文档中心

云安全中心

HIDS_ALARM

GetAlarmBySmithKey - 根据smithkey获取原始数据

根据必填的 SmithKey 和 AlarmCategory 查询对应安全告警或 RASP 告警的原始详情，供告警调查和安全分析使用；SmithKey 可从告警详情或告警列表关联数据中获取。

调试

API Explorer

您可以通过 API Explorer 在线发起调用，无需关注签名生成过程，快速获取调用结果。

去调试

请求参数

下表仅列出该接口特有的请求参数和部分公共参数。更多信息请见公共参数。

参数	类型	是否必填	示例值	描述
Action	String	是	GetAlarmBySmithKey	要执行的操作，取值：GetAlarmBySmithKey。
Version	String	是	2024-05-08	API的版本，取值：2024-05-08。
SmithKey	String	是	smith-key-001	告警原始事件的 SmithKey，必填，可从告警详情或告警列表关联数据中获取
AlarmCategory	String	是	hids	告警类别 rasp:应用防护 hids:安全告警
Type	String	否	killchain	告警类型: algorithm_killchain:安全告警_算法杀伤链 killchain:安全告警_杀伤链

返回参数

下表仅列出本接口特有的返回参数。更多信息请参见返回结构。

参数	类型	示例值	描述
AlarmDataType2439	Object	--	AlarmDataType2439
HubTraceData	Object	--	HubTraceData
BaseAlarmInfo	Object	--	BaseAlarmInfo
BaseInfo	Object	--	BaseInfo
CommAlarmInfo	Object	--	CommAlarmInfo
ContainerInfo	Object	--	ContainerInfo
DataType	String	4000	数据类型，具体取值见接口说明
DataTypeStr	String	SSH登陆	数据类型名称
Endpoint	String	example-endpoint	接口路径
PlusAlarmInfo602x	Object	--	PlusAlarmInfo602x
PlusAlarmInfo101	Object	--	PlusAlarmInfo101
PlusAlarmInfo3004	Object	--	PlusAlarmInfo3004
PlusAlarmInfo356	Object	--	PlusAlarmInfo356
PlusAlarmInfo4000	Object	--	PlusAlarmInfo4000
PlusAlarmInfo42	Object	--	PlusAlarmInfo42
PlusAlarmInfo49	Object	--	PlusAlarmInfo49
PlusAlarmInfo59	Object	--	PlusAlarmInfo59
PlusAlarmInfo6001	Object	--	PlusAlarmInfo6001
PlusAlarmInfo6002	Object	--	PlusAlarmInfo6002
PlusAlarmInfo6003	Object	--	PlusAlarmInfo6003
PlusAlarmInfo601	Object	--	PlusAlarmInfo601
PlusAlarmInfo602	Object	--	PlusAlarmInfo602
PlusAlarmInfo603	Object	--	PlusAlarmInfo603
PlusAlarmInfo604	Object	--	PlusAlarmInfo604
PlusAlarmInfo700	Object	--	PlusAlarmInfo700
PlusAlarmInfo701	Object	--	PlusAlarmInfo701
PlusAlarmInfo702	Object	--	PlusAlarmInfo702
PlusAlarmInfo703	Object	--	PlusAlarmInfo703
PlusAlarmInfo82	Object	--	PlusAlarmInfo82
PlusAlarmInfo86	Object	--	PlusAlarmInfo86
PlusKillChain	Object	--	PlusKillChain

请求示例

GET /?Action=GetAlarmBySmithKey&Version=2024-05-08&AlarmCategory=hids&SmithKey=smith-key-001&Type=killchain HTTP/1.1
Host: seccenter.volcengineapi.com
X-Date: 20241120T080538Z
Authorization: HMAC-SHA256 Credential=Adfks******wekfwe/20241120/cn-beijing/seccenter/request, SignedHeaders=host;x-date, Signature=47a7d934ff7b37c03938******cd7b8278a40a1057690c401e92246a0e41085f

返回示例

{
  "ResponseMetadata": {
    "RequestId": "20241120165538010234567890",
    "Action": "GetAlarmBySmithKey",
    "Version": "2024-05-08",
    "Service": "seccenter",
    "Region": "cn-beijing"
  },
  "Result": {
    "AlarmDataType2439": {
      "Args": [
        "--config",
        "/etc/example.conf"
      ],
      "Nspid": "nspid-id-001",
      "Pid": "pid-id-001",
      "ProbeHook": "java.lang.Runtime.exec",
      "StackTrace": "main -\u003e service.Handle -\u003e os.Open",
      "StackTraceHash": "d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2"
    },
    "BaseAlarmInfo": {
      "AlarmType": "credential_access",
      "AttackIDList": [
        "T1078"
      ],
      "CreateTime": 1761208351,
      "Desc": "检测到来自非常用 IP 的 SSH 异常登录",
      "Docker": "-",
      "HandleTime": 1764640425,
      "HandleUser": "alarm.operator@example.com",
      "Level": "high",
      "Name": "异常登录",
      "Status": 1,
      "Suggest": "确认登录行为；如未授权，请更换账户凭证",
      "TraceID": "trace_alarm-id-001",
      "UpdateTime": 1764640425
    },
    "BaseInfo": {
      "AgentID": "agent-id-001",
      "Hostname": "host-001",
      "InIPList": [
        "192.0.2.10"
      ],
      "Os": "linux",
      "OsPlatform": "ubuntu",
      "OutIPList": [
        "192.0.2.10"
      ]
    },
    "CommAlarmInfo": {
      "Argv": "ls -la",
      "Exec": "/usr/bin/bash",
      "Pgid": "pgid-id-001",
      "PgidArgv": "ls -la",
      "Pid": "pid-id-001",
      "Ppid": "ppid-id-001",
      "PpidArgv": "ls -la",
      "Username": "user@example.com"
    },
    "ContainerInfo": {
      "ContainerImage": "nginx:1.27",
      "ContainerName": "example-name"
    },
    "DataType": "4000",
    "DataTypeStr": "SSH登陆",
    "Endpoint": "example-endpoint",
    "HubTraceData": {},
    "PlusAlarmInfo101": {
      "PtraceRequest": "PTRACE_ATTACH",
      "TargetArgv": "ls -la",
      "TargetPid": "target-pid-id-001"
    },
    "PlusAlarmInfo3004": {
      "Path": "/var/log/example.log"
    },
    "PlusAlarmInfo356": {
      "FdName": "example-name",
      "Flags": "rw,nosuid"
    },
    "PlusAlarmInfo4000": {
      "Sip": "198.51.100.20",
      "Sport": "59204",
      "Types": "password",
      "User": "root"
    },
    "PlusAlarmInfo42": {
      "PidTree": "1(systemd)-\u003e1234(bash)",
      "SshInfo": "user@example.com from 192.0.2.10"
    },
    "PlusAlarmInfo49": {
      "PidTree": "1(systemd)-\u003e1234(bash)",
      "Sip": "192.0.2.10",
      "Sport": "443"
    },
    "PlusAlarmInfo59": {
      "Comm": "bash",
      "LdPreload": "/etc/ld.so.preload",
      "PidTree": "1(systemd)-\u003e1234(bash)",
      "RunPath": "/var/log/example.log",
      "SocketArgv": "ls -la",
      "SocketPid": "socket-pid-id-001",
      "Ssh": "user@example.com from 192.0.2.10",
      "SshInfo": "user@example.com from 192.0.2.10",
      "Stdin": "curl https://example.com",
      "Stdout": "command completed",
      "Uid": "uid-id-001"
    },
    "PlusAlarmInfo6001": {
      "Class": "executable",
      "CreateAt": "2026-08-13T10:00:00+08:00",
      "FileHash": "d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2",
      "ModifyAt": "2026-08-13T10:00:00+08:00",
      "Name": "example-name",
      "StaticFile": "/tmp/suspicious.sh",
      "Timestamp": "1786492800",
      "Types": "default"
    },
    "PlusAlarmInfo6002": {
      "Argv": "ls -la",
      "Class": "executable",
      "CreateAt": "2026-08-13T10:00:00+08:00",
      "FileHash": "d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2",
      "ModifyAt": "2026-08-13T10:00:00+08:00",
      "Name": "example-name",
      "Pgid": "pgid-id-001",
      "Pid": "pid-id-001",
      "Ppid": "ppid-id-001",
      "StaticFile": "/tmp/suspicious.sh",
      "Timestamp": "1786492800",
      "Types": "default",
      "Uid": "uid-id-001"
    },
    "PlusAlarmInfo6003": {
      "Class": "executable",
      "CreateAt": "2026-08-13T10:00:00+08:00",
      "FileHash": "d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2",
      "ModifyAt": "2026-08-13T10:00:00+08:00",
      "Name": "example-name",
      "StaticFile": "/tmp/suspicious.sh",
      "Timestamp": "1786492800",
      "Types": "default"
    },
    "PlusAlarmInfo601": {
      "PidTree": "1(systemd)-\u003e1234(bash)",
      "Query": "example.com"
    },
    "PlusAlarmInfo602": {
      "ConnectInfo": "192.0.2.10:443 -\u003e 198.51.100.20:443",
      "FilePath": "/var/log/example.log",
      "PidTree": "1(systemd)-\u003e1234(bash)",
      "SocketArgv": "ls -la"
    },
    "PlusAlarmInfo602x": {
      "Class": "Webshell",
      "CreateAt": "2026-08-13T10:00:00+08:00",
      "FileEntropy": "7.8",
      "FileHash": "d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2",
      "FileMagic": "PHP script text",
      "FileMime": "text/x-php",
      "FileSsdeep": "3:examplehash:examplehash",
      "FileTlsh": "T1ABCDEF0123456789",
      "FileType": "code/php",
      "M2md5": "d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2",
      "Md5Hash": "d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2",
      "ModifyAt": "2026-08-13T10:00:00+08:00",
      "Name": "webshell_php",
      "StaticFile": "/tmp/suspicious.sh",
      "Timestamp": "2024-05-08T10:00:00Z",
      "Types": "Php"
    },
    "PlusAlarmInfo603": {
      "KoFile": "/lib/modules/example.ko"
    },
    "PlusAlarmInfo604": {
      "OldUid": "old-uid-id-001",
      "OldUsername": "user@example.com",
      "PidTree": "1(systemd)-\u003e1234(bash)"
    },
    "PlusAlarmInfo700": {
      "ModuleName": "example-name"
    },
    "PlusAlarmInfo701": {
      "ModuleName": "example-name",
      "SyscallNumber": "59"
    },
    "PlusAlarmInfo702": {
      "ModuleName": "example-name"
    },
    "PlusAlarmInfo703": {
      "InterruptNumber": "14",
      "ModuleName": "example-name"
    },
    "PlusAlarmInfo82": {
      "NewName": "example-name",
      "OldName": "example-name",
      "PidTree": "1(systemd)-\u003e1234(bash)"
    },
    "PlusAlarmInfo86": {
      "NewName": "example-name",
      "OldName": "example-name",
      "PidTree": "1(systemd)-\u003e1234(bash)"
    },
    "PlusKillChain": {
      "Docker": "true",
      "ExternalConns": "198.51.100.20:443",
      "PidSet": "1234,5678",
      "Ssh": "user@example.com from 192.0.2.10",
      "Timestamp": "2025-10-23T08:32:29Z",
      "TopChain": "top-chain-sample",
      "TopRuleChain": [
        "initial_access",
        "execution"
      ]
    }
  }
}

错误码

下表为您列举了该接口与业务逻辑相关的错误码。公共错误码请参见公共错误码文档。

状态码	错误码	错误信息	说明
400	MissingParameter	The required parameter %s is missing.	请求参数缺失，请检查参数是否已正确传入。
400	InvalidParameter	The specified parameter %s is invalid.	请求参数错误，请检查参数传递内容是否正确。
400	OperationDenied	Operation is denied because the specified resource is in use.	不允许的操作，请检查当前资源是否被占用。
500	InternalError	The request has failed due to an unknown error.	服务器内部错误，请稍后重试或联系技术支持。
500	DBOperateError	The request has failed because database return error: %s	数据库操作异常，请稍后重试或联系技术支持。

最近更新时间：2026.10.30 14:06:19

这个页面对您有帮助吗？

有用

无用

云安全中心

调试 #

请求参数 #

返回参数 #

请求示例 #

返回示例 #

错误码 #

调试

请求参数

返回参数

请求示例

返回示例

错误码