Help Center/ SecMaster/ User Guide/ Security Orchestration/ Workflow Plugins Built in the System/ SecMaster
Updated on 2026-07-01 GMT+08:00
View PDF
Share

SecMaster

Function Description

The SecMaster plugin built in SecMaster can call SecMaster APIs to perform operations.

Each built-in plugin has a corresponding built-in operation connection.

Viewing Details and Operation Connections of SecMasterUtilities

  1. Log in to the SecMaster console.
  2. Click in the upper left corner of the management console and select a region or project.
  3. In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.

    Figure 1 Workspace management page

  4. In the navigation pane on the left, choose Security Orchestration > Plugins.

    Figure 2 Plugins page

  5. On the Plugins page, select the SecMaster plugin under the Huawei Cloud catalog. The Details tab is displayed by default. The Details tab displays the login credential information of the operation connection associated with the plugin.
  6. Click the Operation Connections tab for the SecMaster plugin. On the displayed page, you can view information about the operation connections associated with the SecMaster plugin.
  7. For details about how to edit or delete an operation connection, see Editing an Operation Connection and Deleting an Operation Connection. For details about how to add an operation connection for a plugin, see Creating an Operation Connection. A plugin can have multiple operation connections.

Plugin Execution Function changeAlert

Parameters of the changeAlert Function

Function: Calls the corresponding SecMaster API to update alerts.

Table 1 Input parameters of the changeAlert function

Parameter

Parameter Type

Parameter Description

Mandatory

workspaceId

String

Workspace ID.

Yes

alertId

String

Alert ID.

Yes

dataObject

String

Content to be updated for the alert data object. Example: Close the alert and update the alert owner and title.

{

"owner": "test-owner",

"title": "title updated by api",

"close_comment": "api closed"

}

No

triggerFlag

String

Whether to trigger the playbook with Trigger Condition set to Event Trigger and Trigger Method set to Updated. The options are true and false. The default value is false. The recommended value is false.

No

language

String

Response language of the query result. The value can be zh-cn or en-us. Uppercase letters and other values are not supported.

The value zh-cn indicates that the query result is displayed in simplified Chinese, and the value en-us indicates that the query result is displayed in English.

No

agency_type

String

Unified adaptation parameter for multi-account management. Use the default value.

No
Table 2 Output parameters of the changeAlert function

Parameter

Parameter Type

Parameter Description

header

Object

Headers of the response returned by the SecMaster API. It includes basic request and response information, such as the request time, response service, and request ID.

code

Int

Status code, which indicates whether the request is successful.

Response code description:

  • If the value of code is 200, the request is successful.
  • If the value of code is 401, the account or password is incorrect.
  • If the value of code is 403, the permission is insufficient.
  • If the value of code is 404, the requested resource does not exist.

body

Object

Content returned by the API.

Output Example of the changeAlert Function

{
  "headers": {
    "Transfer-Encoding": "chunked",
    "Server": "api-gateway",
    "X-Request-Id": "4d6162bb3aeb82b9a448dcb0123aa101",
    "X-Content-Type-Options": "nosniff",
    "Connection": "keep-alive",
    "X-Download-Options": "noopen",
    "Pragma": "no-cache",
    "Date": "Tue, 24 Feb 2026 08:32:53 GMT",
    "X-Frame-Options": "SAMEORIGIN",
    "Strict-Transport-Security": "max-age=31536000; includeSubdomains;",
    "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate",
    "Content-Encoding": "gzip",
    "Vary": "origin,access-control-request-method,access-control-request-headers,accept-encoding",
    "X-XSS-Protection": "1; mode=block;",
    "Content-Type": "application/json; charset=UTF-8"
  },
  "code": 200,
  "body": {
    "code": "00000000",
    "data": {
      "success_ids": [
        "2e63a9a5-d6b4-46f9-85f1-10aa673918cc"
      ],
      "error_ids": []
    },
    "success": true,
    "message": "",
    "request_id": null
  }
}

Plugin Execution Function createComment

Parameters of the createComment Function

Function: Calls the corresponding SecMaster API to add comments for alerts.

Table 3 Input parameters of the createComment function

Parameter

Parameter Type

Parameter Description

Mandatory

workspaceId

String

Workspace ID.

Yes

alertId

String

Alert ID.

Yes

type

String

Set this parameter to the fixed value textMessage.

Yes

content

String

Comment content.

Yes

noteType

String

Set this parameter to the fixed value note.

Yes

triggerFlag

String

The options are true and false.

Whether to trigger the playbook with Trigger Condition set to Event Trigger and Trigger Method set to Updated. The default value is false. The recommended value is false.

No

language

String

Response language of the query result. The value can be zh-cn or en-us. Uppercase letters and other values are not supported.

The value zh-cn indicates that the query result is displayed in simplified Chinese, and the value en-us indicates that the query result is displayed in English.

No

agency_type

String

Unified adaptation parameter for multiple accounts. Use the default value.

No
Table 4 Output parameters of the createComment function

Parameter

Parameter Type

Parameter Description

header

Object

Headers of the response returned by the SecMaster API. It includes basic request and response information, such as the request time, response service, and request ID.

code

Int

Status code, which indicates whether the request is successful.

Response code description:

  • If the value of code is 200, the request is successful.
  • If the value of code is 401, the account or password is incorrect.
  • If the value of code is 403, the permission is insufficient.
  • If the value of code is 404, the requested resource does not exist.

body

Object

Content returned by the API.

Output Example of the createComment Function

{
  "headers": {
    "Transfer-Encoding": "chunked",
    "Server": "api-gateway",
    "X-Request-Id": "a888be8d33d3949e9e9f9b5ab1c24c15",
    "X-Content-Type-Options": "nosniff",
    "Connection": "keep-alive",
    "X-Download-Options": "noopen",
    "Pragma": "no-cache",
    "Date": "Tue, 24 Feb 2026 08:43:11 GMT",
    "X-Frame-Options": "SAMEORIGIN",
    "Strict-Transport-Security": "max-age=31536000; includeSubdomains;",
    "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate",
    "Content-Encoding": "gzip",
    "Vary": "Origin, Access-Control-Request-Method, Access-Control-Request-Headers",
    "X-XSS-Protection": "1; mode=block;",
    "Content-Type": "application/json; charset=UTF-8"
  },
  "code": 200,
  "body": {
    "code": "00000000",
    "data": {
      "note_type": "note",
      "war_room_id": "bbe340fd-872d-4fa2-b647-9db6c71d04e5",
      "create_time": "2026-02-24T16:43:11.314Z+0800",
      "data": {
        "content": "321123"
      },
      "content_en": null,
      "type": "textMessage",
      "content": null,
      "tags": "",
      "target": null,
      "content_zh": null,
      "workspace_id": "fxxx6b-62bb-49c6-af65-75xxxx0c28b",
      "update_time": "2026-02-24T16:43:11.314Z+0800",
      "is_deleted": false,
      "project_id": "099xxxxx14b68c0527",
      "marked_note": true,
      "marked_evidence": null,
      "id": "6dcb8d79-3f8c-451d-9c22-118e294cc495",
      "user": {
        "name": "SecMasterRobot",
        "id": "SecMasterRobot"
      }
    },
    "success": true,
    "message": "",
    "request_id": ""
  }
}

Plugin Execution Function listAlerts

Parameters of the listAlerts Function

Function: Calls the corresponding SecMaster API to query the alert list.

Table 5 Input parameters of the listAlerts function

Parameter

Parameter Type

Parameter Description

Mandatory

workspaceId

String

Workspace ID.

Yes

limit

String

This parameter is often used together with offset. limit specifies the maximum number of records to be returned, and offset specifies the starting point, or how many records to skip.

No

offset

String

This parameter is often used together with limit. limit specifies the maximum number of records to be returned, and offset specifies the starting point, or how many records to skip.

No

sortBy

String

Sorting field. The value can be create_time or update_time.

No

order

String

Sorting order. Options: DESC and ASC.

No

fromDate

String

Query start date. Format example: 2026-01-01T00:00:00.000Z+0800.

No

toDate

String

Query end date. Format example: 2026-01-01T00:00:00.000Z+0800.

No

condition

String

Search criteria. Example: Query the list of alerts whose status is Open and title contains High-risk.

{
  "conditions": [
    {
      "name": "title",
      "data": [
        "title",
        "contains",
        "High-risk"
      ]
    }
  ],
  "logics": [
    "title"
  ]
}

No

language

String

Response language of the query result. The value can be zh-cn or en-us. Uppercase letters and other values are not supported.

The value zh-cn indicates that the query result is displayed in simplified Chinese, and the value en-us indicates that the query result is displayed in English.

No

resultVariable

String

(Optional) Query result filter.

No

agency_type

String

Unified adaptation parameter for multiple accounts. Use the default value.

No
Table 6 Output parameters of the listAlerts function

Parameter

Parameter Type

Parameter Description

header

Object

Headers of the response returned by the SecMaster API. It includes basic request and response information, such as the request time, response service, and request ID.

code

Int

Status code, which indicates whether the request is successful.

Response code description:

  • If the value of code is 200, the request is successful.
  • If the value of code is 401, the account or password is incorrect.
  • If the value of code is 403, the permission is insufficient.
  • If the value of code is 404, the requested resource does not exist.

body

Object

Content returned by the API.

Output Example of the listAlerts Function

{
  "headers": {
    "Transfer-Encoding": "chunked",
    "Server": "api-gateway",
    "X-Request-Id": "4d6162bb3aeb82b9a448dcb0123aa101",
    "X-Content-Type-Options": "nosniff",
    "Connection": "keep-alive",
    "X-Download-Options": "noopen",
    "Pragma": "no-cache",
    "Date": "Tue, 24 Feb 2026 08:32:53 GMT",
    "X-Frame-Options": "SAMEORIGIN",
    "Strict-Transport-Security": "max-age=31536000; includeSubdomains;",
    "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate",
    "Content-Encoding": "gzip",
    "Vary": "origin,access-control-request-method,access-control-request-headers,accept-encoding",
    "X-XSS-Protection": "1; mode=block;",
    "Content-Type": "application/json; charset=UTF-8"
  },
  "code": 200,
  "body": {
    "code": "00000000",
    "data": {
      "success_ids": [
        "2e63a9a5-d6b4-46f9-85f1-10aa673918cc"
      ],
      "error_ids": []
    },
    "success": true,
    "message": "",
    "request_id": null
  }
}
{
  "headers": {
    "Transfer-Encoding": "chunked",
    "Server": "api-gateway",
    "X-Request-Id": "3852be7d71ef9a889870a0c49d526780",
    "X-Content-Type-Options": "nosniff",
    "Connection": "keep-alive",
    "X-Download-Options": "noopen",
    "Pragma": "no-cache",
    "Date": "Tue, 24 Feb 2026 09:55:19 GMT",
    "X-Frame-Options": "SAMEORIGIN",
    "Strict-Transport-Security": "max-age=31536000; includeSubdomains;",
    "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate",
    "Content-Encoding": "gzip",
    "Vary": "origin,access-control-request-method,access-control-request-headers,accept-encoding",
    "X-XSS-Protection": "1; mode=block;",
    "Content-Type": "application/json; charset=UTF-8"
  },
  "code": 200,
  "body": {
    "total": 2,
    "code": "00000000",
    "data": [
      {
        "workspace_id": "ffxxxxx6b-62bb-49c6-af65-751xxxc28b",
        "update_time": "2026-02-24T16:15:50.830Z+0800",
        "format_version": 0,
        "create_time": "2026-02-24T16:10:27.313Z+0800",
        "project_id": "099706f409xxxxxx0bc014b68c0527",
        "dataclass_ref": {
          "name": null,
          "id": "a164b25e-36ed-37cd-8b80-7xxxfebe71"
        },
        "aggs_data_objects": null,
        "data_object": {
          "first_observed_time": "2026-02-24T16:10:21.000Z+0800",
          "is_auto_closed": null,
          "simulation": "false",
          "description": "123",
          "title": "title updated by api",
          "type": "alerts",
          "alert_type": {
            "id": "4335d81b88fe0ce7885ca9cfaca5e078",
            "category": "Abnormal cluster behavior",
            "alert_type": "Kubernetes incident deletion"
          },
          "workspace_id": "ff86716b-62bb-49c6-af65-75xxxxa0c28b",
          "domain_id": "0996e7xxxx4c014f001b7c0",
          "verification_state": "Unknown",
          "update_time": "2026-02-24T16:15:50.830Z+0800",
          "domain_name": "hxxxff_p_xxxCC",
          "is_deleted": false,
          "project_id": "099706f4xxxf0bc014b68c0527",
          "handle_status": "Open",
          "id": "bbe340fd-872d-4fa2-b647-9db6c71d04e5",
          "severity": "Tips",
          "owner": "test-owner",
          "close_comment": "api closed",
          "creator": "w3_sso_sexxr_ops_02",
          "create_time": "2026-02-24T16:10:27.313Z+0800",
          "ttd": 0,
          "region_id": "cn-north-4",
          "count": 1,
          "dataclass_id": "a164b25e-36ed-37cd-8b80-7369fdfebe71",
          "close_time": null,
          "version": "1.0.0",
          "data_source": {
            "domain_id": "0996e74xxx3180f34c014f001b7c0",
            "product_feature": "hss",
            "project_id": "099706f40xxx6a62f0bc014b68c0527",
            "company_name": "Huawei",
            "region_id": "cn-north-4",
            "source_type": 1,
            "product_name": "hss"
          },
          "data_sources": [
            {
              "domain_id": "0996e744f600xxxxc014f001b7c0",
              "product_feature": "hss",
              "project_id": "099706f4090xxxxf0bc014b68c0527",
              "company_name": "Huawei",
              "region_id": "cn-north-4",
              "source_type": 1,
              "product_name": "hss"
            }
          ],
          "labels": "",
          "arrive_time": "2026-02-24T16:10:27.248Z+0800",
          "environment": {
            "domain_id": "0996e744f600f3180f34c014f001b7c0",
            "domain_name": "xxxff_p_SxxxxC",
            "project_id": "099706f4090026a62f0bc014b68c0527",
            "region_id": "cn-north-4",
            "project_name": "cn-north-4",
            "vendor_type": "HWC"
          },
          "trigger_flag": false,
          "ipdrr_phase": "Preparation",
          "creator_id": "w3_sxxxo_secmaster_oxxxs_02",
          "creator_name": "w3_sxxxxo_secmaster_oxxxxs_02"
        },
        "id": "bbe340fd-872d-4fa2-b647-9db6c71d04e5",
        "type": null,
        "version": 0
      },
      {
        "workspace_id": "ff86716b-62bb-49c6-af65-75192ca0c28b",
        "update_time": "2026-02-24T16:32:53.251Z+0800",
        "format_version": 0,
        "create_time": "2026-02-24T16:16:22.970Z+0800",
        "project_id": "099706f4090026a62f0bc014b68c0527",
        "dataclass_ref": {
          "name": null,
          "id": "a164b25e-36ed-37cd-8b80-7369fdfebe71"
        },
        "aggs_data_objects": null,
        "data_object": {
          "first_observed_time": "2026-02-03T16:16:19.000Z+0800",
          "is_auto_closed": null,
          "simulation": "false",
          "description": "1",
          "title": "title updated by api",
          "type": "alerts",
          "alert_type": {
            "id": "d601100066a433fd054b5fbc15162a32",
            "category": "Vulnerability exploit",
            "alert_type": "ActiveX vulnerability exploit"
          },
          "workspace_id": "ff86716b-62bb-49c6-af65-75192ca0c28b",
          "domain_id": "0996e744f600f3180f34c014f001b7c0",
          "verification_state": "Unknown",
          "update_time": "2026-02-24T16:32:53.251Z+0800",
          "domain_name": "hwsxxxxff_p_SexxxxCC",
          "is_deleted": false,
          "project_id": "099706f4090026a62f0bc014b68c0527",
          "handle_status": "Open",
          "id": "2e63a9a5-d6b4-46f9-85f1-10aa673918cc",
          "severity": "Tips",
          "owner": "test-owner",
          "close_comment": "api closed",
          "creator": "w3_sxxxx_secmaster_oxxxxs_02",
          "create_time": "2026-02-24T16:16:22.970Z+0800",
          "ttd": 30240,
          "region_id": "cn-north-4",
          "count": 1,
          "dataclass_id": "a164b25e-36ed-37cd-8b80-7369fdfebe71",
          "close_time": null,
          "version": "1.0.0",
          "data_source": {
            "domain_id": "0996e744f60xxxxc014f001b7c0",
            "product_feature": "hss",
            "project_id": "099706f4090xxxx014b68c0527",
            "company_name": "Huawei",
            "region_id": "cn-north-4",
            "source_type": 1,
            "product_name": "hss"
          },
          "data_sources": [
            {
              "domain_id": "0996e744f600f3180f34c014f001b7c0",
              "product_feature": "hss",
              "project_id": "099706f4090026a62f0bc014b68c0527",
              "company_name": "Huawei",
              "region_id": "cn-north-4",
              "source_type": 1,
              "product_name": "hss"
            }
          ],
          "labels": "",
          "arrive_time": "2026-02-24T16:16:22.925Z+0800",
          "environment": {
            "domain_id": "0996e744f600f3180f34c014f001b7c0",
            "domain_name": "hwxxxxf_p_SecCMCC",
            "project_id": "099706f409002xxxxbc014b68c0527",
            "region_id": "cn-north-4",
            "project_name": "cn-north-4",
            "vendor_type": "HWC"
          },
          "trigger_flag": false,
          "ipdrr_phase": "Preparation",
          "creator_id": "w3_xxxo_secxxxr_ops_02",
          "creator_name": "w3_xxxo_sexxxster_ops_02"
        },
        "id": "2e63a9a5-d6b4-46f9-85f1-10aa673918cc",
        "type": null,
        "version": 0
      }
    ],
    "size": 0,
    "success": true,
    "page": 0,
    "message": null,
    "request_id": null
  }
}

Plugin Execution Function createPolicys

Parameters of the createPolicys Function

Function: Calls the corresponding SecMaster API to create an emergency policy.

Table 7 Input parameters of the createPolicys function

Parameter

Parameter Type

Parameter Description

Mandatory

workspaceId

String

Workspace ID.

Yes

blockTarget

String

Blocked object.

If defenseType is set to IAM, enter the name of the forbidden user.

If defenseType is set to WAF or VPC, enter the blocked IP address.

If defenseType is set to CFW, enter the blocked IP address or domain name.

Yes

isBlockAgeing

String

Whether to set the aging time.

No

enterpriseProjectId

String

Enterprise project ID.

No

enterpriseProjectNmme

String

Enterprise project name.

No

blockAgeing

String

Aging time.

No

description

String

Policy description.

No

defenseConnectionName

String

Asset connection name. Set this parameter based on the value of defenseType.

IAM: IAM authentication token.

WAF: WAF authentication token.

VPC: VPC authentication token.

CFW: CFW authentication token.

Yes

defenseType

String

Defense line. The value can be IAM, WAF, VPC, or CFW. Other values are invalid.

Yes

defenseConnectionRegionId

String

ID of the region to which the asset connection name belongs.

Yes

defenseConnectionRegionName

String

ID of the region to which the asset connection name belongs.

No

dataObjectId

String

Data object ID, which is used to determine whether to trigger other playbooks. Leave this parameter empty.

No

triggerFlag

String

The options are true and false.

Whether to trigger the playbook with Trigger Condition set to Event Trigger and Trigger Method set to Created. The default value is false. The recommended value is false.

No

language

String

Response language of the query result. The value can be zh-cn or en-us. Uppercase letters and other values are not supported.

The value zh-cn indicates that the query result is displayed in simplified Chinese, and the value en-us indicates that the query result is displayed in English.

No

policy_direction

String

Policy direction.

Yes

account_scope

String

Account scope.

Yes

eps_scope

String

Enterprise project scope.

Yes

region_scope

String

Region range.

Yes

agency_type

String

Unified adaptation parameter for multiple accounts. Use the default value.

No
Table 8 Output parameters of the createPolicys function

Parameter

Parameter Type

Parameter Description

header

Object

Headers of the response returned by the SecMaster API. It includes basic request and response information, such as the request time, response service, and request ID.

code

Int

Status code, which indicates whether the request is successful.

Response code description:

  • If the value of code is 200, the request is successful.
  • If the value of code is 401, the account or password is incorrect.
  • If the value of code is 403, the permission is insufficient.
  • If the value of code is 404, the requested resource does not exist.

body

Object

Content returned by the API.

Output Example of the createPolicys Function

{
  "headers": {
    "Transfer-Encoding": "chunked",
    "Server": "api-gateway",
    "X-Request-Id": "445df3c02e5cb28b05a075230a7a8b07",
    "X-Content-Type-Options": "nosniff",
    "Connection": "keep-alive",
    "lubanops-gtrace-id": "2630817-1771988198123-2776",
    "X-Download-Options": "noopen",
    "Pragma": "no-cache",
    "Date": "Wed, 25 Feb 2026 02:56:39 GMT",
    "lubanops-ntrace-id": "2630817-1771988198123-2776",
    "X-Frame-Options": "SAMEORIGIN",
    "Strict-Transport-Security": "max-age=31536000; includeSubdomains;",
    "lubanops-nenv-id": "374014",
    "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate, no-cache, no-store, must-revalidate",
    "Content-Encoding": "gzip",
    "Vary": "Origin, Access-Control-Request-Method, Access-Control-Request-Headers",
    "X-XSS-Protection": "1; mode=block;",
    "Content-Type": "application/json; charset=UTF-8"
  },
  "code": 200,
  "body": {
    "code": "00000000",
    "error_msg": "",
    "data": "86bc7dd6-2ba0-4bff-9a0b-415829b11456",
    "success": true,
    "error_code": "",
    "message": "",
    "request_id": ""
  }
}

Plugin Execution Function showAlert

Parameters of the showAlert Function

Function: Calls the corresponding SecMaster API to query alert details.

Table 9 Input parameters of the showAlert function

Parameter

Parameter Type

Parameter Description

Mandatory

workspaceId

String

Workspace ID.

Yes

alertId

String

Alert ID.

Yes

language

String

Response language of the query result. The value can be zh-cn or en-us. Uppercase letters and other values are not supported.

The value zh-cn indicates that the query result is displayed in simplified Chinese, and the value en-us indicates that the query result is displayed in English.

No

agency_type

String

Unified adaptation parameter for multiple accounts. Use the default value.

No
Table 10 Output parameters of the showAlert function

Parameter

Parameter Type

Parameter Description

header

Object

Headers of the response returned by the SecMaster API. It includes basic request and response information, such as the request time, response service, and request ID.

code

Int

Status code, which indicates whether the request is successful.

Response code description:

  • If the value of code is 200, the request is successful.
  • If the value of code is 401, the account or password is incorrect.
  • If the value of code is 403, the permission is insufficient.
  • If the value of code is 404, the requested resource does not exist.

body

Object

Content returned by the API.

Output Example of the showAlert Function

{
  "headers": {
    "Transfer-Encoding": "chunked",
    "Server": "api-gateway",
    "X-Request-Id": "98cdb8b52390fda88170536607d2a7cd",
    "X-Content-Type-Options": "nosniff",
    "Connection": "keep-alive",
    "lubanops-gtrace-id": "2630815-1771988606244-15776",
    "X-Download-Options": "noopen",
    "Pragma": "no-cache",
    "Date": "Wed, 25 Feb 2026 03:03:26 GMT",
    "lubanops-ntrace-id": "2630815-1771988606244-15776",
    "X-Frame-Options": "SAMEORIGIN",
    "Strict-Transport-Security": "max-age=31536000; includeSubdomains;",
    "lubanops-nenv-id": "374014",
    "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate, no-cache, no-store, must-revalidate",
    "Content-Encoding": "gzip",
    "Vary": "origin,access-control-request-method,access-control-request-headers,accept-encoding",
    "X-XSS-Protection": "1; mode=block;",
    "Content-Type": "application/json; charset=UTF-8"
  },
  "code": 200,
  "body": {
    "code": "00000000",
    "error_msg": "",
    "data": {
      "workspace_id": "",
      "update_time": "2026-02-25T11:02:50.661Z+0800",
      "layout_id": "",
      "create_time": "2026-02-25T11:02:50.661Z+0800",
      "format_version": 0,
      "project_id": "",
      "dataclass_ref": {
        "name": "Alert",
        "id": "32719554-54b8-3a4b-abc2-1d0a58cc1d92"
      },
      "aggs_data_objects": [],
      "data_object": {
        "first_observed_time": "2026-02-24T03:02:32.000Z",
        "is_auto_closed": null,
        "simulation": "false",
        "description": "for document ",
        "title": "test-alert",
        "type": "alerts",
        "alert_type": {
          "id": "353847ffad072ffd019197db7401c291",
          "category": "Abnormal network behavior",
          "alert_type": "First IP access"
        },
        "workspace_id": "eeba6e24-ecd4-4d2d-a0b9-d6d652d9358c",
        "domain_id": "52aba549ab5141dba19d30efa7e6644e",
        "verification_state": "Unknown",
        "update_time": "2026-02-25T03:02:50.661Z+0000",
        "domain_name": "scc_cnfw_h00801130",
        "is_deleted": false,
        "project_id": "f8ae07d4148f4e418c5fe15833f6b105",
        "handle_status": "Open",
        "id": "ec1c30cd-09fa-49c3-8ce1-1149b63a57cc",
        "severity": "Tips",
        "creator": "huangqiong",
        "create_time": "2026-02-25T03:02:50.661Z+0000",
        "ttd": 1440,
        "region_id": "cn-north-7",
        "count": 1,
        "dataclass_id": "32719554-54b8-3a4b-abc2-1d0a58cc1d92",
        "close_time": null,
        "version": "1.0.0",
        "data_source": {
          "domain_id": "52aba549ab5141dba19d30efa7e6644e",
          "product_feature": "cfw",
          "project_id": "f8ae07d4148f4e418c5fe15833f6b105",
          "company_name": "System",
          "region_id": "cn-north-7",
          "source_type": 1,
          "product_name": "cfw"
        },
        "data_sources": [
          {
            "domain_id": "52aba549ab5141dba19d30efa7e6644e",
            "product_feature": "cfw",
            "project_id": "f8ae07d4148f4e418c5fe15833f6b105",
            "company_name": "System",
            "region_id": "cn-north-7",
            "source_type": 1,
            "product_name": "cfw"
          }
        ],
        "labels": "",
        "arrive_time": "2026-02-25T03:02:50.625Z",
        "environment": {
          "domain_id": "52aba549ab5141dba19d30efa7e6644e",
          "domain_name": "scc_cnfw_h00801130",
          "project_id": "f8ae07d4148f4e418c5fe15833f6b105",
          "region_id": "cn-north-7",
          "project_name": "cn-north-7",
          "vendor_type": "CloudService"
        },
        "trigger_flag": true,
        "ipdrr_phase": "Preparation",
        "entities": [],
        "creator_id": "huxxxxong",
        "creator_name": "hxxxg"
      },
      "id": "ec1c30cd-09fa-49c3-8ce1-1149b63a57cc",
      "type": null,
      "version": 0
    },
    "success": true,
    "error_code": "",
    "message": "",
    "request_id": ""
  }
}

Plugin Execution Function updateDataobject

Parameters of the updateDataobject Function

Function: Calls the corresponding SecMaster API to update data objects.

Table 11 Input parameters of the updateDataobject function

Parameter

Parameter Type

Parameter Description

Mandatory

workspaceId

String

Workspace ID.

Yes

ids

String

Data object ID, which is enclosed in square brackets ([]). Use commas (,) to separate multiple IDs. Example: ["id1,""id2"]

Yes

dataclass

String

Data class. The options are as follows:

Whitelist: whitelist

Department: department

Business: business system

Baseline: baseline checks

PolicyRecord: policy record

Policy: policy

Evidence: evidence

Vulnerability: vulnerability

CommonContext: common context

Resource: assets

Incident: incidents

Alert: alerts

AccountRiskMetric: account risk control metrics

Indicator: indicators

Yes

header

String

Request header. Leave it empty.

No

triggerFlag

String

The options are true and false.

Whether to trigger the playbook with Trigger Condition set to Event Trigger and Trigger Method set to Updated. The default value is false. The recommended value is false.

Yes

formatVersion

String

Set it to the fixed value 1.

Yes

dataObject

String

Content to be updated for the data object. Example: Close the incident and update the incident owner and title.

{
"owner": "test-owner",
"title": "title updated by api",
"close_comment": "api closed"
}

Yes

language

String

Response language of the query result. The value can be zh-cn or en-us. Uppercase letters and other values are not supported.

The value zh-cn indicates that the query result is displayed in simplified Chinese, and the value en-us indicates that the query result is displayed in English.

No

agency_type

String

Unified adaptation parameter for multiple accounts. Use the default value.

No
Table 12 Output parameters of the updateDataobject function

Parameter

Parameter Type

Parameter Description

header

Object

Headers of the response returned by the SecMaster API. It includes basic request and response information, such as the request time, response service, and request ID.

code

Int

Status code, which indicates whether the request is successful.

Response code description:

  • If the value of code is 200, the request is successful.
  • If the value of code is 401, the account or password is incorrect.
  • If the value of code is 403, the permission is insufficient.
  • If the value of code is 404, the requested resource does not exist.

body

Object

Content returned by the API.

Output Example of the updateDataobject Function

{
  "headers": {
    "Transfer-Encoding": "chunked",
    "Server": "api-gateway",
    "X-Request-Id": "7448dfb7a5c77159e7a0e3e5fad5c6cf",
    "X-Content-Type-Options": "nosniff",
    "Connection": "keep-alive",
    "lubanops-gtrace-id": "2630909-1772001496625-13587",
    "X-Download-Options": "noopen",
    "Pragma": "no-cache",
    "Date": "Wed, 25 Feb 2026 06:38:16 GMT",
    "lubanops-ntrace-id": "2630909-1772001496625-13587",
    "X-Frame-Options": "SAMEORIGIN",
    "Strict-Transport-Security": "max-age=31536000; includeSubdomains;",
    "lubanops-nenv-id": "374017",
    "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate, no-cache, no-store, must-revalidate",
    "Content-Encoding": "gzip",
    "Vary": "origin,access-control-request-method,access-control-request-headers,accept-encoding",
    "X-XSS-Protection": "1; mode=block;",
    "Content-Type": "application/json; charset=UTF-8"
  },
  "code": 200,
  "body": {
    "code": "00000000",
    "error_msg": null,
    "data": {
      "success_ids": [
        "f7fc3c5d-b1b1-4b54-b03d-ec238d0e4ca6",
        "5c7d8c0a-a53d-4e0d-b393-710b18953e72"
      ],
      "error_ids": []
    },
    "success": true,
    "error_code": null,
    "message": "",
    "request_id": null
  }
}

Plugin Execution Function listDataobjects

Parameters of the listDataobjects Function

Function: Calls the corresponding SecMaster API to query the data object list.

Table 13 Input parameters of the listDataobjects function

Parameter

Parameter Type

Parameter Description

Mandatory

workspaceId

String

Workspace ID.

Yes

dataclassName

String

Data class business code. The options are Alert, Incident, Indicator, Evidence, Vulnerability, Resource, PolicyRecord, Baseline, and Policy.

Yes

ids

String

This parameter is meaningless. You can leave it blank or set it to any value. This issue will be resolved later.

No

limit

String

This parameter is often used together with offset. limit specifies the maximum number of records to be returned, and offset specifies the starting point, or how many records to skip.

Yes

offset

String

This parameter is often used together with limit. limit specifies the maximum number of records to be returned, and offset specifies the starting point, or how many records to skip.

Yes

type

String

This parameter is meaningless. You can leave it blank or set it to any value. This issue will be resolved later.

No

sortBy

String

Sorting field. The value can be create_time or update_time.

No

order

String

Sorting mode. The options are as follows:

  • DESC: sorting in descending order
  • ASC: sorting in ascending order

No

fromDate

String

Search start time, for example, 2023-02-20T00:00:00.000Z.

No

toDate

String

Search end time, for example, 2023-02-27T23:59:59.999Z.

No

condition

String

Search condition expression.

No

resultVariable

String

Query result filter.

No

language

String

Response language of the query result. The value can be zh-cn or en-us. Uppercase letters and other values are not supported.

The value zh-cn indicates that the query result is displayed in simplified Chinese, and the value en-us indicates that the query result is displayed in English.

No

agency_type

String

Unified adaptation parameter for multiple accounts. Use the default value.

No
Table 14 Output parameters of the listDataobjects function

Parameter

Parameter Type

Parameter Description

header

Object

Headers of the response returned by the SecMaster API. It includes basic request and response information, such as the request time, response service, and request ID.

code

Int

Status code, which indicates whether the request is successful.

Response code description:

  • If the value of code is 200, the request is successful.
  • If the value of code is 401, the account or password is incorrect.
  • If the value of code is 403, the permission is insufficient.
  • If the value of code is 404, the requested resource does not exist.

body

Object

Content returned by the API.

Output Example of the listDataobjects Function

{
  "headers": {
    "Transfer-Encoding": "chunked",
    "Server": "api-gateway",
    "X-Request-Id": "2ee9f10233600ba1ee7b2d6b2585f147",
    "X-Content-Type-Options": "nosniff",
    "Connection": "keep-alive",
    "X-Download-Options": "noopen",
    "Pragma": "no-cache",
    "Date": "Wed, 08 Apr 2026 09:40:41 GMT",
    "X-Frame-Options": "SAMEORIGIN",
    "Strict-Transport-Security": "max-age=31536000; includeSubdomains;",
    "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate",
    "Content-Encoding": "gzip",
    "Vary": "origin,access-control-request-method,access-control-request-headers,accept-encoding",
    "X-XSS-Protection": "1; mode=block;",
    "Content-Type": "application/json; charset=UTF-8"
  },
  "code": 200,
  "body": {
    "total": 27,
    "code": "00000000",
    "data": [
      {
        "workspace_id": "ff86716b-62bb-49c6-af65-75192ca0c28b",
        "update_time": "2026-04-08T00:05:08.078Z+0800",
        "format_version": 0,
        "create_time": "2026-04-08T00:05:08.078Z+0800",
        "project_id": "099706f4090026a62f0bc014b68c0527",
        "dataclass_ref": {
          "name": null,
          "id": "a164b25e-36ed-37cd-8b80-7369fdfebe71"
        },
        "aggs_data_objects": null,
        "data_object": {
          "first_observed_time": "2026-04-08T00:05:01.893Z+0800",
          "defense_type": "Network",
          "description": "Source host: 1x6.65.139.81; destination host: 121.36.76.xx9; action: Vulnerability Exploit Attack",
          "origin_id": "3700ffb1-5ebc-41ce-a15b-9bfbc54dd7cc",
          "title": "[Vulnerability Exploit Attack] [CFW] Source host: 176.65.139.81; destination host: 121.36.76.229; action: Vulnerability Exploit Attack,2026-04-08T00:05:01.893+08:00",
          "type": "defense_alerts",
          "alert_type": {
            "id": "e236e29fa7xxxxff4e1ae9fc2dffd",
            "category": "Others,"
            "alert_type": "Attack detected by CFW"
          },
          "domain_id": "0996e744fxxxxx34c014f001b7c0",
          "workspace_id": "ff86716b-62bb-49c6-af65-75192ca0c28b",
          "verification_state": "Unknown",
          "update_time": "2026-04-08T00:05:08.078Z+0800",
          "domain_name": "hwsxxxxxf_p_SecCMCC",
          "is_deleted": false,
          "project_id": "099706f4090026a62f0bc014b68c0527",
          "extend_properties": {
            "defense_action": "permit"
          },
          "region_name": "cn-north-4",
          "id": "9a7fa4ab-9b0b-4971-b168-6a9676b72e38",
          "handle_status": "Ignored",
          "network_list": [
            {
              "src_ip": "176.65.139.81",
              "src_port": "59943",
              "protocol": "UDP",
              "src_geo": {
                "country_code": "Germany"
              },
              "dest_geo": {
                "country_code": "China/Beijing"
              },
              "dest_ip": "121.36.76.229",
              "dest_port": "9034",
              "direction": "out2in"
            }
          ],
          "severity": "Fatal",
          "network_payload": {
            "app": "UDP-ANY",
            "packet": "b3JmO2NkIC90bXAgfHwgY2QgL3Zhci9ydW4gfHwgY2QgL21udCB8fCBjZCAvcm9vdCB8fCBjZCAvOyB3Z2V0IGh0dHA6Ly8xNzYuNjUuMTM5LjgxL2FsbC5zaDsgY3VybCAtTyBodHRwOi8vMTc2LjY1LjEzOS44MS9hbGwuc2g7IGNobW9kIDc3NyBhbGwuc2g7IHNoIGFsbC5zaDsgdGZ0cCAxNzYuNjUuMTM5LjgxIC1jIGdldCBhbGwuc2g7IGNobW9kIDc3NyBhbGwuc2g7IHNoIGFsbC5zaDsgdGZ0cCAtciBhbGwuc2ggLWcgMTc2LjY1LjEzOS44MTsgY2htb2QgNzc3IGFsbC5zaDsgc2ggYWxsLnNoOyBmdHBnZXQgLXYgLXUgYW5vbnltb3VzIC1wIGFub255bW91cyAtUCAyMSAxNzYuNjUuMTM5LjgxIGFsbC5zaCBhbGwuc2g7IHNoIGFsbC5zaDsgcm0gLXJmIGFsbC5zaCBhbGwuc2ggYWxsLnNoIGFsbC5zaDsgcm0gLXJmICoKCg=="
          },
          "last_observed_time": "2026-04-08T00:05:01.893Z+0800",
          "create_time": "2026-04-08T00:05:08.078Z+0800",
          "defense_layers": {
            "defense_policy": {
              "policy_id": "806310",
              "policy_name": "Realtek Jungle SDK Command Injection Vulnerability (CVE-2021-35394)",
              "defense_action": "permit"
            }
          },
          "ttd": 0,
          "count": 1,
          "region_id": "cn-north-4",
          "raw": [
            {
              "data": "{\"attack_rule\":\"Realtek Jungle SDK Command Injection Vulnerability (CVE-2021-35394)\",\"app\":\"UDP-ANY\",\"attack_type\":\"Vulnerability Exploit Attack\",\"action\":\"permit\"}",
              "type": "cfw"
            }
          ],
          "dataclass_id": "a164b25e-36ed-37cd-8b80-7369fdfebe71",
          "version": "1.1.0_cfw_risk",
          "data_source": {
            "domain_id": "0996e744f600fxxxx4c014f001b7c0",
            "product_feature": "cfw",
            "project_id": "099706f4090026axxxc014b68c0527",
            "company_name": "Huawei",
            "region_id": "cn-north-4",
            "source_type": 1,
            "product_name": "cfw"
          },
          "data_sources": [
            {
              "domain_id": "0996e744f600f3180f34c014f001b7c0",
              "product_feature": "cfw",
              "project_id": "099706f4090026a62f0bc014b68c0527",
              "company_name": "Huawei",
              "region_id": "cn-north-4",
              "source_type": 1,
              "product_name": "cfw"
            }
          ],
          "arrive_time": "2026-04-08T00:05:01.893Z+0800",
          "environment": {
            "domain_id": "0996e744f600f3180f34c014f001b7c0",
            "domain_name": "hwxxxxxf_p_SecCMCC",
            "project_id": "099706f4090026a62f0bc014b68c0527",
            "region_id": "cn-north-4",
            "region_name": "cn-north-4",
            "project_name": "cn-north-4",
            "vendor_type": "HWC"
          },
          "trigger_flag": false
        },
        "id": "9a7fa4ab-9b0b-4971-b168-6a9676b72e38",
        "type": null,
        "version": 0
      }
    ],
    "size": 1,
    "success": true,
    "page": 0,
    "message": null,
    "request_id": null
  }
}

Plugin Execution Function createDataobject

Parameters of the createDataobject Function

Function: Calls the corresponding SecMaster API to create a data object.

Table 15 Input parameters of the createDataobject function

Parameter

Parameter Type

Parameter Description

Mandatory

workspaceId

String

Workspace ID.

Yes

id

String

Data object ID.

No

dataclass

String

Data class business code. The options are Alert, Incident, Indicator, Evidence, Vulnerability, Resource, PolicyRecord, Baseline, and Policy.

Yes

type

String

Set this parameter to the fixed value DATA_SOURCE.

Yes

formatVersion

String

Version of the aligned template. The default value is 1.

Yes

dataObject

String

Data object details. The value must be a string in JSON format.

Yes

triggerFlag

String

The options are true and false.

Whether to trigger the playbook with Trigger Condition set to Event Trigger and Trigger Method set to Created. The default value is false. The recommended value is false.

No

language

String

Response language of the query result. The value can be zh-cn or en-us. Uppercase letters and other values are not supported.

The value zh-cn indicates that the query result is displayed in simplified Chinese, and the value en-us indicates that the query result is displayed in English.

No

agency_type

String

Unified adaptation parameter for multiple accounts. Use the default value.

No
Table 16 Output parameters of the createDataobject function

Parameter

Parameter Type

Parameter Description

header

Object

Headers of the response returned by the SecMaster API. It includes basic request and response information, such as the request time, response service, and request ID.

code

Int

Status code, which indicates whether the request is successful.

Response code description:

  • If the value of code is 200, the request is successful.
  • If the value of code is 401, the account or password is incorrect.
  • If the value of code is 403, the permission is insufficient.
  • If the value of code is 404, the requested resource does not exist.

body

Object

Content returned by the API.

Output Example of the createDataobject Function

{
  "headers": {
    "Transfer-Encoding": "chunked",
    "Server": "api-gateway",
    "X-Request-Id": "5f4bc7c26041faffec036bc14b60fee5",
    "X-Content-Type-Options": "nosniff",
    "Connection": "keep-alive",
    "X-Download-Options": "noopen",
    "Pragma": "no-cache",
    "Date": "Thu, 09 Apr 2026 01:57:59 GMT",
    "X-Frame-Options": "SAMEORIGIN",
    "Strict-Transport-Security": "max-age=31536000; includeSubdomains;",
    "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate",
    "Content-Encoding": "gzip",
    "Vary": "origin,access-control-request-method,access-control-request-headers,accept-encoding",
    "X-XSS-Protection": "1; mode=block;",
    "Content-Type": "application/json; charset=UTF-8"
  },
  "code": 200,
  "body": {
    "event_id": "null",
    "id": "79c85b41-72f2-4827-9e90-345deb3cf75b"
  }
}

Plugin Execution Function listMetrics

Parameters of the listMetrics Function

Function: Calls the corresponding SecMaster API to query indicator data.

Table 17 Input parameters of the listMetrics function

Parameter

Parameter Type

Parameter Description

Mandatory

workspaceId

String

Workspace ID.

Yes

metricId

String

Indicator ID. Use commas (,) to separate multiple IDs.

No

resultVariable

String

Query result filter.

Yes

language

String

Response language of the query result. The value can be zh-cn or en-us. Uppercase letters and other values are not supported.

The value zh-cn indicates that the query result is displayed in simplified Chinese, and the value en-us indicates that the query result is displayed in English.

No

agency_type

String

Unified adaptation parameter for multiple accounts. Use the default value.

No
Table 18 Output parameters of the listMetrics function

Parameter

Parameter Type

Parameter Description

header

Object

Headers of the response returned by the SecMaster API. It includes basic request and response information, such as the request time, response service, and request ID.

code

Int

Status code, which indicates whether the request is successful.

Response code description:

  • If the value of code is 200, the request is successful.
  • If the value of code is 401, the account or password is incorrect.
  • If the value of code is 403, the permission is insufficient.
  • If the value of code is 404, the requested resource does not exist.

body

Object

Content returned by the API.

Output Example of the listMetrics Function

{
  "headers": {
    "Transfer-Encoding": "chunked",
    "Server": "api-gateway",
    "X-Request-Id": "f7e759ff25266227a1d31f5068a5b3ed",
    "vary": "accept-encoding",
    "X-Content-Type-Options": "nosniff",
    "Connection": "keep-alive",
    "lubanops-gtrace-id": "2632423-1777341427465-57926",
    "X-Download-Options": "noopen",
    "Pragma": "no-cache",
    "Date": "Tue, 28 Apr 2026 01:57:07 GMT",
    "lubanops-ntrace-id": "2632423-1777341427465-57926",
    "X-Frame-Options": "SAMEORIGIN",
    "Strict-Transport-Security": "max-age=31536000; includeSubdomains;",
    "lubanops-nenv-id": "374017",
    "Cache-Control": "no-cache, no-store, must-revalidate",
    "Content-Encoding": "gzip",
    "X-XSS-Protection": "1; mode=block;",
    "Content-Type": "application/json"
  },
  "code": 200,
  "body": [
    {
      "result": {
        "effective_column": null,
        "datarows": [
          [
            8,
            5,
            0,
            4,
            9,
            23,
            0
          ]
        ],
        "labels": [
          "Host",
          "Website",
          "IP",
          "Database",
          "EIP",
          "VPC",
          "Device"
        ]
      },
      "metric_id": "ec1a973e-8ab2-4dc7-8e8c-afbef12cca13",
      "log_msg": null,
      "metric_format": [],
      "status": "SUCCESS",
      "metrics_meta": {
        "link": {
          "default": "/secmaster/?region=cn-north-7#/ssa/workspace/soc/resource?project_id=5c85b9f0a7884f649112f90d91739e28&spaceId=4135627a-3c8e-41d4-b414-62abdc508916&tabType=0"
        },
        "description": {
          "period": "Real-time",
          "measurement_rule": "Current workspace",
          "caretaker": "default",
          "source": "Asset data integrated into SecMaster",
          "frequence": "Real-time",
          "title": "Total tenant assets",
          "calc_rule": "Total number of assets in the current workspace under the tenant",
          "score_rule": ""
        }
      }
    },
    {
      "result": {
        "effective_column": null,
        "datarows": [
          [
            0,
            80,
            0,
            66.67,
            0
          ]
        ],
        "labels": [
          "Host",
          "Website",
          "Database",
          "EIP",
          "VPC"
        ]
      },
      "metric_id": "16f3d4df-a64f-4f0f-bba5-8aa953d913fa",
      "log_msg": null,
      "metric_format": [],
      "status": "SUCCESS",
      "metrics_meta": {
        "link": {
          "default": "/secmaster/?region=cn-north-7#/ssa/isap/securityAnalysis/table?project_id=5c85b9f0a7884f649112f90d91739e28&spaceId=4135627a-3c8e-41d4-b414-62abdc508916&metric_id=16f3d4df-a64f-4f0f-bba5-8aa953d913fa&table_name=security_resource"
        },
        "description": {
          "period": "Real-time",
          "measurement_rule": "Current workspace",
          "caretaker": "default",
          "source": "Asset table",
          "frequence": "5 minutes,"
          "title": "Percentage of protection for different types of assets",
          "calc_rule": "Percentage of protection for different types of assets per day",
          "score_rule": ""
        }
      }
    },
    {
      "result": {
        "effective_column": null,
        "datarows": [
          [
            49
          ]
        ],
        "labels": [
          "Total Assets"
        ]
      },
      "metric_id": "a1b38c8f-5659-47ad-915d-a5c075306c1f",
      "log_msg": null,
      "metric_format": [],
      "status": "SUCCESS",
      "metrics_meta": {
        "link": null,
        "description": null
      }
    }
  ]
}

Plugin Execution Function relateDataobject

Parameters of the relateDataobject Function

Function: Calls the corresponding SecMaster API to associate data objects.

Table 19 Input parameters of the relateDataobject function

Parameter

Parameter Type

Parameter Description

Mandatory

workspaceId

String

Workspace ID.

Yes

dataclassType

String

Data class to which the association subject data object belongs. The value is plural in lowercase, for example, alerts and incidents.

No

dataObjectId

String

ID of the associated data object.

Yes

relatedDataclassType

String

Data class to which the associated data object belongs. The value is plural in lowercase, for example, alerts and incidents.

Yes

ids

String

ID list of association data objects.

Yes

triggerFlag

String

The options are true and false. Whether to trigger the playbook with Trigger Condition set to Event Trigger and Trigger Method set to Updated. The default value is false. The recommended value is false.

No

language

String

Response language of the query result. The value can be zh-cn or en-us. Uppercase letters and other values are not supported.

The value zh-cn indicates that the query result is displayed in simplified Chinese, and the value en-us indicates that the query result is displayed in English.

No

agency_type

String

Unified adaptation parameter for multiple accounts. Use the default value.

No
Table 20 Output parameters of the relateDataobject function

Parameter

Parameter Type

Parameter Description

header

Object

Headers of the response returned by the SecMaster API. It includes basic request and response information, such as the request time, response service, and request ID.

code

Int

Status code, which indicates whether the request is successful.

Response code description:

  • If the value of code is 200, the request is successful.
  • If the value of code is 401, the account or password is incorrect.
  • If the value of code is 403, the permission is insufficient.
  • If the value of code is 404, the requested resource does not exist.

body

Object

Content returned by the API.

Output Example of the relateDataobject Function

{
  "headers": {
    "Transfer-Encoding": "chunked",
    "Server": "api-gateway",
    "X-Request-Id": "90fe94274a4c7ae3294556bdf8d5f79e",
    "X-Content-Type-Options": "nosniff",
    "Connection": "keep-alive",
    "lubanops-gtrace-id": "2654515-1777427347441-9830",
    "X-Download-Options": "noopen",
    "Pragma": "no-cache",
    "Date": "Wed, 29 Apr 2026 01:49:09 GMT",
    "lubanops-ntrace-id": "2654515-1777427347441-9830",
    "X-Frame-Options": "SAMEORIGIN",
    "Strict-Transport-Security": "max-age=31536000; includeSubdomains;",
    "lubanops-nenv-id": "374014",
    "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate, no-cache, no-store, must-revalidate",
    "Content-Encoding": "gzip",
    "Vary": "Origin, Access-Control-Request-Method, Access-Control-Request-Headers",
    "X-XSS-Protection": "1; mode=block;",
    "Content-Type": "application/json; charset=UTF-8"
  },
  "code": 200,
  "body": {
    "code": "00000000",
    "error_msg": "",
    "data": {
      "success_ids": [
        "05fa1ada-57f4-4ef7-9fee-ecd0372dba3b"
      ],
      "error_ids": []
    },
    "success": true,
    "error_code": "",
    "message": "",
    "request_id": ""
  }
}

Plugin Execution Function listResources

Parameters of the listResources Function

Function: Calls the corresponding SecMaster API to query the asset list based on specified conditions.

Table 21 Input parameters of the listResources function

Parameter

Parameter Type

Parameter Description

Mandatory

workspaceId

String

Workspace ID.

Yes

limit

String

This parameter is often used together with offset. limit specifies the maximum number of records to be returned, and offset specifies the starting point, or how many records to skip.

No

offset

String

This parameter is often used together with limit. limit specifies the maximum number of records to be returned, and offset specifies the starting point, or how many records to skip.

Yes

condition

String

Query condition. Example:

{
  "conditions": [
    {
      "name": "resource_id",
      "data": [
        "resource_id",
        "=",
        "d27f2d2e-5b35-4228-9533-7ad2c927f893"
      ]
    }
  ],
  "logics": [
    "resource_id"
  ]
}

Yes

resultVariable

String

Query result filter.

Yes

language

String

Response language of the query result. The value can be zh-cn or en-us. Uppercase letters and other values are not supported.

The value zh-cn indicates that the query result is displayed in simplified Chinese, and the value en-us indicates that the query result is displayed in English.

No

agency_type

String

Unified adaptation parameter for multiple accounts. Use the default value.

No
Table 22 Output parameters of the listResources function

Parameter

Parameter Type

Parameter Description

header

Object

Headers of the response returned by the SecMaster API. It includes basic request and response information, such as the request time, response service, and request ID.

code

Int

Status code, which indicates whether the request is successful.

Response code description:

  • If the value of code is 200, the request is successful.
  • If the value of code is 401, the account or password is incorrect.
  • If the value of code is 403, the permission is insufficient.
  • If the value of code is 404, the requested resource does not exist.

body

Object

Content returned by the API.

Output Example of the listResources Function

{
  "headers": {
    "Transfer-Encoding": "chunked",
    "Server": "api-gateway",
    "X-Request-Id": "d12bcd1201134dac90e28be8adf977dd",
    "X-Content-Type-Options": "nosniff",
    "Connection": "keep-alive",
    "lubanops-gtrace-id": "2654515-1777428667661-9954",
    "X-Download-Options": "noopen",
    "Pragma": "no-cache",
    "Date": "Wed, 29 Apr 2026 02:11:09 GMT",
    "lubanops-ntrace-id": "2654515-1777428667661-9954",
    "X-Frame-Options": "SAMEORIGIN",
    "Strict-Transport-Security": "max-age=31536000; includeSubdomains;",
    "lubanops-nenv-id": "374014",
    "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate, no-cache, no-store, must-revalidate",
    "Content-Encoding": "gzip",
    "Vary": "origin,access-control-request-method,access-control-request-headers,accept-encoding",
    "X-XSS-Protection": "1; mode=block;",
    "Content-Type": "application/json; charset=UTF-8"
  },
  "code": 200,
  "body": {
    "total": 1,
    "code": "00000000",
    "data": [
      {
        "workspace_id": "",
        "update_time": "2026-04-29T17:52:36.500+08:00",
        "create_time": "2026-04-02T03:41:59.711+08:00",
        "format_version": 0,
        "project_id": "",
        "dataclass_ref": {
          "name": "",
          "id": "830bc41c-c7e0-39c0-b8da-975a76392467"
        },
        "data_object": {
          "sys_key": "CloudServicecloudserversd27f2d2e-5b35-4228-9533-7ad2c927f8934135627a-3c8e-41d4-b414-62abdc508916",
          "type": "cloudservers",
          "domain_id": "a7e437dac49949148b08102a42bb0723",
          "workspace_id": "4135627a-3c8e-41d4-b414-62abdc508916",
          "domain_name": "scc_sa_l30042695_01",
          "update_time": "2026-04-29T09:52:36.500Z+0800",
          "is_deleted": false,
          "provider": "ecs",
          "project_id": "5c85b9f0a7884f649112f90d91739e28",
          "region_name": "cn-north-7",
          "id": "CloudServicecloudserversd27f2d2e-5b35-4228-9533-7ad2c927f8934135627a-3c8e-41d4-b414-62abdc508916",
          "public_ips": [
            "100.93.12.83"
          ],
          "is_build_in": true,
          "create_time": "2026-04-01T19:41:59.711Z+0800",
          "import_time": "2026-04-29T09:52:35.983Z+0800",
          "region_id": "cn-north-7",
          "dataclass_id": "830bc41c-c7e0-39c0-b8da-975a76392467",
          "resource_list": [
            {
              "id": "CloudServicevpcs316a461f-8219-498e-84cc-726d0ffe89764135627a-3c8e-41d4-b414-62abdc508916",
              "import_type": "Manual"
            },
            {
              "id": "CloudServicepublicips75a2eace-1c2a-445c-af59-6a2cd5cdf3374135627a-3c8e-41d4-b414-62abdc508916",
              "import_type": "Manual"
            },
            {
              "id": "CloudServicevpcs316a461f-8219-498e-84cc-726d0ffe89764135627a-3c8e-41d4-b414-62abdc508916",
              "import_type": "Manual"
            },
            {
              "id": "CloudServicewebsitea67510e1fb0445459e479620a096133d4135627a-3c8e-41d4-b414-62abdc508916",
              "import_type": "Manual"
            }
          ],
          "protected_status": "CLOSE",
          "environment": {
            "domain_id": "f9d7bacbfd2c49e892532ba3f62ab75d",
            "domain_name": "scc_sa_l00357374_01",
            "project_id": "f69081793d9e4ea8a2f479dcef961989",
            "region_id": "cn-north-7",
            "ep_id": "0",
            "project_name": "cn-north-7",
            "ep_name": "default",
            "vendor_type": "CloudService"
          },
          "trigger_flag": true,
          "name": "test-a00607964",
          "private_ips": [
            "192.168.0.246"
          ],
          "resource_id": "d27f2d2e-5b35-4228-9533-7ad2c927f893",
          "properties": {
            "ecs_cloudservers": {
              "availability_zone": "cn-north-7c",
              "metadata": {
                "image_name": "hce-2.0-enterprise-x86_64_20250407110955.qcow2",
                "vpc_id": "316a461f-8219-498e-84cc-726d0ffe8976",
                "os_type": "Linux",
                "resource_type": "1",
                "resource_spec_code": "ac6.2xlarge.2.linux",
                "os_bit": "64",
                "image_id": "55a65962-6e5f-48aa-8d5a-30abb42d90e5",
                "image_type": "gold"
              },
              "addresses": [
                {
                  "vpc_id": "316a461f-8219-498e-84cc-726d0ffe8976",
                  "mac_addr": "fa:16:3e:1e:76:6c",
                  "port_id": "dd749bc7-4430-4d62-8ab0-90462a32592d",
                  "addr": "192.168.0.246",
                  "type": "fixed",
                  "version": "4"
                },
                {
                  "vpc_id": "316a461f-8219-498e-84cc-726d0ffe8976",
                  "mac_addr": "fa:16:3e:1e:76:6c",
                  "port_id": "dd749bc7-4430-4d62-8ab0-90462a32592d",
                  "addr": "100.93.12.83",
                  "type": "floating",
                  "version": "4"
                }
              ],
              "create_time": "2025-11-11T11:23:20.000+08:00",
              "volumes_attached": [
                {
                  "boot_index": "0",
                  "delete_on_termination": "true",
                  "id": "00646d03-a12e-431e-a3af-2a4dbcf5ea1a",
                  "device": "/dev/vda"
                },
                {
                  "boot_index": "-1",
                  "delete_on_termination": "false",
                  "id": "399e1d13-db64-4909-8fc2-328fc33528f8",
                  "device": "/dev/vdb"
                }
              ],
              "description": "",
              "host_status": "UP",
              "host_id": "f504ea6eac53da17c7dfe11f764daeefa7426171d4cd8812b256bba4",
              "tags": [],
              "flavor": {
                "disk": "0",
                "name": "ac6.2xlarge.2",
                "id": "ac6.2xlarge.2",
                "vcpus": "8",
                "ram": "16384"
              },
              "security_groups": [
                {
                  "name": "SecMaster_One-click host isolation",
                  "id": "50830185-312e-423c-b045-374f0bb24035"
                },
                {
                  "name": "default",
                  "id": "587a32c2-0c23-4eee-ab79-9287679da14c"
                }
              ],
              "update_time": "2026-04-29T09:52:30.000+08:00",
              "enterprise_project_id": "0",
              "user_id": "5e01a57cf13b45bfa991d07937f6e57c",
              "project_id": "f69081793d9e4ea8a2f479dcef961989",
              "scheduler_hints": {},
              "name": "test-a00607964",
              "id": "d27f2d2e-5b35-4228-9533-7ad2c927f893",
              "locked": false,
              "host_name": "f504ea6eac53da17c7dfe11f764daeefa7426171d4cd8812b256bba4",
              "status": "ACTIVE"
            }
          }
        },
        "id": "CloudServicecloudserversd27f2d2e-5b35-4228-9533-7ad2c927f8934135627a-3c8e-41d4-b414-62abdc508916",
        "type": null,
        "version": 0
      }
    ],
    "size": 10,
    "success": true,
    "page": 0,
    "message": "",
    "request_id": ""
  }
}

Plugin Execution Function listType

Parameters of the listType Function

Function: Calls the corresponding SecMaster API to query the data class layout.

Table 23 Input parameters of the listType function

Parameter

Parameter Type

Parameter Description

Mandatory

workspaceId

String

Workspace ID.

Yes

limit

String

This parameter is often used together with offset. limit specifies the maximum number of records to be returned, and offset specifies the starting point, or how many records to skip.

No

dataclassName

String

Data class business code. The options are Alert, Incident, Indicator, Evidence, Vulnerability, Resource, PolicyRecord, Baseline, and Policy.

Yes

offset

String

This parameter is often used together with limit. limit specifies the maximum number of records to be returned, and offset specifies the starting point, or how many records to skip.

Yes

categoryCode

String

Data classification code.

Yes

subCategoryCode

String

Sub-data classification code.

Yes

subCategory

String

Sub-data classification.

No

resultVariable

String

Query result filter.

No

language

String

Response language of the query result. The value can be zh-cn or en-us. Uppercase letters and other values are not supported.

The value zh-cn indicates that the query result is displayed in simplified Chinese, and the value en-us indicates that the query result is displayed in English.

No

agency_type

String

Unified adaptation parameter for multiple accounts. Use the default value.

No
Table 24 Output parameters of the listType function

Parameter

Parameter Type

Parameter Description

header

Object

Headers of the response returned by the SecMaster API. It includes basic request and response information, such as the request time, response service, and request ID.

code

Int

Status code, which indicates whether the request is successful.

Response code description:

  • If the value of code is 200, the request is successful.
  • If the value of code is 401, the account or password is incorrect.
  • If the value of code is 403, the permission is insufficient.
  • If the value of code is 404, the requested resource does not exist.

body

Object

Content returned by the API.

Output Example of the listType Function

{
  "headers": {
    "Transfer-Encoding": "chunked",
    "Server": "api-gateway",
    "X-Request-Id": "dd699f389b510cb39432a0ca8cce0e2c",
    "X-Content-Type-Options": "nosniff",
    "Connection": "keep-alive",
    "lubanops-gtrace-id": "2654515-1777442860773-13046",
    "X-Download-Options": "noopen",
    "Pragma": "no-cache",
    "Date": "Wed, 29 Apr 2026 06:07:40 GMT",
    "lubanops-ntrace-id": "2654515-1777442860773-13046",
    "X-Frame-Options": "SAMEORIGIN",
    "Strict-Transport-Security": "max-age=31536000; includeSubdomains;",
    "lubanops-nenv-id": "374014",
    "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate, no-cache, no-store, must-revalidate",
    "Content-Encoding": "gzip",
    "Vary": "Origin, Access-Control-Request-Method, Access-Control-Request-Headers",
    "X-XSS-Protection": "1; mode=block;",
    "Content-Type": "application/json; charset=UTF-8"
  },
  "code": 200,
  "body": {
    "total": 0,
    "code": "00000000",
    "error_msg": "",
    "data": [],
    "size": 1,
    "success": true,
    "error_code": "",
    "page": 0,
    "message": "",
    "request_id": ""
  }
}

Plugin Execution Function createDataobjectBatch

Parameters of the createDataobjectBatch Function

Function: Calls the corresponding SecMaster API to create data objects in batches.

Table 25 Input parameters of the createDataobjectBatch function

Parameter

Parameter Type

Parameter Description

Mandatory

workspaceId

String

Workspace ID.

Yes

id

String

Data object ID.

No

dataclass

String

Data class business code. The options are Alert, Incident, Indicator, Evidence, Vulnerability, Resource, PolicyRecord, Baseline, and Policy.

Yes

type

String

Set this parameter to the fixed value DATA_SOURCE.

Yes

formatVersion

String

Version of the aligned template. The default value is 1.

Yes

dataObjectList

String

Data object details list. The value must be a string in JSON format.

Yes

triggerFlag

String

The options are true and false.

Whether to trigger the playbook with Trigger Condition set to Event Trigger and Trigger Method set to Created. The default value is false. The recommended value is false.

No

language

String

Response language of the query result. The value can be zh-cn or en-us. Uppercase letters and other values are not supported.

The value zh-cn indicates that the query result is displayed in simplified Chinese, and the value en-us indicates that the query result is displayed in English.

No

agency_type

String

Unified adaptation parameter for multiple accounts. Use the default value.

No
Table 26 Output parameters of the createDataobjectBatch function

Parameter

Parameter Type

Parameter Description

header

Object

Headers of the response returned by the SecMaster API. It includes basic request and response information, such as the request time, response service, and request ID.

code

Int

Status code, which indicates whether the request is successful.

Response code description:

  • If the value of code is 200, the request is successful.
  • If the value of code is 401, the account or password is incorrect.
  • If the value of code is 403, the permission is insufficient.
  • If the value of code is 404, the requested resource does not exist.

body

Object

Content returned by the API.

Output Example of the createDataobjectBatch Function

{
  "headers": {
    "Transfer-Encoding": "chunked",
    "Server": "api-gateway",
    "X-Request-Id": "5f4bc7c26041faffec036bc14b60fee5",
    "X-Content-Type-Options": "nosniff",
    "Connection": "keep-alive",
    "X-Download-Options": "noopen",
    "Pragma": "no-cache",
    "Date": "Thu, 09 Apr 2026 01:57:59 GMT",
    "X-Frame-Options": "SAMEORIGIN",
    "Strict-Transport-Security": "max-age=31536000; includeSubdomains;",
    "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate",
    "Content-Encoding": "gzip",
    "Vary": "origin,access-control-request-method,access-control-request-headers,accept-encoding",
    "X-XSS-Protection": "1; mode=block;",
    "Content-Type": "application/json; charset=UTF-8"
  },
  "code": 200,
  "body": {
    "event_id": "null",
    "id": "79c85b41-72f2-4827-9e90-345deb3cf75b"
  }
}

Plugin Execution Function showWorkspace

Parameters of the showWorkspace Function

Function: Calls the corresponding SecMaster API to query workspace details.

Table 27 Input parameters of the showWorkspace function

Parameter

Parameter Type

Parameter Description

Mandatory

workspaceId

String

Workspace ID.

Yes

resultVariable

String

Query result filter.

No

agency_type

String

Unified adaptation parameter for multiple accounts. Use the default value.

No
Table 28 Output parameters of the showWorkspace function

Parameter

Parameter Type

Parameter Description

header

Object

Headers of the response returned by the SecMaster API. It includes basic request and response information, such as the request time, response service, and request ID.

code

Int

Status code, which indicates whether the request is successful.

Response code description:

  • If the value of code is 200, the request is successful.
  • If the value of code is 401, the account or password is incorrect.
  • If the value of code is 403, the permission is insufficient.
  • If the value of code is 404, the requested resource does not exist.

body

Object

Content returned by the API.

Output Example of the showWorkspace Function

{
  "headers": {
    "Transfer-Encoding": "chunked",
    "Server": "api-gateway",
    "X-Request-Id": "a87360ec5001f532893bfa07b2e73e1b",
    "X-Content-Type-Options": "nosniff",
    "Connection": "keep-alive",
    "X-Download-Options": "noopen",
    "Pragma": "no-cache",
    "Date": "Tue, 28 Apr 2026 02:28:55 GMT",
    "X-Frame-Options": "SAMEORIGIN",
    "Strict-Transport-Security": "max-age=31536000; includeSubdomains;",
    "Cache-Control": "no-cache, no-store, must-revalidate",
    "Content-Encoding": "gzip",
    "Vary": "Origin, Access-Control-Request-Method, Access-Control-Request-Headers",
    "X-XSS-Protection": "1; mode=block;",
    "Content-Type": "application/json; charset=UTF-8"
  },
  "code": 200,
  "body": {
    "workspace": {
      "modifier_name": "scc_sa_l30042695_01",
      "create_time": "2026-02-11T10:32:52Z+0800",
      "enterprise_project_name": "",
      "workspace_agency_list": [],
      "is_view": false,
      "region_id": "cn-north-7",
      "description": "1123114122",
      "is_main_workspace": true,
      "project_name": "cn-north-7",
      "tags": [],
      "domain_id": "a7e437dac49949148b08102a42bb0723",
      "domain_name": "scc_sa_l30042695_01",
      "enterprise_project_id": "",
      "update_time": "2026-04-28T09:40:13Z+0800",
      "is_force_init": null,
      "project_id": "5c85b9f0a7884f649112f90d91739e28",
      "view_bind_id": "",
      "creator_id": "4f47b0fa23364416a105bf59b3f5a062",
      "modifier_id": "3c8f21444d0d4fe5bdc3299ed481fae9",
      "name": "Multi-account baseline check test",
      "creator_name": "z60055177",
      "id": "4135627a-3c8e-41d4-b414-62abdc508916",
      "statistical_resource": {
        "alerts": null,
        "assets": null,
        "playbook_instances": null,
        "incidents": null,
        "playbooks": null,
        "vulnerabilities": null,
        "dataspaces": null
      },
      "view_bind_name": ""
    }
  }
}

Plugin Execution Function entitlementServiceAssociationAgency

Parameters of the entitlementServiceAssociationAgency Function

Function: Calls the corresponding SecMaster API to create an agency based on the role and scope in the body and assigns a policy to the agency.

Table 29 Input parameters of the entitlementServiceAssociationAgency function

Parameter

Parameter Type

Parameter Description

Mandatory

organization_id

String

Organization ID.

Yes

language

String

Response language of the query result. The value can be zh-cn or en-us. Uppercase letters and other values are not supported.

The value zh-cn indicates that the query result is displayed in simplified Chinese, and the value en-us indicates that the query result is displayed in English.

No

agency_type

String

Unified adaptation parameter for multiple accounts. Use the default value.

No
Table 30 Output parameters of the entitlementServiceAssociationAgency function

Parameter

Parameter Type

Parameter Description

header

Object

Headers of the response returned by the SecMaster API. It includes basic request and response information, such as the request time, response service, and request ID.

code

Int

Status code, which indicates whether the request is successful.

Response code description:

  • If the value of code is 200, the request is successful.
  • If the value of code is 401, the account or password is incorrect.
  • If the value of code is 403, the permission is insufficient.
  • If the value of code is 404, the requested resource does not exist.

body

Object

Content returned by the API.

Output Example of the entitlementServiceAssociationAgency Function

{
  "headers": {
    "Transfer-Encoding": "chunked",
    "Server": "api-gateway",
    "X-Request-Id": "2498b1b1d3bda69fc0c6d942ce46bf21",
    "X-Content-Type-Options": "nosniff",
    "Connection": "keep-alive",
    "X-Download-Options": "noopen",
    "Pragma": "no-cache",
    "Date": "Wed, 06 May 2026 07:33:48 GMT",
    "X-Frame-Options": "SAMEORIGIN",
    "Strict-Transport-Security": "max-age=31536000; includeSubdomains;",
    "Cache-Control": "no-cache, no-store, must-revalidate",
    "Vary": "Origin, Access-Control-Request-Method, Access-Control-Request-Headers",
    "X-XSS-Protection": "1; mode=block;",
    "Content-Type": "application/json"
  },
  "code": 200,
  "body": "success"
}

Plugin Execution Function showComment

Parameters of the showComment Function

Function: Calls the corresponding SecMaster API to search for comments.

Table 31 Input parameters of the showComment function

Parameter

Parameter Type

Parameter Description

Mandatory

workspace_id

String

Organization ID.

Yes

alert_id

String

ID of the commented object.

Yes

limit

String

The maximum number of records can be returned on each page for a pagination query. The value starts from 1.

Yes

offset

String

Page query parameter. This parameter specifies the start position of the query result. The value starts from 0.

Yes

order

String

Sorting order. Options:

  • DESC: sorting in descending order
  • ASC: sorting in ascending order

No

sortby

String

Field for sorting.

No

resultVariable

String

Query result filter.

No

language

String

Response language of the query result. The value can be zh-cn or en-us. Uppercase letters and other values are not supported.

The value zh-cn indicates that the query result is displayed in simplified Chinese, and the value en-us indicates that the query result is displayed in English.

No

agency_type

String

Unified adaptation parameter for multiple accounts. Use the default value.

No
Table 32 Output parameters of the showComment function

Parameter

Parameter Type

Parameter Description

header

Object

Headers of the response returned by the SecMaster API. It includes basic request and response information, such as the request time, response service, and request ID.

code

Int

Status code, which indicates whether the request is successful.

Response code description:

  • If the value of code is 200, the request is successful.
  • If the value of code is 401, the account or password is incorrect.
  • If the value of code is 403, the permission is insufficient.
  • If the value of code is 404, the requested resource does not exist.

body

Object

Content returned by the API.

Output Example of the showComment Function

{
  "headers": {
    "Transfer-Encoding": "chunked",
    "Server": "api-gateway",
    "X-Request-Id": "2fc5bfce28b41aea69ea23f2394fb258",
    "X-Content-Type-Options": "nosniff",
    "Connection": "keep-alive",
    "X-Download-Options": "noopen",
    "Pragma": "no-cache",
    "Date": "Wed, 29 Apr 2026 08:14:55 GMT",
    "X-Frame-Options": "SAMEORIGIN",
    "Strict-Transport-Security": "max-age=31536000; includeSubdomains;",
    "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate",
    "Content-Encoding": "gzip",
    "Vary": "origin,access-control-request-method,access-control-request-headers,accept-encoding",
    "X-XSS-Protection": "1; mode=block;",
    "Content-Type": "application/json; charset=UTF-8"
  },
  "code": 200,
  "body": {
    "total": 8,
    "code": "00000000",
    "data": [
      {
        "note_type": "note",
        "war_room_id": "79c85b41-72f2-4827-9e90-345deb3cf75b",
        "create_time": "2026-04-28T15:33:14.698Z+0800",
        "data": {
          "content": "<div><span style=\"font-size: 14px; color: #191919\">[Project ID]</span><span style=\"font-size: 14px; color: #595959\"> 099706f4090026a62f0bc014b68c0527</span></div><div><span style=\"font-size: 14px; color: #191919\">[Workspace ID]</span><span style=\"font-size: 14px; color: #595959\"> ff86716b-62bb-49c6-af65-75192ca0c28b</span></div><div><span style=\"font-size: 14px; color: #191919\"> [Data object ID] </span><span style=\"font-size: 14px; color: #595959\"> 79c85b41-72f2-4827-9e90-345deb3cf75b</span></div><div><span style=\"font-size: 14px; color: #191919\">[Playbook name]</span><span style=\"font-size: 14px; color: #595959\"> Add the IP indicator tag to the alert</span></div><div><span style=\"font-size: 14px; color: #191919\">[Playbook instance ID]</span><span style=\"font-size: 14px; color: #595959\"> fcd884bb-d4f6-44b5-be23-b0e6e8b14e01</span></div><div><span style=\"font-size: 14px; color: #191919\">[Playbook instance name]</span><span style=\"font-size: 14px; color: #595959\"> ADD THE IP INDICATOR TAG TO THE ALERT-v1-20260428153314-554600</span></div><div><span style=\"font-size: 14px; color: #191919\">[Result]</span><span style="font-size: 14px; color: #595959">Successful</span></div>"
        },
        "content_en": null,
        "type": "textMessage",
        "content": {
          "come_from": "SecMasterRobot",
          "occurred_time": "2026-04-28T15:33:14.698Z+0800",
          "value": "<div><span style=\"font-size: 14px; color: #191919\">[Project ID]</span><span style=\"font-size: 14px; color: #595959\"> 099706f4090026a62f0bc014b68c0527</span></div><div><span style=\"font-size: 14px; color: #191919\">[Workspace ID]</span><span style=\"font-size: 14px; color: #595959\"> ff86716b-62bb-49c6-af65-75192ca0c28b</span></div><div><span style=\"font-size: 14px; color: #191919\">[Data object ID]</span><span style=\"font-size: 14px; color: #595959\"> 79c85b41-72f2-4827-9e90-345deb3cf75b</span></div><div><span style=\"font-size: 14px; color: #191919\">[Playbook name]</span><span style=\"font-size: 14px; color: #595959\"> Add the IP indicator tag to the alert</span></div><div><span style=\"font-size: 14px; color: #191919\">[Playbook instance ID]</span><span style=\"font-size: 14px; color: #595959\"> fcd884bb-d4f6-44b5-be23-b0e6e8b14e01</span></div><div><span style=\"font-size: 14px; color: #191919\">[Playbook instance name]</span><span style=\"font-size: 14px; color: #595959\"> ADD THE IP INDICATOR TAG TO THE ALERT-v1-20260428153314-554600</span></div><div><span style=\"font-size: 14px; color: #191919\">[Result]</span><span style="font-size: 14px; color: #595959">Successful</span></div>"
        },
        "tags": "",
        "target": null,
        "content_zh": null,
        "workspace_id": "ff86716b-62bb-49c6-af65-75192ca0c28b",
        "update_time": "2026-04-28T15:33:14.698Z+0800",
        "is_deleted": false,
        "project_id": "099706f4090026a62f0bc014b68c0527",
        "marked_note": true,
        "marked_evidence": null,
        "id": "4cb62d15-ebe1-49c3-b9dd-eebf61873045",
        "user": {
          "name": "SecMasterRobot",
          "id": "SecMasterRobot"
        }
      },
      {
        "note_type": "relateToDataObject",
        "war_room_id": "79c85b41-72f2-4827-9e90-345deb3cf75b",
        "create_time": "2026-04-28T15:33:12.558Z+0800",
        "data": {
          "content": "w3_sso_secmaster_ops_02 associated indicators, ID list: a2446ff2-33fe-4cb8-83a4-12a653fe64ad"
        },
        "content_en": null,
        "type": "textMessage",
        "content": {
          "come_from": "w3_sso_secmaster_ops_02",
          "occurred_time": "2026-04-28T15:33:12.558Z+0800",
          "value": "w3_sso_secmaster_ops_02 associated indicators, ID list: a2446ff2-33fe-4cb8-83a4-12a653fe64ad"
        },
        "tags": "",
        "target": null,
        "content_zh": null,
        "workspace_id": "ff86716b-62bb-49c6-af65-75192ca0c28b",
        "update_time": "2026-04-28T15:33:12.558Z+0800",
        "is_deleted": false,
        "project_id": "099706f4090026a62f0bc014b68c0527",
        "marked_note": true,
        "marked_evidence": null,
        "id": "2e4d2eed-25a7-42f9-b582-f7688e5fc495",
        "user": {
          "name": "w3_sso_secmaster_ops_02",
          "id": "w3_sso_secmaster_ops_02:w3_ops:t30027803"
        }
      },
      {
        "note_type": "note",
        "war_room_id": "79c85b41-72f2-4827-9e90-345deb3cf75b",
        "create_time": "2026-04-09T09:58:50.150Z+0800",
        "data": {
          "content": "<div><span style=\"font-size: 14px; color: #191919\">[Project ID]</span><span style=\"font-size: 14px; color: #595959\"> 099706f4090026a62f0bc014b68c0527</span></div><div><span style=\"font-size: 14px; color: #191919\">[Workspace ID]</span><span style=\"font-size: 14px; color: #595959\"> ff86716b-62bb-49c6-af65-75192ca0c28b</span></div><div><span style=\"font-size: 14px; color: #191919\">[Data object ID]</span><span style=\"font-size: 14px; color: #595959\"> 79c85b41-72f2-4827-9e90-345deb3cf75b</span></div><div><span style=\"font-size: 14px; color: #191919\">[Playbook name]</span><span style=\"font-size: 14px; color: #595959\"> Add the IP indicator tag to the alert</span></div><div><span style=\"font-size: 14px; color: #191919\">[Playbook instance ID]</span><span style=\"font-size: 14px; color: #595959\"> 4cc934cd-a614-426b-9a95-400376ead83c</span></div><div><span style=\"font-size: 14px; color: #191919\">[Playbook instance name]</span><span style=\"font-size: 14px; color: #595959\"> ADD THE IP INDICATOR TAG TO THE ALERT-v1-20260409095835-14165</span></div><div><span style=\"font-size: 14px; color: #191919\">[Result]</span><span style="font-size: 14px; color: #595959">Successful</span></div>"
        },
        "content_en": null,
        "type": "textMessage",
        "content": {
          "come_from": "SecMasterRobot",
          "occurred_time": "2026-04-09T09:58:50.150Z+0800",
          "value": "<div><span style=\"font-size: 14px; color: #191919\">[Project ID]</span><span style=\"font-size: 14px; color: #595959\"> 099706f4090026a62f0bc014b68c0527</span></div><div><span style=\"font-size: 14px; color: #191919\">[Workspace ID]</span><span style=\"font-size: 14px; color: #595959\"> ff86716b-62bb-49c6-af65-75192ca0c28b</span></div><div><span style=\"font-size: 14px; color: #191919\">[Data object ID]</span><span style=\"font-size: 14px; color: #595959\"> 79c85b41-72f2-4827-9e90-345deb3cf75b</span></div><div><span style=\"font-size: 14px; color: #191919\">[Playbook name]</span><span style=\"font-size: 14px; color: #595959\">Add the IP indicator tag to the alert</span></div><div><span style=\"font-size: 14px; color: #191919\">[Playbook instance ID]</span><span style=\"font-size: 14px; color: #595959\"> 4cc934cd-a614-426b-9a95-400376ead83c</span></div><div><span style=\"font-size: 14px; color: #191919\">[Playbook instance name]</span><span style=\"font-size: 14px; color: #595959\"> ADD THE IP INDICATOR TAG TO THE ALERT-v1-20260409095835-14165</span></div><div><span style=\"font-size: 14px; color: #191919\">[Result]</span><span style="font-size: 14px; color: #595959">Successful</span></div>"
        },
        "tags": "",
        "target": null,
        "content_zh": null,
        "workspace_id": "ff86716b-62bb-49c6-af65-75192ca0c28b",
        "update_time": "2026-04-09T09:58:50.150Z+0800",
        "is_deleted": false,
        "project_id": "099706f4090026a62f0bc014b68c0527",
        "marked_note": true,
        "marked_evidence": null,
        "id": "d93a11cf-b621-4875-b632-0372bdef0441",
        "user": {
          "name": "SecMasterRobot",
          "id": "SecMasterRobot"
        }
      },
      {
        "note_type": "note",
        "war_room_id": "79c85b41-72f2-4827-9e90-345deb3cf75b",
        "create_time": "2026-04-09T09:58:35.987Z+0800",
        "data": {
          "content": "<div><span style=\"font-size: 14px; color: #191919\">[Project ID]</span><span style=\"font-size: 14px; color: #595959\"> 099706f4090026a62f0bc014b68c0527</span></div><div><span style=\"font-size: 14px; color: #191919\">[Workspace ID]</span><span style=\"font-size: 14px; color: #595959\"> ff86716b-62bb-49c6-af65-75192ca0c28b</span></div><div><span style=\"font-size: 14px; color: #191919\">[Data object ID]</span><span style=\"font-size: 14px; color: #595959\"> 79c85b41-72f2-4827-9e90-345deb3cf75b</span></div><div><span style=\"font-size: 14px; color: #191919\">[Playbook name]</span><span style="font-size: 14px; color: #595959">Repeated alarms are automatically closed.</span></div><div><span style="font-size: 14px; color: #191919">[Playbook instance ID] </span><span style=\"font-size: 14px; color: #595959\"> 55f8a830-a22a-489a-94d0-563a4c6bbd75</span></div><div><span style=\"font-size: 14px; color: #191919\"> [Playbook instance name] </span><span style=\"font-size: 14px; color: #595959\"> ZFGJZDGB-v1-20260409095800-13072</span></div><div><span style=\"font-size: 14px; color: #191919\"> [Result] </span><span style="font-size: 14px; color: #595959">Successful.</span></div>
        },
        "content_en": null,
        "type": "textMessage",
        "content": {
          "come_from": "SecMasterRobot",
          "occurred_time": "2026-04-09T09:58:35.987Z+0800",
          "value": "<div><span style=\"font-size: 14px; color: #191919\">[Project ID]</span><span style=\"font-size: 14px; color: #595959\"> 099706f4090026a62f0bc014b68c0527</span></div><div><span style=\"font-size: 14px; color: #191919\">[Workspace ID]</span><span style=\"font-size: 14px; color: #595959\"> ff86716b-62bb-49c6-af65-75192ca0c28b</span></div><div><span style=\"font-size: 14px; color: #191919\">[Data object ID]</span><span style=\"font-size: 14px; color: #595959\"> 79c85b41-72f2-4827-9e90-345deb3cf75b</span></div><div><span style=\"font-size: 14px; color: #191919\">[Playbook name]</span><span style="font-size: 14px; color: #595959">Repeated alarms are automatically closed.</span></div><div><span style="font-size: 14px; color: #191919">[Playbook instance ID]</span><span style=\"font-size: 14px; color: #595959\"> 55f8a830-a22a-489a-94d0-563a4c6bbd75</span></div><div><span style=\"font-size: 14px; color: #191919\">[Playbook instance name]</span><span style=\"font-size: 14px; color: #595959\"> ZFGJZDGB-v1-20260409095800-13072</span></div><div><span style=\"font-size: 14px; color: #191919\">[Result]</span><span style="font-size: 14px; color: #595959">Successful.</span></div>
        },
        "tags": "",
        "target": null,
        "content_zh": null,
        "workspace_id": "ff86716b-62bb-49c6-af65-75192ca0c28b",
        "update_time": "2026-04-09T09:58:35.987Z+0800",
        "is_deleted": false,
        "project_id": "099706f4090026a62f0bc014b68c0527",
        "marked_note": true,
        "marked_evidence": null,
        "id": "d64522b9-be7f-40dc-9a1b-811b9cc9eb7a",
        "user": {
          "name": "SecMasterRobot",
          "id": "SecMasterRobot"
        }
      },
      {
        "note_type": "relateToDataObject",
        "war_room_id": "79c85b41-72f2-4827-9e90-345deb3cf75b",
        "create_time": "2026-04-09T09:58:35.145Z+0800",
        "data": {
          "content": "SecMasterRobot associated alerts, ID list: 79c85b41-72f2-4827-9e90-345deb3cf75b"
        },
        "content_en": null,
        "type": "textMessage",
        "content": {
          "come_from": "SecMasterRobot",
          "occurred_time": "2026-04-09T09:58:35.145Z+0800",
          "value": "SecMasterRobot associated alerts, ID list: 79c85b41-72f2-4827-9e90-345deb3cf75b"
        },
        "tags": "",
        "target": null,
        "content_zh": null,
        "workspace_id": "ff86716b-62bb-49c6-af65-75192ca0c28b",
        "update_time": "2026-04-09T09:58:35.145Z+0800",
        "is_deleted": false,
        "project_id": "099706f4090026a62f0bc014b68c0527",
        "marked_note": true,
        "marked_evidence": null,
        "id": "cfd60b92-5d89-4cf8-b969-d1a3dbc7bcab",
        "user": {
          "name": "SecMasterRobot",
          "id": "SecMasterRobot"
        }
      },
      {
        "note_type": "note",
        "war_room_id": "79c85b41-72f2-4827-9e90-345deb3cf75b",
        "create_time": "2026-04-09T09:58:32.441Z+0800",
        "data": {
          "content": "<div><span style=\"font-size: 14px; color: #191919\">[Project ID]</span><span style=\"font-size: 14px; color: #595959\"> 099706f4090026a62f0bc014b68c0527</span></div><div><span style=\"font-size: 14px; color: #191919\">[Workspace ID]</span><span style=\"font-size: 14px; color: #595959\"> ff86716b-62bb-49c6-af65-75192ca0c28b</span></div><div><span style=\"font-size: 14px; color: #191919\"> [Data object ID] </span><span style=\"font-size: 14px; color: #595959\"> 79c85b41-72f2-4827-9e90-345deb3cf75b</span></div><div><span style=\"font-size: 14px; color: #191919\">[Playbook name]</span><span style="font-size: 14px; color: #595959">Host defense alarm correlation with historical handling information </span></div><div><span style="font-size: 14px; color: #191919">[Playbook instance ID]</span><span style=\"font-size: 14px; color: #595959\"> 7968bf95-5cb8-4c48-99cf-caa6fc2b4379</span></div><div><span style=\"font-size: 14px; color: #191919\">[Playbook instance name]</span><span style=\"font-size: 14px; color: #595959\"> ZJFXGJGLLSCZXX-v1-20260409095800-13070</span></div><div><span style=\"font-size: 14px; color: #191919\"> [Result] </span><span style="font-size: 14px; color: #595959">Failed </span></div>"
        },
        "content_en": null,
        "type": "textMessage",
        "content": {
          "come_from": "SecMasterRobot",
          "occurred_time": "2026-04-09T09:58:32.441Z+0800",
          "value": "<div><span style=\"font-size: 14px; color: #191919\">[Project ID]</span><span style=\"font-size: 14px; color: #595959\"> 099706f4090026a62f0bc014b68c0527</span></div><div><span style=\"font-size: 14px; color: #191919\">[Workspace ID]</span><span style=\"font-size: 14px; color: #595959\"> ff86716b-62bb-49c6-af65-75192ca0c28b</span></div><div><span style=\"font-size: 14px; color: #191919\"> [Data object ID] </span><span style=\"font-size: 14px; color: #595959\"> 79c85b41-72f2-4827-9e90-345deb3cf75b</span></div><div><span style=\"font-size: 14px; color: #191919\">[Playbook name]</span><span style="font-size: 14px; color: #595959">Host defense alarm correlation with historical handling information </span></div><div><span style="font-size: 14px; color: #191919">[Playbook instance ID]</span><span style=\"font-size: 14px; color: #595959\"> 7968bf95-5cb8-4c48-99cf-caa6fc2b4379</span></div><div><span style=\"font-size: 14px; color: #191919\">[Playbook instance name]</span><span style=\"font-size: 14px; color: #595959\"> ZJFXGJGLLSCZXX-v1-20260409095800-13070</span></div><div><span style=\"font-size: 14px; color: #191919\"> [Result] </span><span style="font-size: 14px; color: #595959">Failed </span></div>"
        },
        "tags": "",
        "target": null,
        "content_zh": null,
        "workspace_id": "ff86716b-62bb-49c6-af65-75192ca0c28b",
        "update_time": "2026-04-09T09:58:32.441Z+0800",
        "is_deleted": false,
        "project_id": "099706f4090026a62f0bc014b68c0527",
        "marked_note": true,
        "marked_evidence": null,
        "id": "c41cb9e3-3e69-480f-b1d7-614fed2def42",
        "user": {
          "name": "SecMasterRobot",
          "id": "SecMasterRobot"
        }
      },
      {
        "note_type": "note",
        "war_room_id": "79c85b41-72f2-4827-9e90-345deb3cf75b",
        "create_time": "2026-04-09T09:58:32.274Z+0800",
        "data": {
          "content": "<div><span style=\"font-size: 14px; color: #191919\">[Project ID]</span><span style=\"font-size: 14px; color: #595959\"> 099706f4090026a62f0bc014b68c0527</span></div><div><span style=\"font-size: 14px; color: #191919\">[Workspace ID]</span><span style=\"font-size: 14px; color: #595959\"> ff86716b-62bb-49c6-af65-75192ca0c28b</span></div><div><span style=\"font-size: 14px; color: #191919\"> [Data object ID] </span><span style=\"font-size: 14px; color: #595959\"> 79c85b41-72f2-4827-9e90-345deb3cf75b</span></div><div><span style=\"font-size: 14px; color: #191919\">[Playbook name]</span><span style="font-size: 14px; color: #595959">Host defense alarm correlation with historical handling information </span></div><div><span style="font-size: 14px; color: #191919">[Playbook instance ID]</span><span style=\"font-size: 14px; color: #595959\"> 7968bf95-5cb8-4c48-99cf-caa6fc2b4379</span></div><div><span style=\"font-size: 14px; color: #191919\">[Playbook instance name]</span><span style=\"font-size: 14px; color: #595959\"> ZJFXGJGLLSCZXX-v1-20260409095800-13070</span></div><div><span style=\"font-size: 14px; color: #191919\"> [Result] </span><span style="font-size: 14px; color: #595959">Failed </span></div>"
        },
        "content_en": null,
        "type": "textMessage",
        "content": {
          "come_from": "SecMasterRobot",
          "occurred_time": "2026-04-09T09:58:32.274Z+0800",
          "value": "<div><span style=\"font-size: 14px; color: #191919\">[Project ID]</span><span style=\"font-size: 14px; color: #595959\"> 099706f4090026a62f0bc014b68c0527</span></div><div><span style=\"font-size: 14px; color: #191919\">[Workspace ID]</span><span style=\"font-size: 14px; color: #595959\"> ff86716b-62bb-49c6-af65-75192ca0c28b</span></div><div><span style=\"font-size: 14px; color: #191919\"> [Data object ID] </span><span style=\"font-size: 14px; color: #595959\"> 79c85b41-72f2-4827-9e90-345deb3cf75b</span></div><div><span style=\"font-size: 14px; color: #191919\">[Playbook name]</span><span style="font-size: 14px; color: #595959">Host defense alarm correlation with historical handling information </span></div><div><span style="font-size: 14px; color: #191919">[Playbook instance ID]</span><span style=\"font-size: 14px; color: #595959\"> 7968bf95-5cb8-4c48-99cf-caa6fc2b4379</span></div><div><span style=\"font-size: 14px; color: #191919\">[Playbook instance name]</span><span style=\"font-size: 14px; color: #595959\"> ZJFXGJGLLSCZXX-v1-20260409095800-13070</span></div><div><span style=\"font-size: 14px; color: #191919\"> [Result] </span><span style="font-size: 14px; color: #595959">Failed </span></div>"
        },
        "tags": "",
        "target": null,
        "content_zh": null,
        "workspace_id": "ff86716b-62bb-49c6-af65-75192ca0c28b",
        "update_time": "2026-04-09T09:58:32.274Z+0800",
        "is_deleted": false,
        "project_id": "099706f4090026a62f0bc014b68c0527",
        "marked_note": true,
        "marked_evidence": null,
        "id": "9f92f602-5cde-41fb-8da1-92aa1caaafea",
        "user": {
          "name": "SecMasterRobot",
          "id": "SecMasterRobot"
        }
      },
      {
        "note_type": "note",
        "war_room_id": "79c85b41-72f2-4827-9e90-345deb3cf75b",
        "create_time": "2026-04-09T09:58:31.904Z+0800",
        "data": {
          "content": "<div><span style=\"font-size: 14px; color: #191919\">[Project ID]</span><span style=\"font-size: 14px; color: #595959\"> 099706f4090026a62f0bc014b68c0527</span></div><div><span style=\"font-size: 14px; color: #191919\"> [Workspace ID] </span><span style=\"font-size: 14px; color: #595959\"> ff86716b-62bb-49c6-af65-75192ca0c28b</span></div><div><span style=\"font-size: 14px; color: #191919\">[Data object ID]</span><span style=\"font-size: 14px; color: #595959\"> 79c85b41-72f2-4827-9e90-345deb3cf75b</span></div><div><span style=\"font-size: 14px; color: #191919\">[Playbook name]</span><span style=\"font-size: 14px; color: #595959\"> Add the IP indicator tag to the alert</span></div><div><span style=\"font-size: 14px; color: #191919\">[Playbook instance ID]</span><span style=\"font-size: 14px; color: #595959\"> 4d02b847-9741-4df7-a8ea-89b45fbe7ca9</span></div><div><span style=\"font-size: 14px; color: #191919\">[Playbook instance name]</span><span style=\"font-size: 14px; color: #595959\"> ADD THE IP INDICATOR TAG TO THE ALERT-v1-20260409095800-13071</span></div><div><span style=\"font-size: 14px; color: #191919\">[Result]</span><span style="font-size: 14px; color: #595959">Successful</span></div>"
        },
        "content_en": null,
        "type": "textMessage",
        "content": {
          "come_from": "SecMasterRobot",
          "occurred_time": "2026-04-09T09:58:31.904Z+0800",
          "value": "<div><span style=\"font-size: 14px; color: #191919\">[Project ID]</span><span style=\"font-size: 14px; color: #595959\"> 099706f4090026a62f0bc014b68c0527</span></div><div><span style=\"font-size: 14px; color: #191919\"> [Workspace ID] </span><span style=\"font-size: 14px; color: #595959\"> ff86716b-62bb-49c6-af65-75192ca0c28b</span></div><div><span style=\"font-size: 14px; color: #191919\">[Data object ID]</span><span style=\"font-size: 14px; color: #595959\"> 79c85b41-72f2-4827-9e90-345deb3cf75b</span></div><div><span style=\"font-size: 14px; color: #191919\">[Playbook name]</span><span style=\"font-size: 14px; color: #595959\"> Add the IP indicator tag to the alert</span></div><div><span style=\"font-size: 14px; color: #191919\">[Playbook instance ID]</span><span style=\"font-size: 14px; color: #595959\"> 4d02b847-9741-4df7-a8ea-89b45fbe7ca9</span></div><div><span style=\"font-size: 14px; color: #191919\">[Playbook instance name]</span><span style=\"font-size: 14px; color: #595959\"> ADD THE IP INDICATOR TAG TO THE ALERT-v1-20260409095800-13071</span></div><div><span style=\"font-size: 14px; color: #191919\">[Result]</span><span style="font-size: 14px; color: #595959">Successful</span></div>"
        },
        "tags": "",
        "target": null,
        "content_zh": null,
        "workspace_id": "ff86716b-62bb-49c6-af65-75192ca0c28b",
        "update_time": "2026-04-09T09:58:31.904Z+0800",
        "is_deleted": false,
        "project_id": "099706f4090026a62f0bc014b68c0527",
        "marked_note": true,
        "marked_evidence": null,
        "id": "92e3f3ac-0bfa-4414-92b6-02c2fe2aa421",
        "user": {
          "name": "SecMasterRobot",
          "id": "SecMasterRobot"
        }
      }
    ],
    "size": 10,
    "success": true,
    "page": 0,
    "message": "",
    "request_id": ""
  }
}

Plugin Execution Function listPlaybooks

Parameters of the listPlaybooks Function

Function: Calls the corresponding SecMaster API to query the playbook list.

Table 33 Input parameters of the listPlaybooks function

Parameter

Parameter Type

Parameter Description

Mandatory

workspace_id

String

Organization ID.

Yes

limit

String

The maximum number of records can be returned on each page for a pagination query. The value starts from 1.

Yes

offset

String

Page query parameter. This parameter specifies the start position of the query result. The value starts from 0.

Yes

search_txt

String

Keyword for search.

No

enabled

String

Whether to enable it.

No

description

String

Playbook description.

No

dataclass_name

String

Data class name.

No

name

String

Playbook name.

No

resultVariable

String

Query result filter.

No
Table 34 Output parameters of the listPlaybooks function

Parameter

Parameter Type

Parameter Description

header

Object

Headers of the response returned by the SecMaster API. It includes basic request and response information, such as the request time, response service, and request ID.

code

Int

Status code, which indicates whether the request is successful.

Response code description:

  • If the value of code is 200, the request is successful.
  • If the value of code is 401, the account or password is incorrect.
  • If the value of code is 403, the permission is insufficient.
  • If the value of code is 404, the requested resource does not exist.

body

Object

Content returned by the API.

Output Example of the listPlaybooks Function

{
  "headers": {
    "Transfer-Encoding": "chunked",
    "Server": "api-gateway",
    "X-Request-Id": "c00754a39bc7046caa557f054c58e34d",
    "X-Content-Type-Options": "nosniff",
    "Connection": "keep-alive",
    "X-Download-Options": "noopen",
    "Pragma": "no-cache",
    "Date": "Wed, 29 Apr 2026 08:31:54 GMT",
    "X-Frame-Options": "SAMEORIGIN",
    "Strict-Transport-Security": "max-age=31536000; includeSubdomains;",
    "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate",
    "Content-Encoding": "gzip",
    "Vary": "Origin, Access-Control-Request-Method, Access-Control-Request-Headers",
    "X-XSS-Protection": "1; mode=block;",
    "Content-Type": "application/json; charset=UTF-8"
  },
  "code": 200,
  "body": {
    "total": 2,
    "code": "00000000",
    "data": [
      {
        "dataclass_name": "CommonContext",
        "modifier_name": "xxxxx4216",
        "create_time": "2024-08-13T00:41:01.000Z+0800",
        "owner_id": "",
        "description": "",
        "dataclass_id": "58ed51dd-810e-36c6-a164-aeb99aba9562",
        "version_id": "c5d263a9-f953-3a72-a8bf-01bbe204811a",
        "approve_role": "",
        "unaudited_version_id": "",
        "edit_role": "",
        "version": "v1",
        "enabled": true,
        "cloud_pack_id": "",
        "workspace_id": "ff86716b-62bb-49c6-af65-75192ca0c28b",
        "user_role": "",
        "update_time": "2024-10-18T14:17:40.000Z+0800",
        "cloud_pack_name": "",
        "project_id": "099706f4090026a62f0bc014b68c0527",
        "creator_id": "system",
        "modifier_id": "5ed860274b1b433e9f6f581350c96215",
        "name": "Synchronize CFW IP address blacklist to Indicators,"
        "creator_name": "system",
        "id": "84a9c0a9-73af-337a-a21d-0c454671d259",
        "reject_version_id": ""
      },
      {
        "dataclass_name": "CommonContext",
        "modifier_name": "xxxxx16",
        "create_time": "2024-08-13T00:41:01.000Z+0800",
        "owner_id": "",
        "description": "",
        "dataclass_id": "58ed51dd-810e-36c6-a164-aeb99aba9562",
        "version_id": "58577d03-94e6-3960-97f5-22ec839dd8b7",
        "approve_role": "",
        "unaudited_version_id": "",
        "edit_role": "",
        "version": "v1",
        "enabled": true,
        "cloud_pack_id": "",
        "workspace_id": "ff86716b-62bb-49c6-af65-75192ca0c28b",
        "user_role": "",
        "update_time": "2024-10-18T14:19:24.000Z+0800",
        "cloud_pack_name": "",
        "project_id": "099706f4090026a62f0bc014b68c0527",
        "creator_id": "system",
        "modifier_id": "5ed860274b1b433e9f6f581350c96215",
        "name": "Synchronize WAF IP address blacklist to Indicators,"
        "creator_name": "system",
        "id": "13b7f802-1e0a-38c4-a2a4-873e66231189",
        "reject_version_id": ""
      }
    ],
    "size": 10,
    "success": true,
    "page": 1,
    "message": "",
    "request_id": ""
  }
}

Plugin Execution Function listWorkspaces

Parameters of the listWorkspaces Function

Function: Calls the corresponding SecMaster API to query the workspace list.

Table 35 Input parameters of the listWorkspaces function

Parameter

Parameter Type

Parameter Description

Mandatory

region_id

String

Region ID.

No

limit

String

Number of records displayed on each page.

Yes

offset

String

Start position of the record to be returned. The value must be a number no less than 0.

Yes

view_bind_id

String

ID of the workspace associated with the view.

No

view_bind_name

String

Name of the workspace associated with the view.

No

description

String

Search by description.

No

create_time_start

String

Creation start time, for example, 2024-04-26T16:08:09Z+0800.

No

create_time_end

String

Creation end time, for example, 2024-04-2T16:08:09Z+0800.

No

name

String

Query by name.

No

is_view

String

Whether to query the view. The value can be true or false.

No

ids

String

Workspace ID array. IDs must be separated by commas (,).

No

normal_project_id

String

General project ID.

No

enterprise_project_id

String

Enterprise project ID.

No

resultVariable

String

Query result filter.

No
Table 36 Output parameters of the listWorkspaces function

Parameter

Parameter Type

Parameter Description

header

Object

Headers of the response returned by the SecMaster API. It includes basic request and response information, such as the request time, response service, and request ID.

code

Int

Status code, which indicates whether the request is successful.

Response code description:

  • If the value of code is 200, the request is successful.
  • If the value of code is 401, the account or password is incorrect.
  • If the value of code is 403, the permission is insufficient.
  • If the value of code is 404, the requested resource does not exist.

body

Object

Content returned by the API.

Output Example of the listWorkspaces Function

{
  "headers": {
    "Transfer-Encoding": "chunked",
    "Server": "api-gateway",
    "X-Request-Id": "6390735e11356fec3d63083ec183d32b",
    "X-Content-Type-Options": "nosniff",
    "Connection": "keep-alive",
    "X-Download-Options": "noopen",
    "Pragma": "no-cache",
    "Date": "Wed, 29 Apr 2026 08:58:16 GMT",
    "X-Frame-Options": "SAMEORIGIN",
    "Strict-Transport-Security": "max-age=31536000; includeSubdomains;",
    "Cache-Control": "no-cache, no-store, must-revalidate",
    "Content-Encoding": "gzip",
    "Vary": "Origin, Access-Control-Request-Method, Access-Control-Request-Headers",
    "X-XSS-Protection": "1; mode=block;",
    "Content-Type": "application/json; charset=UTF-8"
  },
  "code": 200,
  "body": {
    "count": 5,
    "workspaces": [
      {
        "modifier_name": "w3_sso_secmaster_ops_02",
        "create_time": "2023-08-21T18:26:53Z+0800",
        "enterprise_project_name": "",
        "workspace_agency_list": [],
        "is_view": false,
        "region_id": "cn-north-4",
        "description": "11",
        "is_main_workspace": true,
        "project_name": "cn-north-4",
        "tags": [],
        "domain_id": "0996e744f600f3180f34c014f001b7c0",
        "domain_name": "hwstaff_p_SecCMCC",
        "enterprise_project_id": "",
        "update_time": "2025-10-29T15:27:02Z+0800",
        "is_force_init": null,
        "project_id": "099706f4090026a62f0bc014b68c0527",
        "view_bind_id": "",
        "creator_id": "7647edc14997453b896a962e3554d3c2",
        "modifier_id": "w3_sso_secmaster_ops_02:w3_ops:l30073350",
        "name": "SecMaster-POC",
        "creator_name": "z00525017",
        "id": "ff86716b-62bb-49c6-af65-75192ca0c28b",
        "statistical_resource": {
          "alerts": null,
          "assets": null,
          "playbook_instances": null,
          "incidents": null,
          "playbooks": null,
          "vulnerabilities": null,
          "dataspaces": null
        },
        "view_bind_name": ""
      },
      {
        "modifier_name": "",
        "create_time": "2026-04-16T16:06:44Z+0800",
        "enterprise_project_name": "",
        "workspace_agency_list": [],
        "is_view": false,
        "region_id": "cn-north-4",
        "description": "",
        "is_main_workspace": false,
        "project_name": "cn-north-4",
        "tags": [],
        "domain_id": "0996e744f600f3180f34c014f001b7c0",
        "domain_name": "hwstaff_p_SecCMCC",
        "enterprise_project_id": "",
        "update_time": "2026-04-16T16:06:44Z+0800",
        "is_force_init": null,
        "project_id": "099706f4090026a62f0bc014b68c0527",
        "view_bind_id": "",
        "creator_id": "w3_sso_secmaster_ops_02:w3_ops:m30074793",
        "modifier_id": "",
        "name": "IDCshowcase",
        "creator_name": "w3_sso_secmaster_ops_02",
        "id": "eb61684c-c2d5-4b69-a663-72efd4fc60ab",
        "statistical_resource": {
          "alerts": null,
          "assets": null,
          "playbook_instances": null,
          "incidents": null,
          "playbooks": null,
          "vulnerabilities": null,
          "dataspaces": null
        },
        "view_bind_name": ""
      }
    ]
  }
}

Plugin Execution Function createBatchOrderAlerts

Parameters of the createBatchOrderAlerts Function

Function: Calls the corresponding SecMaster API to convert alerts into incidents in batches.

Table 37 Input parameters of the createBatchOrderAlerts function

Parameter

Parameter Type

Parameter Description

Mandatory

workspace_id

String

Workspace ID.

Yes

ids

String

IDs of the alerts to be converted into incidents.

Yes

title

String

Incident name.

Yes

id

String

Incident type ID.

Yes

category

String

Parent incident type.

Yes

incident_type

String

Incident type.

Yes

language

String

Response language of the query result. The value can be zh-cn or en-us. Uppercase letters and other values are not supported.

The value zh-cn indicates that the query result is displayed in simplified Chinese, and the value en-us indicates that the query result is displayed in English.

No
Table 38 Output parameters of the createBatchOrderAlerts function

Parameter

Parameter Type

Parameter Description

header

Object

Headers of the response returned by the SecMaster API. It includes basic request and response information, such as the request time, response service, and request ID.

code

Int

Status code, which indicates whether the request is successful.

Response code description:

  • If the value of code is 200, the request is successful.
  • If the value of code is 401, the account or password is incorrect.
  • If the value of code is 403, the permission is insufficient.
  • If the value of code is 404, the requested resource does not exist.

body

Object

Content returned by the API.

Output Example of the createBatchOrderAlerts Function

{
  "headers": {
    "Transfer-Encoding": "chunked",
    "Server": "CloudWAF",
    "X-Request-Id": "d3f816911df1cf413b5536487bce28e4",
    "X-Content-Type-Options": "nosniff",
    "Connection": "keep-alive",
    "X-Download-Options": "noopen",
    "Pragma": "no-cache",
    "Date": "Wed, 29 Apr 2026 09:16:18 GMT",
    "X-Frame-Options": "SAMEORIGIN",
    "Strict-Transport-Security": "max-age=31536000; includeSubdomains;",
    "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate",
    "Vary": "Access-Control-Request-Headers",
    "Set-Cookie": "HWWAFSESID=ff83573716301c994f; path=/",
    "X-XSS-Protection": "1; mode=block;",
    "Content-Type": "application/json; charset=UTF-8"
  },
  "code": "00000000",
  "data": {
    "error_ids": [],
    "success_ids": [
      "79c85b41-72f2-4827-9e90-345deb3cf75b"
    ]
  },
  "message": "",
  "request_id": "",
  "success": true
}

Plugin Execution Function listAccounts

Parameters of the listAccounts Function

Function: Calls the corresponding SecMaster API to query the list of member accounts managed by the primary account in a multi-account scenario.

Table 39 Input parameters of the listAccounts function

Parameter

Parameter Type

Parameter Description

Mandatory

ou_id

String

Organization ID.

No

status

String

Agency status. The value can be TO_BE_RECEIVED, RECEIVED, REJECTED, RELEASED, or WITHDRAWN.

No

limit

String

This parameter is often used together with offset. limit specifies the maximum number of records to be returned, and offset specifies the starting point, or how many records to skip.

No

offset

String

This parameter is often used together with limit. limit specifies the maximum number of records to be returned, and offset specifies the starting point, or how many records to skip.

No

language

String

Response language of the query result. The value can be zh-cn or en-us. Uppercase letters and other values are not supported.

The value zh-cn indicates that the query result is displayed in simplified Chinese, and the value en-us indicates that the query result is displayed in English.

No

resultVariable

String

Query result filter.

No

agency_type

String

Agency type. ORG_AGENCY: The agency is created by an organization. ACCOUNT_AGENCY: The agency is created by an account.

No
Table 40 Output parameters of the listAccounts function

Parameter

Parameter Type

Parameter Description

header

Object

Headers of the response returned by the SecMaster API. It includes basic request and response information, such as the request time, response service, and request ID.

code

Int

Status code, which indicates whether the request is successful.

Response code description:

  • If the value of code is 200, the request is successful.
  • If the value of code is 401, the account or password is incorrect.
  • If the value of code is 403, the permission is insufficient.
  • If the value of code is 404, the requested resource does not exist.

body

Object

Content returned by the API.

Output Example of the listAccounts Function

{
  "headers": {
    "Transfer-Encoding": "chunked",
    "Server": "api-gateway",
    "X-Request-Id": "efd856d1bb0f8681925ce8b79f3bf055",
    "X-Content-Type-Options": "nosniff",
    "Connection": "keep-alive",
    "X-Download-Options": "noopen",
    "Pragma": "no-cache",
    "Date": "Fri, 24 Apr 2026 02:51:07 GMT",
    "X-Frame-Options": "SAMEORIGIN",
    "Strict-Transport-Security": "max-age=31536000; includeSubdomains;",
    "Cache-Control": "no-cache, no-store, must-revalidate",
    "Content-Encoding": "gzip",
    "Vary": "origin,access-control-request-method,access-control-request-headers,accept-encoding",
    "X-XSS-Protection": "1; mode=block;",
    "Content-Type": "application/json; charset=UTF-8"
  },
  "code": 200,
  "body": {
    "total": 4,
    "agencies": [
      {
        "iam_agency_id": "f7ea255ab6534d85a8e0444553960c01",
        "org_ou_path": "o-xyh41atuqr0irw8wc67cnsv2xjzo663z/r-3zsjft4vo3ptq74v6tnfs8tdvgzf1qtn/ou-7qtb8abzfttluxh2kwguce5g1mfn4mi3",
        "projects": [],
        "create_time": "2026-03-18T10:56:09Z+0800",
        "trust_domain_id": "a7e437dac49949148b08102a42bb0723",
        "eps": [],
        "trust_domain_name": "scc_sa_xxxxx695_01",
        "domain_id": "f9d7bacbfd2c49e892532ba3f62ab75d",
        "domain_name": "scc_sa_xxxx74_01",
        "update_time": "2026-03-18T10:56:11Z+0800",
        "org_id": "o-xyh41atuqr0irw8wc67cnsv2xjzo663z",
        "org_ou_name": "",
        "error_code": "",
        "log_list": [],
        "id": "e9d638d2-85b3-4554-bd2e-9bd5fcdc4510",
        "agency_type": "ORG_AGENCY",
        "iam_agency_name": "SecMaster_Account_Agency_e9d638d2-85b3-4554-bd2e-9bd5fcdc4510",
        "status": "RECEIVED"
      },
      {
        "iam_agency_id": "639a6cbe4c264491ac5eef7bd6c3ccca",
        "org_ou_path": "o-xyh41atuqr0irw8wc67cnsv2xjzo663z/r-3zsjft4vo3ptq74v6tnfs8tdvgzf1qtn/ou-7qtb8abzfttluxh2kwguce5g1mfn4mi3",
        "projects": [],
        "create_time": "2026-02-05T11:29:58Z+0800",
        "trust_domain_id": "a7e437dac49949148b08102a42bb0723",
        "eps": [],
        "trust_domain_name": "scc_sa_xxxxx695_01",
        "domain_id": "9f284b6b77a247eb9d0ede96e092e322",
        "domain_name": "scc_sa_xxxxx7803_01",
        "update_time": "2026-02-05T11:30:00Z+0800",
        "org_id": "o-xyh41atuqr0irw8wc67cnsv2xjzo663z",
        "org_ou_name": "",
        "error_code": "",
        "log_list": [],
        "id": "d8d3c54c-466b-4415-b7ee-7f70d07e46c2",
        "agency_type": "ORG_AGENCY",
        "iam_agency_name": "SecMaster_Account_Agency_d8d3c54c-466b-4415-b7ee-7f70d07e46c2",
        "status": "RECEIVED"
      },
      {
        "iam_agency_id": "bf62d98b39094c3da6a18081a50d16d0",
        "org_ou_path": "o-xyh41atuqr0irw8wc67cnsv2xjzo663z/r-3zsjft4vo3ptq74v6tnfs8tdvgzf1qtn/ou-7qtb8abzfttluxh2kwguce5g1mfn4mi3",
        "projects": [],
        "create_time": "2026-02-05T11:29:43Z+0800",
        "trust_domain_id": "a7e437dac49949148b08102a42bb0723",
        "eps": [],
        "trust_domain_name": "scc_sa_xxxxx5_01",
        "domain_id": "090956086980d4330fc0c00c9f6ec180",
        "domain_name": "SCC_SA_xxxx693_02",
        "update_time": "2026-02-05T11:29:45Z+0800",
        "org_id": "o-xyh41atuqr0irw8wc67cnsv2xjzo663z",
        "org_ou_name": "",
        "error_code": "",
        "log_list": [],
        "id": "781e1dd6-b474-4d10-b5af-052269cbc6b2",
        "agency_type": "ORG_AGENCY",
        "iam_agency_name": "SecMaster_Account_Agency_781e1dd6-b474-4d10-b5af-052269cbc6b2",
        "status": "RECEIVED"
      },
      {
        "iam_agency_id": "748e52f9f6fe45f3aaf79910cdc12cba",
        "org_ou_path": "o-xyh41atuqr0irw8wc67cnsv2xjzo663z/r-3zsjft4vo3ptq74v6tnfs8tdvgzf1qtn/ou-7qtb8abzfttluxh2kwguce5g1mfn4mi3",
        "projects": [],
        "create_time": "2026-01-29T16:20:01Z+0800",
        "trust_domain_id": "a7e437dac49949148b08102a42bb0723",
        "eps": [],
        "trust_domain_name": "",
        "domain_id": "7de770a0f1084d78afd0523e59102e43",
        "domain_name": "scc_sa_xxxxx03_02",
        "update_time": "2026-02-05T11:20:00Z+0800",
        "org_id": "o-xyh41atuqr0irw8wc67cnsv2xjzo663z",
        "org_ou_name": "",
        "error_code": "Failed to create the agency. Check the maximum number of IAM agencies that can be created by the hosting party.",
        "log_list": [],
        "id": "d3d98680-783e-4ab9-8f4e-9b0ad5a0578d",
        "agency_type": "ORG_AGENCY",
        "iam_agency_name": "SecMaster_Account_Agency_d3d98680-783e-4ab9-8f4e-9b0ad5a0578d",
        "status": "RECEIVED"
      }
    ],
    "config": {
      "org": {
        "account_list": [],
        "id": "",
        "is_auto_agency": false
      },
      "trust_domain_id": "",
      "accounts": []
    }
  }
}