处理告警事件
功能介绍
处理告警事件
调用方法
请参见如何调用API。
URI
POST /v5/{project_id}/event/operate
|
参数 |
是否必选 |
参数类型 |
描述 |
|---|---|---|---|
|
project_id |
是 |
String |
项目ID |
|
参数 |
是否必选 |
参数类型 |
描述 |
|---|---|---|---|
|
enterprise_project_id |
否 |
String |
主机所属的企业项目ID。 开通企业项目功能后才需要配置企业项目。 企业项目ID默认取值为“0”，表示默认企业项目。如果需要查询所有企业项目下的主机，请传参“all_granted_eps”。如果您只有某个企业项目的权限，则需要传递该企业项目ID，查询该企业项目下的主机，否则会因权限不足而报错。 |
|
container_name |
否 |
String |
容器实例名称 |
|
container_id |
否 |
String |
容器Id |
请求参数
|
参数 |
是否必选 |
参数类型 |
描述 |
|---|---|---|---|
|
X-Auth-Token |
是 |
String |
用户Token。 通过调用IAM服务获取用户Token接口获取（响应消息头中X-Subject-Token的值） |
|
region |
是 |
String |
Region ID |
|
参数 |
是否必选 |
参数类型 |
描述 |
|---|---|---|---|
|
operate_type |
是 |
String |
处理方式，包含如下:
|
|
handler |
否 |
String |
备注信息，已处理的告警才有 |
|
operate_event_list |
是 |
Array of OperateEventRequestInfo objects |
操作的事件列表 |
|
event_white_rule_list |
否 |
Array of EventWhiteRuleListRequestInfo objects |
用户自定义告警白名单规则列表 |
|
参数 |
是否必选 |
参数类型 |
描述 |
|---|---|---|---|
|
event_class_id |
是 |
String |
事件分类，包含如下:
|
|
event_id |
是 |
String |
事件编号 |
|
event_type |
是 |
Integer |
事件类型，包含如下:
|
|
occur_time |
是 |
Integer |
发生时间，毫秒 |
|
operate_detail_list |
是 |
Array of EventDetailRequestInfo objects |
操作详情信息列表，当 operate_type 为 add_to_alarm_whitelist 或 remove_from_alarm_whitelist 时，必传 keyword 和 hash；当 operate_type 为 add_to_login_whitelist 或 remove_from_login_whitelist 时，必传 login_ip， private_ip 和 login_user_name；当 operate_type 为 isolate_and_kill 或 do_not_isolate_or_kill 时，必传 agent_id，file_hash，file_path，process_pid；其余情况可不填写内容。 |
|
参数 |
是否必选 |
参数类型 |
描述 |
|---|---|---|---|
|
agent_id |
否 |
String |
Agent ID |
|
process_pid |
否 |
Integer |
进程id |
|
file_hash |
否 |
String |
文件哈希 |
|
file_path |
否 |
String |
文件路径 |
|
file_attr |
否 |
String |
文件属性 |
|
keyword |
否 |
String |
告警事件关键字，仅用于告警白名单 |
|
hash |
否 |
String |
告警事件hash，仅用于告警白名单 |
|
private_ip |
否 |
String |
服务器私有IP |
|
login_ip |
否 |
String |
登录源IP |
|
login_user_name |
否 |
String |
登录用户名 |
|
container_id |
否 |
String |
容器ID |
|
container_name |
否 |
String |
容器名称 |
|
参数 |
是否必选 |
参数类型 |
描述 |
|---|---|---|---|
|
event_type |
是 |
Integer |
事件类型，包含如下:
|
|
field_key |
是 |
String |
加白字段，包含如下:
|
|
field_value |
是 |
String |
加白字段值 |
|
judge_type |
是 |
String |
通配符，包含如下:
|
响应参数
无
请求示例
手动处理告警事件类型为Rootkit、告警事件编号为2a71e1e2-60f4-4d56-b314-2038fdc39de6的入侵告警事件。
POST https://{endpoint}/v5/{project_id}/event/operate?enterprise_project_id=xxx
{
"operate_type" : "mark_as_handled",
"handler" : "test",
"operate_event_list" : [ {
"event_class_id" : "rootkit_0001",
"event_id" : "2a71e1e2-60f4-4d56-b314-2038fdc39de6",
"occur_time" : 1672046760353,
"event_type" : 1010,
"operate_detail_list" : [ {
"agent_id" : "c9bed5397db449ebdfba15e85fcfc36accee125c68954daf5cab0528bab59bd8",
"file_hash" : "e8b50f0b91e3dce0885ccc5902846b139d28108a0a7976c9b8d43154c5dbc44d",
"file_path" : "/usr/test",
"process_pid" : 3123,
"file_attr" : 33261,
"keyword" : "file_path=/usr/test",
"hash" : "e8b50f0b91e3dce0885ccc5902846b139d28108a0a7976c9b8d43154c5dbc44d",
"login_ip" : "127.0.0.1",
"private_ip" : "127.0.0.2",
"login_user_name" : "root",
"container_id" : "containerid",
"container_name" : "/test"
} ]
} ]
}
响应示例
无
SDK代码示例
SDK代码示例如下。
手动处理告警事件类型为Rootkit、告警事件编号为2a71e1e2-60f4-4d56-b314-2038fdc39de6的入侵告警事件。
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 |
package com.huaweicloud.sdk.test; import com.huaweicloud.sdk.core.auth.ICredential; import com.huaweicloud.sdk.core.auth.BasicCredentials; import com.huaweicloud.sdk.core.exception.ConnectionException; import com.huaweicloud.sdk.core.exception.RequestTimeoutException; import com.huaweicloud.sdk.core.exception.ServiceResponseException; import com.huaweicloud.sdk.hss.v5.region.HssRegion; import com.huaweicloud.sdk.hss.v5.*; import com.huaweicloud.sdk.hss.v5.model.*; import java.util.List; import java.util.ArrayList; public class ChangeEventSolution { public static void main(String[] args) { // The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security. // In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment String ak = System.getenv("CLOUD_SDK_AK"); String sk = System.getenv("CLOUD_SDK_SK"); String projectId = "{project_id}"; ICredential auth = new BasicCredentials() .withProjectId(projectId) .withAk(ak) .withSk(sk); HssClient client = HssClient.newBuilder() .withCredential(auth) .withRegion(HssRegion.valueOf("<YOUR REGION>")) .build(); ChangeEventRequest request = new ChangeEventRequest(); ChangeEventRequestInfo body = new ChangeEventRequestInfo(); List<EventDetailRequestInfo> listOperateEventListOperateDetailList = new ArrayList<>(); listOperateEventListOperateDetailList.add( new EventDetailRequestInfo() .withAgentId("c9bed5397db449ebdfba15e85fcfc36accee125c68954daf5cab0528bab59bd8") .withProcessPid(3123) .withFileHash("e8b50f0b91e3dce0885ccc5902846b139d28108a0a7976c9b8d43154c5dbc44d") .withFilePath("/usr/test") .withFileAttr("33261") .withKeyword("file_path=/usr/test") .withHash("e8b50f0b91e3dce0885ccc5902846b139d28108a0a7976c9b8d43154c5dbc44d") .withPrivateIp("127.0.0.2") .withLoginIp("127.0.0.1") .withLoginUserName("root") .withContainerId("containerid") .withContainerName("/test") ); List<OperateEventRequestInfo> listbodyOperateEventList = new ArrayList<>(); listbodyOperateEventList.add( new OperateEventRequestInfo() .withEventClassId("rootkit_0001") .withEventId("2a71e1e2-60f4-4d56-b314-2038fdc39de6") .withEventType(1010) .withOccurTime(1672046760353L) .withOperateDetailList(listOperateEventListOperateDetailList) ); body.withOperateEventList(listbodyOperateEventList); body.withHandler("test"); body.withOperateType("mark_as_handled"); request.withBody(body); try { ChangeEventResponse response = client.changeEvent(request); System.out.println(response.toString()); } catch (ConnectionException e) { e.printStackTrace(); } catch (RequestTimeoutException e) { e.printStackTrace(); } catch (ServiceResponseException e) { e.printStackTrace(); System.out.println(e.getHttpStatusCode()); System.out.println(e.getRequestId()); System.out.println(e.getErrorCode()); System.out.println(e.getErrorMsg()); } } } |
手动处理告警事件类型为Rootkit、告警事件编号为2a71e1e2-60f4-4d56-b314-2038fdc39de6的入侵告警事件。
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 |
# coding: utf-8 import os from huaweicloudsdkcore.auth.credentials import BasicCredentials from huaweicloudsdkhss.v5.region.hss_region import HssRegion from huaweicloudsdkcore.exceptions import exceptions from huaweicloudsdkhss.v5 import * if __name__ == "__main__": # The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security. # In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment ak = os.environ["CLOUD_SDK_AK"] sk = os.environ["CLOUD_SDK_SK"] projectId = "{project_id}" credentials = BasicCredentials(ak, sk, projectId) client = HssClient.new_builder() \ .with_credentials(credentials) \ .with_region(HssRegion.value_of("<YOUR REGION>")) \ .build() try: request = ChangeEventRequest() listOperateDetailListOperateEventList = [ EventDetailRequestInfo( agent_id="c9bed5397db449ebdfba15e85fcfc36accee125c68954daf5cab0528bab59bd8", process_pid=3123, file_hash="e8b50f0b91e3dce0885ccc5902846b139d28108a0a7976c9b8d43154c5dbc44d", file_path="/usr/test", file_attr="33261", keyword="file_path=/usr/test", hash="e8b50f0b91e3dce0885ccc5902846b139d28108a0a7976c9b8d43154c5dbc44d", private_ip="127.0.0.2", login_ip="127.0.0.1", login_user_name="root", container_id="containerid", container_name="/test" ) ] listOperateEventListbody = [ OperateEventRequestInfo( event_class_id="rootkit_0001", event_id="2a71e1e2-60f4-4d56-b314-2038fdc39de6", event_type=1010, occur_time=1672046760353, operate_detail_list=listOperateDetailListOperateEventList ) ] request.body = ChangeEventRequestInfo( operate_event_list=listOperateEventListbody, handler="test", operate_type="mark_as_handled" ) response = client.change_event(request) print(response) except exceptions.ClientRequestException as e: print(e.status_code) print(e.request_id) print(e.error_code) print(e.error_msg) |
手动处理告警事件类型为Rootkit、告警事件编号为2a71e1e2-60f4-4d56-b314-2038fdc39de6的入侵告警事件。
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 |
package main import ( "fmt" "github.com/huaweicloud/huaweicloud-sdk-go-v3/core/auth/basic" hss "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/hss/v5" "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/hss/v5/model" region "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/hss/v5/region" ) func main() { // The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security. // In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment ak := os.Getenv("CLOUD_SDK_AK") sk := os.Getenv("CLOUD_SDK_SK") projectId := "{project_id}" auth := basic.NewCredentialsBuilder(). WithAk(ak). WithSk(sk). WithProjectId(projectId). Build() client := hss.NewHssClient( hss.HssClientBuilder(). WithRegion(region.ValueOf("<YOUR REGION>")). WithCredential(auth). Build()) request := &model.ChangeEventRequest{} agentIdOperateDetailList:= "c9bed5397db449ebdfba15e85fcfc36accee125c68954daf5cab0528bab59bd8" processPidOperateDetailList:= int32(3123) fileHashOperateDetailList:= "e8b50f0b91e3dce0885ccc5902846b139d28108a0a7976c9b8d43154c5dbc44d" filePathOperateDetailList:= "/usr/test" fileAttrOperateDetailList:= "33261" keywordOperateDetailList:= "file_path=/usr/test" hashOperateDetailList:= "e8b50f0b91e3dce0885ccc5902846b139d28108a0a7976c9b8d43154c5dbc44d" privateIpOperateDetailList:= "127.0.0.2" loginIpOperateDetailList:= "127.0.0.1" loginUserNameOperateDetailList:= "root" containerIdOperateDetailList:= "containerid" containerNameOperateDetailList:= "/test" var listOperateDetailListOperateEventList = []model.EventDetailRequestInfo{ { AgentId: &agentIdOperateDetailList, ProcessPid: &processPidOperateDetailList, FileHash: &fileHashOperateDetailList, FilePath: &filePathOperateDetailList, FileAttr: &fileAttrOperateDetailList, Keyword: &keywordOperateDetailList, Hash: &hashOperateDetailList, PrivateIp: &privateIpOperateDetailList, LoginIp: &loginIpOperateDetailList, LoginUserName: &loginUserNameOperateDetailList, ContainerId: &containerIdOperateDetailList, ContainerName: &containerNameOperateDetailList, }, } var listOperateEventListbody = []model.OperateEventRequestInfo{ { EventClassId: "rootkit_0001", EventId: "2a71e1e2-60f4-4d56-b314-2038fdc39de6", EventType: int32(1010), OccurTime: int64(1672046760353), OperateDetailList: listOperateDetailListOperateEventList, }, } handlerChangeEventRequestInfo:= "test" request.Body = &model.ChangeEventRequestInfo{ OperateEventList: listOperateEventListbody, Handler: &handlerChangeEventRequestInfo, OperateType: "mark_as_handled", } response, err := client.ChangeEvent(request) if err == nil { fmt.Printf("%+v\n", response) } else { fmt.Println(err) } } |
更多编程语言的SDK代码示例，请参见API Explorer的代码示例页签，可生成自动对应的SDK代码示例。
状态码
|
状态码 |
描述 |
|---|---|
|
200 |
请求已成功 |
|
400 |
参数非法 |
|
401 |
鉴权失败 |
|
403 |
权限不足 |
|
404 |
资源未找到 |
|
500 |
系统异常 |
错误码
请参见错误码。
