Querying the Servers Affected by a Vulnerability

Function

This API is used to query the servers affected by a vulnerability.

Calling Method

For details, see Calling APIs.

URI

GET /v5/{project_id}/vulnerability/hosts

**Table 1** Path Parameters
Parameter	Mandatory	Type	Description
project_id	Yes	String	Tenant ID

**Table 2** Query Parameters
Parameter	Mandatory	Type	Description
enterprise_project_id	No	String	Enterprise user ID. To query all enterprise projects, set this parameter to all_granted_eps.
vul_id	Yes	String	Vulnerability ID
type	Yes	String	Vulnerability type linux_vul: Linux vulnerability windows_vul: Windows vulnerability app_vul: application vulnerability urgent_vul: emergency vulnerability -web_cms: Web-CMS vulnerability
host_name	No	String	Affected asset name
host_ip	No	String	IP address of the affected asset
status	No	String	Vulnerability status. vul_status_unfix: not fixed vul_status_ignored: ignored vul_status_verified: verification in progress vul_status_fixing: The fix is in progress. vul_status_fixed: The fix succeeded. vul_status_reboot: The issue is fixed and waiting for restart. vul_status_failed: The issue failed to be fixed. vul_status_fix_after_reboot: Restart the server and try again.
limit	No	Integer	Number of records on each page
offset	No	Integer	Offset
asset_value	No	String	Asset importance important common test
group_name	No	String	Server group name
handle_status	No	String	description: \|- Handling status. The options are as follows: - unhandled - handled
severity_level	No	String	Risk level. The value can be Critical, High, Medium, or Low.
is_affect_business	No	Boolean	Indicates whether services are affected. The value can be y or n.

Request Parameters

**Table 3** Request header parameters
Parameter	Mandatory	Type	Description
x-auth-token	Yes	String	User token. It can be obtained by calling the IAM API used to obtain a user token. The value of X-Subject-Token in the response header is a token.

Response Parameters

Status code: 200

**Table 4** Response body parameters
Parameter	Type	Description
total_num	Integer	Number of affected servers
data_list	Array of VulHostInfo objects	Number of affected servers

**Table 5** VulHostInfo
Parameter	Type	Description
host_id	String	Server ID
severity_level	String	Risk level. Critical: The CVSS score of the vulnerability is greater than or equal to 9, corresponding to the high risk level on the console. High: The CVSS score of the vulnerability is greater than or equal to 7 and less than 9, corresponding to the medium risk level on the console. Medium: The CVSS score of the vulnerability is greater than or equal to 4 and less than 7, corresponding to the medium risk level on the console. Low: The CVSS score of the vulnerability is less than 4, corresponding to the low risk level on the console.
host_name	String	Affected asset name
host_ip	String	IP address of the affected asset
agent_id	String	The corresponding agent ID of the server
cve_num	Integer	Vulnerability CVEs
cve_id_list	Array of strings	CVE list
status	String	Vulnerability status. vul_status_unfix: not fixed vul_status_ignored: ignored vul_status_verified: verification in progress vul_status_fixing: The fix is in progress. vul_status_fixed: The fix succeeded. vul_status_reboot: The issue is fixed and waiting for restart. vul_status_failed: The issue failed to be fixed. vul_status_fix_after_reboot: Restart the server and try again.
repair_cmd	String	Repair command
app_path	String	Path of the application software (This field is available only for application vulnerabilities.)
region_name	String	Region
public_ip	String	Server public IP address
private_ip	String	Server private IP address
group_id	String	Server group ID
group_name	String	Server group name
os_type	String	Operating system (OS)
asset_value	String	Asset importance. The options are as follows: important common test
is_affect_business	Boolean	Whether services are affected
first_scan_time	Long	First scan time
scan_time	Long	Scan time
support_restore	Boolean	Indicates whether data can be rolled back to the backup created when the vulnerability was fixed.

Example Requests

Query the first 10 records in the list of servers with EulerOS-SA-2021-1894 vulnerability.

GET https://{endpoint}/v5/2b31ed520xxxxxxebedb6e57xxxxxxxx/vulnerability/hosts?vul_id=EulerOS-SA-2021-1894&offset=0&limit=10

Example Responses

Status code: 200

Vul host info list

{
  "total_num" : 1,
  "data_list" : [ {
    "host_id" : "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "severity_level" : "Low",
    "host_name" : "ecs",
    "host_ip" : "xxx.xxx.xxx.xxx",
    "agent_id" : "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
    "cve_num" : 1,
    "cve_id_list" : [ "CVE-2022-1664" ],
    "status" : "vul_status_ignored",
    "repair_cmd" : "zypper update update-alternatives",
    "app_path" : "/root/apache-tomcat-8.5.15/bin/bootstrap.jar",
    "support_restore" : true
  } ]
}