Querying the Statistics of ATT&CK Phases

Function

This API is used to query statistics of ATT&CK phases.

Calling Method

For details, see Calling APIs.

URI

GET /v5/{project_id}/event/att-ck

**Table 1** Path Parameters
Parameter	Mandatory	Type	Description
project_id	Yes	String	Definition Project ID, which is used to specify the project that an asset belongs to. After the project ID is configured, you can query assets in the project using the project ID. For details about how to obtain it, see Obtaining a Project ID. Constraints N/A Range Length: 1 to 256 characters Default Value N/A

**Table 2** Query Parameters
Parameter	Mandatory	Type	Description
enterprise_project_id	No	String	Definition Enterprise project ID, which is used to filter assets in different enterprise projects. For details, see Obtaining an Enterprise Project ID. To query assets in all enterprise projects, set this parameter to all_granted_eps. Constraints You need to set this parameter only after the enterprise project function is enabled. Range Length: 1 to 256 characters Default Value 0: default enterprise project.
last_days	No	Integer	Definition Number of days to be queried. This parameter is manually exclusive with begin_time and end_time. Constraints N/A Range Minimum value: 1; maximum value: 30 Default Value N/A
category	Yes	String	Definition Event type. Constraints N/A Range host: server security event container: container security event serverless: serverless security event Default Value N/A
host_name	No	String	Definition Server name. Constraints N/A Range Length: 1 to 256 characters Default Value N/A
host_id	No	String	Definition Server ID. Constraints N/A Range Length: 1 to 256 characters Default Value N/A
private_ip	No	String	Definition Server private IP address. Constraints N/A Range Length: 1 to 256 characters Default Value N/A
public_ip	No	String	Definition Server EIP. Constraints N/A Range Length: 1 to 256 characters Default Value N/A
container_name	No	String	Definition Container instance name. Constraints N/A Range Length: 1 to 512 characters Default Value N/A
event_type	No	Integer	Definition Event type. Constraints N/A Range 1001: common malware 1002: virus 1003: worm 1004: Trojan 1005: Botnet 1006: backdoor 1010: Rootkit 1011: Ransomware 1012: hacker tool 1015: Webshell 1016: mining 1017: reverse shell 2001: common vulnerability exploit 2012: remote code execution 2047: Redis vulnerability exploit 2048: Hadoop vulnerability exploit 2049: MySQL vulnerability exploit 3002: file privilege escalation 3003: process privilege escalation 3004: critical file change 3005: file/directory change 3007: abnormal process behavior 3015: high-risk command execution 3018: abnormal shell 3026: crontab privilege escalation 3027: crontab suspicious task 3029: system protection disabled 3030: backup deletion 3031: abnormal registry operation 3036: container image blocking 4002: brute-force attack 4004: abnormal login 4006: invalid system account 4014: account added 4020: password theft 6002: port scan 6003: server scan 13001: Kubernetes event deletion 13002: abnormal pod behavior 13003: user information enumeration 13004: cluster role binding Default Value N/A
handle_status	No	String	Definition Handling status. Constraints N/A Range unhandled: unhandled handled: handled Default Value N/A
severity	No	String	Definition Risk level. Constraints N/A Range Security: security Low: low-risk Medium: medium-risk High: high-risk Critical: critical Default Value N/A
severity_list	No	Array of strings	Definition Risk level. Constraints N/A Range Security: security Low: low-risk Medium: medium-risk High: high-risk Critical: critical Default Value N/A
attack_tag	No	String	Definition Attack tag. Constraints N/A Range attack_success: The attack is successful. attack_attempt: attack attempt attack_blocked: The attack is blocked. abnormal_behavior: abnormal behavior collapsible_host: The server is compromised. system_vulnerability: system vulnerability Default Value N/A
asset_value	No	String	Definition Asset importance. Constraints N/A Range important: important asset common: common asset test: test asset Default Value N/A
tag_list	No	Array of strings	Event tag list, for example, ["hot event"].
event_name	No	String	Definition Alarm name Constraints N/A Range Length: 1 to 128 characters Default Value N/A

Request Parameters

**Table 3** Request header parameters
Parameter	Mandatory	Type	Description
X-Auth-Token	Yes	String	Definition User token, which contains user identity and permissions. The token can be used for identity authentication when an API is called. For details about how to obtain the token, see Obtaining a User Token. Constraints N/A Range Length: 1 to 32768 characters Default Value N/A
region	Yes	String	Definition Region ID, which is used to query assets in the required region. For details about how to obtain a region ID, see Obtaining a Region ID. Constraints N/A Range Length: 0 to 128 characters Default Value N/A

Response Parameters

Status code: 200

**Table 4** Response body parameters
Parameter	Type	Description
data_list	Array of EventAttCkDetailResponseInfo objects	Attack phase details

**Table 5** EventAttCkDetailResponseInfo
Parameter	Type	Description
att_ck	String	Definition Attack phase name. Chinese or English is returned based on the locale of the page. Range Length: 1 to 64 characters
num	Integer	Definition Quantity. Range Minimum value: 0; maximum value: 2147483647

Example Requests

None

Example Responses

Status code: 200

Request succeeded.

{
  "data_list" : [ {
    "att_ck" : "Privilege escalation",
    "num" : 10
  } ]
}

SDK Sample Code

The SDK sample code is as follows.

      
       
         
         
           package com.huaweicloud.sdk.test;

import com.huaweicloud.sdk.core.auth.ICredential;
import com.huaweicloud.sdk.core.auth.BasicCredentials;
import com.huaweicloud.sdk.core.exception.ConnectionException;
import com.huaweicloud.sdk.core.exception.RequestTimeoutException;
import com.huaweicloud.sdk.core.exception.ServiceResponseException;
import com.huaweicloud.sdk.hss.v5.region.HssRegion;
import com.huaweicloud.sdk.hss.v5.*;
import com.huaweicloud.sdk.hss.v5.model.*;


public class ListEventAttCkSolution {

    public static void main(String[] args) {
        // The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
        // In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
        String ak = System.getenv("CLOUD_SDK_AK");
        String sk = System.getenv("CLOUD_SDK_SK");
        String projectId = "{project_id}";

        ICredential auth = new BasicCredentials()
                .withProjectId(projectId)
                .withAk(ak)
                .withSk(sk);

        HssClient client = HssClient.newBuilder()
                .withCredential(auth)
                .withRegion(HssRegion.valueOf("<YOUR REGION>"))
                .build();
        ListEventAttCkRequest request = new ListEventAttCkRequest();
        try {
            ListEventAttCkResponse response = client.listEventAttCk(request);
            System.out.println(response.toString());
        } catch (ConnectionException e) {
            e.printStackTrace();
        } catch (RequestTimeoutException e) {
            e.printStackTrace();
        } catch (ServiceResponseException e) {
            e.printStackTrace();
            System.out.println(e.getHttpStatusCode());
            System.out.println(e.getRequestId());
            System.out.println(e.getErrorCode());
            System.out.println(e.getErrorMsg());
        }
    }
}

          

        

      
     

      
       
         
         
           # coding: utf-8

import os
from huaweicloudsdkcore.auth.credentials import BasicCredentials
from huaweicloudsdkhss.v5.region.hss_region import HssRegion
from huaweicloudsdkcore.exceptions import exceptions
from huaweicloudsdkhss.v5 import *

if __name__ == "__main__":
    # The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
    # In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
    ak = os.environ["CLOUD_SDK_AK"]
    sk = os.environ["CLOUD_SDK_SK"]
    projectId = "{project_id}"

    credentials = BasicCredentials(ak, sk, projectId)

    client = HssClient.new_builder() \
        .with_credentials(credentials) \
        .with_region(HssRegion.value_of("<YOUR REGION>")) \
        .build()

    try:
        request = ListEventAttCkRequest()
        response = client.list_event_att_ck(request)
        print(response)
    except exceptions.ClientRequestException as e:
        print(e.status_code)
        print(e.request_id)
        print(e.error_code)
        print(e.error_msg)

          

        

      
     

      
       
         
         
           package main

import (
	"fmt"
	"github.com/huaweicloud/huaweicloud-sdk-go-v3/core/auth/basic"
    hss "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/hss/v5"
	"github.com/huaweicloud/huaweicloud-sdk-go-v3/services/hss/v5/model"
    region "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/hss/v5/region"
)

func main() {
    // The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
    // In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
    ak := os.Getenv("CLOUD_SDK_AK")
    sk := os.Getenv("CLOUD_SDK_SK")
    projectId := "{project_id}"

    auth := basic.NewCredentialsBuilder().
        WithAk(ak).
        WithSk(sk).
        WithProjectId(projectId).
        Build()

    client := hss.NewHssClient(
        hss.HssClientBuilder().
            WithRegion(region.ValueOf("<YOUR REGION>")).
            WithCredential(auth).
            Build())

    request := &model.ListEventAttCkRequest{}
	response, err := client.ListEventAttCk(request)
	if err == nil {
        fmt.Printf("%+v\n", response)
    } else {
        fmt.Println(err)
    }
}

          

        

      
     