Help Center> Host Security Service (New)> API Reference> API Description> Baseline Management> Querying the Check Result of a Security Configuration Item
Updated on 2024-03-27 GMT+08:00

Querying the Check Result of a Security Configuration Item

Function

This API is used to query the check result of a specified security configuration item.

Calling Method

For details, see Calling APIs.

URI

GET /v5/{project_id}/baseline/risk-config/{check_name}/detail

Table 1 Path Parameters

Parameter

Mandatory

Type

Description

project_id

Yes

String

Project ID.

Minimum: 20

Maximum: 64

check_name

Yes

String

Baseline name, for example, SSH, CentOS 7, and Windows.

Minimum: 0

Maximum: 256

Table 2 Query Parameters

Parameter

Mandatory

Type

Description

enterprise_project_id

No

String

Enterprise project ID. To query all enterprise projects, set this parameter to all_granted_eps.

Minimum: 0

Maximum: 64

standard

Yes

String

Standard type. Its value can be:

  • cn_standard: DJCP MLPS compliance standard

  • hw_standard: Cloud security practice standard

Minimum: 0

Maximum: 32

host_id

No

String

Server ID. If this parameter is not specified, all the servers of the user are queried.

Minimum: 0

Maximum: 64

limit

No

Integer

Number of records on each page.

Minimum: 0

Maximum: 200

Default: 10

offset

No

Integer

Offset, which specifies the start position of the record to be returned. The value must be a number no less than 0.

Minimum: 0

Maximum: 2000000

Default: 0

Request Parameters

Table 3 Request header parameters

Parameter

Mandatory

Type

Description

X-Auth-Token

Yes

String

User token. It can be obtained by calling the IAM API used to obtain a user token. The value of X-Subject-Token in the response header is a token.

Minimum: 32

Maximum: 2097152

Response Parameters

Status code: 200

Table 4 Response body parameters

Parameter

Type

Description

severity

String

Risk level. Its value can be:

  • Low

  • Medium

  • High

Minimum: 0

Maximum: 65534

check_type

String

Configuration check (baseline) type, for example, SSH, CentOS 7, Windows Server 2019 R2, Windows Server 2016 R2 and MySQL5-Windows.

Minimum: 0

Maximum: 256

check_type_desc

String

Description of the baseline type, including the standards for the check items and the issues that can be audited.

Minimum: 0

Maximum: 65534

check_rule_num

Integer

Indicates the total number of check items of the current configuration check (baseline) type. For example, if the standard type of the SSH baseline is hw_standard, server security provides 17 check items, but only five check items of the SSH baseline are detected on all servers. Therefore, the value of check_rule_num is 5. All check items are checked on a server. The value of check_rule_num is 17.

Minimum: 0

Maximum: 2147483647

failed_rule_num

Integer

Number of failed check items. If a server fails to pass a check item in check_rule_num, the item is counted in failed_rule_num.

Minimum: 0

Maximum: 2147483647

passed_rule_num

Integer

Number of passed check items. If a server passes a check item in check_rule_num, the check item is counted in passed_rule_num.

Minimum: 0

Maximum: 2147483647

ignored_rule_num

Integer

Number of ignored check items. If a server ignores a check item in check_rule_num, the check item is counted in ignored_rule_num.

Minimum: 0

Maximum: 2147483647

host_num

Long

The number of servers on which the current baseline detection is performed.

Minimum: 0

Maximum: 2147483647

Example Requests

This API is used to query the configuration check list whose baseline name is SSH, check standard is cloud security practice standard, and enterprise project ID is xxx.

GET https://{endpoint}/v5/{project_id}/baseline/risk-config/SSH/detail?standard=hw_standard&enterprise_project_id=xxx

Example Responses

Status code: 200

Security configuration item check result

{
  "check_rule_num" : 17,
  "check_type_desc" : "This policy checks the basic security configuration items of the SSH service to improve the security of the SSH service.",
  "failed_rule_num" : 15,
  "host_num" : 2,
  "ignored_rule_num" : 1,
  "passed_rule_num" : 14,
  "severity" : "Medium"
}

SDK Sample Code

The SDK sample code is as follows.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
package com.huaweicloud.sdk.test;

import com.huaweicloud.sdk.core.auth.ICredential;
import com.huaweicloud.sdk.core.auth.BasicCredentials;
import com.huaweicloud.sdk.core.exception.ConnectionException;
import com.huaweicloud.sdk.core.exception.RequestTimeoutException;
import com.huaweicloud.sdk.core.exception.ServiceResponseException;
import com.huaweicloud.sdk.hss.v5.region.HssRegion;
import com.huaweicloud.sdk.hss.v5.*;
import com.huaweicloud.sdk.hss.v5.model.*;


public class ShowRiskConfigDetailSolution {

    public static void main(String[] args) {
        // The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
        // In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
        String ak = System.getenv("CLOUD_SDK_AK");
        String sk = System.getenv("CLOUD_SDK_SK");

        ICredential auth = new BasicCredentials()
                .withAk(ak)
                .withSk(sk);

        HssClient client = HssClient.newBuilder()
                .withCredential(auth)
                .withRegion(HssRegion.valueOf("<YOUR REGION>"))
                .build();
        ShowRiskConfigDetailRequest request = new ShowRiskConfigDetailRequest();
        request.withEnterpriseProjectId("<enterprise_project_id>");
        request.withStandard("<standard>");
        request.withHostId("<host_id>");
        request.withLimit(<limit>);
        request.withOffset(<offset>);
        try {
            ShowRiskConfigDetailResponse response = client.showRiskConfigDetail(request);
            System.out.println(response.toString());
        } catch (ConnectionException e) {
            e.printStackTrace();
        } catch (RequestTimeoutException e) {
            e.printStackTrace();
        } catch (ServiceResponseException e) {
            e.printStackTrace();
            System.out.println(e.getHttpStatusCode());
            System.out.println(e.getRequestId());
            System.out.println(e.getErrorCode());
            System.out.println(e.getErrorMsg());
        }
    }
}
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
# coding: utf-8

from huaweicloudsdkcore.auth.credentials import BasicCredentials
from huaweicloudsdkhss.v5.region.hss_region import HssRegion
from huaweicloudsdkcore.exceptions import exceptions
from huaweicloudsdkhss.v5 import *

if __name__ == "__main__":
    # The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
    # In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
    ak = __import__('os').getenv("CLOUD_SDK_AK")
    sk = __import__('os').getenv("CLOUD_SDK_SK")

    credentials = BasicCredentials(ak, sk) \

    client = HssClient.new_builder() \
        .with_credentials(credentials) \
        .with_region(HssRegion.value_of("<YOUR REGION>")) \
        .build()

    try:
        request = ShowRiskConfigDetailRequest()
        request.enterprise_project_id = "<enterprise_project_id>"
        request.standard = "<standard>"
        request.host_id = "<host_id>"
        request.limit = <limit>
        request.offset = <offset>
        response = client.show_risk_config_detail(request)
        print(response)
    except exceptions.ClientRequestException as e:
        print(e.status_code)
        print(e.request_id)
        print(e.error_code)
        print(e.error_msg)
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
package main

import (
	"fmt"
	"github.com/huaweicloud/huaweicloud-sdk-go-v3/core/auth/basic"
    hss "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/hss/v5"
	"github.com/huaweicloud/huaweicloud-sdk-go-v3/services/hss/v5/model"
    region "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/hss/v5/region"
)

func main() {
    // The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
    // In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
    ak := os.Getenv("CLOUD_SDK_AK")
    sk := os.Getenv("CLOUD_SDK_SK")

    auth := basic.NewCredentialsBuilder().
        WithAk(ak).
        WithSk(sk).
        Build()

    client := hss.NewHssClient(
        hss.HssClientBuilder().
            WithRegion(region.ValueOf("<YOUR REGION>")).
            WithCredential(auth).
            Build())

    request := &model.ShowRiskConfigDetailRequest{}
	enterpriseProjectIdRequest:= "<enterprise_project_id>"
	request.EnterpriseProjectId = &enterpriseProjectIdRequest
	request.Standard = "<standard>"
	hostIdRequest:= "<host_id>"
	request.HostId = &hostIdRequest
	limitRequest:= int32(<limit>)
	request.Limit = &limitRequest
	offsetRequest:= int32(<offset>)
	request.Offset = &offsetRequest
	response, err := client.ShowRiskConfigDetail(request)
	if err == nil {
        fmt.Printf("%+v\n", response)
    } else {
        fmt.Println(err)
    }
}

For SDK sample code of more programming languages, see the Sample Code tab in API Explorer. SDK sample code can be automatically generated.

Status Codes

Status Code

Description

200

Security configuration item check result

Error Codes

See Error Codes.