1. 接口描述
接口请求域名： tcss.tencentcloudapi.com 。
查询运行时异常策略详细信息
默认接口请求频率限制：20次/秒。
推荐使用 API Explorer
点击调试
API Explorer 提供了在线调用、签名验证、SDK 代码生成和快速检索接口等能力。您可查看每次调用的请求内容和返回结果以及自动生成 SDK 调用示例。
2. 输入参数
以下请求参数列表仅列出了接口请求参数和部分公共参数，完整公共参数列表见 公共请求参数。
| 参数名称 | 必选 | 类型 | 描述 |
|---|---|---|---|
| Action | 是 | String | 公共参数，本接口取值：DescribeAbnormalProcessRuleDetail。 |
| Version | 是 | String | 公共参数，本接口取值：2020-11-01。 |
| Region | 否 | String | 公共参数，此参数为可选参数。 |
| RuleId | 否 | String | 策略唯一id 示例值：sub1 |
| ImageId | 否 | String | 镜像id, 在添加白名单的时候使用 示例值：sha256:9aae1601d6832af6c69ef257f09f9d4e41646ed287a269cf62ac39d8d |
| Limit | 否 | Integer | 需要返回的数量，默认为10，最大值为100 示例值：10 |
| Offset | 否 | Integer | 偏移量，默认为0。 示例值：0 |
3. 输出参数
| 参数名称 | 类型 | 描述 |
|---|---|---|
| RuleDetail | AbnormalProcessRuleInfo | 异常进程策略详细信息 示例值：{} |
| RequestId | String | 唯一请求 ID，由服务端生成，每次请求都会返回（若请求因其他原因未能抵达服务端，则该次请求不会获得 RequestId）。定位问题时需要提供该次请求的 RequestId。 |
4. 示例
示例1 根据规则ID查询规则详情（用户策略）
输入示例
https://tcss.tencentcloudapi.com/?Action=DescribeAbnormalProcessRuleDetail
&RuleId=6045892534b9a9000c4ae5ba
&Limit=10
&Offset=0
&<公共请求参数>输出示例
{
"Response": {
"RequestId": "fee1bdb0-c13f-4c65-b567-8e270df211c1",
"RuleDetail": {
"RuleId": "6045892534b9a9000c4ae5ba",
"IsEnable": true,
"RuleName": "9999",
"ChildRules": [
{
"RuleId": "6020e81134b9a9000c50b56a",
"RuleMode": "RULE_MODE_ALERT",
"ProcessPath": "/bin/ptest",
"RuleLevel": "MIDDLE"
},
{
"RuleId": "60212ddd98dab16785dfeab2",
"RuleMode": "RULE_MODE_ALERT",
"ProcessPath": "/usr/bin/ps",
"RuleLevel": "MIDDLE"
},
{
"RuleId": "6021472934b9a9000c358fa3",
"RuleMode": "RULE_MODE_RELEASE",
"ProcessPath": "/usr/bin/top",
"RuleLevel": "MIDDLE"
},
{
"RuleId": "602f603d34b9a9000cb2b405",
"RuleMode": "RULE_MODE_ALERT",
"ProcessPath": "/usr/bin/tail",
"RuleLevel": "MIDDLE"
},
{
"RuleId": "60326e4434b9a9000c0897a8",
"RuleMode": "RULE_MODE_ALERT",
"ProcessPath": "/usr/bin/busybox",
"RuleLevel": "MIDDLE"
},
{
"RuleId": "60337df034b9a9000c2240c8",
"RuleMode": "RULE_MODE_ALERT",
"ProcessPath": "/usr/bin/sss",
"RuleLevel": "MIDDLE"
}
],
"SystemChildRules": [],
"ImageIds": [
"sha256:300e315adb2f96afe5f0b2780b87f28ae95231fe3bdd1e16b9ba606307728f55"
]
}
}
}示例2 根据规则ID查询规则详情（系统策略）
输入示例
https://tcss.tencentcloudapi.com/?Action=DescribeAbnormalProcessRuleDetail
&RuleId=6045892534b9a9000c4ae5ba
&Limit=10
&Offset=0
&<公共请求参数>输出示例
{
"Response": {
"RequestId": "fee1bdb0-c13f-4c65-b567-8e270df211c1",
"RuleDetail": {
"RuleId": "6048403bd620f3f9012c521d",
"IsEnable": true,
"IsDefault": true,
"RuleName": "系统策略",
"ChildRules": [],
"SystemChildRules": [
{
"RuleId": "100000000000000000000001",
"IsEnable": true,
"RuleMode": "RULE_MODE_ALERT",
"RuleType": "PROXY_TOOL",
"RuleLevel": "MIDDLE"
},
{
"RuleId": "100000000000000000000002",
"IsEnable": true,
"RuleMode": "RULE_MODE_ALERT",
"RuleType": "TRANSFER_CONTROL",
"RuleLevel": "MIDDLE"
},
{
"RuleId": "100000000000000000000003",
"IsEnable": true,
"RuleMode": "RULE_MODE_ALERT",
"RuleType": "ATTACK_CMD",
"RuleLevel": "MIDDLE"
},
{
"RuleId": "100000000000000000000004",
"IsEnable": true,
"RuleMode": "RULE_MODE_ALERT",
"RuleType": "REVERSE_SHELL",
"RuleLevel": "MIDDLE"
},
{
"RuleId": "100000000000000000000005",
"IsEnable": true,
"RuleMode": "RULE_MODE_ALERT",
"RuleType": "FILELESS",
"RuleLevel": "MIDDLE"
},
{
"RuleId": "100000000000000000000006",
"IsEnable": true,
"RuleMode": "RULE_MODE_ALERT",
"RuleType": "RISK_CMD",
"RuleLevel": "MIDDLE"
},
{
"RuleId": "100000000000000000000007",
"IsEnable": true,
"RuleMode": "RULE_MODE_ALERT",
"RuleType": "ABNORMAL_CHILD_PROC",
"RuleLevel": "MIDDLE"
}
],
"ImageIds": [
"sha256:300e315adb2f96afe5f0b2780b87f28ae95231fe3bdd1e16b9ba606307728f55"
]
}
}
}示例3 根据事件的镜像ID，查询当前镜像的规则详情（用户策略）
输入示例
https://tcss.tencentcloudapi.com/?Action=DescribeAbnormalProcessRuleDetail
&ImageId="sha256:300e315adb2f96afe5f0b2780b87f28ae95231fe3bdd1e16b9ba606307728f55"
&Limit=10
&Offset=0
&<公共请求参数>输出示例
{
"Response": {
"RequestId": "fee1bdb0-c13f-4c65-b567-8e270df211c1",
"RuleDetail": {
"RuleId": "6045892534b9a9000c4ae5ba",
"IsEnable": true,
"RuleName": "9999",
"ChildRules": [
{
"RuleId": "6020e81134b9a9000c50b56a",
"RuleMode": "RULE_MODE_ALERT",
"ProcessPath": "/bin/ptest",
"RuleLevel": "MIDDLE"
},
{
"RuleId": "60212ddd98dab16785dfeab2",
"RuleMode": "RULE_MODE_ALERT",
"ProcessPath": "/usr/bin/ps",
"RuleLevel": "MIDDLE"
},
{
"RuleId": "6021472934b9a9000c358fa3",
"RuleMode": "RULE_MODE_RELEASE",
"ProcessPath": "/usr/bin/top",
"RuleLevel": "MIDDLE"
},
{
"RuleId": "602f603d34b9a9000cb2b405",
"RuleMode": "RULE_MODE_ALERT",
"ProcessPath": "/usr/bin/tail",
"RuleLevel": "MIDDLE"
},
{
"RuleId": "60326e4434b9a9000c0897a8",
"RuleMode": "RULE_MODE_ALERT",
"ProcessPath": "/usr/bin/busybox",
"RuleLevel": "MIDDLE"
},
{
"RuleId": "60337df034b9a9000c2240c8",
"RuleMode": "RULE_MODE_ALERT",
"ProcessPath": "/usr/bin/sss",
"RuleLevel": "MIDDLE"
}
],
"SystemChildRules": [],
"ImageIds": [
"sha256:300e315adb2f96afe5f0b2780b87f28ae95231fe3bdd1e16b9ba606307728f55"
]
}
}
}示例4 根据事件的镜像ID，查询当前镜像的规则详情（系统策略）
输入示例
https://tcss.tencentcloudapi.com/?Action=DescribeAbnormalProcessRuleDetail
&ImageId="sha256:300e315adb2f96afe5f0b2780b87f28ae95231fe3bdd1e16b9ba606307728f55"
&Limit=10
&Offset=0
&<公共请求参数>输出示例
{
"Response": {
"RequestId": "fee1bdb0-c13f-4c65-b567-8e270df211c1",
"RuleDetail": {
"RuleId": "6048403bd620f3f9012c521d",
"IsEnable": true,
"IsDefault": true,
"RuleName": "系统策略",
"ChildRules": [],
"SystemChildRules": [
{
"RuleId": "100000000000000000000001",
"IsEnable": true,
"RuleMode": "RULE_MODE_ALERT",
"RuleType": "PROXY_TOOL",
"RuleLevel": "MIDDLE"
},
{
"RuleId": "100000000000000000000002",
"IsEnable": true,
"RuleMode": "RULE_MODE_ALERT",
"RuleType": "TRANSFER_CONTROL",
"RuleLevel": "MIDDLE"
},
{
"RuleId": "100000000000000000000003",
"IsEnable": true,
"RuleMode": "RULE_MODE_ALERT",
"RuleType": "ATTACK_CMD",
"RuleLevel": "MIDDLE"
},
{
"RuleId": "100000000000000000000004",
"IsEnable": true,
"RuleMode": "RULE_MODE_ALERT",
"RuleType": "REVERSE_SHELL",
"RuleLevel": "MIDDLE"
},
{
"RuleId": "100000000000000000000005",
"IsEnable": true,
"RuleMode": "RULE_MODE_ALERT",
"RuleType": "FILELESS",
"RuleLevel": "MIDDLE"
},
{
"RuleId": "100000000000000000000006",
"IsEnable": true,
"RuleMode": "RULE_MODE_ALERT",
"RuleType": "RISK_CMD",
"RuleLevel": "MIDDLE"
},
{
"RuleId": "100000000000000000000007",
"IsEnable": true,
"RuleMode": "RULE_MODE_ALERT",
"RuleType": "ABNORMAL_CHILD_PROC",
"RuleLevel": "MIDDLE"
}
],
"ImageIds": [
"sha256:300e315adb2f96afe5f0b2780b87f28ae95231fe3bdd1e16b9ba606307728f55"
]
}
}
}5. 开发者资源
腾讯云 API 平台
腾讯云 API 平台 是综合 API 文档、错误码、API Explorer 及 SDK 等资源的统一查询平台，方便您从同一入口查询及使用腾讯云提供的所有 API 服务。
API Inspector
用户可通过 API Inspector 查看控制台每一步操作关联的 API 调用情况，并自动生成各语言版本的 API 代码，也可前往 API Explorer 进行在线调试。
SDK
云 API 3.0 提供了配套的开发工具集（SDK），支持多种编程语言，能更方便的调用 API。
- Tencent Cloud SDK 3.0 for Python: GitHub Gitee
- Tencent Cloud SDK 3.0 for Java: GitHub Gitee
- Tencent Cloud SDK 3.0 for PHP: GitHub Gitee
- Tencent Cloud SDK 3.0 for Go: GitHub Gitee
- Tencent Cloud SDK 3.0 for Node.js: GitHub Gitee
- Tencent Cloud SDK 3.0 for .NET: GitHub Gitee
- Tencent Cloud SDK 3.0 for C++: GitHub Gitee
- Tencent Cloud SDK 3.0 for Ruby: GitHub Gitee
命令行工具
6. 错误码
以下仅列出了接口业务逻辑相关的错误码，其他错误码详见 公共错误码。
| 错误码 | 描述 |
|---|---|
| AuthFailure | CAM签名/鉴权错误。 |
| FailedOperation.RuleNotFind | 当前规则信息未找到。 |
| InternalError | 内部错误。 |
| InvalidParameter | 参数错误。 |
| InvalidParameter.InvalidFormat | 参数格式错误。 |
| InvalidParameter.MissingParameter | 缺少必须参数。 |
| InvalidParameterValue | 参数取值错误。 |
| ResourceNotFound | 资源不存在。 |
