根据必填告警 ID 查询病毒告警的资产、文件、命中规则、处置记录和原始数据；告警 ID 可从 ListVirusAlarms 获取。

调试 #

请求参数 #

下表仅列出该接口特有的请求参数和部分公共参数。更多信息请见公共参数。

返回参数 #

下表仅列出本接口特有的返回参数。更多信息请参见返回结构。

请求示例 #

GET /?Action=GetVirusAlarmSummaryInfo&Version=2024-05-08&AlarmID=alarm-id-001 HTTP/1.1
Host: seccenter.volcengineapi.com
X-Date: 20241120T080538Z
Authorization: HMAC-SHA256 Credential=Adfks******wekfwe/20241120/cn-beijing/seccenter/request, SignedHeaders=host;x-date, Signature=47a7d934ff7b37c03938******cd7b8278a40a1057690c401e92246a0e41085f

返回示例 #

{
  "ResponseMetadata": {
    "RequestId": "20241120165538010234567890",
    "Action": "GetVirusAlarmSummaryInfo",
    "Version": "2024-05-08",
    "Service": "seccenter",
    "Region": "cn-beijing"
  },
  "Result": {
    "AlarmDesc": {
      "AlarmCount": 1,
      "AlarmHandleResult": 11,
      "AlarmID": "alarm-id-001",
      "AlertDesc": "使用 SSH/RDP 服务在非工作时间或从非常用登录 IP 进行远程访问",
      "AlertDescUS": "Remote access via SSH/RDP from an unknown location outside working hours",
      "AlertDetail": "host-001 上存在异常登录告警；root 通过 publickey 成功登录，源 IP 为 198.51.100.20",
      "AlertDetailUS": "Abnormal login detected on host-001; root logged in via publickey from 198.51.100.20",
      "AlertTags": [
        "production"
      ],
      "AlertType": "账密盗用",
      "AlertTypeUs": "credential_access",
      "AnalyzeReport": "https://example.com/security/report/001",
      "AnalyzeReportName": "example-name",
      "AttackID": "T1078",
      "AttackIDList": "T1078",
      "DataTypeStr": "SSH登陆",
      "DataTypeStrEn": "DNS Query",
      "Desc": "example description",
      "Docker": "-",
      "ErrorReason": "example description",
      "HandleTime": 1764640425,
      "HandleUser": "alarm.operator@example.com",
      "HidsLevel": "high",
      "InsertTime": 1761208351,
      "KubeLevel": "default",
      "LastAlarmTime": 1786579199,
      "OperationList": [
        "write"
      ],
      "RaspConfigName": "example-name",
      "RaspLevel": "default",
      "RelatedConfigID": "config-id-001",
      "RiskDesc": "example description",
      "RuleName": "异常登录",
      "RuleNameUs": "Abnormal Login",
      "Status": 1,
      "Suggestion": "验证登录行为并检查系统和网络日志；如确认未授权登录，请立即更换账户凭证",
      "SuggestionUs": "example description",
      "TraceID": "trace_alarm-id-001"
    },
    "AssetInfo": {
      "ClusterInfo": {
        "ClusterArea": "cn-beijing",
        "ClusterID": "cluster-id-001",
        "ClusterName": "example-name",
        "ClusterTags": [
          "production"
        ]
      },
      "HostInfo": {
        "AgentID": "agent-id-001",
        "CloudProviders": [
          "volcengine"
        ],
        "ContainerImage": "nginx:1.27",
        "ContainerName": "example-name",
        "Hostname": "host-001",
        "InIPList": [
          "192.0.2.10"
        ],
        "LeafGroupIDs": [
          "group-id-101",
          "group-id-102"
        ],
        "MlpInstanceID": "instance-id-001",
        "Os": "linux",
        "OsPlatform": "linux",
        "OutIPList": [
          "192.0.2.10"
        ],
        "Region": "cn-beijing",
        "TagList": [
          "production"
        ],
        "TopGroupID": "group-id-001"
      }
    },
    "ContainerInfo": {
      "ContainerCreateTime": "1786492800",
      "ContainerCreateTimestamp": 1786492800,
      "ContainerHostName": "host-001",
      "ContainerID": "container-id-001",
      "ContainerIP": "192.0.2.10",
      "ContainerName": "example-name",
      "ContainerNetMode": "bridge",
      "ContainerPns": "4026533001",
      "ContainerQueryResult": "success",
      "ContainerRuntime": "cri",
      "ContainerState": "running",
      "ImageID": "image-id-001",
      "ImageName": "example-name",
      "PodID": "pod-id-001",
      "PodName": "example-name"
    },
    "EndpointTrace": {
      "AlarmID": "alarm-id-001",
      "ResultList": [
        {
          "Argv": "ls -la",
          "Attr": "-rwxr-xr-x",
          "Comm": "name",
          "CreateAt": "create-at-sample",
          "Cron": "0 2 * * * /usr/bin/backup",
          "Data": "suspicious process execution",
          "DataType": "default",
          "Exe": "/usr/bin/bash",
          "ExeHash": "d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2",
          "ExeSize": "1048576",
          "FilePath": "/var/log/example.log",
          "IP": "192.0.2.10",
          "Keywords": "keywords-sample",
          "LineNumber": "line-number-sample",
          "LoginAt": "login-at-sample",
          "LogoutAt": "logout-at-sample",
          "Matches": "matches-sample",
          "Md5sum": "d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2",
          "ModifyAt": "modify-at-sample",
          "Name": "example-name",
          "Permission": "rwx",
          "Pgid": "pgid-id-001",
          "Pid": 1234,
          "Port": "443",
          "Ppid": "ppid-id-001",
          "Restart": "always",
          "Sha256sum": "d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2",
          "Stype": "default",
          "TraceID": "trace-id-001",
          "Types": "default",
          "User": "user@example.com"
        }
      ],
      "TraceID": "trace-id-001"
    },
    "HandlingRecords": [
      {
        "Action": "标记为:已加白",
        "ActionContent": {
          "IsolateFileList": [
            "/tmp/malware.bin"
          ],
          "KillProcList": [
            {
              "Cmdline": "ls -la",
              "Pid": 1234
            }
          ],
          "RmFileList": [
            "/tmp/suspicious.sh"
          ]
        },
        "ExtraDescription": "example description",
        "HandleTime": 1764640425,
        "Language": "zh-CN",
        "Result": {
          "Reason": "--",
          "Status": "success"
        },
        "SoarName": "example-name",
        "User": "alarm.operator@example.com",
        "WhiteListID": "whitelist-id-001",
        "WhiteListName": "example-name",
        "WhiteListStatus": true
      }
    ],
    "RawData": {}
  }
}

错误码 #

下表为您列举了该接口与业务逻辑相关的错误码。公共错误码请参见公共错误码文档。