Querying the Processes Identified by the Process Whitelist Policy

Function

This API is used to query the processes identified by the process whitelist policy.

Authorization Information

Each account has all the permissions required to call all APIs, but IAM users must be assigned the required permissions.

If you are using role/policy-based authorization, see Permissions Policies and Supported Actions for details on the required permissions.
If you are using identity policy-based authorization, no identity policy-based permission required for calling this API.

URI

GET /v5/{project_id}/app/{policy_id}/process

**Table 1** Path Parameters
Parameter	Mandatory	Type	Description
project_id	Yes	String	Definition Project ID, which is used to specify the project that an asset belongs to. After the project ID is configured, you can query assets in the project using the project ID. For details about how to obtain it, see Obtaining a Project ID. Constraints N/A Range The value can contain 1 to 256 characters. Default Value N/A
policy_id	Yes	String	Definition Policy ID. Constraints Mandatory. Range The value can contain 1 to 64 characters. Default Value N/A

**Table 2** Query Parameters
Parameter	Mandatory	Type	Description
enterprise_project_id	Yes	String	Definition Enterprise project ID, which is used to filter assets in different enterprise projects. For details, see Obtaining an Enterprise Project ID. To query assets in all enterprise projects, set this parameter to all_granted_eps. Constraints You need to set this parameter only after the enterprise project function is enabled. Range Length: 1 to 256 characters Default Value 0: default enterprise project.
offset	Yes	Integer	Definition Offset, which specifies the start position of the record to be returned. Constraints N/A Range The value range is 0 to 2,000,000. Default Value N/A
limit	Yes	Integer	Definition Number of records displayed on each page. Constraints N/A Range Value range: 10 to 200 Default Value 10
process_status	No	String	Definition Trust status. Constraints N/A Range trust suspicious malicious unknown Default Value N/A
process_type	No	String	Definition Process type. Constraints N/A Range system: system program interpretive: interpretive program normal: common executable program Default Value N/A
process_name	No	String	Definition Process name. Constraints N/A Range The value can contain 1 to 128 characters. Default Value N/A
process_hash	No	String	Definition Process hash. Constraints N/A Range The value can contain 1 to 128 characters. Default Value N/A
process_path	No	String	Definition Process path. Constraints N/A Range The value can contain 1 to 256 characters. Default Value N/A
handle_status	No	String	Definition Confirmation status. Constraints N/A Range confirmed unconfirmed Default Value N/A
os_type	No	String	Definition OS type. Constraints N/A Range Linux Windows Default Value None
file_signer	No	String	Definition File signature. Constraints N/A Range The value can contain 1 to 128 characters. Default Value N/A

Request Parameters

**Table 3** Request header parameters
Parameter	Mandatory	Type	Description
X-Auth-Token	Yes	String	Definition User token, which contains user identity and permissions. The token can be used for identity authentication when an API is called. For details about how to obtain the token, see Obtaining a User Token. Constraints N/A Range The value can contain 1 to 32,768 characters. Default Value N/A

Response Parameters

Status code: 200

**Table 4** Response body parameters
Parameter	Type	Description
data_list	Array of AppWhitelistPolicyProcessResponseInfo objects	data list
total_num	Integer	Definition Total number. Range The value range is 0 to 2,147,483,647.

**Table 5** AppWhitelistPolicyProcessResponseInfo
Parameter	Type	Description
process_name	String	Definition Process name. Range The value can contain 1 to 128 characters.
process_path	String	Definition Process path. Range The value can contain 1 to 256 characters.
process_hash	String	Process hash
handle_status	String	Definition Handling method. Range confirmed unconfirmed
specified_path	String	Definition Specified directory. Range The value can contain 1 to 512 characters.
cmdline	String	Definition Process command line. Constraints N/A
file_size	Integer	Definition File size. Constraints N/A Range The value range is 0 to 9,223,372,036,854,775,807. Default Value N/A
file_signer	String	Definition File signature. Range The value can contain 1 to 128 characters.
process_type	Integer	Definition Process type. Constraints N/A Range 1*: system program 2: interpretive program 3: common executable program
os_type	String	Definition OS Type Range Linux Windows
app_type	String	Definition Application type. Constraints N/A
whitelist_count	Integer	Definition Whitelist confirmation count Constraints N/A
blacklist_count	Integer	Definition Blacklist confirmation count Constraints N/A
trust_status_source	Integer	Definition Process trust status. Constraints N/A Range 0: intelligence 1: malware 2: manual confirmation 3: self-learning Default Value N/A
process_status	String	Definition Process trust status. Constraints N/A Range trust suspicious malicious unknown Default Value N/A

Example Requests

None

Example Responses

Status code: 200

Request succeeded.

{
  "total_num" : 10,
  "data_list" : [ {
    "process_name" : "",
    "process_path" : "",
    "process_hash" : "",
    "process_status" : "trust",
    "handle_status" : "confirmed",
    "specified_path" : "",
    "cmdline" : "",
    "file_size" : 2147483647,
    "file_signer" : "",
    "process_type" : 111,
    "os_type" : "",
    "app_type" : "",
    "whitelist_count" : 2147483647,
    "blacklist_count" : 2147483647
  } ]
}