Help Center/ SecMaster/ API Reference/ Security Analysis V2 APIs/ Alert Rule Template Management/ Querying the Alert Rule Template List

Updated on 2025-10-29 GMT+08:00

Online Debugging

CLI Examples

View PDF

Querying the Alert Rule Template List

Function

This API is used to query the list of alert rule templates.

Calling Method

For details, see Calling APIs.

URI

GET /v2/{project_id}/workspaces/{workspace_id}/siem/alert-rules/templates

**Table 1** Path Parameters
Parameter	Mandatory	Type	Description
project_id	Yes	String	Definition Project ID, which is used to specify the project that a resource belongs to. You can query the resources of a project by project ID. You can obtain the project ID from the API or console. Obtaining the Project ID Constraints N/A Range N/A Default Value N/A
workspace_id	Yes	String	Workspace ID.

**Table 2** Query Parameters
Parameter	Mandatory	Type	Description
template_name	No	String	Template Name
status	No	String	Definition Status. ENABLED DISABLED Constraints N/A Range ENABLED DISABLED Default Value N/A
severity	No	String	Definition Alert severity. TIPS: informational LOW: low risk MEDIUM: medium risk HIGH: high risk FATAL: critical Constraints N/A Range TIPS LOW MEDIUM HIGH FATAL Default Value N/A
offset	No	Long	Definition Offset. Constraints N/A Range N/A Default Value N/A
limit	No	Long	Definition Data query limit. Range 0-1000 Default Value N/A
sort_key	No	String	Sorting by attribute.
sort_dir	No	String	Sorting order. The value can be ASC or DESC.

Request Parameters

**Table 3** Request header parameters
Parameter	Mandatory	Type	Description
X-Auth-Token	Yes	String	Definition User token. You can obtain it by calling the IAM API for obtaining a user token. The user token is the value of X-Subject-Token in the response header. Obtaining a User Token Constraints N/A Range N/A Default Value N/A

Response Parameters

Status code: 200

**Table 4** Response body parameters
Parameter	Type	Description
count	Integer	Count.
records	Array of AlertRuleTemplate objects	Record.

**Table 5** AlertRuleTemplate
Parameter	Type	Description
accumulated_times	Integer	Accumulated times.
alert_description	String	Alert description
alert_name	String	Alert name
alert_remediation	String	Alert remediation
alert_type	Map<String,String>	Map<String,String>
create_by	String	IAM user ID.
create_time	Integer	Timestamp, in ms.
custom_properties	Map<String,String>	Map<String,String>
description	String	Alert rule template description.
event_grouping	Boolean	Group
job_mode	String	Definition Job mode. STREAMING: streaming processing BATCH: batch processing SEARCH: retrieval Constraints N/A Range STREAMING BATCH SEARCH Default Value N/A
process_status	String	Definition Handling status. COMPLETED: completed CREATING: being created UPDATING: being updated ENABLING: being enabled DISABLING: being disabled DELETING: being deleted CREATE_FAILED: creation failed UPDATE_FAILED: update failed ENABLE_FAILED: enabling failed DISABLE_FAILED: disabling failed DELETE_FAILED: deletion failed RECOVERING: being recovered Constraints N/A Range COMPLETED CREATING UPDATING ENABLING DISABLING DELETING CREATE_FAILED UPDATE_FAILED ENABLE_FAILED DISABLE_FAILED DELETE_FAILED RECOVERING Default Value N/A
query	String	Query statement.
query_type	String	Definition Query type. SQL: SQL query CBSL: CBSL query Constraints N/A Range SQL CBSL Default Value N/A
schedule	AlertRuleSchedule object	Alert rule schedule.
severity	String	Definition Alert severity. TIPS: informational LOW: low risk MEDIUM: medium risk HIGH: high risk FATAL: critical Constraints N/A Range TIPS LOW MEDIUM HIGH FATAL Default Value N/A
simulation	Boolean	simulation
status	String	Definition Status. ENABLED DISABLED Constraints N/A Range ENABLED DISABLED Default Value N/A
suppresion	Boolean	Suppression
table_name	String	Table name.
template_id	String	UUID
template_name	String	Template Name
triggers	Array of Trigger objects	Trigger array.
update_by	String	IAM user ID.
update_time	Integer	Timestamp, in ms.
update_time_by_user	Integer	Timestamp, in ms.

**Table 6** AlertRuleSchedule
Parameter	Type	Description
delay_interval	Integer	Time
frequency_interval	Integer	Time
frequency_unit	String	Definition Frequency unit. MINUTE HOUR DAY Constraints N/A Range MINUTE HOUR DAY Default Value N/A
overtime_interval	Integer	Time
period_interval	Integer	Time
period_unit	String	Definition Frequency unit. MINUTE HOUR DAY Constraints N/A Range MINUTE HOUR DAY Default Value N/A

**Table 7** Trigger
Parameter	Type	Description
accumulated_times	Integer	Accumulated times.
expression	String	Expression
job_id	String	UUID
mode	String	Definition Mode. COUNT: counting Constraints N/A Range COUNT Default Value N/A
operator	String	Definition Operator type. GT: greater than LT: less than EQ: equal to NE: not equal to Constraints N/A Range GT LT EQ NE Default Value N/A
severity	String	Definition Alert severity. TIPS: informational LOW: low risk MEDIUM: medium risk HIGH: high risk FATAL: critical Constraints N/A Range TIPS LOW MEDIUM HIGH FATAL Default Value N/A

Example Requests

None

Example Responses

None

SDK Sample Code

The SDK sample code is as follows.

Java

    
     
       
       
         package com.huaweicloud.sdk.test;

import com.huaweicloud.sdk.core.auth.ICredential;
import com.huaweicloud.sdk.core.auth.BasicCredentials;
import com.huaweicloud.sdk.core.exception.ConnectionException;
import com.huaweicloud.sdk.core.exception.RequestTimeoutException;
import com.huaweicloud.sdk.core.exception.ServiceResponseException;
import com.huaweicloud.sdk.secmaster.v2.region.SecMasterRegion;
import com.huaweicloud.sdk.secmaster.v2.*;
import com.huaweicloud.sdk.secmaster.v2.model.*;


public class ListAlertRuleTemplatesSolution {

    public static void main(String[] args) {
        // The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
        // In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
        String ak = System.getenv("CLOUD_SDK_AK");
        String sk = System.getenv("CLOUD_SDK_SK");
        String projectId = "{project_id}";

        ICredential auth = new BasicCredentials()
                .withProjectId(projectId)
                .withAk(ak)
                .withSk(sk);

        SecMasterClient client = SecMasterClient.newBuilder()
                .withCredential(auth)
                .withRegion(SecMasterRegion.valueOf("<YOUR REGION>"))
                .build();
        ListAlertRuleTemplatesRequest request = new ListAlertRuleTemplatesRequest();
        request.withWorkspaceId("{workspace_id}");
        try {
            ListAlertRuleTemplatesResponse response = client.listAlertRuleTemplates(request);
            System.out.println(response.toString());
        } catch (ConnectionException e) {
            e.printStackTrace();
        } catch (RequestTimeoutException e) {
            e.printStackTrace();
        } catch (ServiceResponseException e) {
            e.printStackTrace();
            System.out.println(e.getHttpStatusCode());
            System.out.println(e.getRequestId());
            System.out.println(e.getErrorCode());
            System.out.println(e.getErrorMsg());
        }
    }
}

        

      

    
   

Python

    
     
       
       
         # coding: utf-8

import os
from huaweicloudsdkcore.auth.credentials import BasicCredentials
from huaweicloudsdksecmaster.v2.region.secmaster_region import SecMasterRegion
from huaweicloudsdkcore.exceptions import exceptions
from huaweicloudsdksecmaster.v2 import *

if __name__ == "__main__":
    # The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
    # In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
    ak = os.environ["CLOUD_SDK_AK"]
    sk = os.environ["CLOUD_SDK_SK"]
    projectId = "{project_id}"

    credentials = BasicCredentials(ak, sk, projectId)

    client = SecMasterClient.new_builder() \
        .with_credentials(credentials) \
        .with_region(SecMasterRegion.value_of("<YOUR REGION>")) \
        .build()

    try:
        request = ListAlertRuleTemplatesRequest()
        request.workspace_id = "{workspace_id}"
        response = client.list_alert_rule_templates(request)
        print(response)
    except exceptions.ClientRequestException as e:
        print(e.status_code)
        print(e.request_id)
        print(e.error_code)
        print(e.error_msg)

        

      

    
   

Go

    
     
       
       
         package main

import (
	"fmt"
	"github.com/huaweicloud/huaweicloud-sdk-go-v3/core/auth/basic"
    secmaster "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/secmaster/v2"
	"github.com/huaweicloud/huaweicloud-sdk-go-v3/services/secmaster/v2/model"
    region "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/secmaster/v2/region"
)

func main() {
    // The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
    // In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
    ak := os.Getenv("CLOUD_SDK_AK")
    sk := os.Getenv("CLOUD_SDK_SK")
    projectId := "{project_id}"

    auth := basic.NewCredentialsBuilder().
        WithAk(ak).
        WithSk(sk).
        WithProjectId(projectId).
        Build()

    client := secmaster.NewSecMasterClient(
        secmaster.SecMasterClientBuilder().
            WithRegion(region.ValueOf("<YOUR REGION>")).
            WithCredential(auth).
            Build())

    request := &model.ListAlertRuleTemplatesRequest{}
	request.WorkspaceId = "{workspace_id}"
	response, err := client.ListAlertRuleTemplates(request)
	if err == nil {
        fmt.Printf("%+v\n", response)
    } else {
        fmt.Println(err)
    }
}

        

      

    
   

For SDK sample code of more programming languages, see the Sample Code tab in API Explorer. SDK sample code can be automatically generated.

Status Codes

Status Code	Description
200	Success

Error Codes

See Error Codes.

Parent topic: Alert Rule Template Management

Previous topic: Alert Rule Template Management

Next topic: Viewing an Alert Rule Template

Feedback

Was this page helpful?

Helpful Not helpful

Provide feedback

Thank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.

The system is busy. Please try again later.

Which of the following issues have you encountered?

Content is inconsistent with the product UI

Unclear descriptions

Lack of examples or code

Incorrect steps

Can't find what I need

Lack of best practices

Feedback (optional)

0/500

Select at least one type of issue, and enter your comments or suggestions.

Enter a maximum of 500 characters.

Submit Cancel

For any further questions, feel free to contact us through the chatbot.

Chatbot