Configuring SMN Alarm Notification

Function

This API is used to query the event types supported by alarm notifications.

Calling Method

For details, see Calling APIs.

URI

GET /v1/{project_id}/waf/tag/threat/map

**Table 1** Path Parameters
Parameter	Mandatory	Type	Description
project_id	Yes	String	Definition Project ID. To obtain it, log in to the Huawei Cloud console, click the username, choose My Credentials, and find the project ID in the Projects list. Constraints N/A Range N/A Default Value ''

Request Parameters

**Table 2** Request header parameters
Parameter	Mandatory	Type	Description
X-Auth-Token	Yes	String	Definition User token. It can be obtained by calling the IAM API (value of X-Subject-Token in the response header). Constraints N/A Range N/A Default Value ''
Content-Type	Yes	String	Definition Content type. Constraints N/A Range N/A Default Value application/json;charset=utf8

Response Parameters

Status code: 200

**Table 3** Response body parameters
Parameter	Type	Description
threats	Array of strings	Definition Event types available in alarm notifications. Constraints N/A Range N/A Default Value N/A
locale	locale object	Definition Description of each event type in alarm notifications. Constraints N/A Range N/A Default Value N/A

**Table 4** locale
Parameter	Type	Description
cmdi	String	Definition Command injection attack, in which an attacker injects malicious commands to perform unauthorized operations. Constraints N/A Range N/A Default Value N/A
llm_prompt_injection	String	Definition LLM prompt injection attack, in which an attacker constructs special inputs to tamper with the prompts of an AI model. Constraints N/A Range N/A Default Value N/A
anticrawler	String	Definition Website anti-crawler policy, which is used to prevent automated programs from illegally obtaining website content. Constraints N/A Range N/A Default Value N/A
custom_custom	String	Definition Precise protection, which is a custom security protection policy based on specific rules. Constraints N/A Range N/A Default Value N/A
third_bot_river	String	Definition Third-party bot, which is an automated interaction program from a third-party service. Constraints N/A Range N/A Default Value N/A
robot	String	Definition Malicious crawler, which is an automated program used to illegally obtain data or launch attacks. Constraints N/A Range N/A Default Value N/A
custom_idc_ip	String	Definition IDC intelligence, which is threat intelligence based on data center IP addresses. Constraints N/A Range N/A Default Value N/A
antiscan_dir_traversal	String	Definition Directory traversal protection, which prevents attackers from accessing system files through directory traversal. Constraints N/A Range N/A Default Value N/A
advanced_bot	String	Definition Advanced bot, which is an automated program with complex behavior patterns. Constraints N/A Range N/A Default Value N/A
xss	String	Definition XSS attack, in which an attacker obtains user information by injecting malicious scripts. Constraints N/A Range N/A Default Value N/A
antiscan_high_freq_scan	String	Definition Scanning blocking, which identifies and blocks abnormal high-frequency requests. Constraints N/A Range N/A Default Value N/A
webshell	String	Definition Web shells, which are malicious programs uploaded by attackers to remotely control websites. Constraints N/A Range N/A Default Value N/A
cc	String	Definition CC attack, a challenge attack, exhausting server resources by sending a large number of requests Constraints N/A Range N/A Default Value N/A
botm	String	Definition BOT attacks: malicious attacks using automated programs Constraints N/A Range N/A Default Value N/A
illegal	String	Definition Invalid request, which violates security policies or service rules. Constraints N/A Range N/A Default Value N/A
llm_prompt_sensitive	String	Definition Large model prompt word compliance detection, identifying sensitive information in prompts Constraints N/A Range N/A Default Value N/A
sqli	String	Definition SQL injection: Attackers inject malicious SQL statements to obtain or tamper with data. Constraints N/A Range N/A Default Value N/A
lfi	String	Definition Local file inclusion: Attackers exploit this vulnerability to include local files to obtain information. Constraints N/A Range N/A Default Value N/A
antitamper	String	Definition Web Tamper Protection, Protecting Website Content from Unauthorized Modification Constraints N/A Range N/A Default Value N/A
custom_geoip	String	Definition geolocation access control: geographical location-based access control policy Constraints N/A Range N/A Default Value N/A
rfi	String	Definition Remote file inclusion: Attackers exploit this vulnerability to execute malicious code using remote files. Constraints N/A Range N/A Default Value N/A
vuln	String	Definition Other types of attacks, unclassified security vulnerabilities or attacks Constraints N/A Range N/A Default Value N/A
llm_response_sensitive	String	Definition The foundation model responds to compliance detection and identifies sensitive information in the AI model output. Constraints N/A Range N/A Default Value N/A
custom_whiteblackip	String	Definition IP address blacklist and whitelist, IP address-based access control policy Constraints N/A Range N/A Default Value N/A
leakage	String	Definition Website information leakage and accidental exposure of sensitive information Constraints N/A Range N/A Default Value N/A

Status code: 400

**Table 5** Response body parameters
Parameter	Type	Description
error_code	String	Error code.
error_msg	String	Error message.
encoded_authorization_message	String	You can call the decode-authorization-message interface of the STS service to decode the rejection reason. For details, see the STS5 joint commissioning and self-verification. This parameter is returned only when an IAM 5 authentication error occurs.
details	Array of IAM5ErrorDetails objects	The set of error messages reported when a downstream service is invoked. This parameter is returned only when an IAM 5 authentication error occurs.

**Table 6** IAM5ErrorDetails
Parameter	Type	Description
error_code	String	Error codes of the downstream service.
error_msg	String	Error messages of the downstream service.

Status code: 401

**Table 7** Response body parameters
Parameter	Type	Description
error_code	String	Error code.
error_msg	String	Error message.
encoded_authorization_message	String	You can call the decode-authorization-message interface of the STS service to decode the rejection reason. For details, see the STS5 joint commissioning and self-verification. This parameter is returned only when an IAM 5 authentication error occurs.
details	Array of IAM5ErrorDetails objects	The set of error messages reported when a downstream service is invoked. This parameter is returned only when an IAM 5 authentication error occurs.

**Table 8** IAM5ErrorDetails
Parameter	Type	Description
error_code	String	Error codes of the downstream service.
error_msg	String	Error messages of the downstream service.

Status code: 500

**Table 9** Response body parameters
Parameter	Type	Description
error_code	String	Error code.
error_msg	String	Error message.
encoded_authorization_message	String	You can call the decode-authorization-message interface of the STS service to decode the rejection reason. For details, see the STS5 joint commissioning and self-verification. This parameter is returned only when an IAM 5 authentication error occurs.
details	Array of IAM5ErrorDetails objects	The set of error messages reported when a downstream service is invoked. This parameter is returned only when an IAM 5 authentication error occurs.

**Table 10** IAM5ErrorDetails
Parameter	Type	Description
error_code	String	Error codes of the downstream service.
error_msg	String	Error messages of the downstream service.

Example Requests

GET https://{Endpoint}/v1/{project_id}/waf/instance?enterprise_project_id=0

Example Responses

Status code: 200

{
  "threats" : [ "xss", "sqli", "cmdi", "robot", "lfi", "rfi", "webshell", "cc", "custom_custom", "custom_whiteblackip", "custom_geoip", "custom_idc_ip", "antitamper", "anticrawler", "third_bot_river", "antiscan_high_freq_scan", "antiscan_dir_traversal", "leakage", "illegal", "vuln", "advanced_bot", "botm", "llm_prompt_injection", "llm_prompt_sensitive", "llm_response_sensitive" ],
  "locale" : {
    "cmdi" : "Command injection",
    "llm_prompt_injection" : "LLM prompt injection",
    "anticrawler" : "Anti-crawler protection",
    "custom_custom" : "Precise protection",
    "third_bot_river" : "Third-party bot",
    "robot" : "Malicious crawlers",
    "custom_idc_ip" : "IDC intelligence",
    "antiscan_dir_traversal" : "Directory traversal protection",
    "advanced_bot" : "Advanced bot",
    "xss" : "XSS attacks",
    "antiscan_high_freq_scan" : "Scanning blocking",
    "webshell" : "Website Trojans",
    "cc" : "CC attacks",
    "botm" : "Bot attacks",
    "illegal" : "Invalid request.",
    "llm_prompt_sensitive" : "LLM prompt compliance check",
    "sqli" : "SQL injection",
    "lfi" : "Local file inclusion",
    "antitamper" : "Web tamper protection",
    "custom_geoip" : "Geolocation access control",
    "rfi" : "Remote file inclusion",
    "vuln" : "Other types of attacks",
    "llm_response_sensitive" : "LLM response compliance check",
    "custom_whiteblackip" : "IP address blacklists or whitelists",
    "leakage" : "Information leakage"
  }
}

SDK Sample Code

The SDK sample code is as follows.

      
       
         
         
           package com.huaweicloud.sdk.test;

import com.huaweicloud.sdk.core.auth.ICredential;
import com.huaweicloud.sdk.core.auth.BasicCredentials;
import com.huaweicloud.sdk.core.exception.ConnectionException;
import com.huaweicloud.sdk.core.exception.RequestTimeoutException;
import com.huaweicloud.sdk.core.exception.ServiceResponseException;
import com.huaweicloud.sdk.waf.v1.region.WafRegion;
import com.huaweicloud.sdk.waf.v1.*;
import com.huaweicloud.sdk.waf.v1.model.*;


public class ConfirmThreatMapSolution {

    public static void main(String[] args) {
        // The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
        // In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
        String ak = System.getenv("CLOUD_SDK_AK");
        String sk = System.getenv("CLOUD_SDK_SK");
        String projectId = "{project_id}";

        ICredential auth = new BasicCredentials()
                .withProjectId(projectId)
                .withAk(ak)
                .withSk(sk);

        WafClient client = WafClient.newBuilder()
                .withCredential(auth)
                .withRegion(WafRegion.valueOf("<YOUR REGION>"))
                .build();
        ConfirmThreatMapRequest request = new ConfirmThreatMapRequest();
        try {
            ConfirmThreatMapResponse response = client.confirmThreatMap(request);
            System.out.println(response.toString());
        } catch (ConnectionException e) {
            e.printStackTrace();
        } catch (RequestTimeoutException e) {
            e.printStackTrace();
        } catch (ServiceResponseException e) {
            e.printStackTrace();
            System.out.println(e.getHttpStatusCode());
            System.out.println(e.getRequestId());
            System.out.println(e.getErrorCode());
            System.out.println(e.getErrorMsg());
        }
    }
}

          

        

      
     

      
       
         
         
           # coding: utf-8

import os
from huaweicloudsdkcore.auth.credentials import BasicCredentials
from huaweicloudsdkwaf.v1.region.waf_region import WafRegion
from huaweicloudsdkcore.exceptions import exceptions
from huaweicloudsdkwaf.v1 import *

if __name__ == "__main__":
    # The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
    # In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
    ak = os.environ["CLOUD_SDK_AK"]
    sk = os.environ["CLOUD_SDK_SK"]
    projectId = "{project_id}"

    credentials = BasicCredentials(ak, sk, projectId)

    client = WafClient.new_builder() \
        .with_credentials(credentials) \
        .with_region(WafRegion.value_of("<YOUR REGION>")) \
        .build()

    try:
        request = ConfirmThreatMapRequest()
        response = client.confirm_threat_map(request)
        print(response)
    except exceptions.ClientRequestException as e:
        print(e.status_code)
        print(e.request_id)
        print(e.error_code)
        print(e.error_msg)

          

        

      
     

      
       
         
         
           package main

import (
	"fmt"
	"github.com/huaweicloud/huaweicloud-sdk-go-v3/core/auth/basic"
    waf "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/waf/v1"
	"github.com/huaweicloud/huaweicloud-sdk-go-v3/services/waf/v1/model"
    region "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/waf/v1/region"
)

func main() {
    // The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
    // In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
    ak := os.Getenv("CLOUD_SDK_AK")
    sk := os.Getenv("CLOUD_SDK_SK")
    projectId := "{project_id}"

    auth := basic.NewCredentialsBuilder().
        WithAk(ak).
        WithSk(sk).
        WithProjectId(projectId).
        Build()

    client := waf.NewWafClient(
        waf.WafClientBuilder().
            WithRegion(region.ValueOf("<YOUR REGION>")).
            WithCredential(auth).
            Build())

    request := &model.ConfirmThreatMapRequest{}
	response, err := client.ConfirmThreatMap(request)
	if err == nil {
        fmt.Printf("%+v\n", response)
    } else {
        fmt.Println(err)
    }
}

          

        

      
     