分页查询当前账户的主机入侵安全告警，支持按发生时间、处理状态、告警级别、告警类别、资产及分组等条件筛选，用于安全事件分析和处置；筛选条件均不传时查询全部可见告警。

调试 #

请求参数 #

下表仅列出该接口特有的请求参数和部分公共参数。更多信息请见公共参数。

返回参数 #

下表仅列出本接口特有的返回参数。更多信息请参见返回结构。

请求示例 #

POST /?Action=ListHidsAlarms&Version=2024-05-08 HTTP/1.1
Host: seccenter.volcengineapi.com
Content-Type: application/json; charset=UTF-8
X-Date: 20241120T080538Z
X-Content-Sha256: 287e874e******d653b44d21e
Authorization: HMAC-SHA256 Credential=Adfks******wekfwe/20241120/cn-beijing/seccenter/request, SignedHeaders=host;x-content-sha256;x-date, Signature=47a7d934ff7b37c03938******cd7b8278a40a1057690c401e92246a0e41085f

{
  "AgentGroup": "production-hosts",
  "AgentGroupList": [
    "production"
  ],
  "AgentID": "agent-id-001",
  "AgentIDList": [
    "agent-id-001"
  ],
  "AgentTags": [
    "production"
  ],
  "AlarmHandleResultList": [
    0,
    3,
    25
  ],
  "AlarmID": "64b000000000000000000002",
  "AlertTags": [
    "production"
  ],
  "CloudProviders": [
    "volcengine"
  ],
  "ClusterID": "cluster-id-001",
  "ClusterName": "example-name",
  "ClusterRegion": "cn-beijing",
  "ClusterTags": [
    "production"
  ],
  "ContainerID": "container-id-001",
  "ContainerName": "example-name",
  "DataType": "4000",
  "EventID": "event-id-001",
  "EventName": "example-name",
  "EventReason": "example description",
  "Exe": "/var/log/example",
  "FileHash": "d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2",
  "FilePath": "/var/log/example.log",
  "Hostname": "host-001",
  "IP": "192.0.2.10",
  "ImageName": "example-name",
  "LastAlarmTimeEnd": 1786579199,
  "LastAlarmTimeStart": 1786492800,
  "LeafGroupIDs": [
    "group-id-101",
    "group-id-102"
  ],
  "LevelList": [
    "critical",
    "high"
  ],
  "MlpInstanceID": "mlp-instance-id-001",
  "Name": "异常登录",
  "OperationList": [
    "write"
  ],
  "PageNumber": 1,
  "PageSize": 20,
  "ProbeHook": "java.lang.Runtime.exec",
  "RaspArgv": "ls -la",
  "SortBy": "LastHeartbeatTime",
  "SortOrder": "Desc",
  "Status": [
    0,
    1
  ],
  "TaskID": "task-id-001",
  "TimeEnd": 1761209000,
  "TimeStart": 1761208000,
  "TopGroupID": "group-id-001",
  "Type": [
    "credential_access"
  ],
  "VirusType": "Webshell",
  "WhiteListID": "64b000000000000000000001",
  "WhiteListName": "example-name"
}

返回示例 #

{
  "ResponseMetadata": {
    "RequestId": "20241120165538010234567890",
    "Action": "ListHidsAlarms",
    "Version": "2024-05-08",
    "Service": "seccenter",
    "Region": "cn-beijing"
  },
  "Result": {
    "Data": [
      {
        "AgentGroup": "production-hosts",
        "AgentID": "agent-id-001",
        "AlarmCount": 1,
        "AlarmHandleResult": 11,
        "AlarmHostname": "host-001",
        "AlarmID": "alarm-id-001",
        "AlarmTime": 1761208351,
        "AlertTags": [
          "已处理"
        ],
        "AnalysisRecordUUID": "sec_intel_risk_analysis_alarm-id-001",
        "Args": [
          "RASP"
        ],
        "ArgsList": [
          "RASP"
        ],
        "ArgvList": [
          "java -jar app.jar"
        ],
        "AttributionList": [
          {
            "Type": "USER",
            "Value": "value"
          }
        ],
        "Class": "Webshell",
        "Cluster": {
          "ClusterArea": "cn-beijing",
          "ClusterID": "cluster-id-001",
          "ClusterName": "example-name",
          "ClusterTags": [
            "production"
          ],
          "RuleType1st": "default",
          "RuleType2nd": "default"
        },
        "Confidence": "8",
        "DataType": "601",
        "ErrorReason": "example description",
        "EventID": "event-id-001",
        "EventName": "example-name",
        "Exe": "/usr/bin/bash",
        "FileDownloadable": true,
        "FileHash": "d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2",
        "FilePath": "/var/log/example.log",
        "GroupPath": "/未分组",
        "HandleFailReason": "example description",
        "HandleTime": 1764640425,
        "Host": {
          "AgentID": "agent-id-001",
          "AgentTags": [
            "production"
          ],
          "Hostname": "host-001",
          "InnerIPList": [
            "192.0.2.10"
          ],
          "OuterIPList": [
            "192.0.2.10"
          ]
        },
        "ImageName": "example-name",
        "InDocker": "true",
        "LLMAnalysisResult": "success",
        "LLMProcessed": true,
        "LastAlarmTime": 1786579199,
        "Level": "high",
        "MlpInstanceID": "instance-id-001",
        "MlpPrivateIP": "192.0.2.10",
        "Name": "可疑代理程序",
        "NsPid": "ns-pid-id-001",
        "OperationList": [
          "write"
        ],
        "OsType": "linux",
        "Pid": "32754",
        "ProbeHook": "java.lang.Runtime.exec",
        "Region": "cn-shanghai",
        "SecurityIntelligenceComplete": true,
        "SecurityIntelligenceError": "model service unavailable",
        "SecurityIntelligenceResult": "FALSE",
        "SecurityIntelligenceStatus": "PENDING",
        "Sid": "sid-id-001",
        "StackTraceFormat": "RASP",
        "StackTraceHash": "d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2",
        "Status": 1,
        "TraceID": "trace_alarm-id-001",
        "Type": "command_control"
      }
    ],
    "PageNumber": 1,
    "PageSize": 20,
    "TotalCount": 1
  }
}

错误码 #

下表为您列举了该接口与业务逻辑相关的错误码。公共错误码请参见公共错误码文档。