Converting an Alert to an Incident
Function
This API is used to convert alerts to incidents.
Calling Method
For details, see Calling APIs.
URI
POST /v1/{project_id}/workspaces/{workspace_id}/soc/alerts/batch-order
Parameter |
Mandatory |
Type |
Description |
---|---|---|---|
project_id |
Yes |
String |
Project ID. Minimum: 32 Maximum: 36 |
workspace_id |
Yes |
String |
Workspace ID Minimum: 32 Maximum: 36 |
Request Parameters
Parameter |
Mandatory |
Type |
Description |
---|---|---|---|
X-Auth-Token |
Yes |
String |
User token. It can be obtained by calling the IAM API used to obtain a user token. The value of X-Subject-Token in the response header is a token. Minimum: 0 Maximum: 2097152 |
content-type |
Yes |
String |
Content type. Default: application/json;charset=UTF-8 Minimum: 0 Maximum: 64 |
Parameter |
Mandatory |
Type |
Description |
---|---|---|---|
ids |
No |
Array of strings |
IDs of the alerts to be converted into incidents. Minimum: 0 Maximum: 100 Array Length: 0 - 999 |
incident_content |
No |
incident_content object |
Incident details. |
Parameter |
Mandatory |
Type |
Description |
---|---|---|---|
title |
No |
String |
Trace Minimum: 0 Maximum: 255 |
incident_type |
No |
incident_type object |
Incident type. |
Response Parameters
Status code: 200
Parameter |
Type |
Description |
---|---|---|
X-request-id |
String |
Request ID, in the format request_uuid-timestamp-hostname. |
Parameter |
Type |
Description |
---|---|---|
code |
String |
Error code Minimum: 0 Maximum: 64 |
message |
String |
Error Message Minimum: 0 Maximum: 1024 |
data |
BatchOperateAlertResult object |
Returned object for batch operation on alerts. |
Parameter |
Type |
Description |
---|---|---|
error_ids |
Array of strings |
IDs of alerts not transferred to incidents Minimum: 0 Maximum: 100 Array Length: 0 - 100 |
success_ids |
Array of strings |
IDs of alerts transferred to incidents. Minimum: 0 Maximum: 100 Array Length: 0 - 100 |
Status code: 400
Parameter |
Type |
Description |
---|---|---|
X-request-id |
String |
Request ID, in the format request_uuid-timestamp-hostname. |
Parameter |
Type |
Description |
---|---|---|
code |
String |
Error Code Minimum: 0 Maximum: 64 |
message |
String |
Error Description Minimum: 0 Maximum: 1024 |
Example Requests
Convert an alert to an incident, set Alert ID to 909494e3-558e-46b6-a9eb-07a8e18ca62f, Incident ID to 909494e3-558e-46b6-a9eb-07a8e18ca621, Alert status to Closed, and Mark as Evidence to No.
{ "ids" : [ "909494e3-558e-46b6-a9eb-07a8e18ca62f" ], "incident_content" : { "title" : "XXX", "incident_type" : { "id" : "909494e3-558e-46b6-a9eb-07a8e18ca62f", "category" : "DDoS attack", "incident_type" : "DNS protocol attacks" } } }
Example Responses
Status code: 200
Response body for converting alerts into incidents.
{ "code" : "909494e3-558e-46b6-a9eb-07a8e18ca62f", "message" : "Error message", "data" : { "error_ids" : [ "909494e3-558e-46b6-a9eb-07a8e18ca62f" ], "success_ids" : [ "909494e3-558e-46b6-a9eb-07a8e18ca62f" ] } }
SDK Sample Code
The SDK sample code is as follows.
Convert an alert to an incident, set Alert ID to 909494e3-558e-46b6-a9eb-07a8e18ca62f, Incident ID to 909494e3-558e-46b6-a9eb-07a8e18ca621, Alert status to Closed, and Mark as Evidence to No.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 |
package com.huaweicloud.sdk.test; import com.huaweicloud.sdk.core.auth.ICredential; import com.huaweicloud.sdk.core.auth.BasicCredentials; import com.huaweicloud.sdk.core.exception.ConnectionException; import com.huaweicloud.sdk.core.exception.RequestTimeoutException; import com.huaweicloud.sdk.core.exception.ServiceResponseException; import com.huaweicloud.sdk.secmaster.v2.region.SecMasterRegion; import com.huaweicloud.sdk.secmaster.v2.*; import com.huaweicloud.sdk.secmaster.v2.model.*; import java.util.List; import java.util.ArrayList; public class CreateBatchOrderAlertsSolution { public static void main(String[] args) { // The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security. // In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment String ak = System.getenv("CLOUD_SDK_AK"); String sk = System.getenv("CLOUD_SDK_SK"); ICredential auth = new BasicCredentials() .withAk(ak) .withSk(sk); SecMasterClient client = SecMasterClient.newBuilder() .withCredential(auth) .withRegion(SecMasterRegion.valueOf("<YOUR REGION>")) .build(); CreateBatchOrderAlertsRequest request = new CreateBatchOrderAlertsRequest(); OrderAlert body = new OrderAlert(); OrderAlertIncidentContentIncidentType incidentTypeIncidentContent = new OrderAlertIncidentContentIncidentType(); incidentTypeIncidentContent.withId("909494e3-558e-46b6-a9eb-07a8e18ca62f") .withCategory("DDoS attack") .withIncidentType("DNS protocol attacks"); OrderAlertIncidentContent incidentContentbody = new OrderAlertIncidentContent(); incidentContentbody.withTitle("XXX") .withIncidentType(incidentTypeIncidentContent); List<String> listbodyIds = new ArrayList<>(); listbodyIds.add("909494e3-558e-46b6-a9eb-07a8e18ca62f"); body.withIncidentContent(incidentContentbody); body.withIds(listbodyIds); request.withBody(body); try { CreateBatchOrderAlertsResponse response = client.createBatchOrderAlerts(request); System.out.println(response.toString()); } catch (ConnectionException e) { e.printStackTrace(); } catch (RequestTimeoutException e) { e.printStackTrace(); } catch (ServiceResponseException e) { e.printStackTrace(); System.out.println(e.getHttpStatusCode()); System.out.println(e.getRequestId()); System.out.println(e.getErrorCode()); System.out.println(e.getErrorMsg()); } } } |
Convert an alert to an incident, set Alert ID to 909494e3-558e-46b6-a9eb-07a8e18ca62f, Incident ID to 909494e3-558e-46b6-a9eb-07a8e18ca621, Alert status to Closed, and Mark as Evidence to No.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 |
# coding: utf-8 import os from huaweicloudsdkcore.auth.credentials import BasicCredentials from huaweicloudsdksecmaster.v2.region.secmaster_region import SecMasterRegion from huaweicloudsdkcore.exceptions import exceptions from huaweicloudsdksecmaster.v2 import * if __name__ == "__main__": # The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security. # In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment ak = os.environ["CLOUD_SDK_AK"] sk = os.environ["CLOUD_SDK_SK"] credentials = BasicCredentials(ak, sk) client = SecMasterClient.new_builder() \ .with_credentials(credentials) \ .with_region(SecMasterRegion.value_of("<YOUR REGION>")) \ .build() try: request = CreateBatchOrderAlertsRequest() incidentTypeIncidentContent = OrderAlertIncidentContentIncidentType( id="909494e3-558e-46b6-a9eb-07a8e18ca62f", category="DDoS attack", incident_type="DNS protocol attacks" ) incidentContentbody = OrderAlertIncidentContent( title="XXX", incident_type=incidentTypeIncidentContent ) listIdsbody = [ "909494e3-558e-46b6-a9eb-07a8e18ca62f" ] request.body = OrderAlert( incident_content=incidentContentbody, ids=listIdsbody ) response = client.create_batch_order_alerts(request) print(response) except exceptions.ClientRequestException as e: print(e.status_code) print(e.request_id) print(e.error_code) print(e.error_msg) |
Convert an alert to an incident, set Alert ID to 909494e3-558e-46b6-a9eb-07a8e18ca62f, Incident ID to 909494e3-558e-46b6-a9eb-07a8e18ca621, Alert status to Closed, and Mark as Evidence to No.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 |
package main import ( "fmt" "github.com/huaweicloud/huaweicloud-sdk-go-v3/core/auth/basic" secmaster "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/secmaster/v2" "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/secmaster/v2/model" region "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/secmaster/v2/region" ) func main() { // The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security. // In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment ak := os.Getenv("CLOUD_SDK_AK") sk := os.Getenv("CLOUD_SDK_SK") auth := basic.NewCredentialsBuilder(). WithAk(ak). WithSk(sk). Build() client := secmaster.NewSecMasterClient( secmaster.SecMasterClientBuilder(). WithRegion(region.ValueOf("<YOUR REGION>")). WithCredential(auth). Build()) request := &model.CreateBatchOrderAlertsRequest{} idIncidentType:= "909494e3-558e-46b6-a9eb-07a8e18ca62f" categoryIncidentType:= "DDoS attack" incidentTypeIncidentType:= "DNS protocol attacks" incidentTypeIncidentContent := &model.OrderAlertIncidentContentIncidentType{ Id: &idIncidentType, Category: &categoryIncidentType, IncidentType: &incidentTypeIncidentType, } titleIncidentContent:= "XXX" incidentContentbody := &model.OrderAlertIncidentContent{ Title: &titleIncidentContent, IncidentType: incidentTypeIncidentContent, } var listIdsbody = []string{ "909494e3-558e-46b6-a9eb-07a8e18ca62f", } request.Body = &model.OrderAlert{ IncidentContent: incidentContentbody, Ids: &listIdsbody, } response, err := client.CreateBatchOrderAlerts(request) if err == nil { fmt.Printf("%+v\n", response) } else { fmt.Println(err) } } |
For SDK sample code of more programming languages, see the Sample Code tab in API Explorer. SDK sample code can be automatically generated.
Status Codes
Status Code |
Description |
---|---|
200 |
Response body for converting alerts into incidents. |
400 |
Response body for failures of converting alerts into incidents. |
Error Codes
See Error Codes.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot