查询运行时异常进程策略详细信息

最近更新时间：2024-04-03 11:28:01

我的收藏

本页目录：

1. 接口描述

接口请求域名： tcss.tencentcloudapi.com 。

查询运行时异常策略详细信息

默认接口请求频率限制：20次/秒。

推荐使用 API Explorer

点击调试

API Explorer 提供了在线调用、签名验证、SDK 代码生成和快速检索接口等能力。您可查看每次调用的请求内容和返回结果以及自动生成 SDK 调用示例。

2. 输入参数

以下请求参数列表仅列出了接口请求参数和部分公共参数，完整公共参数列表见公共请求参数。

参数名称	必选	类型	描述
Action	是	String	公共参数，本接口取值：DescribeAbnormalProcessRuleDetail。
Version	是	String	公共参数，本接口取值：2020-11-01。
Region	否	String	公共参数，此参数为可选参数。
RuleId	否	String	策略唯一id 示例值：sub1
ImageId	否	String	镜像id, 在添加白名单的时候使用示例值：sha256:9aae1601d6832af6c69ef257f09f9d4e41646ed287a269cf62ac39d8d
Limit	否	Integer	需要返回的数量，默认为10，最大值为100 示例值：10
Offset	否	Integer	偏移量，默认为0。示例值：0

3. 输出参数

参数名称	类型	描述
RuleDetail	AbnormalProcessRuleInfo	异常进程策略详细信息示例值：{}
RequestId	String	唯一请求 ID，由服务端生成，每次请求都会返回（若请求因其他原因未能抵达服务端，则该次请求不会获得 RequestId）。定位问题时需要提供该次请求的 RequestId。

4. 示例

示例1 根据规则ID查询规则详情（用户策略）

输入示例

https://tcss.tencentcloudapi.com/?Action=DescribeAbnormalProcessRuleDetail
&RuleId=xxx
&Limit=10
&Offset=0
&<公共请求参数>

输出示例

{
    "Response": {
        "RequestId": "fee1bdb0-c13f-4c65-b567-8e270df211c1",
        "RuleDetail": {
            "RuleId": "6045892534b9a9000c4ae5ba",
            "IsEnable": true,
            "RuleName": "9999",
            "ChildRules": [
                {
                    "RuleId": "6020e81134b9a9000c50b56a",
                    "RuleMode": "RULE_MODE_ALERT",
                    "ProcessPath": "/bin/ptest",
                    "RuleLevel": "MIDDLE"
                },
                {
                    "RuleId": "60212ddd98dab16785dfeab2",
                    "RuleMode": "RULE_MODE_ALERT",
                    "ProcessPath": "/usr/bin/ps",
                    "RuleLevel": "MIDDLE"
                },
                {
                    "RuleId": "6021472934b9a9000c358fa3",
                    "RuleMode": "RULE_MODE_RELEASE",
                    "ProcessPath": "/usr/bin/top",
                    "RuleLevel": "MIDDLE"
                },
                {
                    "RuleId": "602f603d34b9a9000cb2b405",
                    "RuleMode": "RULE_MODE_ALERT",
                    "ProcessPath": "/usr/bin/tail",
                    "RuleLevel": "MIDDLE"
                },
                {
                    "RuleId": "60326e4434b9a9000c0897a8",
                    "RuleMode": "RULE_MODE_ALERT",
                    "ProcessPath": "/usr/bin/busybox",
                    "RuleLevel": "MIDDLE"
                },
                {
                    "RuleId": "60337df034b9a9000c2240c8",
                    "RuleMode": "RULE_MODE_ALERT",
                    "ProcessPath": "/usr/bin/sss",
                    "RuleLevel": "MIDDLE"
                }
            ],
            "SystemChildRules": [],
            "ImageIds": [
                "sha256:300e315adb2f96afe5f0b2780b87f28ae95231fe3bdd1e16b9ba606307728f55"
            ]
        }
    }
}

示例2 根据规则ID查询规则详情（系统策略）

输入示例

https://tcss.tencentcloudapi.com/?Action=DescribeAbnormalProcessRuleDetail
&RuleId=xxx
&Limit=10
&Offset=0
&<公共请求参数>

输出示例

{
    "Response": {
        "RequestId": "fee1bdb0-c13f-4c65-b567-8e270df211c1",
        "RuleDetail": {
            "RuleId": "6048403bd620f3f9012c521d",
            "IsEnable": true,
            "IsDefault": true,
            "RuleName": "系统策略",
            "ChildRules": [],
            "SystemChildRules": [
                {
                    "RuleId": "100000000000000000000001",
                    "IsEnable": true,
                    "RuleMode": "RULE_MODE_ALERT",
                    "RuleType": "PROXY_TOOL",
                    "RuleLevel": "MIDDLE"
                },
                {
                    "RuleId": "100000000000000000000002",
                    "IsEnable": true,
                    "RuleMode": "RULE_MODE_ALERT",
                    "RuleType": "TRANSFER_CONTROL",
                    "RuleLevel": "MIDDLE"
                },
                {
                    "RuleId": "100000000000000000000003",
                    "IsEnable": true,
                    "RuleMode": "RULE_MODE_ALERT",
                    "RuleType": "ATTACK_CMD",
                    "RuleLevel": "MIDDLE"
                },
                {
                    "RuleId": "100000000000000000000004",
                    "IsEnable": true,
                    "RuleMode": "RULE_MODE_ALERT",
                    "RuleType": "REVERSE_SHELL",
                    "RuleLevel": "MIDDLE"
                },
                {
                    "RuleId": "100000000000000000000005",
                    "IsEnable": true,
                    "RuleMode": "RULE_MODE_ALERT",
                    "RuleType": "FILELESS",
                    "RuleLevel": "MIDDLE"
                },
                {
                    "RuleId": "100000000000000000000006",
                    "IsEnable": true,
                    "RuleMode": "RULE_MODE_ALERT",
                    "RuleType": "RISK_CMD",
                    "RuleLevel": "MIDDLE"
                },
                {
                    "RuleId": "100000000000000000000007",
                    "IsEnable": true,
                    "RuleMode": "RULE_MODE_ALERT",
                    "RuleType": "ABNORMAL_CHILD_PROC",
                    "RuleLevel": "MIDDLE"
                }
            ],
            "ImageIds": [
                "sha256:300e315adb2f96afe5f0b2780b87f28ae95231fe3bdd1e16b9ba606307728f55"
            ]
        }
    }
}

示例3 根据事件的镜像ID，查询当前镜像的规则详情（用户策略）

输入示例

https://tcss.tencentcloudapi.com/?Action=DescribeAbnormalProcessRuleDetail
&ImageId=xxx
&Limit=10
&Offset=0
&<公共请求参数>

输出示例

{
    "Response": {
        "RequestId": "fee1bdb0-c13f-4c65-b567-8e270df211c1",
        "RuleDetail": {
            "RuleId": "6045892534b9a9000c4ae5ba",
            "IsEnable": true,
            "RuleName": "9999",
            "ChildRules": [
                {
                    "RuleId": "6020e81134b9a9000c50b56a",
                    "RuleMode": "RULE_MODE_ALERT",
                    "ProcessPath": "/bin/ptest",
                    "RuleLevel": "MIDDLE"
                },
                {
                    "RuleId": "60212ddd98dab16785dfeab2",
                    "RuleMode": "RULE_MODE_ALERT",
                    "ProcessPath": "/usr/bin/ps",
                    "RuleLevel": "MIDDLE"
                },
                {
                    "RuleId": "6021472934b9a9000c358fa3",
                    "RuleMode": "RULE_MODE_RELEASE",
                    "ProcessPath": "/usr/bin/top",
                    "RuleLevel": "MIDDLE"
                },
                {
                    "RuleId": "602f603d34b9a9000cb2b405",
                    "RuleMode": "RULE_MODE_ALERT",
                    "ProcessPath": "/usr/bin/tail",
                    "RuleLevel": "MIDDLE"
                },
                {
                    "RuleId": "60326e4434b9a9000c0897a8",
                    "RuleMode": "RULE_MODE_ALERT",
                    "ProcessPath": "/usr/bin/busybox",
                    "RuleLevel": "MIDDLE"
                },
                {
                    "RuleId": "60337df034b9a9000c2240c8",
                    "RuleMode": "RULE_MODE_ALERT",
                    "ProcessPath": "/usr/bin/sss",
                    "RuleLevel": "MIDDLE"
                }
            ],
            "SystemChildRules": [],
            "ImageIds": [
                "sha256:300e315adb2f96afe5f0b2780b87f28ae95231fe3bdd1e16b9ba606307728f55"
            ]
        }
    }
}

示例4 根据事件的镜像ID，查询当前镜像的规则详情（系统策略）

输入示例

https://tcss.tencentcloudapi.com/?Action=DescribeAbnormalProcessRuleDetail
&ImageId=xxx
&Limit=10
&Offset=0
&<公共请求参数>

输出示例

{
    "Response": {
        "RequestId": "fee1bdb0-c13f-4c65-b567-8e270df211c1",
        "RuleDetail": {
            "RuleId": "6048403bd620f3f9012c521d",
            "IsEnable": true,
            "IsDefault": true,
            "RuleName": "系统策略",
            "ChildRules": [],
            "SystemChildRules": [
                {
                    "RuleId": "100000000000000000000001",
                    "IsEnable": true,
                    "RuleMode": "RULE_MODE_ALERT",
                    "RuleType": "PROXY_TOOL",
                    "RuleLevel": "MIDDLE"
                },
                {
                    "RuleId": "100000000000000000000002",
                    "IsEnable": true,
                    "RuleMode": "RULE_MODE_ALERT",
                    "RuleType": "TRANSFER_CONTROL",
                    "RuleLevel": "MIDDLE"
                },
                {
                    "RuleId": "100000000000000000000003",
                    "IsEnable": true,
                    "RuleMode": "RULE_MODE_ALERT",
                    "RuleType": "ATTACK_CMD",
                    "RuleLevel": "MIDDLE"
                },
                {
                    "RuleId": "100000000000000000000004",
                    "IsEnable": true,
                    "RuleMode": "RULE_MODE_ALERT",
                    "RuleType": "REVERSE_SHELL",
                    "RuleLevel": "MIDDLE"
                },
                {
                    "RuleId": "100000000000000000000005",
                    "IsEnable": true,
                    "RuleMode": "RULE_MODE_ALERT",
                    "RuleType": "FILELESS",
                    "RuleLevel": "MIDDLE"
                },
                {
                    "RuleId": "100000000000000000000006",
                    "IsEnable": true,
                    "RuleMode": "RULE_MODE_ALERT",
                    "RuleType": "RISK_CMD",
                    "RuleLevel": "MIDDLE"
                },
                {
                    "RuleId": "100000000000000000000007",
                    "IsEnable": true,
                    "RuleMode": "RULE_MODE_ALERT",
                    "RuleType": "ABNORMAL_CHILD_PROC",
                    "RuleLevel": "MIDDLE"
                }
            ],
            "ImageIds": [
                "sha256:300e315adb2f96afe5f0b2780b87f28ae95231fe3bdd1e16b9ba606307728f55"
            ]
        }
    }
}

5. 开发者资源

腾讯云 API 平台

腾讯云 API 平台是综合 API 文档、错误码、API Explorer 及 SDK 等资源的统一查询平台，方便您从同一入口查询及使用腾讯云提供的所有 API 服务。

API Inspector

用户可通过 API Inspector 查看控制台每一步操作关联的 API 调用情况，并自动生成各语言版本的 API 代码，也可前往 API Explorer 进行在线调试。

SDK

云 API 3.0 提供了配套的开发工具集（SDK），支持多种编程语言，能更方便的调用 API。

Tencent Cloud SDK 3.0 for Python: GitHub Gitee
Tencent Cloud SDK 3.0 for Java: GitHub Gitee
Tencent Cloud SDK 3.0 for PHP: GitHub Gitee
Tencent Cloud SDK 3.0 for Go: GitHub Gitee
Tencent Cloud SDK 3.0 for Node.js: GitHub Gitee
Tencent Cloud SDK 3.0 for .NET: GitHub Gitee
Tencent Cloud SDK 3.0 for C++: GitHub Gitee
Tencent Cloud SDK 3.0 for Ruby: GitHub Gitee

命令行工具

Tencent Cloud CLI 3.0

6. 错误码

以下仅列出了接口业务逻辑相关的错误码，其他错误码详见公共错误码。

错误码	描述
AuthFailure	CAM签名/鉴权错误。
FailedOperation.RuleNotFind	当前规则信息未找到。
InternalError	内部错误。
InvalidParameter	参数错误。
InvalidParameter.InvalidFormat	参数格式错误。
InvalidParameter.MissingParameter	缺少必须参数。
InvalidParameterValue	参数取值错误。
ResourceNotFound	资源不存在。

上一篇: 统计异常进程各威胁等级待处理事件数下一篇: 运行时异常进程策略列表