms+Time zone. Time zone where the incident occurred. If this parameter cannot be parsed, the default time zone GMT+8 is used.

last_observed_time

String

First discovery time. The format is ISO 8601- YYYY-MM-DDTHH:mm:ss.ms+Time zone. Time zone where the incident occurred. If this parameter cannot be parsed, the default time zone GMT+8 is used.

create_time

String

Recording time. The format is ISO 8601- YYYY-MM-DDTHH:mm:ss.ms+Timezone. Time zone where the incident occurred. If this parameter cannot be parsed, the default time zone GMT+8 is used.

arrive_time

String

Data receiving time. The format is ISO 8601- YYYY-MM-DDTHH:mm:ss.ms+Time zone. Time zone where the incident occurred. If this parameter cannot be parsed, the default time zone GMT+8 is used.

title

String

Incident title.

description

String

Event Description

source_url

String

Incident URL, which points to the page of the current incident description in the data source product.

count

Integer

Incident occurrences

confidence

Integer

Incident confidence. Confidence is used to illustrate the accuracy of an identified behavior or incident.

Value range -- 0-100. 0 indicates that the confidence is 0%, and 100 indicates that the confidence is 100%.

severity

String

Severity level. Value range: Tips | Low | Medium | High | Fatal

Description:

• 0: TIPS: No threats are found.

• 1: LOW: No actions are required for the threat.

• 2: MEDIUM: The threat needs to be handled but is not urgent.

• 3: HIGH: The threat must be handled preferentially.

• 4: FATAL: The threat must be handled immediately to prevent further damage.

criticality

Integer

Criticality, which specifies the importance level of the resources involved in an incident.

Value range -- 0 to 100. The value 0 indicates that the resource is not critical, and 100 indicates that the resource is critical.

incident_type

incident_type object

Incident categories. For details, see the Alert Incident Type Definition.

network_list

Array of network_list objects

Network Information

resource_list

Array of resource_list objects

Affected resources.

remediation

remediation object

Remedy measure.

verification_state

String

Verification status, which identifies the accuracy of an incident. The options are as follows:

– Unknown

– True_Positive

– False_Positive

Enter Unknown by default.

handle_status

String

Incident handling status. The options are as follows:

• Open: enabled.

• Block: blocked.

• Closed: closed.

  The default value is Open.

sla

Integer

Risk close time -- Set the acceptable risk duration. Unit -- Hour

update_time

String

Update time. The format is ISO 8601 -- YYYY-MM-DDTHH:mm:ss.ms+Timezone. Time zone where the alert occurred. If this parameter cannot be parsed, the default time zone GMT+8 is used.

close_time

String

Closing time. The format is ISO 8601 -- YYYY-MM-DDTHH:mm:ss.ms+Timezone. Time zone where the incident occurred. If this parameter cannot be parsed, the default time zone GMT+8 is used.

ipdrr_phase

String

Period/Handling phase No.

Prepartion|Detection and Analysis|Containm,Eradication& Recovery|Post-Incident-Activity

simulation

String

Debugging field.

actor

String

Incident investigator.

owner

String

Owner and service owner.

creator

String

Creator

close_reason

String

Close reason.

• False detection.

• Resolved

• Repeated

• Other

close_comment

String

Whether to close comment.

malware

malware object

Malware

system_info

Object

System information.

process

Array of process objects

Process information.

user_info

Array of user_info objects

User Details

file_info

Array of file_info objects

Document Information

system_alert_table

Object

Layout fields in the incident list.

vendor_type

String

Environment provider.

domain_id

String

Tenant ID.

region_id

String

Region ID. global is returned for global services.

cross_workspace_id

String

ID of the source workspace for the data delivery. If the source workspace ID is null, then the destination workspace account ID is used.

project_id

String

Project ID. The default value is null for global services.

source_type

Integer

Data source type. The options are as follows-- 1- cloud product 2- Third-party product 3- Tenant product

domain_id

String

Account ID to which the data source product belongs.

project_id

String

ID of the project to which the data source product belongs.

region_id

String

Region where the data source is located, for example, cn-north1. For details about the value range, see Regions and Endpoints.

company_name

String

Name of the company to which a data source belongs.

product_name

String

Name of the data source.

product_feature

String

Name of the feature of the product that detects the incident.

product_module

String

Threat detection module list.

category

String

Type

incident_type

String

Incident type.

direction

String

Direction. The value can be IN or OUT.

protocol

String

Protocol, including Layer 7 and Layer 4 protocols.

For details, see IANA registered name.

https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml.

src_ip

String

Source IP address

src_port

Integer

Source port. The value ranges from 0 to 65535.

src_domain

String

Source domain name.

src_geo

src_geo object

Geographical location of the source IP address.

dest_ip

String

Destination IP address

dest_port

String

Destination port. The value ranges from 0 to 65535.

dest_domain

String

Destination domain name

dest_geo

dest_geo object

Geographical location of the destination IP address.

latitude

Number

Latitude

longitude

Number

Longitude

city_code

String

City code. For example, Beijing or Shanghai.

country_code

String

Country code. For details, see ISO 3166-1 alpha-2. For example, CN | US | DE | IT | SG.

latitude

Number

Latitude

longitude

Number

Longitude

city_code

String

City code. For example, Beijing or Shanghai.

country_code

String

Country code. For details, see ISO 3166-1 alpha-2. For example, CN | US | DE | IT | SG.

id

String

Cloud service resource ID.

name

String

Resource name.

type

String

Resource type. This parameter references the value of RMS type on Cloud.

provider

String

Cloud service name, which is the same as the provider field in the RMS service.

region_id

String

Region ID in Cloud, for example, cn-north-1.

domain_id

String

ID of the account to which the resource belongs, in UUID format.

project_id

String

ID of the account to which the resource belongs, in UUID format.

ep_id

String

Specifies the enterprise project ID.

ep_name

String

Enterprise Project Name

tags

String

Resource tag.

1. A maximum of 50 key/value pairs are supported.

2. Value: a maximum of 255 characters, including letters, digits, spaces, and +, -, =, ., _, :, /,@

recommendation

String

Recommended solution.

url

String

Link to the general fix information for the incident. The URL must be accessible from the public network with no credentials required.

malware_family

String

Malicious family.

malware_class

String

Malware category.

process_name

String

Process name.

process_path

String

Process execution file path.

process_pid

Integer

Process ID.

process_uid

Integer

Process user ID.

process_cmdline

String

Process command line.

process_parent_name

String

Parent process name.

process_parent_path

String

Parent process execution file path.

process_parent_pid

Integer

Parent process ID.

process_parent_uid

Integer

Parent process user ID.

process_parent_cmdline

String

Parent process command line.

process_child_name

String

Subprocess name.

process_child_path

String

Subprocess execution file path.

process_child_pid

Integer

Subprocess ID.

process_child_uid

Integer

Subprocess user ID.

process_child_cmdline

String

Subprocess command line

process_launche_time

String

Incident start time. The format is ISO 8601 -- YYYY-MM-DDTHH:mm:ss.ms+Time zone. Time zone where the incident occurred. If this parameter cannot be parsed, the default time zone GMT+8 is used.

process_terminate_time

String

Process end time. The format is ISO 8601 -- YYYY-MM-DDTHH:mm:ss.ms+Time zone. Time zone where the incident occurred. If this parameter cannot be parsed, the default time zone GMT+8 is used.

user_id

String

User UID

user_name

String

Username

file_path

String

File path/name.

file_content

String

File path/name.

file_new_path

String

New file path/name.

file_hash

String

File Hash

file_md5

String

File MD5

file_sha256

String

File SHA256

file_attr

String

File attribute.

id

String

Unique identifier of a data class. The value is in UUID format and can contain a maximum of 36 characters.

name

String

Data class name.

code

String

Error Code

message

String

Error Description

200

Response body for requests for obtaining incident details.

400

Response body for failed requests for obtaining incident details.