Tenant Cloud Security Cloud Workload Protection Platform Data structure

Data structure

Last Updated At: 2026-08-02 00:05:06

BaselineItem

Baseline item information.

Referenced by the following interfaces: DescribeBaselineItemList

name	required	NULL allowed	type	description
CanBeFixed	no	yes	Int64	Whether it can be fixed. Example: 1
CategoryId	no	no	Int64	Category of the check item. Example: 50
DetectResultDesc	no	yes	String	Description of the check result. Example: If Redis is started with the root permission and access is not authorized, the arbitrary file write issue occurs, resulting in a command execution vulnerability.
DetectStatus	no	yes	Int64	Check status. 0: not passed. 1: ignored. 3: passed. 5: checking. Example: 1
FirstTime	no	yes	String	First occurrence time. Example: 1
FixMethod	no	no	String	Fix solution. Example: 1. Start Redis with low user permission.
HostId	no	yes	String	Server ID. Example: 1
HostIp	no	yes	String	IP address of the server. Example: 192.168.0.1
HostName	no	yes	String	Server name. Example: redis_node_cvm
ItemDesc	no	no	String	Description of the check item. Example: If Redis is started with the root permission and access is not authorized, the arbitrary file write issue occurs, resulting in a command execution vulnerability.
ItemId	no	no	Int64	Item ID. Example: 1100
ItemName	no	no	String	Item name. Example: Redis baseline compliance check
LastTime	no	yes	String	Last occurrence time. Example: 2025-01-01 12:00:00
Level	no	yes	Int64	Baseline risk level. 0: low; 1: medium; 2: high; 3: critical. Example: 1
MachineExtraInfo	no	yes	MachineExtraInfo	Host Additional Information Example:View
RuleName	no	no	String	Rule name. Example: Weak password check for Linux system
Uuid	no	yes	String	UUID of the CWP agent. Example: 5a540076-d38a-4078-aa98-q45rt371d322
WanIp	no	yes	String	Public IP address. Example: 35.236.25.11

BanWhiteListDetail

Blocklist details, including server information.

Referenced by the following interfaces: DescribeBanWhiteList

name	required	NULL allowed	type	description
CreateTime	yes	no	Datetime	Time when the blocklist was created. Example: 2021-03-03 16:05:00
Id	yes	no	String	Allowlist ID. Example: 1
IsGlobal	yes	no	Bool	Whether the blocklist is global. Example: false
MachineIp	yes	no	String	Server IP address. Example: 10.0.0.2
MachineName	yes	no	String	The instance name Example: machineName
ModifyTime	yes	no	Datetime	Time when the blocklist was modified. Example: 2021-03-03 16:05:00
Quuid	yes	no	String	QUUID of the server. Example: 059cb8b1-98c7-4e44-8345-ba9d87d722e2
Remark	yes	no	String	Alias of the blocklist. Example: remarkName
SrcIp	yes	no	String	Source IP address in the blocklist. Example: 10.0.0.1
Uuid	yes	no	String	UUID of the CWP agent. Example: 059cb8b1-98c7-4e44-8345-ba9d87d722e2

BaselineItemDetect

Baseline check item.

Referenced by the following interfaces: DescribeBaselineItemDetectList

name	required	NULL allowed	type	description
DetectResult	yes	yes	String	Check result, in JSON string format. (This field is deprecated.) Example: Obsolete
DetectStatus	yes	yes	Int64	0: checked not passed. 1: ignored. 3: check passed. 5: checking. Example: 1
FirstTime	yes	yes	String	First scan time. Example: 2021-02-01 12:00:00
FixMethod	yes	yes	String	Fix solution. Example: Create a dedicated user (generally named mongodb) for performing MongoDB database activities, and use this dedicated user to run MongoD...
HostCount	yes	yes	Int64	Number of affected servers. Example: 1
ItemDesc	yes	yes	String	Description of the check item. Example: If Redis is started with the root permission and access is not authorized, the arbitrary file write issue occurs, resulting in a command execution vulnerability.
ItemId	yes	yes	Int64	Item ID. Example: 1401
ItemName	yes	yes	String	Item name. Example: Redis baseline compliance check
LastTime	yes	yes	String	Last detection time. Example: 2021-02-01 12:00:00
Level	yes	yes	Int64	Risk level. Example: 2
NotPassedHostCount	yes	yes	Int64	Number of servers that failed the check. Example: 1
PassedHostCount	yes	yes	Int64	Number of servers that passed the check. Example: 1
RuleId	yes	yes	Int64	Rule ID. Example: 120
RuleName	yes	yes	String	Rule name. Example: Weak password

MachineLoginType

Host login

Referenced by the following interfaces: DescribeMachineLoginType

name	required	NULL allowed	type	description
InstanceId	no	yes	String	Instance ID. Example: inxs-36843684
LoginType	no	yes	Uint64	Login method: 0 - original login method; 1 - password-free QR code login; 2 - enable QR code scanning; 3 - disable QR code scanning. Example: 0
Quuid	no	yes	String	Host QUUID. Example: cf706bb3-ebac-47c4-aa68-171888888888

IgnoreRuleEffectHostInfo

Server information affected by an ignored check item.

Referenced by the following interfaces: DescribeIgnoreRuleEffectHostList

name	required	NULL allowed	type	description
EventId	yes	yes	Uint64	Event ID. Example: 1
HostName	yes	yes	String	Server name. Example: redis_node_cvm
LastScanTime	yes	yes	String	Last detection time. Example: 2021-11-10 00:00:00
Level	yes	yes	Uint64	Risk severity. 1: low. 2: medium. 3: high. 4: critical. Example: 1
Quuid	yes	yes	String	QUUID of the server. Example: 935e27b1-d675-4509-80bf-96fbf0764237
Status	yes	yes	Uint64	Status. 0: not passed. 1: ignored. 3: passed. 5: checking. Example: 0
TagList	yes	yes	Array of String	Server tags. Example: ["tag-01"]

VulEventList

Vulnerability events.

Referenced by the following interfaces: DescribeEventList

name	required	NULL allowed	type	description
AliasName	yes	no	String	Host alias. Example: redis_node_cvm
Descript	yes	no	String	Vulnerability description. Example: If Redis is started with the root permission and access is not authorized, the arbitrary file write issue occurs, resulting in a command execution vulnerability.
HostIp	yes	no	String	HostIp Example: 192.168.0.10
Id	yes	no	Uint64	ID of the vulnerability event. Example: 1
IfProfession	yes	no	Bool	Whether CWP Pro is activated. Example: false
LastTime	yes	no	String	Last detection time. Example: 2020-02-01 12:00:00
Level	yes	no	Uint64	Vulnerability severity. 1: low. 2: medium. 3: high. 4: informational. Example: 1
Name	yes	no	String	Vulnerability name. Example: Apache HTTP/2 DoS vulnerability (CVE-2023-44487)
PublishTime	yes	no	String	Time when the vulnerability was published. Example: 2020-02-01 12:00:00
Quuid	yes	no	String	QUUID of the server. Example: 5a540076-d38a-4078-aa98-qwert371d322
Status	yes	no	Uint64	Event status. 0: to be handled. 1: ignored. 3: fixed. 5: checking. You can only manage vulnerabilities in the preceding valid states in the console. Example: 1
Uuid	yes	no	String	Uuid Example: 5a540076-d38a-4078-aa98-qwert371d322
VulId	yes	no	Uint64	Vulnerability ID. Example: 1

LicenseBindTaskDetail

License binding task details.

Referenced by the following interfaces: DescribeLicenseBindSchedule

name	required	NULL allowed	type	description
ErrMsg	yes	no	String	Error message. Example: No machine was found.
FixMessage	no	yes	String	Fix suggestions. Example: Asset management - host list - click Synchronize Assets.
MachineExtraInfo	no	yes	MachineExtraInfo	Additional Information on Machine Example:View
Quuid	yes	no	String	UUID of the cloud server. Example: 93b5fa8f-f5bc-4cf9-8253-d2739e5aa484
Status	yes	no	Uint64	0: running. 1: successful. 2: failed. Example: 2

FileTamperRule

Core file monitoring rule.

Referenced by the following interfaces: DescribeFileTamperEventRuleInfo, DescribeFileTamperRuleInfo, DescribeMachineFileTamperRules, ModifyFileTamperRule

name	required	NULL allowed	type	description
Action	yes	no	String	Perform an action: skip (to skip), alert (to send alarms). Example: alert
FileAction	yes	no	String	Monitoring behavior. read: read file write: modify file read;write: read or modify file Example: read
ProcessPath	yes	no	String	Process path. Example: /tmp/*
Target	yes	no	String	Path of the accessed file. Example: /etc/shadow

NetAttackEventInfo

Referenced by the following interfaces: DescribeAttackEventInfo

name	required	NULL allowed	type	description
AbnormalAction	no	yes	String	Unusual behavior Example: dnslog:v5igcrlnyt94ka7f.k2qb16y0.ser.dnslogayay
AttackLevel	no	yes	Uint64	Attack level. If the value is 3 or higher, the attack is a notable attack. Example: 3
CVEId	no	yes	String	CVE number Example: CVE-2023-44487
Count	no	yes	Uint64	Attacks Example: 1
DstPort	no	yes	Uint64	Target port. Example: 80
HostOpProcessTree	no	yes	String	Process Tree, needs to be decoded with base64. Example: W3sicGlkIjoyODc0MCwiZXhlIjoiL3Vzci9iaW4vY3VybCIsImFjY291bnQiOiIwOjAiLCJjbWRsaW5lIjoiY3VybCAtcyAtTCBodHRwczovL2Rvd25sb2FkLmMzcG9v
HostOpType	no	yes	Uint64	0: No Compromised Behavior 1: RCE (command execution) 2: Dnslog 3: Writefile Example: 1
Id	no	yes	Uint64	Event ID. Example: 49754647
Location	no	yes	String	Attack Source Example: location1-location2
MachineExtraInfo	no	yes	MachineExtraInfo	Host Additional Information Example:View
MergeTime	no	yes	String	Time of Attack Example: 2021-02-01 12:00:00
NetPayload	no	yes	String	Attack packets Example: POST /wls-wsat/CoordinatorPortType HTTP/1.1 X-Stgw-Time: 1730212752.801 Host: h2.lghd111.com X-Client-Proto: https X-Forwarded-Proto: https X-Client-Proto-Ver: HTTP/1.1
PayVersion	no	yes	Uint64	Machine payment edition. 0: Basic Edition; 1: Professional Edition; 2: Premium Edition; 3: General Discount Edition Example: 1
Quuid	no	yes	String	CVM UUID Example: 3ddf6cc1-9389-4b9a-a10b-85f30491ayay
SrcIP	no	yes	String	Attack source IP address. Example: 192.168.0.204
Status	no	yes	Uint64	Processing Status: 0 Pending, 1 Processed, 2 Allowlisted, 3 Ignored, 4 Deleted, 5: Defense Enabled. Example: 1
SvcPs	no	yes	String	Service Process Base64 Example: eyJhY2NvdW50IjoiMDowIiwiYXJndiI6Im5naW54OiBtYXN0ZXIgcHJvY2VzcyAvdXNyL3NiaW4vbmdpbngiLCJleGUiOiIvdXNyL2xvY2FsL25naW54L25naW54IiwibGlzdGVuIjoiMC4wLjAuMDo4MCIsInBpZCI6MTI0ayay
Type	no	yes	Uint64	0: Attack Attempt 1: Successful Attack Example: 1
Uuid	no	yes	String	Host UUID. Example: 3ddf6cc1-9389-4b9a-a10b-85f30491ayay
VulDefenceStatus	no	yes	Uint64	Vulnerability Defense Status: 0 Disabled, 1 Enabled. Example: 1
VulId	no	yes	Uint64	Vulnerability ID. Example: 100386
VulName	no	yes	String	Vulnerability name. Example: Weblogic deserialization and remote code execution vulnerability (CVE-2019-2725)
VulSupportDefense	no	yes	Uint64	Whether vulnerabilities support defense. 0: No 1: Yes Example: 1

FileTamperRuleCount

Quantity information of the core file monitoring rules associated with servers.

Referenced by the following interfaces: DescribeFileTamperRuleCount

name	required	NULL allowed	type	description
Count	yes	no	Uint64	Number of associated rules. Example: 1
Name	yes	yes	String	Name of the associated rule. This value displays only the name of one rule. Example: redis_node_check
Uuid	yes	no	String	Host UUID. Example: 935e27b1-d675-4509-80bf-96fbf0764237

BaselineEventLevelInfo

Information about top servers at risk.

Referenced by the following interfaces: DescribeBaselineHostTop

name	required	NULL allowed	type	description
EventCount	yes	yes	Uint64	Number of vulnerabilities. Example: 10
EventLevel	yes	yes	Uint64	Risk severity. 1: low. 1: medium. 3: high. 4: critical. Example: 2

VulDefenceRangeDetail

Exploit prevention scope details.

Referenced by the following interfaces: DescribeVulDefenceList

name	required	NULL allowed	type	description
CveId	yes	no	String	cve id Example: CVE-2020-9496
CvssScore	yes	no	Float	CVSS score. Example: 6.1
Label	yes	no	String	Tag. Example: Remote exploit
Level	yes	no	Uint64	Vulnerability severity. 1: low-risk. 2: medium-risk. 3: high-risk. 4: critical. Example: 2
PublishTime	yes	no	String	Release time. Example: 2020-07-16 00:15:00
VulId	yes	no	Int64	Vulnerability ID. Example: 105068
VulName	yes	no	String	Vulnerability name. Example: Apache HTTP/2 DoS vulnerability (CVE-2023-44487)

ProtectDirInfo

List of protected directories.

Referenced by the following interfaces: DescribeProtectDirList

name	required	NULL allowed	type	description
AutoRestoreSwitchStatus	yes	no	Uint64	Status of automatic recovery. This value is returned when the query results are filtered by QUUID. Default value: 0. Example: 0
DirName	yes	no	String	Website name. Example: nginx web
DirPath	yes	no	String	URL of the protected directory. Example: /opt/nginx
FirstProtectTime	no	yes	String	First enabled Example: 2021-02-01 12:00:00
Id	yes	no	String	Unique ID. Example: 2
LatestProtectTime	no	yes	String	Last enabled Example: 2021-02-01 12:00:00
NoProtectServerNum	yes	no	Uint64	Number of unprotected servers. Example: 0
ProtectException	yes	no	Uint64	Protection exception. Example: 0
ProtectFileType	no	yes	String	Protected file type. Example: .php;.js
ProtectFilesCount	no	yes	Int64	Protected files Example: 0
ProtectServerNum	yes	no	Uint64	Number of protected servers. Example: 0
ProtectStatus	yes	no	Uint64	Protection status. Example: 0
RelatedServerNum	yes	no	Uint64	Number of associated servers. Example: 0

AssetPlanTask

List of scheduled tasks in the asset management module.

Referenced by the following interfaces: DescribeAssetPlanTaskList

name	required	NULL allowed	type	description
Command	no	no	String	Command or script to run. Example: /root/sshd
ConfigPath	no	no	String	Path of the configuration file. Example: /etc/sshd
Cycle	no	no	String	Execution cycle. Example: 10 *
FirstTime	no	no	String	First collection time. Example: 2022-07-15 11:27:01
IsNew	no	no	Int64	Whether it is newly added. 0: no. 1: yes. Example: 1
MachineExtraInfo	no	yes	MachineExtraInfo	Supplementary Information Example:View
MachineIp	no	no	String	Server IP. Example: 10.0.0.11
MachineName	no	no	String	Server name. Example: redis_node_cvm
MachineWanIp	no	no	String	Public IP address of a server. Example: 1.1.1.1
OsInfo	no	no	String	Operating system. Example: centos 64bit
Quuid	no	no	String	Host QUUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116
Status	no	no	Uint64	Default enabling status. 1: enabled. 2: not enabled. Example: 1
UpdateTime	no	yes	String	Data update time. Example: 2011-11-11 12:12:12
User	no	no	String	User who triggers initialization. Example: root
Uuid	no	no	String	Host UUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116

CanFixVulInfo

Server information for a vulnerability included in the messages displayed for batch vulnerability fixing.

Referenced by the following interfaces: DescribeCanFixVulMachine

name	required	NULL allowed	type	description
FixTag	yes	yes	Array of String	Fix tags. Example: ["restart needed"]
HostList	yes	yes	Array of VulInfoHostInfo	Information about servers on which the vulnerability can be fixed. Example:View
VulCategory	no	yes	Uint64	Vulnerability category. 1: web CMS vulnerability, 2: application vulnerability, 4: Linux software vulnerability, 5 Windows system vulnerability. Example: 1
VulId	yes	yes	Uint64	Vulnerability ID. Example: 1373
VulName	yes	yes	String	Vulnerability name. Example: Local permission escalation vulnerability

AssetNetworkCardInfo

Network card information in the asset management module.

Referenced by the following interfaces: DescribeAssetMachineDetail, DescribeAssetMachineInfo

name	required	NULL allowed	type	description
DnsServer	yes	no	String	DNS server. Example: 8.8.8.8
GateWay	yes	no	String	Gateway. Example: 10.0.0.1
Ip	yes	no	String	IPv4 address. Example: 172.17.0.1
Ipv6	yes	no	String	IPv6 address. Example: fe80::42:4dff:fe1b:ed6c
Mac	yes	no	String	MAC address. Example: 16:75:bf:b8:73:9c
Name	yes	no	String	Network card name. Example: eth1

BaselineRule

Baseline rule.

Referenced by the following interfaces: DescribeBaselineRuleIgnoreList, DescribeBaselineRuleList, ModifyBaselineRule

name	required	NULL allowed	type	description
AssetType	no	yes	Int64	0: all servers with CWP Pro and all servers with CWP Ultimate. 1: server ID. 2: IP address. Example: 1
CategoryId	no	no	Int64	Rule category ID. Example: 1
HostCount	no	no	Int64	Number of servers. Example: 0
HostIds	no	yes	Array of String	Server IDs. Example: ["F00A8503-6233-452E-913E-DAFEE9ayayay", "E3CB79D9-8892-408C-AE2D-A90059ayayay"]
HostIps	no	yes	Array of String	IP address of the server. Example: ["10.0.1.11","10.0.0.12"]
Items	no	no	Array of Item	Item IDs. Example:View
RuleDesc	no	no	String	Rule description. Example: International standard—CentOS 6 security baseline check
RuleId	no	no	Int64	Rule ID. Example: 11
RuleName	yes	no	String	Rule name. The maximum length is 128 characters. Example: International standard—CentOS 6 security baseline check
RuleType	no	no	Int64	Rule type. 0: system rule. 1: custom rule. Example: 1

KeyValueArrayInfo

Index key information.

Referenced by the following interfaces: DescribeLogIndex

name	required	NULL allowed	type	description
Key	yes	no	String	Field of the key or metafield index that you want to configure. Example: key1
Value	yes	no	ValueInfo	Index description of the field. Example:View

OrderModifyObject

Order Modification Parameter Object

Referenced by the following interfaces: CreateLicenseOrder

name	required	NULL allowed	type	description
InquireNum	no	no	Int64	Scale-up/Scale-down Count, which is ignored for reconfiguration sub-product Example: 1242
NewSubProductCode	no	no	String	New Product Identification. PRO_VERSION: Professional Edition; FLAGSHIP: Premium Edition Example: PRO_VERSION
ResourceId	no	no	String	Resource ID. Example: 'cakf-4mrnxayayay'

UnionProtectDetail

Billable item information for jointly purchased container protection.

Referenced by the following interfaces: DescribeLicenseList

name	required	NULL allowed	type	description
Deadline	no	yes	String	The point in time when it expires. Example: 2024-07-30 15:02:19
InquireKey	no	yes	String	Billing Item Example: sv_yunjing_ue_x
Number	no	yes	Int64	Total number. Example: 10
ResourceId	no	yes	String	Resource ID. Example: resource_gdskh12h

AssetUserDetail

Basic account information in the asset management module.

Referenced by the following interfaces: DescribeAssetUserInfo

name	required	NULL allowed	type	description
DisableTime	yes	no	String	Time when the account expires. Example: 2024-10-22 19:44:42
Gid	yes	no	String	Account GID. Example: 16
GroupName	yes	no	String	User group name. Example: root
HomePath	yes	no	String	Home directory. Example: 1
IsDomain	yes	no	Uint64	Whether a domain account: 0: no; 1: yes; 999: null (Windows only). Example: 1
IsRoot	yes	no	Uint64	Whether it is granted the root permissions. 0: no. 1: yes. 999: empty string. This parameter is applicable only to Linux systems. Example: 1
IsSshLogin	yes	no	Uint64	Whether SSH logins are allowed. 1: allowed. 0: not allowed. 999: empty string. This parameter is applicable only to Linux systems. Example: 1
Keys	yes	yes	Array of AssetUserKeyInfo	List of custom public keys. Example:View
LastLoginIp	yes	no	String	Last login IP address. Example: 1.1.1.1
LastLoginLoc	yes	no	String	Last login location. Example: usa
LastLoginTerminal	yes	no	String	Terminal on which it was last logged in. Example: 1
LastLoginTime	yes	no	String	Last login time. Example: 2024-10-22 19:44:19
MachineIp	yes	no	String	Private IP address of the server. Example: 10.0.0.11
MachineName	yes	no	String	Server name. Example: redis_node_cvm
Name	yes	no	String	The username. Example: root
PasswordChangeTime	yes	no	String	Password reset time. Example: 2024-10-22 19:44:42
PasswordChangeType	yes	no	Uint64	Password reset setting. 0: the password cannot be reset. 1: the password can be reset. Example: 1
PasswordDueTime	yes	no	String	Time when the password expires. This parameter is applicable only to Linux systems. Example: 2024-10-22 19:44:42
PasswordLockDays	yes	no	Int64	Number of days for which the password is locked. -1: never locked. 999: empty string. This parameter is applicable only to Linux systems. Example: 1
PasswordWarnDays	yes	no	Uint64	When to send a notification before the password expires. Unit: days. Example: 10
Quuid	yes	no	String	Host QUUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116
Remark	yes	no	String	Description. Example: no login
Shell	yes	no	String	Path of the shell. This parameter is applicable only to Linux systems. Example: /root
ShellLoginStatus	yes	no	Uint64	Whether it is a shell login. 0: no. 1: yes. This parameter is applicable only to Linux systems. Example: 1
Status	yes	no	Uint64	Account status. 0: disabled. 1: enabled. Example: 1
Uid	yes	no	String	Account UID. Example: 134393481
UpdateTime	yes	yes	String	Data update time. Example: 2011-11-11 12:12:12
UserType	yes	no	Uint64	Account type: 0: guest user; 1: standard user; 2: administrator user; 999: null (Windows only). Example: 1
Uuid	yes	no	String	Host UUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116

LoginWhiteCombinedInfo

Referenced by the following interfaces: DescribeLoginWhiteCombinedList

name	required	NULL allowed	type	description
CreateTime	yes	no	String	Creation time. Example: 2024-11-04 09:57:28
Desc	yes	no	String	Allowlist description. If IsLocal is set to 1, the description is fixed as All servers. If the allowlist applies to only a single server, the description is the server's name. If the allowlist applies to multiple servers, the description is the server QUUID. Example: 192.168.0.2
EndTime	yes	no	String	End time. Example: 2024-11-04 09:57:28
Id	yes	no	Uint64	Allowlist ID. Example: 1001
IsGlobal	yes	no	Uint64	Whether it takes effect globally. 1: globally effective. 0: valid only for specified servers. Example: 1
Locale	yes	no	String	Region string. Example: locale1
Locations	yes	no	String	Login Location Example: location1
ModifyTime	yes	no	String	The point in time when the namespace was last modified. Example: 2024-11-04 09:57:28
Name	yes	no	String	Allowlist name. If IsLocal is set to 1, the name is fixed as All servers. If the allowlist applies to only a single server, the name is the server's name. If the allowlist applies to multiple servers, the name is the server QUUID. Example: redis_node_cvm
Places	yes	yes	Array of Place	Region of the allowlist. Example:View
Remark	yes	no	String	Description. Example: add redis cvm ip
SrcIp	yes	no	String	IP addresses in the allowlist. Multiple IP addresses are separated with commas (,). Example: 192.168.0.204
StartTime	yes	no	String	Start time. Example: 2024-11-04 09:57:28
UserName	yes	no	String	Users in the allowlist. Separate multiple usernames with commas (,). Example: uname
Uuid	yes	no	String	Server UUID. Example: df131b24-8528-4809-9d07-a9e4d58ad566

ScreenProtectionCnt

Situation data returned from the CWP dashboard visualization module.

Referenced by the following interfaces: DescribeScreenProtectionCnt

name	required	NULL allowed	type	description
Count	yes	no	Uint64	Total number. Example: 12
Name	yes	no	String	cloud: cloud scanning and cleaning engine. detect: detection engine. defend: attack defense. threat: threat intelligence. analysis: exception analysis. ai: AI engine. Example: Threat intelligence
Type	yes	no	String	cloud: cloud scanning and cleaning engine. detect: detection engine. defend: attack defense. threat: threat intelligence. analysis: exception analysis. ai: AI engine. Example: cloud

HostInfo

Server information used for creating a login audit allowlist.

Referenced by the following interfaces: AddLoginWhiteLists, ModifyLoginWhiteRecord

name	required	NULL allowed	type	description
Quuid	yes	no	String	Host QUUID. Example: d99a1b46-cc2d-4633-a11f-4a7663d2523e
Uuid	yes	no	String	Host UUID. Example: d99a1b46-cc2d-4633-a11f-4a7663d2523e

RansomDefenseStrategyMachineInfo

Anti-Ransomware Machine Hard Disk Configuration

Referenced by the following interfaces: CreateRansomDefenseStrategy

name	required	NULL allowed	type	description
DiskInfo	no	yes	String	Specified Hard Disk List. When it is empty, it means all hard disks: disk_id1
Uuid	yes	no	String	Host UUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116

AssetWebLocationInfo

Website information in the asset management module.

Referenced by the following interfaces: DescribeAssetWebLocationInfo

name	required	NULL allowed	type	description
Command	yes	no	String	Start Command Example: true
Ip	yes	no	String	Binds the IP address. Example: 0.0.0.0
MainPath	yes	no	String	Main directory. Example: /data
Name	yes	no	String	Domain name. Example: domain.com
Port	yes	no	String	Port of the website. Example: 22
Proto	yes	no	String	Protocol of the website. Example: tcp
SafeStatus	yes	no	Uint64	Security module status. 0: not enabled. 1: enabled. 999: empty string. This parameter is applicable only to NGINX websites. Example: 1
ServiceType	yes	no	String	Service Type Example: web
UpdateTime	yes	yes	String	Data update time. Example: 2011-11-11 12:12:12
User	yes	no	String	Run user. Example: root

NetAttackTrend

Referenced by the following interfaces: DescribeAttackTrends

name	required	NULL allowed	type	description
AttackCount	no	yes	Uint64	Attacks Example: 1
DateTime	no	yes	String	Time Point, e.g., 2023-05-06 Example: 2023-05-06
SuccAttackCount	no	yes	Uint64	Attack Success Count Example: 0
TryAttackCount	no	yes	Uint64	Attack Attempts Example: 1

FullTextInfo

Full-text index-related configuration.

Referenced by the following interfaces: DescribeLogIndex

name	required	NULL allowed	type	description
CaseSensitive	yes	no	Bool	Whether it is case-sensitive. Example: false
ContainZH	yes	no	Bool	Whether to contain zh characters Example: false
Tokenizer	yes	no	String	Tokenizer. Example: \n\t\r

ScreenTrendsChart

Attack defense trend chart in the dashboard.

Referenced by the following interfaces: DescribeScreenDefenseTrends

name	required	NULL allowed	type	description
Type	yes	no	String	Data category for statistics collection. Valid values: number of attack defense times and number of attacks. Example: Defended attacks
X	yes	no	String	Time in the X axis. Example: 2021-03-30 19:17:28
Y	yes	no	Uint64	Value in the Y axis. Example: 12

AssetFilters

Container security
Describes a key-value pair filter for conditional filtering queries. For example, filter the ID, name, and status.
If there are multiple filters, the relationship between filters is logical AND.
If you specify multiple values for 1 filter, the OR relationship is used between the values.

name	required	NULL allowed	type	description
ExactMatch	no	no	Bool	Whether to fuzzy query. Example: true
Name	yes	no	String	Name of the filter key. Example: Ip
Values	yes	no	Array of String	One or more filter values. Example: ["192.168.0.1"]

AssetInitServiceBaseInfo

List of initialization services in the asset management module.

Referenced by the following interfaces: DescribeAssetInitServiceList

name	required	NULL allowed	type	description
FirstTime	no	no	String	First collection time. Example: 2022-07-15 11:27:01
IsAutoRun	no	yes	Int64	Start at boot [0: No
IsNew	no	no	Int64	Whether it is newly added. 0: no. 1: yes. Example: 1
MachineExtraInfo	no	yes	MachineExtraInfo	Supplementary Information Example:View
MachineIp	no	no	String	Server IP. Example: 192.168.0.1
MachineName	no	no	String	Server name. Example: redis_node_cvm
MachineWanIp	no	no	String	Public IP address of a server. Example: 43.156.40.46
Name	no	no	String	Name. Example: bootlocal
OsInfo	no	no	String	Operating system. Example: 1
Path	no	no	String	Path Example: 1
Quuid	no	no	String	Host QUUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116
Status	no	no	Uint64	Default enabling status. 0: not enabled. 1: enabled. Example: 1
Type	no	no	Uint64	The attribute type. Valid values: 1: encoder 2: IE plug-in 3: network provider 4: Image File Execution Options 5: LSA provider 6:KnownDLLs 7: boot execution 8:WMI 9: scheduled task 10: Winsock provider 11: print monitor 12: resource manager 13: drive service 14: login Example: 1
UpdateTime	no	no	String	Data update time. Example: 2011-11-11 12:12:12
User	no	no	String	User who triggers initialization. Example: root
Uuid	no	no	String	Host UUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116

AssetCoreModuleBaseInfo

List of kernel modules in the asset management module.

Referenced by the following interfaces: DescribeAssetCoreModuleList

name	required	NULL allowed	type	description
Desc	no	no	String	Description. Example: system
FirstTime	no	no	String	First collection time. Example: 2022-07-15 11:27:01
Id	no	no	String	Module ID. Example: 10001
IsNew	no	no	Int64	Whether it is newly added. 0: no. 1: yes. Example: 1
MachineExtraInfo	no	yes	MachineExtraInfo	Supplementary Information Example:View
MachineIp	no	no	String	Server IP. Example: 1.1.1.1
MachineName	no	no	String	Server name. Example: any-ins
MachineWanIp	no	no	String	Public IP address of a server. Example: 1.1.1.1
ModuleCount	no	no	Uint64	Number of dependent modules. Example: 0
Name	no	no	String	Name. Example: core.package
OsInfo	no	no	String	Operating system. Example: centos-64bit
Path	no	no	String	Path Example: /root
ProcessCount	no	no	Uint64	Number of dependent processes. Example: 0
Quuid	no	no	String	Host QUUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116
Size	no	no	Uint64	Module size. Example: 10001
UpdateTime	no	yes	String	Data update time. Example: 2011-11-11 12:12:12
Uuid	no	no	String	Host UUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116
Version	no	no	String	Version. Example: 1.0.0.1

BaselineDetail

Baseline details.

Referenced by the following interfaces: DescribeBaselineDetail

name	required	NULL allowed	type	description
Description	yes	yes	String	Baseline description. Example: Using weak passwords for MySQL can make it easier for hackers to guess and obtain access to data privileges, leading to data theft and deletion. Moreover, hackers may further obtain system permissions based on database access.
Level	yes	yes	Uint64	Risk severity. Example: 3
Name	yes	yes	String	Baseline name. Example: Weak password
PackageName	yes	yes	String	Package name. Example: 21.dat
ParentId	yes	yes	Uint64	Parent ID. Example: 1

FieldValueRatioInfo

Quick analysis statistics.

Referenced by the following interfaces: DescribeFastAnalysis

name	required	NULL allowed	type	description
Count	yes	no	Int64	Count. Example: 0
Ratio	yes	no	Float	Proportion. Example: 0.5
Value	yes	no	String	Value. Example: value

MaConnPodInfo

Referenced by the following interfaces: DescribeMaConnEventList

name	required	NULL allowed	type	description
ClusterId	no	yes	String	Cluster ID of the pod. Example: cls-dfdayayay
Namespace	no	yes	String	Namespace of the pod. Example: tcss
PodName	no	yes	String	Pod Name Example: redis-job-sdfa-9885-sd23

HostTagInfo

Server information and server tag information.

Referenced by the following interfaces: DescribeHostInfo

name	required	NULL allowed	type	description
AliasName	no	yes	String	Server name. Example: redis_node_cvm
CloudTags	no	yes	Array of Tags	Cloud tag information. Example:View
HostIp	no	yes	String	Private IP address of the server. Example: 1.2.3.4
InstanceID	no	yes	String	Host Instance ID Example: ins-dada
KernelVersion	no	yes	String	Kernel version. Example: 5.1.0
MachineStatus	no	yes	String	Connection status of the server. Valid values: ONLINE and OFFLINE. Example: ONLINE
MachineWanIp	no	yes	String	Public IP address of the server. Example: 10.0.0.1
ProtectType	no	yes	String	Protection edition. BASIC_VERSION: Basic Edition. PRO_VERSION: Professional Edition. Flagship: Ultimate Edition. Example: BASIC_VERSION
Quuid	no	yes	String	Host QUUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116
TagList	no	yes	Array of String	Keys of the tags attached to the server. Example: ["dev"]
Uuid	no	yes	String	Host UUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116
VulNum	no	yes	Int64	Number of vulnerabilities. Example: 32

Tag

Tag information

Referenced by the following interfaces: DescribeRansomDefenseMachineList, DescribeRansomDefenseStrategyMachines, DescribeTags

name	required	NULL allowed	type	description
Count	yes	no	Uint64	Number of servers. Example: 100
Id	yes	no	Uint64	Tag ID. Example: 1
Name	yes	no	String	Tag name. Example: business1

BashEventNew

High-risk command data (new).

Referenced by the following interfaces: DescribeBashEventsNew

name	required	NULL allowed	type	description
BashCmd	no	no	String	Command to run. Example: rm
CreateTime	no	no	String	Event time. Example: 2021-03-30 19:17:28
DetectBy	no	yes	Uint64	0: bash command. 1: real-time monitoring (Thunder Edition) Example: 1
Exe	no	yes	String	Process name. Example: 1.exe
HostIp	no	no	String	Private IP address of the server. Example: 127.0.0.1
Id	no	no	Uint64	Data ID. Example: 1
MachineExtraInfo	no	yes	MachineExtraInfo	Additional Information on Machine Example:View
MachineName	no	no	String	Server name. Example: redis_node_cvm
MachineType	no	yes	Int64	0: Basic Edition. 1: Professional Edition. 2: Ultimate Edition. Example: 1
ModifyTime	no	yes	String	Handling time. Example: 2021-03-30 19:17:28
Pid	no	yes	String	Process ID. Example: 1
Platform	no	no	Uint64	Platform type. Example: 1
Quuid	no	no	String	Server ID. Example: dadasda
RegexBashCmd	no	yes	String	Escaped regular expression. Example: rm -rf /tmp/t*
RuleCategory	no	yes	Uint64	Rule type. 0: system rule. 1: custom rule. Example: 0
RuleId	no	no	Uint64	Rule ID. Example: 1
RuleLevel	no	no	Uint64	Rule severity. 1: high. 2: medium. 3: low. Example: 1
RuleName	no	no	String	Rule Name Example: 1
Status	no	no	Uint64	Handling status. 0: to be handled. 1: handled. 2: added to the allowlist. 3: ignored. Example: 1
User	no	no	String	User who performs execution. Example: root
Uuid	no	no	String	CWP ID. Example: 5a540076-d38a-4078-aa98-q45rt371d322

AssetWebFrameBaseInfo

Web application information in the asset management module.

Referenced by the following interfaces: DescribeAssetWebFrameList

name	required	NULL allowed	type	description
FirstTime	no	no	String	First collection time. Example: 2022-07-15 11:27:01
IsNew	no	no	Int64	Whether it is newly added. 0: no. 1: yes. Example: 1
Lang	no	no	String	Language. Example: eng
MachineExtraInfo	no	yes	MachineExtraInfo	Supplementary Information Example:View
MachineIp	no	no	String	Private IP address of the server. Example: 1.1.1.1.
MachineName	no	no	String	Server name. Example: redis_node_cvm
MachineWanIp	no	no	String	Public IP address of the server. Example: 1.1.1.1
Name	no	no	String	Web application name. Example: Nginx
OsInfo	no	no	String	OS information. Example: Centos 64Bit
Path	no	yes	String	Application Path Example: /root
ProjectId	no	no	Uint64	ID of the project to which the server belongs. Example: 1
Quuid	no	no	String	Host QUUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116
ServiceType	no	no	String	Service Type Example: tcp
Tag	no	yes	Array of MachineTag	Server tags. Example:View
UpdateTime	no	yes	String	Data update time. Example: 2011-11-11 12:12:12
Uuid	no	no	String	Host UUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116
Version	no	no	String	Version. Example: 1.0.1

VulOverview

Vulnerability overview.

Referenced by the following interfaces: DescribeVulOverview

name	required	NULL allowed	type	description
TodayCount	yes	no	Int64	New count on the current day. Example: 0
TotalCount	yes	no	Uint64	Total number. Example: 12

BaselineHostTopList

Information about a server affected by a baseline.

Referenced by the following interfaces: DescribeBaselineHostTop

name	required	NULL allowed	type	description
EventLevelList	yes	yes	Array of BaselineEventLevelInfo	Event severity and quantity. Example:View
HostName	yes	yes	String	Server name. Example: v_vxnnzhayay
Quuid	yes	yes	String	Host QUUID. Example: fcf85fc9-f45e-457a-bca4-fcae074eayay
Score	yes	yes	Uint64	Score used to calculate the weight. Example: 20

ScreenInvasion

Intrusion event details in the dashboard.

Referenced by the following interfaces: DescribeScreenHostInvasion

name	required	NULL allowed	type	description
Content	yes	no	String	Event data in the JSON format, which varies based on event types. For file scanning and cleaning, the data includes VirusName, FileName, FilePath, FileSize, MD5, CreateTime, LatestScanTime, HarmDescribe, and SuggestScheme. For logins from unusual locations, the data includes SrcIp, Location, UserName, and LoginTime. For password cracking, the data includes SrcIp, City, Country, Protocol, UserName, Port, Count, CreateTime, and ModifyTime. For malicious requests, the data includes Url, ProcessName, ProcessMd5, Pid, AccessCount, MergeTime, HarmDescribe, and SuggestScheme. For high-risk commands, the data includes RuleName, RuleCategory, BashCmd, DetectBy, User, Pid, CreateTime, HarmDescribe, and SuggestScheme. For local privilege escalation, the data includes UserName, ParentProcName, ParentProcGroup, CreateTime, HarmDescribe, and SuggestScheme. For reverse shells, the data includes ProcessName, CmdLine, ParentProcName, DstIp, DstPort, CreateTime, HarmDescribe, and SuggestScheme. Example: {"Id":202444023294136,"Uuid":"c7ebf82f-a039-406c-96cb-9624b3cd6826","SrcIp":"219.152.236.34","Location":"Province1-City1","UserName":"root","LoginTime":"2024-10-31 18:59:32","Status":2,"Country":1,"City":234,"Province"ayay
CreatedTime	yes	no	String	Intrusion time. Example: 2021-03-30 19:17:28
EventType	yes	no	Uint64	Event type. 0: file scanning and cleaning. 1: login from an unusual location. 2: password cracking. 3: malicious request. 4: high-command risk. 5: local privilege escalation. 6: reverse shell. Example: 1
Id	yes	no	Uint64	Event ID. Example: 1
Level	yes	no	Uint64	Uniform event severity. 0: informational. 1: low-risk. 2: medium-risk. 3: high-risk. 4: critical. Example: 1
LevelZh	yes	no	String	Level name Example: High-risk
Uuid	yes	no	String	Host UUID. Example: e5b4724c-49af-46ab-bd84-cdbae897e7e0

VulDefencePluginStatus

Information about a server exploit prevention plug-in.

Referenced by the following interfaces: DescribeVulDefencePluginStatus

name	required	NULL allowed	type	description
Alias	yes	no	String	Host alias. Example: redis_node_cvm
CreateTime	yes	no	String	Creation time. Example: 2021-01-20 16:17:11
Exception	yes	no	Int64	Plug-in status. 0: normal. 1: abnormal. Example: 1
ModifyTime	yes	no	String	Last update time. Example: 2021-01-20 16:17:11
PrivateIp	yes	no	String	Private IP address. Example: 10.1.1.2
PublicIp	yes	no	String	Public IP address. Example: 112.23.2.1
Quuid	yes	no	String	QUUID of the server. Example: d92d723e-4aac-4f4a-bbf9-e5430e29d289

AssetUserKeyInfo

Account key details in the asset management module.

Referenced by the following interfaces: DescribeAssetUserInfo, DescribeAssetUserKeyList

name	required	NULL allowed	type	description
Comment	yes	no	String	Description of the public key. Example: comment
EncryptType	yes	no	String	Encryption method. Example: aes
Value	yes	no	String	Value of the public key. Example: value1

MaGlobalConf

Referenced by the following interfaces: DescribeMaGlobalConf, ModifyMaGlobalConf

name	required	NULL allowed	type	description
MonitorEnabled	yes	yes	Int64	Monitoring enabling status. 1: enabled; 0: disabled. Example: 1
MonitorIpRanges	no	yes	Array of String	Monitoring IP range. Example: ["192.168.0.1"]
MonitorLabelIds	no	yes	Array of Int64	Monitoring tag. Example: [1]
MonitorScope	yes	yes	Int64	Monitoring scope [0: All; 1: Partial]. Example: 0
MonitorWorkloadIds	no	yes	Array of Int64	Excluded workload ID list. Example: [1]
NewEnabled	no	yes	Int64	Whether the new asset is automatically protected [1: Yes; 0: No]. Example: 1
NewEndTime	no	yes	Datetime_iso	End time of self-learning. Example: 2020-02-01 12:00:00
NewIpRanges	no	yes	Array of String	Added asset protection IP range. Example: ["192.168.0.1"]
NewLabelIds	no	yes	Array of Int64	Added asset protection IP range. Example: [1]
NewLearnCycle	no	yes	Int64	Number of self-learning days for new asset. Example: 3
NewScope	no	yes	Int64	Added protection scope [0: All; 1: Selective]. Example: 1
NewStartTime	no	yes	Datetime_iso	Start time of self-learning. Example: 2020-02-01 12:00:00

VulStoreListInfo

Referenced by the following interfaces: DescribeHotVulTop, DescribeVulStoreList

name	required	NULL allowed	type	description
AttackLevel	no	yes	Uint64	Attack level. If the value is 3 or higher, the attack is a notable attack. Example: 1
CveId	no	yes	String	CVE ID. Example: CVE-2023-44487
FixSwitch	no	yes	Uint64	Whether vulnerabilities can be automatically fixed. 0 - disabled for Windows and Linux; 1 - enabled for Windows and Linux; 2 - for Linux only; 3 - for Windows only. Example: 1
Level	no	yes	Uint64	Vulnerability severity. 1: low. 2: medium. 3: high. 4: critical. Example: 1
Method	no	yes	Uint64	Vulnerability Detection Method: 0 - Version Comparison, 1 - POC Verification Example: 0
Name	no	yes	String	Vulnerability name. Example: Apache HTTP/2 DoS vulnerability (CVE-2023-44487)
PublishDate	no	yes	String	Release time. Example: 2012-10-10 07:55:00
SupportDefense	no	yes	Uint64	Whether vulnerabilities support defense. 0: No 1: Yes Example: 1
VulCategory	no	yes	Uint64	1: Web-CMS vulnerability. 2: application vulnerability. 4: Linux software vulnerability. 5: Windows system vulnerability. 0: emergency vulnerability. Example: 1
VulId	no	yes	Uint64	Vulnerability ID. Example: 1

WarningInfoObj

Alarm settings.

Referenced by the following interfaces: DescribeWarningList

name	required	NULL allowed	type	description
BeginTime	yes	no	String	Start time. Format: HH:mm Example: 00:00
ControlBit	yes	no	Uint64	Control bit of the vulnerability severity, which corresponds to the decimal storage of databases. Example: 0
ControlBits	yes	no	String	Binary control bit of the vulnerability severity. Each bit corresponds to the enabling status of each vulnerability severity: low, medium, and high (0: disabled. 1: enabled). For example, a value of 101 indicates that both the low and high severities are selected. Example: 0
Count	yes	yes	Int64	Configured Number of Hosts in the Range of Alarm, used by the frontend to decide when to display prompt information. Example: 0
DisablePhoneWarning	yes	no	Uint64	1: disables alarming. 0: enables alarming. Example: 1
EndTime	yes	no	String	End time. Format: HH:mm Example: 00:00
HostRange	no	yes	Int64	Alarm host range type: 0: all hosts; 1: by project; 2: by cloud tag; 3: by CWP tag; 4: custom hosts. Example: 0
OfflineInterval	yes	yes	Int64	Time duration used to determine a disconnection event. Unit: seconds. Example: 1432524532
TimeZone	yes	no	String	Timezone information. Example: Europe/London
Type	yes	no	Uint64	Event alarm type. 1: disconnection. 2: trojan. 3: login from an unusual location. 4: brute force attack. 5: vulnerability (further divided into four types: 9 to 12). 6: high-risk command. 7: reverse shell. 8: local privilege escalation. 9: application vulnerability. 10: Web-CMS vulnerability. 11: emergency vulnerability. 12: security baseline vulnerability. 13: tampering attack. 14: malicious request. 15: cyberattack. 16: Windows system vulnerability. 17: Linux software vulnerability. 18: core file monitoring and alarming. 19: agent uninstallation. 20: agent disconnection. Example: 1

LicenseExtraParam

Additional parameters for authorization.

Referenced by the following interfaces: DescribeLicenseList

name	required	NULL allowed	type	description
IsUnBind	no	yes	Bool	Whether unbinding/rebinding is allowed. Example: false
UnionBuyDetail	no	yes	Array of UnionProtectDetail	Joint purchase information of containers and hosts. Example:View

AssetMachineDetail

Basic server information in the asset fingerprint module.

Referenced by the following interfaces: DescribeAssetMachineDetail

name	required	NULL allowed	type	description
AgentVersion	no	no	String	Agent version. Example: 1.2.3.1
BootTime	no	no	String	System boot time. Example: 2021-12-21
BuyTime	no	no	String	Time when CWP Pro was activated. Example: 2021-12-21
CoreVersion	no	no	String	Kernel version. Example: 3.10.0-1160.99.1.el7.x8ayay
Cpu	no	no	String	CPU information. Example: Intel(R) Xeon(R) Platinum 8255C CPU @ 192.168.0.204
CpuLoad	no	no	String	CPU load. Example: Medium
CpuLoadVul	no	yes	String	CpuLoadVul Example: 10.1
CpuSize	no	no	Uint64	Number of CPU cores. Example: 2
DeviceVersion	no	no	String	Device model. Example: CVM
DiskLoad	no	no	String	Disk usage in percentage. Example: 11
DiskSize	no	no	Uint64	Disk capacity. Unit: GB. Example: 11
Disks	no	no	Array of AssetDiskPartitionInfo	Partition. Example:View
EndTime	no	no	String	Time when CWP Pro expires. Example: 2021-12-21
FirstTime	no	yes	String	Time. Example: 2021-02-01 12:00:00
InstallTime	no	no	String	Installation time. Example: 2021-12-21
InstanceId	no	yes	String	Server ID. Example: cvm-112234
LastLiveTime	no	no	String	Last connection time. Example: 2021-12-21
MachineExtraInfo	no	yes	MachineExtraInfo	Host information Example:View
MachineIp	no	no	String	Server private IP address. Example: 11.22.33.44
MachineName	no	no	String	Server name. Example: txbj-k8s-main-192.168.0.204
MachineWanIp	no	no	String	Public IP address of the server. Example: 1.2.3.4
MemLoad	no	no	String	Memory utilization in percentage. Example: 11
MemSize	no	no	Uint64	Memory capacity. Unit: GB. Example: 11
NetCards	no	no	Array of AssetNetworkCardInfo	ENI. Example:View
OfflineTime	no	yes	String	Disconnection time. Example: 2021-12-21
OsInfo	no	no	String	OS name. Example: centos
OsType	no	no	String	Linux/Windows Example: Linux
PartitionCount	no	no	Uint64	Number of partitions Example: 1
Producer	no	no	String	Vendor name. Example: Cloud Cayay
ProjectId	no	no	Uint64	Project ID. Example: 1241252
ProtectDays	no	no	Uint64	Number of days for which the asset is under protection. Example: 11
ProtectLevel	no	no	Uint64	Protection Level. 0 Basic Edition; 1 Professional Edition; 2 Premium Edition; 3 General Discount Edition Example: 1
Quuid	no	no	String	QUUID of the server. Example: acdd5474-6360-4fd4-bfc7-843162cb8116
RiskStatus	no	no	String	Risk status. UNKNOW: unknown status. RISK: at risk. SAFT: secure. Example: RISK
SerialNumber	no	no	String	The serial number. Example: 641eb296-411e-45b5-8003-903d4f4aayay
Status	no	no	Uint64	0: online. 1: offline. Example: 1
UpdateTime	no	yes	String	Data update time. Example: 2011-11-11 12:12:12
Uuid	no	no	String	UUID of the server. Example: acdd5474-6360-4fd4-bfc7-843162cb8116

VulFixStatusInfo

Vulnerability fixing details.

Referenced by the following interfaces: DescribeVulFixStatus

name	required	NULL allowed	type	description
FailCnt	yes	yes	Uint64	Number of servers on which the vulnerability failed to be fixed. Example: 1
FixMethod	no	yes	Uint64	Repair method. 0: Update components or install patches. 1: Disable service. Example: 0
FixSuccessCnt	yes	yes	Uint64	Number of servers on which the vulnerability is fixed. Example: 0
HostList	yes	yes	Array of VulFixStatusHostInfo	Fixing status of the vulnerability on servers. Example:View
Progress	yes	no	Uint64	Fixing progress of the vulnerability. Valid values: 1 to 100. Example: 80
VulId	yes	yes	Uint64	Vulnerability ID. Example: 12
VulName	yes	yes	String	Vulnerability name. Example: Apache HTTP/2 DoS vulnerability (CVE-2023-44487)

Machine

Server list

Referenced by the following interfaces: DescribeMachineList, DescribeMachines

name	required	NULL allowed	type	description
BaselineNum	no	no	Int64	Number of baseline risks. Example: 2
CloudFrom	no	yes	Int64	Cloud server vendor type. 0: cloud 1: IDC 2: Alibaba Cloud 3: Huawei Cloud 4: Amazon 5: Microsoft 6: Google 7: Oracle 8: DigitalOcean Example: 0
CloudTags	no	yes	Array of Tags	Cloud tag information. Example:View
CyberAttackNum	no	no	Int64	Number of network risks. Example: 2
HasAssetScan	no	no	Uint64	Whether there is an asset scan API. 0: no. 1: yes. Example: 1
InstanceId	no	no	String	Instance ID. Example: ins-sad143
InstanceState	no	no	String	Instance status. PENDING: creating; LAUNCH_FAILED: creation failed; RUNNING: running; STOPPED: shut down; STARTING: starting; STOPPING: shutting down; REBOOTING: restarting; SHUTDOWN: shut down and pending termination; TERMINATING: terminating; TERMINATED: terminated; TERMINATED_PRO_VERSION: terminated but Yunjing Pro Edition not expired. Example: TERMINATED_PRO_VERSION
InvasionNum	no	no	Int64	Number of intrusion events. Example: 1
IpList	no	yes	String	Host IP List Example: 1.1.1.1,2.2.2.2
IsAddedOnTheFifteen	no	yes	Uint64	Whether it is a server that is added within the last 15 days. 0: no. 1: yes. Example: 1
IsProVersion	no	no	Bool	Whether it is a professional version. true: yes. false: no. Example: false
KernelVersion	no	no	String	Kernel version. Example: 3.10.0-1127.19.1.el7.x86_64
LicenseStatus	no	no	Uint64	License status of anti-tampering. 1: licensed. 0: not licensed. Example: 1
MachineExtraInfo	no	yes	MachineExtraInfo	Supplementary Information Example:View
MachineIp	no	no	String	IP address of the server. Example: 10.0.0.2
MachineName	no	no	String	Host name. Example: stone
MachineOs	no	no	String	Operating system of the server. Example: centos
MachineStatus	no	no	String	Host status. OFFLINE: offline. ONLINE: online. SHUTDOWN: shutdown. UNINSTALLED: not protected. Example: ONLINE
MachineType	no	no	String	Zone type of the server. CVM: CVM zone. BM: BM zone. ECM: ECM zone. LH: Lighthouse zone. Other: hybrid cloud zone. Example: CVM
MachineWanIp	no	no	String	Public IP of the host. Example: 114.11.12.13
MalwareNum	no	no	Int64	Number of trojans. Example: 1
PayMode	no	no	String	Host status. POSTPAY: postpaid mode, that is, pay-as-you-go. PREPAY: prepaid mode, that is, monthly subscription. Example: PREPAY
Platform	no	yes	String	Platform Example: platform
ProjectId	no	no	Int64	Project ID. Example: 1
ProtectType	no	no	String	Protection edition. BASIC_VERSION: Basic Edition. PRO_VERSION: Professional Edition. Flagship: Ultimate Edition. GENERAL_DISCOUNT: General Edition. Example: BASIC_VERSION
Quuid	no	no	String	UUID of the CVM or BM instance. Example: 8c09e1b1-5611-45b3-9c02-737996011b81
RegionInfo	no	no	RegionInfo	Region information. Example:View
Remark	yes	yes	String	Remarks. Example: redis cvm
SecurityStatus	no	no	String	Risk status. SAFE: safe. RISK: risky. UNKNOWN: unknown. Example: RISK
Tag	no	no	Array of MachineTag	Tag information Example:View
Uuid	no	no	String	CWP UUID. If the CWP client is offline for a long time, an empty character is returned. Example: 8c09e1b1-5611-45b3-9c02-737996011b81
VpcId	no	yes	String	Network Example: vpc-sda
VulNum	no	no	Int64	Number of vulnerabilities. Example: 2

VulDefenceOverview

Exploit prevention trend information, including the plug-in status and the attack defense trend. The trend is stored as three arrays with the same length and whose elements are in one-to-one correspondence.

Referenced by the following interfaces: DescribeVulDefenceOverview

name	required	NULL allowed	type	description
AttackCounts	yes	yes	Array of Int64	Daily attack trend. Example: [0,0,20,0,0,0,0,17,11,2,33,49,105,80]
Date	yes	yes	Array of String	Date Example: ["2024-10-21","2024-10-22","2024-10-23","2024-10-24","2024-10-25","2024-10-26","2024-10-27","2024-10-28","2024-10-29","2024-10-30","2024-10-31","2024-11-01","2024-11-02","2024-11-03"]
DefendCounts	yes	yes	Array of Int64	Daily defense trend. Example: [0,0,20,0,0,0,0,17,11,2,33,49,105,80]
DefendHostCount	yes	no	Int64	Number of servers on which exploit prevention is enabled. Example: 12
Enable	yes	no	Int64	Status of the exploit prevention feature. 0: disabled. 1: enabled. Example: 1
ExceptionCount	yes	no	Int64	Number of abnormal plug-ins. Example: 2

ScreenMachine

Server list

Referenced by the following interfaces: DescribeScreenMachines

name	required	NULL allowed	type	description
BaselineNum	no	no	Int64	Number of baseline risks. Example: 2
CoreVersion	no	no	String	Kernel version. Example: 3.10.0-1127.19.1.el7.x86_64
CpuLoad	no	no	String	CPU load status. Example: Low
CpuSize	no	no	Float	Number of CPU cores. Example: 1
CyberAttackNum	no	no	Int64	Number of network risks. Example: 2
DiskLoad	no	no	String	Disk utilization in percentage. Example: 10.60
DiskSize	no	no	Float	Disk capacity. Unit: GB. Example: 40
InvasionNum	no	no	Int64	Number of intrusion events. Example: 1
MachineExtraInfo	no	yes	MachineExtraInfo	Supplementary Information Example:View
MachineIp	no	no	String	IP address of the server. Example: 10.0.0.2
MachineName	no	no	String	Host name. Example: redis_node_cvm
MachineOs	no	no	String	Operating system of the server. Example: centos
MachineStatus	no	no	Uint64	Server status in the dashboard. 0: no agent is installed. 1: the server is offline. 2: the server is offline (at risk). 3: the server is offline (critical). 4: the agent is correctly installed and the server runs normally. 5: the agent is correctly installed, the server runs normally, and CWP Pro or CWP Ultimate is activated. 6: the agent is correctly installed, and risks are detected on the server (number of cyberattack events > 0). 7: the agent is correctly installed, risks are detected on the server (number of cyberattack events > 0), and CWP Pro or CWP Ultimate is activated. 8: the agent is correctly installed, and critical events are detected on the server (number of intrusion detection events > 0). 9: the agent is correctly installed, critical events are detected on the server (number of intrusion detection events > 0), and CWP Pro or CWP Ultimate is activated. Example: 1
MachineType	no	no	String	Zone type of the server. CVM: CVM zone. BM: BM zone. ECM: ECM zone. LH: Lighthouse zone. Other: hybrid cloud zone. Example: CVM
MachineWanIp	no	no	String	Public IP of the host. Example: 114.11.12.13
MemLoad	no	no	String	Memory load rate in percentage. Example: 18.66
MemSize	no	no	Float	Memory capacity. Unit: GB. Example: 2
Quuid	no	no	String	UUID of the CVM or BM instance. Example: d99a1b46-cc2d-4633-a11f-4a7663d2523e
SecurityStatus	no	no	String	Risk status. SAFE: safe. RISK: risky. UNKNOWN: unknown. Example: RISK
Uuid	no	no	String	CWP UUID. If the CWP client is offline for a long time, an empty character is returned. Example: d99a1b46-cc2d-4633-a11f-4a7663d2523e
VulNum	no	no	Int64	Number of vulnerabilities. Example: 2

AssetCoreModuleDetail

Kernel module details in the asset management module.

Referenced by the following interfaces: DescribeAssetCoreModuleInfo

name	required	NULL allowed	type	description
Desc	yes	no	String	Description. Example: module
Modules	yes	no	String	Dependent-on modules. Example: module
Name	yes	no	String	Name. Example: teat
Params	yes	yes	Array of AssetCoreModuleParam	Parameter information. Example:View
Path	yes	no	String	Path Example: /root
Processes	yes	no	String	Dependent processes. Example: 10011
Size	yes	no	Uint64	Size. Example: 102
UpdateTime	yes	yes	String	Data update time. Example: 2011-11-11 12:12:12
Version	yes	no	String	Version. Example: 1.0.1

BaselineRuleTopInfo

Top baseline check item information.

Referenced by the following interfaces: DescribeBaselineTop

name	required	NULL allowed	type	description
EventCount	yes	yes	Uint64	Number of events. Example: 0
Level	yes	yes	Uint64	Baseline risk level. 0: low; 1: medium; 2: high; 3: critical. Example: 1
RuleId	yes	yes	Uint64	ID of the check item. Example: 20
RuleName	yes	yes	String	Name of the baseline check item. Example: Weak password

AssetInfo

Instance information

Referenced by the following interfaces: CreateAgentInstallTask, DescribeAgentInstallResult, ModifyAssetsProtectionStatus

name	required	NULL allowed	type	description
AppId	no	yes	Uint64	App ID information Example: 3680000000
AssetId	no	yes	String	Asset ID Example: ins-36843684
AssetType	no	yes	String	Asset type Example: CVM
MemberId	no	yes	String	memberid Example: mem-36843684
Region	no	yes	String	Availability zone. Example: ap-region1

BaselineRiskItem

Top 5 baseline check items.

Referenced by the following interfaces: DescribeBaselineItemRiskTop

name	required	NULL allowed	type	description
HostCount	yes	no	Int64	Number of affected servers. Example: 1
ItemId	yes	yes	Int64	ID of the check item. Example: 1
ItemName	yes	no	String	Name of the check item. Example: Weak password
Level	yes	no	Int64	Baseline risk level. 0: low; 1: medium; 2: high; 3: critical. Example: 1

JavaMemShellPluginInfo

Java memory trojan plug-in information.

Referenced by the following interfaces: DescribeJavaMemShellPluginInfo

name	required	NULL allowed	type	description
ErrorLog	yes	no	String	Error log. Example: 1736132722
MainClass	yes	no	String	Main class of the injection process. Example: main.class
Pid	yes	no	Uint64	ID of the injection process. Example: 12
Status	yes	no	Uint64	Injection status. 0: injecting. 1: injected successfully. 2: plug-in timeout. 3: plug-in exit. 4: injection failed. 5: logically deleted. Example: 1

MaWorkload

Referenced by the following interfaces: DescribeMaWorkloadList

name	required	NULL allowed	type	description
HostIp	no	yes	String	Private network IP of the server/pod. Example: 10.0.0.0.1
Id	no	yes	Int64	ID Example: 1
IsSupportMa	no	yes	Int64	Whether to support micro-alarms [1: Yes; 0: No]. Example: 0
Labels	no	yes	Array of MaLabel	Tag. Example:View
Name	no	yes	String	Server/Pod name. Example: redis_node_cvm
NotSupportMaCode	no	yes	Int64	Reason for not supporting micro-alarms [0: Supported; 1: Low client version; 2: Not premium edition; 3: Client not installed]. Example: 0
PublicIp	no	yes	String	Public IP of the server. Example: 35.168.0.1
Type	no	yes	Int64	Type [0: Server; 1: Pod]. Example: 0

BaselineRuleDetect

Baseline rule-based check.

Referenced by the following interfaces: DescribeBaselineRuleDetectList

name	required	NULL allowed	type	description
DetectStatus	yes	no	Int64	0: checked not passed. 1: ignored. 3: check passed. 5: checking. Example: 0
FirstTime	yes	no	String	First scan time. Example: 2021-02-01 12:00:00
HostCount	yes	no	Int64	Number of associated servers. Example: 9
ItemCount	yes	no	Int64	Number of associated items. Example: 32
ItemIds	yes	yes	Array of Int64	Item IDs. Example: [3855]
LastTime	yes	no	String	string Example: 2021-02-01 12:00:00
RuleDesc	yes	no	String	Rule description. Example: International standard—CentOS 6 security baseline check
RuleId	yes	no	Int64	Rule ID. Example: 30
RuleName	yes	no	String	Rule Name Example: International standard—CentOS 6 security baseline check

MalWareList

List of trojans.

Referenced by the following interfaces: DescribeMalWareList

name	required	NULL allowed	type	description
Alias	no	no	String	Host alias. Example: redis_node_cvm
CheckPlatform	no	no	String	Trojan detection platforms. Multiple platforms are separated with commas (,). 1: cloud scanning and cleaning engine. 2: TAV. 3: binaryAi. 4: suspicious behavior. 5: threat intelligence. Example: 1
CreateTime	no	no	String	Creation time. Example: 2024-10-30 09:12:22
FileCreateTime	no	yes	String	Time when the file was first run. Example: 2024-10-30 09:12:22
FileExists	no	no	Uint64	Whether the trojan file exists. 0: the trojan file does not exist. 1: the trojan file exists. Example: 1
FileModifierTime	no	yes	String	Last execution time. Example: 2024-10-30 09:12:22
FilePath	no	no	String	Path Example: /tmp/any
HostIp	no	no	String	Server IP address. Example: 10.0.0.1
Id	no	yes	Uint64	Unique ID. Example: 1
LatestScanTime	no	no	String	Last scan time. Example: 2024-10-30 09:12:22
Level	no	no	Uint64	Risk severity. 0: informational. 1: low. 2: medium. 3: high. 4: critical. Example: 1
MD5	no	no	String	MD5 value of the sample trojan. Example: 708cae4cf814c3deda4208da228fad4e
MachineExtraInfo	no	yes	MachineExtraInfo	Supplementary Information Example:View
ProcessExists	no	no	Uint64	Whether the trojan process exists. 0: the trojan process does not exist. 1: the trojan process exists. Example: 1
Quuid	no	no	String	cvm quuid Example: e5b4724c-49af-46ab-bd84-cdbae897e7e0
Status	no	no	Uint64	Status. 4 - pending processing; 5 - trusted; 6 - isolated; 8 - files deleted; 14 - processed; 13 - allowlisted. Example: 4
Tags	no	yes	Array of String	Tags. This parameter has been deprecated, and no tags will be returned. Tag information will be returned only in the details. Example: ["tag1"]
Uuid	no	no	String	Unique UUID. Example: e5b4724c-49af-46ab-bd84-cdbae897e7e0
VirusName	no	no	String	Virus name. Example: Linux.Trojan.Downloader.Snkl

SecurityDynamic

Security event message data.

Referenced by the following interfaces: DescribeSecurityDynamics

name	required	NULL allowed	type	description
EventTime	yes	no	Datetime	Time when the security event occurred. Example: 2018-01-01 00:00:00
EventType	yes	no	String	Type of the security event. MALWARE: trojan event NON_LOCAL_LOGIN: login from an unusual location. BRUTEATTACK_SUCCESS: successful password cracking event VUL: vulnerability BASELINE: security baseline vulnerability Example: BASELINE
Message	yes	no	String	Message sent for the security event. Example: Event message
SecurityLevel	yes	no	String	Security Event Level. RISK: Critical HIGH: High Risk NORMAL: Moderate Risk LOW: Low Risk UNKNOWNED: Suspicious. Example: High
Uuid	yes	no	String	CWP client UUID. Example: 5a540076-d38a-4078-aa98-q45rt371d322

UsualPlace

Usual login location

Referenced by the following interfaces: DescribeUsualLoginPlaces

name	required	NULL allowed	type	description
CityId	yes	no	Uint64	City ID. Example: 101
CountryId	yes	no	Uint64	Country ID. Example: 2
Id	yes	no	Uint64	ID. Example: 13267
ProvinceId	yes	no	Uint64	Province ID. Example: 21
Uuid	yes	no	String	CWP client UUID. Example: 69E78F7F-FFC7-47D1-B406-13C9852ayayay

AssetAppProcessInfo

Information about a process associated with a software application.

Referenced by the following interfaces: DescribeAssetAppProcessList, DescribeAssetJarInfo, DescribeAssetWebServiceProcessList

name	required	NULL allowed	type	description
Name	yes	no	String	Name. Example: sshd
Path	yes	no	String	Path Example: /usr/bin/sshd
StartTime	yes	no	String	Start time. Example: 2024-10-23 14:17:00
Status	yes	no	String	Process status. R: executable; S: interruptible; D: uninterruptible; T: paused or traced; Z: zombie; X: to be terminated. Example: R
User	yes	no	String	User. Example: root
Version	yes	no	String	Process version. Example: 1.1.1

Filter

Key-value pair filters for conditional filtering queries. For example, IDs, names, and states can be filtered.

If multiple filters exist, the AND relationship is used between the filters.
If you specify multiple values for 1 filter, the OR relationship is used between the values.

You can specify a maximum of 5 filters.
You can specify a maximum of 5 values for each filter.

Referenced by the following interfaces: DescribeAccountStatistics, DescribeAssetMachineList, DescribeAssetPortInfoList, DescribeAssetProcessInfoList, DescribeAssetSystemPackageList, DescribeAssetUserList, DescribeAssetWebAppList, DescribeAssetWebFrameList, DescribeAssetWebLocationList, DescribeAttackEvents, DescribeAttackLogs, DescribeAttackTop, DescribeAttackTrends, DescribeBanWhiteList, DescribeBaselineDetectList, DescribeBaselineDownloadList, DescribeBaselineFixList, DescribeBaselineHostDetectList, DescribeBaselineItemDetectList, DescribeBaselineItemIgnoreList, DescribeBaselineItemInfo, DescribeBaselineItemList, DescribeBaselinePolicyList, DescribeBaselineRuleDetectList, DescribeBaselineRuleIgnoreList, DescribeBaselineRuleList, DescribeBaselineWeakPasswordList, DescribeBashEvents, DescribeBashEventsNew, DescribeBashPolicies, DescribeBashRules, DescribeBruteAttackList, DescribeClsLogsets, DescribeComponentStatistics, DescribeComponents, DescribeEventList, DescribeExportMachines, DescribeHistoryAccounts, DescribeHostLoginList, DescribeIgnoreHostAndItemConfig, DescribeLicenseBindSchedule, DescribeLoginWhiteCombinedList, DescribeLoginWhiteList, DescribeLoginWhiteListNew, DescribeMaConnEventList, DescribeMaCustomPolicyList, DescribeMaHostList, DescribeMaLabelList, DescribeMaSelfLearnPolicyList, DescribeMaWhitelist, DescribeMaWorkloadList, DescribeMachineDefenseCnt, DescribeMachineRiskCnt, DescribeMachines, DescribeMachinesSimple, DescribeMalWareList, DescribeMalwareWhiteList, DescribeMalwareWhiteListAffectList, DescribeMemShellRules, DescribeNetAttackWhiteList, DescribeOpenPortStatistics, DescribePrivilegeEvents, DescribePrivilegeRules, DescribeProcessStatistics, DescribeProtectDirRelatedServer, DescribeReverseShellEvents, DescribeReverseShellRules, DescribeReverseShellRulesAggregation, DescribeRiskDnsEventList, DescribeRiskDnsList, DescribeRiskDnsPolicyList, DescribeRiskProcessEvents, DescribeSecurityEventStat, DescribeVulDefenceEvent, DescribeVulDefenceList, DescribeVulDefencePluginDetail, DescribeVulDefencePluginStatus, DescribeVulDefenceSettingList, DescribeVulEffectHostList, DescribeVulEffectModules, DescribeVulStoreList, DescribeVuls, ExportAssetMachineList, ExportAssetPortInfoList, ExportAssetProcessInfoList, ExportAssetSystemPackageList, ExportAssetUserList, ExportAssetWebAppList, ExportAssetWebFrameList, ExportAssetWebLocationList, ExportBaselineFixList, ExportBaselineHostDetectList, ExportBaselineItemDetectList, ExportBaselineItemList, ExportBaselineRuleDetectList, ExportBaselineWeakPasswordList, ExportFileTamperRules, ExportJavaMemShellPlugins, ExportJavaMemShells, ExportMaConnEventList, ExportMaCustomPolicyList, ExportMaHostList, ExportMaPodList, ExportMaSelfLearnPolicyList, ExportMaWhitelist, ExportNonlocalLoginPlaces, ExportRiskDnsEventList, ExportRiskDnsPolicyList, ExportRiskProcessEvents, ExportVulDefenceEvent, ExportVulDefenceList, ExportVulDefencePluginEvent, ExportVulEffectHostList, ExportVulList, ModifyBaselinePolicy, ModifyBaselineRule, ModifyBaselineRuleIgnore

name	required	NULL allowed	type	description
ExactMatch	no	no	Bool	Fuzzy search. Example: false
Name	yes	no	String	Name of the filter key. Example: Keywords
Values	yes	no	Array of String	One or more filter values. Example: ["1.1.1.1"]

AssetDatabaseBaseInfo

Database information in the asset management module.

Referenced by the following interfaces: DescribeAssetDatabaseList

name	required	NULL allowed	type	description
BinPath	no	no	String	Binary path. Example: /usr/local/bin
ConfigPath	no	no	String	Path of the configuration file. Example: /etc/sshd
DataPath	no	no	String	The data path. Example: /data
ErrorLogPath	no	no	String	Path of the error log. Example: /var/log
FirstTime	no	no	String	First collection time. Example: 2022-07-15 11:27:01
Id	no	no	String	Database ID. Example: 1
Ip	no	no	String	Binds the IP address. Example: 112.52.67.8
IsNew	no	no	Int64	Whether it is newly added. 0: no. 1: yes. Example: 1
LogPath	no	no	String	Path of the log file. Example: /var/log
MachineExtraInfo	no	yes	MachineExtraInfo	Supplementary Information Example:View
MachineIp	no	no	String	Private IP address of the server. Example: 10.0.0.11
MachineName	no	no	String	Server name. Example: redis_node_cvm
MachineWanIp	no	no	String	Public IP address of the server. Example: 112.41.55.12
Name	no	no	String	Database name. Example: yunding
OsInfo	no	no	String	OS information. Example: Centos 64Bit
Param	no	no	String	Boot parameters. Example: --configsvr --port 27019 --keyFile /etc/mongodb/key --dbpath /data/db --replSet d1j49h6z --wiredTigerCacheSizeGB 0.43 --maxConns 10000 --auth --bind_ip_all
Permission	no	no	String	Running permissions. Example: polkitd
PlugInPath	no	no	String	Path of the plug-in. Example: /data
Port	no	no	String	Listening port. Example: 27019
ProjectId	no	no	Uint64	ID of the project to which the server belongs. Example: 1
Proto	no	no	String	Protocol. Example: tcp
Quuid	no	no	String	Host QUUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116
Tag	no	yes	Array of MachineTag	Server tags. Example:View
UpdateTime	no	yes	String	Data update time. Example: 2011-11-11 12:12:12
User	no	no	String	Run user. Example: root
Uuid	no	no	String	Host UUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116
Version	no	no	String	Version. Example: 1.1.1

MachineSimple

Server list

Referenced by the following interfaces: DescribeMachinesSimple

name	required	NULL allowed	type	description
CloudFrom	no	yes	Uint64	Cloud server vendor type. 0: cloud 1: IDC 2: Alibaba Cloud 3: Huawei Cloud 4: Amazon 5: Microsoft 6: Google 7: Oracle 8: DigitalOcean Example: 0
CloudTags	no	yes	Array of Tags	Cloud tag information. Example:View
InstanceId	no	yes	String	Instance ID. Example: ins-ddsdsay
InstanceState	no	no	String	Instance status. PENDING: creating; LAUNCH_FAILED: creation failed; RUNNING: running; STOPPED: shut down; STARTING: starting; STOPPING: shutting down; REBOOTING: restarting; SHUTDOWN: shut down and pending termination; TERMINATING: terminating; TERMINATED: terminated; TERMINATED_PRO_VERSION: terminated but Yunjing Pro Edition not expired. Example: RUNNING
IsProVersion	no	no	Bool	Whether it is a professional version. true: yes. false: no. Example: false
KernelVersion	no	no	String	Kernel version. Example: 3.10.0-1127.19.1.el7.x86_64
LicenseOrder	no	yes	LicenseOrder	License order object. Example:View
MachineIp	no	no	String	IP address of the server. Example: 10.0.0.2
MachineName	no	no	String	Host name. Example: redis_node_cvm
MachineOs	no	no	String	Operating system of the server. Example: centos
MachineType	no	no	String	Zone type of the server. CVM: CVM zone. BM: BM zone. ECM: ECM zone. LH: Lighthouse zone. Other: hybrid cloud zone. Example: CVM
MachineWanIp	no	no	String	Public IP of the host. Example: 1.1.1.1
PayMode	no	no	String	Host status. POSTPAY: postpaid mode, that is, pay-as-you-go. PREPAY: prepaid mode, that is, monthly subscription. Example: PREPAY
ProjectId	no	no	Int64	Project ID. Example: 1
ProtectType	no	no	String	Protection edition. BASIC_VERSION: Basic Edition. PRO_VERSION: Professional Edition. Flagship: Ultimate Edition. GENERAL_DISCOUNT: General Edition. Example: BASIC_VERSION
Quuid	no	no	String	UUID of the CVM or BM instance. Example: acdd5474-6360-4fd4-bfc7-843162cb8116
RegionInfo	no	no	RegionInfo	Region information. Example:View
Tag	no	no	Array of MachineTag	Tag information Example:View
Uuid	no	no	String	CWP UUID. If the client remains offline for a long time, an empty string will be returned. Example: acdd5474-6360-4fd4-bfc7-843162cb8116

HostRiskLevelCount

Number of risks at different severity levels on a server.

Referenced by the following interfaces: DescribeBaselineHostRiskTop

name	required	NULL allowed	type	description
HighCount	yes	no	Int64	Number of high risks. Example: 1
HostId	yes	no	String	Server ID. Example: 1
HostName	yes	yes	String	Server name. Example: 1
LowCount	yes	no	Int64	Number of low risks. Example: 1
MediumCount	yes	no	Int64	Number of medium risks. Example: 1
SeriousCount	yes	no	Int64	Number of critical risks. Example: 1

OrderRenewConfig

Order renewal parameters.

Referenced by the following interfaces: ModifyOrder

name	required	NULL allowed	type	description
SubProductCode	yes	yes	String	Secondary sub-product, which is the target sub-product for renewal. Example: sp_yunjing_vas
TimeSpan	yes	yes	Uint64	Duration. The minimum value is 1 and the maximum value is 36. Example: 36
TimeUnit	yes	yes	String	Time unit. y: year, m: month. Example: y

VersionWhiteConfig

License version allowlist configuration.

Referenced by the following interfaces: DescribeLicenseWhiteConfig

name	required	NULL allowed	type	description
Deadline	yes	no	Uint64	Number of days before expiration. Example: 7
IsApplyFor	yes	no	Bool	Whether it can be applied for. Example: false
LicenseNum	yes	no	Uint64	Number of licenses. Example: 10
SourceType	yes	no	Uint64	Order type. 0: default billing order; 1: trial order; 2: gift; 3: experience. Example: 0

RuleInfo

Index rule.

Referenced by the following interfaces: DescribeLogIndex

name	required	NULL allowed	type	description
FullText	yes	no	FullTextInfo	Full-text index-related configuration. Example:View
KeyValue	yes	no	KeyValueInfo	Key-value index configuration. Example:View
Tag	yes	no	KeyValueInfo	Metafield index configuration Example:View

ShellPolicyList

Reverse shell list data details.

Referenced by the following interfaces: DescribeShellPolicyList

name	required	NULL allowed	type	description
HostScope	no	yes	Uint64	Host range. [0: a group of QUuids, 1: all Pro edition hosts, 2: Premium edition, 3: all hosts.] Example: 2
IsEnabled	no	yes	Uint64	0: enabled, 1: disabled. Example: 0
PolicyAction	no	yes	Uint64	Action to take. 0: alarm. 1: allow. 2: block and alarm Example: 0
PolicyDesc	no	yes	String	Policy description. Example: any policy desc
PolicyId	no	yes	Uint64	Policy ID. Example: 2001
PolicyName	no	yes	String	Policy name. Example: Automatic blocking policy of the system
PolicyType	no	yes	Uint64	0: system policy, 1: custom policy. Example: 0
UpdateTime	no	yes	String	Update time. Example: 0000-00-00 00:00:00

CKafkaInstanceInfo

CKafka instance information.

Referenced by the following interfaces: DescribeLogDeliveryKafkaOptions

name	required	NULL allowed	type	description
Az	yes	no	String	Region. Example: az1
Bandwidth	yes	no	Int64	instance bandwidth. Unit: Mbit/s. Example: 0
DiskSize	yes	no	Int64	Disk capacity. Unit: GB. Example: 0
Healthy	yes	no	Int64	Status. 1: healthy. 2: alarming. 3: abnormal. Example: 1
InstanceID	yes	no	String	Instance ID. Example: ins-id
InstanceName	yes	no	String	Instance name. Example: instance_name
KafkaVersion	yes	no	String	Version number. Example: 1.1.0
RouteList	yes	no	Array of CKafkaRouteInfo	List of routes. Example:View
SubnetId	yes	no	String	Subnet ID. Example: 1.1.1.1
TopicList	yes	yes	Array of CKafkaTopicInfo	List of alarm sources. Example:View
VpcId	yes	no	String	VPC ID. An empty value indicates that the classic network is used. Example: 1.1.1.1
Zone	yes	no	String	Availability zone. Example: zone1

RecordInfo

Client Exception Information Structure

Referenced by the following interfaces: DescribeClientException

name	required	NULL allowed	type	description
HostIP	yes	no	String	IP address of the server. Example: 10.10.10.10
InstanceID	yes	no	String	Host Instance ID Example: ins-gdsgdsd
OfflineTime	yes	no	String	Client Offline Time Example: 2022-11-14 00:00:00
UninstallCmd	yes	no	String	Client Uninstallation Call Chain Example: sh uninstall.sh
UninstallTime	yes	no	String	Client Uninstallation Time Example: 2022-11-14 00:00:00
Uuid	yes	no	String	Client UUID Example: c6bf7a9e-95cf-4048-a6cc-97e85d02e6ee

TopInfo

Referenced by the following interfaces: DescribeAttackTop

name	required	NULL allowed	type	description
Count	no	yes	Uint64	Top Statistical Count Example: 10
Value	no	yes	String	Top Statistical Data, such as IP, and vulnerability name Example: DstPort

ClsTopicInfo

Log topic information

Referenced by the following interfaces: DescribeClsTopics

name	required	NULL allowed	type	description
AssumerName	no	yes	String	Cloud Product Identifier Example: CWP
CreateTime	no	yes	String	Creation Time Example: 2021-04-01 08:00:00
LogsetId	no	yes	String	Logset ID Example: 34526
TopicId	no	yes	String	Topic ID Example: topic_redis_node
TopicName	no	yes	String	Topic Name Example: topic_redis_node

FullMachine

Server information.

Referenced by the following interfaces: DescribeAllMachines

name	required	NULL allowed	type	description
IsProVersion	yes	no	Bool	Whether CWP Pro is activated. true: yes. false: no. Example: true
MachineIp	yes	no	String	IP address of the server. Example: 192.168.0.1
MachineName	yes	no	String	Host name. Example: redis_node_cvm
MachineWanIp	yes	no	String	Public IP of the host. Example: 35.168.0.1
Quuid	yes	no	String	UUID of the server. Example: 5a540076-d38a-4078-aa98-qwert371d322

MaConnEvent

Referenced by the following interfaces: DescribeMaConnEventList

name	required	NULL allowed	type	description
CreateTime	no	yes	String	First time. Example: 2023-10-10 00:00:00
DestIP	no	yes	String	Target IP address. Example: 1.1.1.1
DestInstanceId	no	yes	String	Target Instance ID Example: ins-tsa23
DestLabels	no	yes	Array of MaLabel	Tag of the target workload. The length may be 0, indicating that no tags are matched. Example:View
DestPodInfo	no	yes	MaConnPodInfo	Basic information of the pod as the target. Example:View
DestPort	no	yes	Uint64	Target port. Example: 8080
DestUuid	no	yes	String	UUID of the server as the target. Example: 5a540076-d38a-4078-aa98-q45rt371d322
DestWorkloadDeleted	no	yes	Uint64	Whether the target workload is deleted. 0: Not deleted 1: Deleted Example: 1
DestWorkloadId	no	yes	Uint64	ID of the target workload, which may be 0, indicating that no workloads are matched. Example: 1
DestWorkloadName	no	yes	String	Name of the target workload, which may be an empty string, indicating that no workloads are matched. Example: redis_node_cvm
DestWorkloadType	no	yes	Int64	Type of the target workload. 0: IP 1: Server 2: Pod Example: 1
Id	no	yes	Uint64	Event ID. Example: 1
MatchCount	no	yes	Uint64	Number of matches. Example: 100
MatchPolicyId	no	yes	Uint64	ID of the matched policy under custom policies. Example: 1
MatchPolicyName	no	yes	String	Name of the matched policy. Example: policy1
MatchPolicyType	no	yes	Uint64	Type of the matched policy. 0: Self-learning policy 1: Custom allowlist policy Example: 1
MatchPolicyUniqueId	no	yes	String	Unique key of the matched policy under self-learning policies. Example: 2514
ModifyTime	no	yes	String	Last occurrence time. Example: 2023-10-10 00:00:00
PolicyDeleted	no	yes	Uint64	Whether the matched policy is deleted. 0: Not deleted 1: Deleted Example: 1
Protocol	no	yes	String	Protocol: TCP UDP Example: TCP
ServiceName	no	yes	String	Service name, used for extension and not supported currently. Example: sshd
SrcIP	no	yes	String	Source IP Example: 1.1.1.1
SrcInstanceId	no	yes	String	Source instance ID Example: instance1
SrcLabels	no	yes	Array of MaLabel	Tag of the source workload. The length may be 0, indicating that no tags are matched. Example:View
SrcPodInfo	no	yes	MaConnPodInfo	Basic information of the pod as the source. Example:View
SrcUuid	no	yes	String	UUID of the server as the source. Example: 5a540076-d38a-4078-aa98-q45rt371d322
SrcWorkloadDeleted	no	yes	Uint64	Whether the source workload is deleted. 0: Not deleted. 1: Deleted. Example: 1
SrcWorkloadId	no	yes	Uint64	ID of the source workload, which may be 0, indicating that no workloads are matched. Example: 1
SrcWorkloadName	no	yes	String	Name of the source workload, which may be an empty string, indicating that no workloads are matched. Example: 192.168.0.10
SrcWorkloadType	no	yes	Int64	Type of the source workload. 0: IP 1: Server 2: Pod Example: 0
Type	no	yes	Uint64	Event type. 0: Normal access 1: Exception access Example: 0

FileTamperRuleDetail

Details of a core file monitoring rule.

Referenced by the following interfaces: DescribeFileTamperEventRuleInfo, DescribeFileTamperRuleInfo

name	required	NULL allowed	type	description
AddWhiteType	no	yes	String	Allowlisting type. cur: Add only the current item to an allowlist. all: Add all items that meet conditions to an allowlist. Example: cur
CreateTime	yes	no	String	Creation time. Example: 2021-10-13T11:15:06+08:00
Id	yes	no	Uint64	Rule ID. Example: 1
IsGlobal	yes	no	Uint64	Whether it is a global rule. 0: no. 1: yes. Default value: 0. Example: 1
Level	yes	no	Uint64	Risk severity. 0: no risk. 1: high. 2: medium. 3: low. Example: 1
ModifyTime	yes	no	String	Update time. Example: 2021-10-13T11:15:06+08:00
Name	yes	yes	String	Rule Name Example: Deny Access
Rule	yes	no	Array of FileTamperRule	Rule. Example:View
Status	yes	no	Uint64	Status. 0: enabled. 1: disabled. Example: 1
UuidTotalCount	yes	no	Uint64	Total number of servers on which the rule takes effect. Example: 17
Uuids	yes	yes	Array of String	UUIDs of the servers on which the rule takes effect. If this parameter is left empty, this rule takes effect on all servers. You can use this parameter to limit the number of entries to return. Example: ["935e27b1-d675-4509-80bf-96fbf0764237"]

MemShellRule

Java Webshell allowlist rule.

Referenced by the following interfaces: DescribeMemShellRules

name	required	NULL allowed	type	description
AnnotationsRegexp	no	yes	String	Annotation regular expression, which is not matched if empty. Example: org.apache.catalina.startup.Bootstrap
CallStackRegexp	no	yes	String	Call stack regular expression, which is not matched if empty. Example: eval
ClassNameRegexp	no	yes	String	Class name regular expression, which is not matched if empty. Example: webshell_filter
CodeSourceRegexp	no	yes	String	Source code regular expression, which is not matched if empty. Example: eval
CreateTime	no	yes	String	Creation time. Example: 2024-09-20 15:32:26
FileExist	no	yes	Uint64	Whether a file exists. 0: Default value when a user does not select a rule. 1: File exists; 2: File does not exist. Example: 0
GroupID	no	yes	String	Batch ID. Example: ece9dcb3-e427-4ded-ac6f-727cce79130b
GroupName	no	yes	String	Policy name. Example: check_for_redis
HandleHistory	no	yes	Uint64	Whether to process historical events. 0: no, 1: yes. Example: 1
Id	no	yes	Uint64	Rule ID. Example: 12
InterfacesRegexp	no	yes	String	Inherited interface regular expression, which is not matched if empty. Example: org.apache.catalina.startup.Bootstrap
IsGlobal	no	yes	Uint64	Whether it is a global rule. (Whether it is effective for all hosts under appid. 0: single UUID, 1: global. The default value is no.) Example: 0
LoaderClassNameRegexp	no	yes	String	Associated class loader regular expression, which is not matched if empty. Example: org.apache.catalina.startup.Bootstrap
LogicalSymbol	no	yes	Uint64	Logical operator. 0: 5 valid regular expression logical ANDs; 1: logical OR. Example: 0
MachinesNums	no	yes	String	Number of servers covered by a rule. When IsGlobal is set to 1, all servers are displayed. Example: 2
ModifyTime	no	yes	String	Modification time. Example: 2024-11-03 15:09:33
Operator	no	yes	String	Operator. Example: Alice
Status	no	yes	Uint64	Status (0: valid, 1: deleted, 2: invalid (enabling switch off)). Example: 0
SuperClassNameRegexp	no	yes	String	Parent class name regular expression, which is not matched if empty. Example: org.apache.catalina.startup.Bootstrap
UuidHostips	no	yes	Array of UuidHostip	Client ID Example:View

MonthInspectionReport

Monthly inspection report provided by the expert service.

Referenced by the following interfaces: DescribeMonthInspectionReport

name	required	NULL allowed	type	description
ModifyTime	yes	no	String	Time when the inspection report was updated. Example: 2021-03-11 09:50:33
ReportName	yes	no	String	Name of the inspection report. Example: report-2021-03.pdf
ReportPath	yes	no	String	Download URL of the inspection report. Example: https://www.domain.xom/report-2021-03.pdf

RiskDnsPolicy

Anti-malicious request policy.

Referenced by the following interfaces: DescribeRiskDnsPolicyList, ModifyRiskDnsPolicy

name	required	NULL allowed	type	description
Domains	yes	no	Array of String	Domain name. The value must be Base64 encoded when the parameter is used as an input parameter. Example: [domainName1,domainName2]
EventId	no	no	Int64	Event ID. Example: 1
HostIds	yes	no	Array of String	Server ID. Example: [a7c573cb-c228-4211-85e3-64e000f159a5]
HostScope	yes	no	Int64	Server range. 1: all servers with CWP Pro and all servers with CWP Ultimate. 2: all servers with CWP ultimate. 0: some servers. Example: 1
IsDealOldEvent	no	no	Int64	Whether to handle previous events. 0: previous events will not be handled. 1: previous events will be handled. Example: 1
IsEnabled	yes	no	Int64	Specifies whether to take effect. 0: yes. 1: no. Example: 1
PolicyAction	yes	no	Int64	Action to take. 0: alarm. 1: allow. 2: block and alarm Example: 1
PolicyDesc	no	no	String	Policy description. Example: add for nginx web cvm
PolicyId	no	no	Int64	Policy ID. Example: 1
PolicyName	yes	no	String	Policy name. Example: for_nginx_web
PolicyType	yes	no	Int64	Policy type. 0: system policy. 1: custom policy. Example: 1
UpdateTime	no	no	String	Update time. Example: 2022-07-15 11:27:01

EmergencyVul

Emergency vulnerability information.

Referenced by the following interfaces: DescribeEmergencyVulList

name	required	NULL allowed	type	description
AttackLevel	no	yes	Uint64	Attack level. If the value is 3 or higher, the attack is a notable attack. Example: 3
Category	yes	no	Uint64	Vulnerability category. 1: web CMS vulnerability; 2: application vulnerability; 4: Linux software vulnerability; 5: Windows system vulnerability. Example: 2
CveId	yes	yes	String	CVE ID. Example: CVE-2021-3156
CvssScore	yes	yes	Float	CVSS score. Example: 7.4
DefenseAttackCount	yes	yes	Uint64	Number of prevented attack attempts. Example: 12
DefenseState	no	yes	Bool	Whether vulnerable hosts are enabled with vulnerability defense. Example: true
HostCount	yes	yes	Uint64	Number of affected servers. Example: 2
IsSupportDefense	yes	yes	Uint64	Whether to support attack defense. 0: not supported. 1: supported. Example: 1
Labels	yes	yes	String	Tags of the vulnerability, which are separated with commas (,). Example: tag1,tag2
LastScanTime	yes	no	String	Last scan time. Example: 2024-11-04 09:57:28
Level	yes	no	Uint64	Vulnerability risk level. 0: prompt; 1: low; 2: medium; 3: high; 4: critical. Example: 2
Method	no	yes	Uint64	Detection rule. 0: version comparison, 1: POC verification. Example: 0
Progress	yes	no	Uint64	Scan progress. Example: 100
PublishDate	yes	no	String	Publishing date. Example: 2024-09-04
Status	yes	no	Uint64	Vulnerability status. 0: not detected; 1: risk detected; 2: no risk; 3: detecting (Progress field displayed). Example: 1
VulId	yes	no	Uint64	Vulnerability ID. Example: 1001
VulName	yes	no	String	Vulnerability name. Example: Apache HTTP/2 DoS vulnerability (CVE-2023-44487)

BaselineEffectHost

Information about a server affected by a baseline.

Referenced by the following interfaces: DescribeBaselineEffectHostList

name	required	NULL allowed	type	description
AliasName	yes	yes	String	Host alias. Example: redis_node_cvm
FailCount	yes	yes	Uint64	Risk items. Example: 1
FirstScanTime	yes	yes	String	First scan time. Example: 2021-10-27 00:09:38
HostIp	yes	yes	String	IP address of the server. Example: 10.0.0.1
LastScanTime	yes	yes	String	Last detection time. Example: 2021-10-27 00:09:38
MaxStatus	yes	yes	Uint64	Status during scanning. Example: 0
PassCount	yes	yes	Uint64	Check items that the server passed. Example: 1
Quuid	yes	yes	String	Host QUUID. Example: e5b4724c-49af-46ab-bd84-cdbae897e7e0
Status	yes	yes	Uint64	Handling status of the risk item. 0: not passed. 1: passed. Example: 0
Uuid	yes	yes	String	Host UUID. Example: e5b4724c-49af-46ab-bd84-cdbae897e7e0

HistoryAccount

Account change history data.

Referenced by the following interfaces: DescribeHistoryAccounts

name	required	NULL allowed	type	description
Id	yes	no	Uint64	Unique ID. Example: 1
MachineIp	yes	no	String	Private IP address of the server. Example: 1.2.3.4
MachineName	yes	no	String	Server name. Example: stone
ModifyTime	yes	no	Datetime	Point in time when the change took place. Example: 2020-01-01 01:01:01
ModifyType	yes	no	String	Account change type. CREATE: create an account. MODIFY: modify an account. DELETE: delete an account. Example: CREATE
Username	yes	no	String	Account name. Example: user1
Uuid	yes	no	String	CWP client UUID. Example: 8c09e1b1-5611-45b3-9c02-737996011b81

IgnoreBaselineRule

Information about an ignored baseline check item.

Referenced by the following interfaces: DescribeIgnoreBaselineRule

name	required	NULL allowed	type	description
EffectHostCount	yes	yes	Uint64	Number of affected servers. Example: 10
Fix	yes	yes	String	Fix suggestions. Example: 1. Use a more complex password. A strong password should be a combination of letters, numbers, and special characters and should be at least 10 characters long;\n2. Use the CDB.\n3. To delete an account directly, execute the OPTIMIZE TABLE mysql.user; command.
ModifyTime	yes	yes	String	Update time. Example: 2021-02-01 12:00:00
RuleId	yes	yes	Uint64	ID of the baseline check item. Example: 1103
RuleName	yes	yes	String	Name of the baseline check item. Example: Redis baseline compliance check

BaselineCategory

Baseline rule category or baseline check item category.

Referenced by the following interfaces: DescribeBaselineItemInfo, DescribeBaselineRuleCategoryList

name	required	NULL allowed	type	description
CategoryId	yes	no	Int64	Category ID. Example: 1
CategoryName	yes	no	String	Category name. Example: Weak password
ItemCount	no	yes	Uint64	Total number of detection items under a subcategory. Example: 100
ParentCategoryId	yes	no	Int64	ID of the parent category. A value of 0 indicates that no parent category exists. Example: 1

ValueInfo

Description of an index value.

Referenced by the following interfaces: DescribeLogIndex

name	required	NULL allowed	type	description
ContainZH	yes	no	Bool	Whether to contain zh characters Example: false
SqlFlag	yes	no	Bool	Whether the analysis feature is enabled for the field. Example: false
Tokenizer	yes	no	String	Field tokenizer. Example: \n\t\r
Type	yes	no	String	Supported types: long, text, and double. Example: text

Item

Item details.

Referenced by the following interfaces: DescribeBaselineRuleIgnoreList, DescribeBaselineRuleList, ModifyBaselineRule

name	required	NULL allowed	type	description
CategoryId	no	yes	Int64	Category of a detection item. Example: 50
CustomItemValues	no	yes	Array of Uint64	Custom threshold. Example: [1000]
ItemId	yes	no	Int64	Id Example: 100
ItemName	no	no	String	Name. Example: itemname

BruteAttackInfo

Brute force attack information.

Referenced by the following interfaces: DescribeBruteAttackList

name	required	NULL allowed	type	description
AttackStatusDesc	no	yes	String	Cracking status description. Example: fail
BanExpiredTime	no	yes	String	Block expiration time (only valid for blocked events). Example: 2024-10-30 15:58:43
BanStatus	no	yes	Uint64	0 - no blocking (blocking is not supported in the client version). 1 - blocked. 2 - blocking failed (abnormal program). 3 - no blocking (for the private network). 4 - blocking not allowed in availability zones. 10 - blocking in progress. 81 - no blocking (blocking not enabled). 82 - no blocking (non-Pro). 83 - no blocking (added to allowlist). 86 - no blocking (system allowlist). 87 - no blocking (the client is offline). 88 - no blocking (source IP addresses belong to the same customer). 89 - no blocking (IPv6 addresses do not support blocking). Example: 0
City	no	yes	Uint64	City ID. Example: 1
Count	no	yes	Uint64	Number of occurrences. Example: 2
Country	no	yes	Uint64	Country ID. Example: 1
CreateTime	no	yes	String	Creation time. Example: 2021-05-25 12:01:50
DataFrom	no	yes	Int64	Event source. 0: blocking rule, 1: threat intelligence. Example: 0
DataStatus	no	yes	Uint64	0: to be handled. 1: ignored. 5: handled. 6: added to the allowlist. Example: 1
EventType	no	yes	Uint64	Event type: 200 - brute force cracking event; 300 - successful brute force cracking event (the status is displayed on the page); 400 - brute force cracking event for non-existent accounts. Example: 1
Id	no	no	Uint64	Unique ID. Example: 1001
InstanceId	no	yes	String	Instance ID. Example: ins-fsfsaw
IsProVersion	no	yes	Bool	Whether Professional Edition is activated. Valid values: true and false. Example: false
Location	no	yes	String	Geographical location name. Example: location1:location2:location3
MachineExtraInfo	no	yes	MachineExtraInfo	Supplementary Information Example:View
MachineIp	no	yes	String	IP address of the server. Example: 127.0.0.1
MachineName	no	yes	String	Server name. Example: redis_node_cvm
ModifyTime	no	yes	String	Last attack time. Example: 2021-05-25 12:01:50
Port	no	yes	Uint64	Port. Example: 22
Protocol	no	yes	String	Username of the attacked service. Example: ssh/rdp
Province	no	yes	Uint64	Province ID. Example: 1
Quuid	no	yes	String	Server UUID address. Example: 380add75-bb06-4cc4-84c5-cf806d102fba
RiskLevel	no	yes	Uint64	Threat level. 0: low risk, 1: medium risk, 2: high risk. Example: 1
SrcIp	no	yes	String	Source IP. Example: 66.12.2.14
Status	no	yes	String	SUCCESS: cracking succeeded. FAILED: cracking failed. Example: FAILED
UserName	no	yes	String	User name. Example: root
Uuid	no	yes	String	CWP client UUID. Example: 380add75-bb06-4cc4-84c5-cf806d102fba

Component

Component list data.

Referenced by the following interfaces: DescribeComponents

name	required	NULL allowed	type	description
ComponentName	no	yes	String	Component name. Example: redis
ComponentType	no	yes	String	Component type. SYSTEM: system component WEB: web component. Example: SYSTEM
ComponentVersion	no	yes	String	Version number of the component. Example: 1.0.0.1
Id	no	yes	Uint64	Unique ID. Example: 1
MachineIp	no	yes	String	Private IP address of the server. Example: 192.168.0.1
MachineName	no	yes	String	Server name. Example: redis_cvm
ModifyTime	no	yes	Datetime	Time when the component was modified. Example: 2020-02-01 12:00:00
Uuid	no	yes	String	Unique UUID of the CWP client. Example: 5a540076-d38a-4078-aa98-qwert371d322

ReverseShellRule

Anti-reverse shell rule.

Referenced by the following interfaces: DescribeReverseShellRules

name	required	NULL allowed	type	description
CreateTime	yes	no	String	Creation time. Example: 2024-11-04 09:57:28
DestIp	yes	no	String	Target IP address. Example: 127.0.0.1
DestPort	yes	no	String	Target port. Example: 80
Hostip	yes	no	String	IP address of the server. Example: 192.168.0.204
Id	yes	no	Uint64	Rule ID. Example: 1001
IsGlobal	yes	no	Uint64	Indicates whether it is a global rule. Example: 1
ModifyTime	yes	no	String	Modification time. Example: 2024-11-04 09:57:28
Operator	yes	no	String	Operator. Example: root
ProcessName	yes	no	String	Process name. Example: nginx
Status	yes	no	Uint64	Status. 0: valid. 1: invalid. Example: 0
Uuid	yes	no	String	Client ID Example: df131b24-8528-4809-9d07-a9e4d58ad566

RiskDnsList

Malicious request list API

Referenced by the following interfaces: DescribeRiskDnsInfo, DescribeRiskDnsList

name	required	NULL allowed	type	description
AccessCount	yes	no	Uint64	Number of access requests. Example: 22
Alias	yes	no	String	Alias. Example: by_nginx
CmdLine	yes	no	String	Command line. Example: cmd
CreateTime	yes	no	String	First access time. Example: 2021-04-26 15:19:04
Description	yes	no	String	Description. Example: desc of this risk
GlobalRuleId	yes	no	Uint64	Whether it is a global rule. 0: no. 1: yes. Example: 22
HostIp	yes	no	String	IP address of the server. Example: 13.22.3.1
Id	yes	no	Uint64	Unique ID. Example: 153
MachineStatus	yes	yes	String	Connection status of the server. Valid values: OFFLINE, ONLINE, and UNKNOWN. Example: OFFLINE
MachineWanIp	yes	yes	String	Public IP. Example: 13.22.3.1
MergeTime	yes	no	String	Last access time. Example: 2021-04-26 15:19:04
Pid	yes	no	Uint64	Process ID. Example: 33
ProcessMd5	yes	no	String	MD5 value of the process. Example: e10adc3949ba59abbe56e057f20f883e
ProcessName	yes	no	String	Process name. Example: nginx
Quuid	yes	no	String	QUUID. Example: 5a540076-d38a-4078-aa98-q45rt371d322
Reference	yes	no	String	Reference. Example: http://www.vxjump.net/files/virus_analysis/virut%20botnet%20anal
Status	yes	no	Uint64	Status. 0: to be handled. 2: added to the allowlist. 3: untrusted. 4: handled. 5: ignored. Example: 0
SuggestScheme	yes	no	String	Suggestion scheme. Example: 1. Check for malicious processes and invalid ports, and delete suspicious startup items and scheduled tasks. 2. Isolate or delete relevant Trojan files.
Tags	yes	no	Array of String	Tags. Example: ["vueir","mle"]
Url	yes	no	String	Domain name for external access. Example: re.r3r3.org
UserRuleId	yes	no	Uint64	ID of the custom rule. Example: 12
Uuid	yes	no	String	Unique UUID. Example: 5a540076-d38a-4078-aa98-q45rt371d322

ScreenEmergentMsg

API for querying emergency notifications in the dashboard visualization module

Referenced by the following interfaces: DescribeScreenEmergentMsg

name	required	NULL allowed	type	description
Text	yes	no	String	Content of notification. Example: Detected vulnerabilities
Title	yes	no	String	Title of the notification. Example: Notification
Type	yes	no	Uint64	Redirection type. 0: vulnerability management. Example: 0

LicenseDetail

List of license orders.

Referenced by the following interfaces: DescribeLicenseList

name	required	NULL allowed	type	description
Alias	yes	no	String	Alias of the resource. Example: redis_node_cvm
AutoRenewFlag	yes	no	Uint64	0: initialization. 1: auto-renewal is enabled. 2: auto-renewal is not enabled. Example: 0
BuyTime	yes	no	String	Purchase time. Example: 2018-02-28 00:00:00
Deadline	yes	no	String	End date. Example: 2018-02-28 00:00:00
ExtraParam	no	yes	LicenseExtraParam	Additional Parameters Example:View
FreezeNum	no	yes	Int64	Number of frozen licenses. 0: unfrozen, values other than 0: number of frozen licenses. Example: 0
LicenseCnt	yes	no	Uint64	Total number of licenses. Example: 0
LicenseId	yes	no	Uint64	License ID. Example: 1
LicenseStatus	yes	yes	Uint64	License status. 0: not used. 1: partially used. 2: used up. 3: unavailable. Example: 0
LicenseType	yes	no	Uint64	License type. 0: Pro Edition license; 5: Ultimate Edition license. Example: 0
OrderStatus	yes	no	Uint64	Order status. 1: normal. 2: isolated. 3: terminated. Example: 1
ProjectId	yes	no	Uint64	Project ID. Example: 1
ResourceId	yes	no	String	Resource ID of the order. Example: 1c007adc2f0bb9f7c052860e2d3703fa
SourceType	yes	no	Uint64	Order type. 0: default billing order; 1: trial order; 2: gift; 3: experience. Example: 0
Tags	yes	yes	Array of Tags	Platform tags. Example:View
TaskId	yes	no	Uint64	Task ID, which is used to query the binding progress. Default value: 0. Example: 1
UsedLicenseCnt	yes	no	Uint64	Number of used licenses. Example: 0

ProtectMachine

License expiration information of a server.

Referenced by the following interfaces: DescribeWebPageServiceInfo

name	required	NULL allowed	type	description
HostIp	yes	no	String	Server IP address. Example: 10.0.1.92
HostName	yes	no	String	The instance name Example: host1
SafeguardDirNum	yes	no	Uint64	Number of protected directories. Example: 0

AssetChangeInfo

Instance modification information.

Referenced by the following interfaces: DescribeChangingAssetInfo

name	required	NULL allowed	type	description
AppId	no	yes	Uint64	App ID information Example: 1255080011
AssetId	no	yes	String	Asset ID Example: ins-36843684
Status	no	yes	Int64	Modification status. 0: installing, 1: uninstalling, 2: enabling protection. Example: 0

VulEffectModuleInfo

Details of a component affected by vulnerabilities.

Referenced by the following interfaces: DescribeVulEffectModules

name	required	NULL allowed	type	description
FixCmd	yes	no	String	Fixing command. Example: sudo yum update openssl
Name	yes	no	String	Component Name Example: net-wsion
Path	yes	no	String	Component path. Example: /root/
Quuids	yes	no	Array of String	QUUID of the affected server. Example: ["e5b4724c-49af-46ab-bd84-cdbae897e7e0"]
Rule	yes	no	String	Version of the affected component. Example: npt version less than 2.0.0
Uuids	yes	no	Array of String	UUID of the affected server. Example: ["e5b4724c-49af-46ab-bd84-cdbae897e7e0"]
Version	yes	no	String	Component version. Example: 1.1.1

BaselineInfo

Baseline information.

Referenced by the following interfaces: DescribeBaselineList

name	required	NULL allowed	type	description
BaselineFailCount	yes	yes	Uint64	Number of baseline risk items. Example: 0
CategoryId	yes	yes	Uint64	Baseline ID. Example: 1
HostCount	yes	yes	Uint64	Number of affected servers. Example: 0
LastScanTime	yes	yes	String	Last detection time. Example: 2020-11-21 15:16:00
Level	yes	yes	Uint64	Risk severity. 1: low. 1: medium. 3: high. 4: critical. Example: 1
MaxStatus	yes	yes	Uint64	Status during scanning: 5 Example: 5
Name	yes	yes	String	Baseline name. Example: Redis baseline compliance check
RuleCount	yes	yes	Uint64	Number of check items. Example: 0
Status	yes	yes	Uint64	Whether the check is passed. 0: not passed. 1: passed. Example: 1

VulDefenceSetting

Vulnerability defense settings

Referenced by the following interfaces: DescribeVulDefenceSettingList

name	required	NULL allowed	type	description
AppId	no	yes	Uint64	User's App ID Example: 1255080011
DefenceType	no	yes	Uint64	Protection type. 0: vulnerability defense. 1: attack detection. Example: 0
Enable	no	yes	Uint64	0: disabled, 1: enabled. Example: 0
InstanceNum	no	yes	Uint64	Number of custom hosts. Example: 10
MemberId	no	yes	String	User's member ID. Example: qq
Nickname	no	yes	String	User's Nickname Example: Alice
Scope	no	yes	Uint64	1: all Premium edition hosts. 0: custom hosts. Example: 1
StrategyAction	no	yes	Uint64	Policy action. 0: alarm. 1: defense. Example: 0
StrategyId	no	yes	String	Policy ID. Example: any data
StrategyName	no	yes	String	Policy name. Example: defence_redis_cvm
StrategyType	no	yes	Uint64	0: system policy. 1: custom policy. Example: 0
SupportVulNum	no	yes	Uint64	Number of supported vulnerabilities. Example: 180
ThreatLevel	no	yes	Uint64	Threat level. Example: 1
Uin	no	yes	String	User UIN Example: 101223435

RiskProcessEvent

Abnormal Process Event

Referenced by the following interfaces: DescribeRiskProcessEvents

name	required	NULL allowed	type	description
CheckPlatform	no	no	Array of String	Trojan detection platform [1: Cloud search engine
CmdLine	no	no	String	Command to run. Example: /usr/sbin/sshd
DetectTime	no	no	String	Last detection time. Example: 2022-09-23 15:11:46
EventId	no	no	Int64	Event ID. Example: 1
FilePath	no	no	String	File path. Example: /var/www/fscan
HandleStatus	no	no	Int64	Processing Status [0 Pending; 1 Processed; 2 Scanning; 3 Scanned; 4 Exited; 5 Ignore] Example: 1
HostIp	no	no	String	IP address of the server. Example: 10.0.0.1
HostName	no	no	String	Server name. Example: redis_node_cvm
MachineExtraInfo	no	yes	MachineExtraInfo	Supplementary Information Example:View
OnlineStatus	no	no	Int64	Host Online Status Example: 1
ProcessId	no	no	Int64	Process ID. Example: 1
ReferenceLink	no	no	String	Reference link. Example: https://cloud.domain.com/document/product/296/9604
StartTime	no	no	String	Process start time Example: 2022-09-23 15:11:46
SuggestSolution	no	no	String	Suggestion scheme. Example: 1. Check for malicious processes and invalid ports, and delete suspicious startup items and scheduled tasks. 2. Isolate or delete relevant Trojan files.
ThreatDesc	no	no	String	Threat description. Example: It is detected that a proxy tool process exists on your host. If it is not started by you, your host may have been compromised.
Uuid	no	no	String	Host UUID. Example: e05a66ec-8d54-4041-80a8-07e9ab79ayay
VirusName	no	no	String	Virus name. Example: Linux.Risk.Miner
VirusTags	no	no	Array of String	Tag Example: ["Miner","HackTool"]
WanIp	no	no	String	Public IP address. Example: 10.0.0.1

MachineSnapshotInfo

Snapshot information of a server.

Referenced by the following interfaces: DescribeMachineSnapshot

name	required	NULL allowed	type	description
CreateTime	yes	no	String	Time when the snapshot was created. Example: 2021-03-11 18:15:17
DiskId	yes	no	String	Disk ID. Example: adhakdh
HostIp	yes	no	String	IP address of the server. Example: 145.12.3.12
HostName	yes	no	String	Server name. Example: redis_node_cvm
InstanceId	yes	no	String	Instance ID. Example: ins-xjd734
Quuid	yes	no	String	cvm id Example: 5a540076-d38a-4078-aa98-q45rt371d322
RegionId	yes	no	Uint64	Region ID. Example: 1
SnapshotId	yes	no	String	Snapshot ID. Example: ajdajd
SnapshotName	yes	no	String	Name of the snapshot. Example: backup-2021-03-01

BillingDefineParams

Custom Parameters of Billing and Ordering

Referenced by the following interfaces: CreateLicenseOrder

name	required	NULL allowed	type	description
AutoBindSwitch	no	no	Bool	Auto-Binding Switch Example: false
AutoRepurchaseRenewSwitch	no	no	Bool	Is auto-renewal required for auto-purchase orders? Example: false
AutoRepurchaseSwitch	no	no	Bool	Auto-purchase Switch Example: false
ProtectType	no	no	String	CWPP edition Example: "PRO_VERSION"

ScreenBaselineInfo

Baseline information in the dashboard.

Referenced by the following interfaces: DescribeScreenHostInvasion

name	required	NULL allowed	type	description
BaselineFailCount	yes	yes	Uint64	Number of baseline risk items. Example: 23
CategoryId	yes	yes	Uint64	Baseline ID. Example: 12
LastScanTime	yes	yes	String	Last detection time. Example: 2021-03-30 19:17:28
Level	yes	yes	Uint64	Risk severity. 1: low. 1: medium. 3: high. 4: critical. Example: 1
Name	yes	yes	String	Baseline name. Example: International
Uuid	yes	yes	String	Host UUID. Example: 1c26308c-5493-4eaf-a817-112ec25f499e

MalwareRiskOverview

File Scan Overview Information

Referenced by the following interfaces: DescribeMalwareRiskOverview

name	required	NULL allowed	type	description
FileCount	yes	no	Int64	Number of Malicious Files Example: 1
HostCount	yes	no	Int64	Number of affected servers. Example: 1
IsFirstScan	yes	no	Bool	Is it the first Scan [false: No
ProcessCount	yes	no	Int64	Exceptional Process Count Example: 1
ScanTime	yes	no	String	Last scan time. Example: 2022-09-23 15:11:46

ProcessStatistics

Process statistics.

Referenced by the following interfaces: DescribeProcessStatistics

name	required	NULL allowed	type	description
MachineNum	yes	no	Uint64	Number of servers. Example: 0
ProcessName	yes	no	String	Process name. Example: nginx

BaselineWeakPassword

Baseline weak password.

Referenced by the following interfaces: DescribeBaselineWeakPasswordList, ModifyBaselineWeakPassword

name	required	NULL allowed	type	description
CreateTime	no	no	String	Creation time. Example: 2006-01-02 15:04:05
ModifyTime	no	no	String	Modification time. Example: 2006-01-02 15:04:05
PasswordId	yes	no	Int64	Password ID. Example: 1002
WeakPassword	yes	no	String	Password. Example: passwd-01

EmergencyResponseInfo

Emergency response information in the expert service module.

Referenced by the following interfaces: DescribeEmergencyResponseList

name	required	NULL allowed	type	description
EndTime	yes	no	String	Time when the service ends. Example: 2021-02-01 17:12:28
HostNum	yes	no	Uint64	Number of hosts. Example: 12
ReportPath	yes	no	String	Download URL of the report. Example: http://any.domanc.com/anypath/1.pdf
StartTime	yes	no	String	Time when the service starts. Example: 2021-02-01 17:12:28
Status	yes	no	Uint64	Service status. 0: not started. 1: responding. 2: response completed. Example: 0
TaskId	yes	no	String	Task ID. Example: cve2021-4451451

AccountStatistics

Account statistics.

Referenced by the following interfaces: DescribeAccountStatistics

name	required	NULL allowed	type	description
MachineNum	yes	no	Uint64	Number of servers. Example: 100
Username	yes	no	String	Username. Example: root

PrivilegeEscalationProcess

Local privilege escalation data.

Referenced by the following interfaces: DescribePrivilegeEvents

name	required	NULL allowed	type	description
CmdLine	no	no	String	Command to run. Example: ./a
CreateTime	no	no	String	Event time. Example: 2024-10-30 02:19:08
FullPath	no	no	String	Process path. Example: /tmp/any
Hostip	no	no	String	Private IP address of the server. Example: 10.0.0.1
Id	no	no	Uint64	Data ID. Example: 1
MachineExtraInfo	no	yes	MachineExtraInfo	Supplementary Information Example:View
MachineName	no	no	String	The host name. Example: 2024-10-30 02:19:08
ParentProcGroup	no	no	String	User group of the parent process. Example: root
ParentProcName	no	no	String	Parent process name. Example: bash
ParentProcPath	no	no	String	Path of the parent process. Example: /bin/bash
ParentProcUser	no	no	String	Username of the parent process. Example: root
Pid	no	yes	Int64	Process ID. Example: 1
ProcFilePrivilege	no	no	String	Permissions on the process file. Example: rwx
ProcTree	no	no	String	Process tree. Example: a(root),bash(ubuntu),sshd(ubuntu),sshd(root),sshd(root),init(root)
ProcessName	no	no	String	Process name. Example: /etc/sshd
Quuid	no	no	String	Server ID. Example: e5b4724c-49af-46ab-bd84-cdbae897e7e0
Status	no	no	Uint64	Handling status. 0: to be handled. 2: added to the allowlist. 3: handled. 4: ignored. Example: 0
UserGroup	no	no	String	User Group Example: root
UserName	no	no	String	User name. Example: root
Uuid	no	no	String	CWP ID. Example: e5b4724c-49af-46ab-bd84-cdbae897e7e0

BaselineBasicInfo

Basic baseline information.

Referenced by the following interfaces: DescribeBaselineBasicInfo

name	required	NULL allowed	type	description
BaselineId	yes	yes	Uint64	Baseline ID. Example: 1
Name	yes	yes	String	Baseline name. Example: Weak password
ParentId	yes	yes	Uint64	Parent ID. Example: 0

HostDesc

Server information returned for displaying a login audit allowlist.

Referenced by the following interfaces: DescribeLoginWhiteHostList

name	required	NULL allowed	type	description
MachineIp	yes	no	String	IP address of the server. An empty string is returned for a terminated server. Example: 1.1.1.1
MachineName	yes	no	String	The host name. Example: redis_node_cvm
MachineWanIp	yes	no	String	Public IP address of the server. An empty string is returned for a terminated server. Example: 1.1.1.1
Quuid	yes	no	String	Machine UUID Example: 380add75-bb06-4cc4-84c5-cf806d102fba
Tags	yes	no	Array of MachineTag	Tags. Example:View
Uuid	yes	no	String	UUID of the CWP agent. Example: 380add75-bb06-4cc4-84c5-cf806d102fba

TagMachine

Tagged server information

Referenced by the following interfaces: DescribeTagMachines

name	required	NULL allowed	type	description
Id	yes	no	String	ID Example: 100
MachineIp	yes	no	String	Private IP address of the server. Example: 192.168.0.204
MachineName	yes	no	String	Server name. Example: tcs-dev3
MachineRegion	yes	no	String	Server region. Example: None
MachineType	yes	no	String	Server type. Example: CVM
MachineWanIp	yes	no	String	Public IP address of the server. Example: 192.168.0.204
Quuid	yes	no	String	Server ID. Example: 0096440e-9a9f-4e80-a82d-0b018637ayay

BashRule

Anti-high-risk command rule.

Referenced by the following interfaces: DescribeBashRules

name	required	NULL allowed	type	description
CreateTime	yes	no	String	Creation time. Example: 2021-03-30 19:17:28
DealOldEvents	yes	yes	Uint64	Whether to handle previous events. 0: does not handle previous events. 1: handles previous events. Example: 0
Decription	yes	no	String	Rule description. Example: 192.168.0.1
Description	no	yes	String	Rule description. Example: desc of rule
Hostip	yes	no	String	IP address of the server. Example: 172.27.16.14
Id	yes	no	Uint64	Rule ID. Example: 10003
IsGlobal	yes	no	Uint64	Indicates whether it is a global rule. Example: 0
Level	yes	no	Uint64	Risk severity 0: no risk. 1: high. 2: medium. 3: low. Example: 1
ModifyTime	yes	no	String	Modification time. Example: 2021-03-30 19:17:28
Name	yes	no	String	Rule Name Example: redis_node_use
Operator	yes	no	String	Operator. Example: admin
Rule	yes	no	String	Regular expression. Example: vim
Status	yes	no	Uint64	Status. 0: valid. 1: invalid. Example: 0
Uuid	yes	no	String	Client ID Example: 451f36cf-ac23-4635-bb96-23cd721b4b25
Uuids	yes	yes	Array of String	UUIDs of the servers on which the rule takes effect. Example: ["451f36cf-ac23-4635-bb96-23cd721b4b25"]
White	yes	yes	Uint64	0: blocklist. 1: allowlist. Example: 1

AssetKeyVal

General data structure in the key-value format.

Referenced by the following interfaces: DescribeAssetAppCount, DescribeAssetDatabaseCount, DescribeAssetHostTotalCount, DescribeAssetMachineTagTop, DescribeAssetPortCount, DescribeAssetProcessCount, DescribeAssetRecentMachineInfo, DescribeAssetTotalCount, DescribeAssetTypeTop, DescribeAssetUserCount, DescribeAssetWebAppCount, DescribeAssetWebFrameCount, DescribeAssetWebLocationCount, DescribeAssetWebServiceCount

name	required	NULL allowed	type	description
Desc	yes	yes	String	Description. Example: none
Key	yes	no	String	Tag. Example: app
NewCount	yes	yes	Int64	New count on the current day. Example: 10
Value	yes	no	Int64	Total number. Example: 21

AssetProcessBaseInfo

Basic resource information in the asset management module.

Referenced by the following interfaces: DescribeAssetProcessInfoList

name	required	NULL allowed	type	description
Desc	no	no	String	Description of the process. Example: user any
FirstTime	no	no	String	First collection time. Example: 2022-07-15 11:27:01
GroupName	no	no	String	Process user group. Example: root
HasSign	no	no	Uint64	Whether there is a digital signature: 0: no; 1: yes; 999: null (Windows only). Example: 1
InstallByPackage	no	no	Uint64	Whether it is installed by using an installation package. 0: no. 1: yes. 999: empty string. This parameter is applicable only to Linux systems. Example: 1
IsNew	no	no	Int64	Whether it is newly added. 0: no. 1: yes. Example: 1
MachineExtraInfo	no	yes	MachineExtraInfo	Host information Example:View
MachineIp	no	no	String	Private IP address of the server. Example: 10.0.0.11
MachineName	no	no	String	Server name. Example: 1
MachineWanIp	no	no	String	Public IP address of the server. Example: 112.42.66.11
Md5	no	no	String	MD5 value of the process. Example: e10adc3949ba59abbe56e057f20f883e
Name	no	no	String	Process name. Example: rsyslogd
OsInfo	no	no	String	OS information. Example: Centos 64bit
PackageName	no	no	String	Software package name. Example: rsyslog
Param	no	no	String	Boot parameters. Example: /usr/sbin/rsyslogd -n
ParentProcessName	no	no	String	Name of the parent process. Example: systemd
Path	no	no	String	Process path. Example: /usr/sbin/rsyslogd
Pid	no	no	String	Process ID. Example: 10021
Ppid	no	no	String	ID of the parent process. Example: 1
ProjectId	no	no	Uint64	ID of the project to which the server belongs. Example: 1
Quuid	no	no	String	Host QUUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116
StartTime	no	no	String	Start time. Example: 2024-10-23 14:17:00
Status	no	no	String	Process status. R: executable; S: interruptible; D: uninterruptible; T: paused or traced; Z: zombie; X: to be terminated. Example: R
Tag	no	yes	Array of MachineTag	Server tags. Example:View
Tty	no	no	String	Process TTY. Example: ?
UpdateTime	no	yes	String	Data update time. Example: 2011-11-11 12:12:12
User	no	no	String	Run user. Example: root
Uuid	no	no	String	Host UUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116
Version	no	no	String	Process version. Example: 1

VulEffectHostList

API for querying servers affected by vulnerabilities

Referenced by the following interfaces: DescribeVulEffectHostList

name	required	NULL allowed	type	description
AliasName	no	yes	String	Host alias. Example: redis_node_cvm
CloudTags	no	yes	Array of Tags	Cloud tag information. Example:View
Description	no	yes	String	Help. Example: If Redis is started with the root permission and access is not authorized, the arbitrary file write issue occurs, resulting in a command execution vulnerability.
DescriptionEn	no	yes	String	Help. Example: English description.
EventId	no	yes	Uint64	Event ID. Example: 1
FirstDiscoveryTime	no	yes	String	First time when it was found. Example: 2021-03-24 16:37:57
FixStatusMsg	no	yes	String	Cause of failure. Example: Fixing timeout
HostIp	no	yes	String	IP address of the server. Example: 10.12.78.56
HostVersion	no	yes	Uint64	Edition. 0: Basic Edition. 1: Professional Edition. 2: Ultimate Edition. 3: General Edition. Example: 1
InstanceState	no	yes	String	Instance status. "PENDING": the instance is being created. "LAUNCH_FAILED": the instance has failed to be created. "RUNNING": the instance is running. "STOPPED": the instance has stopped. "STARTING": the instance is being started. "STOPPING": the instance is being stopped. "REBOOTING": the instance is rebooting. "SHUTDOWN": the instance is shut down and waiting to be terminated. "TERMINATING": the instance is being terminated. Example: RUNNING
IsSupportAutoFix	no	yes	Uint64	Whether it can be automatically fixed. 0: the vulnerability cannot be automatically fixed. 1: the vulnerability can be automatically fixed. 2: the agent is offline. 3: the server is not associated with a CWP Ultimate license, and the vulnerability can only be manually fixed. 4: automatic vulnerability fixing is not supported for this device model. 5: the vulnerability is being fixed. 6: the vulnerability has been fixed. 7: the vulnerability is being checked. 10: the vulnerability has failed to be fixed. 10: the vulnerability has been ignored. 11: only Linux system vulnerabilities are supported. Windows system vulnerabilities are not supported. 12: only Windows system vulnerabilities are supported. Linux system vulnerabilities are not supported. 13: the fix failed and the server went offline. 14: the fix failed and the server is not associated with a CWP Ultimate license. 15: the vulnerability has been manually fixed. Example: 2
LastTime	no	yes	String	Last detection time. Example: 2021-03-24 16:37:57
Level	no	yes	Uint64	Risk severity. 1: low. 1: medium. 3: high. 4: critical. Example: 1
MachineExtraInfo	no	yes	MachineExtraInfo	Host Additional Information Example:View
PublicIpAddresses	no	yes	String	Public IP. Example: 120.12.78.73
Quuid	no	yes	String	Host QUUID. Example: 5a540076-d38a-4078-aa98-q45rt371d322
Status	no	yes	Uint64	Status. 0: to be handled. 1: ignored. 3: fixed. 5: checking. 6: fixing. 7: rolling back. 8: fix failed. Example: 0
Tags	no	yes	Array of String	Server tags. Example: ["tag-01"]
Uuid	no	yes	String	Host UUID. Example: 5a540076-d38a-4078-aa98-q45rt371d322

ScreenDefendAttackLog

Cyberattack log information in the dashboard.

Referenced by the following interfaces: DescribeScreenHostInvasion

name	required	NULL allowed	type	description
CreatedTime	yes	no	String	Attack time. Example: 2021-03-30 19:17:28
DstIp	yes	no	String	Target IP address. Example: 120.22.1.22
DstPort	yes	no	Uint64	Target port. Example: 2343
HttpMethod	yes	no	String	Attack method. Example: POST
Id	yes	no	Uint64	Log ID. Example: 1
Quuid	yes	no	String	QUUID of the server. Example: e5b4724c-49af-46ab-bd84-cdbae897e7e0
SrcIp	yes	no	String	Source IP address. Example: 120.22.1.22
SrcPort	yes	no	Uint64	Source port. Example: 546
Uuid	yes	no	String	Client ID Example: e5b4724c-49af-46ab-bd84-cdbae897e7e0
VulType	yes	no	String	Threat type. Example: CMD-EXEC

AssetScanTaskHostDetail

Task status on each server in an asset scan task.

Referenced by the following interfaces: DescribeAssetScanTaskDetail

name	required	NULL allowed	type	description
ErrorMessage	yes	no	String	Exception message. Example: some message
MachineIp	yes	no	String	IP address of the server. Example: 192.168.0.1
MachineName	yes	no	String	Server name. Example: redis_node_cvm
Quuid	yes	no	String	Host QUUID. Example: 5a540076-d38a-4078-aa98-qwert371d322
Status	yes	no	Uint64	Task status. 0: in progress. 1: successful. 2: failed. Example: 1

VulHostTopInfo

Top 5 servers at risk.

Referenced by the following interfaces: DescribeVulHostTop

name	required	NULL allowed	type	description
HostName	yes	yes	String	Server name. Example: redis_node_cvm
Quuid	yes	yes	String	Host QUUID. Example: 8efa1586-c390-4131-ad90-19c1ff64ayay
Score	yes	yes	Uint64	Top score. Example: 511
VulLevelList	yes	yes	Array of VulLevelCountInfo	Vulnerability severity and the corresponding quantity statistics. Example:View

ZoneInfo

Information on availability zones.

Referenced by the following interfaces: DescribeBanRegions

name	required	NULL allowed	type	description
ZoneName	yes	no	String	AZ name. Example: zone1

MaLabel

Referenced by the following interfaces: DescribeMaConnEventList, DescribeMaCustomPolicyList, DescribeMaHostList, DescribeMaLabel, DescribeMaLabelList, DescribeMaPodList, DescribeMaSelfLearnPolicyList, DescribeMaWorkloadLabel, DescribeMaWorkloadList, ModifyMaCustomPolicy, ModifyMaLabel

name	required	NULL allowed	type	description
Id	no	yes	Int64	Tag ID. Example: 1
Key	yes	yes	String	Tag key. Example: evn
Source	no	yes	String	Tag source. learn: self-learning. custom: custom. cwp: CWP. tcloud: cloud. Example: learn
Value	yes	yes	String	Tag value Example: ma
WorkloadCount	no	yes	Int64	Associated workload count. Example: 10

ProductStatusInfo

Data returned from the product beta status query API.

Referenced by the following interfaces: DescribeProductStatus

name	required	NULL allowed	type	description
CanApplyTrial	yes	no	Bool	Whether beta applications can be submitted. true: yes. Example: true
CanNotApplyReason	yes	no	String	Reason why beta applications cannot be summited. An empty string is returned if beta applications can be submitted. Example: Not an enterprise user and not meeting the trial conditions.
FWUserStatus	yes	no	Uint64	Protection status. 1: unprotected. 2: under protection. 3: in beta. 4: expired. Example: 1
LastTrialTime	yes	no	String	End of the last beta use. Example: 2022-06-23 10:25:45

VulTopInfo

Top vulnerabilities.

Referenced by the following interfaces: DescribeVulTop

name	required	NULL allowed	type	description
VulCategory	no	yes	Uint64	1: Web-CMS vulnerability. 2: application vulnerability. 4: Linux software vulnerability. 5: Windows system vulnerability. 0: emergency vulnerability. Example: 2
VulCount	yes	yes	Uint64	Number of vulnerabilities. Example: 82
VulId	yes	yes	Uint64	Vulnerability ID. Example: 104994
VulLevel	yes	yes	Uint64	Risk severity. 1: low. 1: medium. 3: high. 4: critical. Example: 3
VulName	yes	yes	String	Vulnerability name. Example: Apache HTTP/2 DoS vulnerability (CVE-2023-44487)

PrivilegeRule

Anti-local privilege escalation rule.

Referenced by the following interfaces: DescribePrivilegeRules

name	required	NULL allowed	type	description
CreateTime	yes	no	String	Creation time. Example: 2024-11-04 09:57:28
Hostip	yes	no	String	IP address of the server. Example: 192.168.0.204
Id	yes	no	Uint64	Rule ID. Example: 10001
IsGlobal	yes	no	Uint64	Indicates whether it is a global rule. Example: 1
ModifyTime	yes	no	String	Modification time. Example: 2024-11-04 09:57:28
Operator	yes	no	String	Operator. Example: master
ProcessName	yes	no	String	Process name. Example: nginx
SMode	yes	no	Uint64	Whether the process is an S-privilege process. 1: yes; 0: no. Example: 1
Status	yes	no	Uint64	Status. 0: valid. 1: invalid. Example: 0
Uuid	yes	no	String	Client ID Example: df131b24-8528-4809-9d07-a9e4d58ad566

Broadcasts

API for querying security notices

Referenced by the following interfaces: DescribeSecurityBroadcasts

name	required	NULL allowed	type	description
CreateTime	yes	no	String	Release time. Example: 2021-03-30 19:17:28
Id	yes	no	Uint64	Unique ID of the notice. Example: 12
Level	yes	no	Uint64	Risk severity. 0: no risk. 1: critical. 2: high. 3: medium. 4: low. Example: 1
Subtitle	yes	no	String	Subtitle of the notice. Example: The new version supports vulnerability fixing.
Title	yes	yes	String	Title of the notice. Example: Vulnerability outbreak
Type	yes	yes	Uint64	Type. 0: emergent notification. 1: feature update. 2: industrial honor. 3: version release. Example: 1

ReverseShellRuleAggregation

Reverse shell rule for the aggregated version.

Referenced by the following interfaces: DescribeReverseShellRulesAggregation

name	required	NULL allowed	type	description
CreateTime	no	yes	String	Creation time. Example: 2020-10-01 00:00:00
DestIp	no	yes	String	Target IP address. Example: 1.2.3.4
DestPort	no	yes	String	Target port. Example: 80
GroupID	no	yes	String	Batch ID. Example: 1
HandleHistory	no	yes	Uint64	Whether to process historical events. 0: no, 1: yes. Example: 0
Id	no	yes	Uint64	Rule ID. Example: 1
IsGlobal	no	yes	Uint64	Indicates whether it is a global rule. Example: 1
MachinesNums	no	yes	String	Number of servers covered by a rule. When IsGlobal is set to 1, all servers are displayed. Example: 12
ModifyTime	no	yes	String	Modification time. Example: 2020-10-01 00:00:00
Operator	no	yes	String	Operator. Example: opt1
ProcessName	no	yes	String	Process name. Example: /etc/sshd
RuleRegexp	no	yes	String	Base64-encoded rule (regular expression). Example: c2ggcmVkaXMuc2g=
Status	no	yes	Uint64	Status. 0: valid. 1: invalid. Example: 0
UuidHostips	no	yes	Array of UuidHostip	Client ID Example:View
WhiteType	no	yes	Uint64	Allowlisting method. 0: regular allowlisting, 1: regular expression allowlisting. Example: 1

VulDefenceEvent

Vulnerability details.

Referenced by the following interfaces: DescribeVulDefenceEvent

name	required	NULL allowed	type	description
Alias	no	no	String	Server name. Example: redis_node_cvm
City	no	no	String	City where the attack source IP address resides. Example: city1
Count	no	no	Int64	Number of occurrences of the event. Example: 1
CreateTime	no	no	String	Time when the event was created. Example: 2021-01-20 16:17:11
CveId	no	no	String	CVE ID. Example: CVE-2014-8500
EventType	no	no	Uint64	0: attempted attack (available for WeDetect). 1: successful attack attempt (available for WeDetect). 2: RASP defense event. Example: 1
FixType	no	no	Int64	0: fixing is not supported. 1: fixing is supported. Example: 1
Id	no	no	Int64	ID of the vulnerability event. Example: 13844
MachineExtraInfo	no	yes	MachineExtraInfo	Host Additional Information Example:View
MergeTime	no	no	String	Time when the event was updated. Example: 2021-01-20 16:17:11
PrivateIp	no	no	String	Private IP address. Example: 10.2.3.1
PublicIp	no	no	String	Public IP address. Example: 111.2.3.1
Quuid	no	no	String	QUUID of the server. Example: d92d723e-4aac-4f4a-bbf9-e5430e29d289
SourceIp	no	no	String	Attack source IP address. Example: 11.2.3.1
SourcePort	no	no	Array of Uint64	Attack source port. Example: [50001,50002]
Status	no	no	Int64	Status. 0: to be handled. 1: prevented. 2: handled. 3: ignored. 4: deleted. Example: 1
UpgradeType	no	no	Int64	0: Professional Edition. 1: Ultimate Edition. 2: Lighthouse General Edition (available only for Lighthouse instances) 3: CVM General Edition (available only for CVM instances). Example: 1
Uuid	no	no	String	Host UUID. Example: d92d723e-4aac-4f4a-bbf9-e5430e29d289
VulId	no	no	Uint64	Vulnerability ID. Example: 14004
VulName	no	no	String	Vulnerability name. Example: Vulnerability

NetAttackWhiteRule

Referenced by the following interfaces: DescribeNetAttackWhiteList

name	required	NULL allowed	type	description
CreateTime	no	yes	String	Creation time. Example: 2024-10-30 02:18:51
DealOldEvents	no	yes	Uint64	Whether to handle previous events. 0: does not handle previous events. 1: handles previous events. Example: 1
Description	no	yes	String	Rule description. Example: add for redis cvm
Id	no	yes	Uint64	Rule ID. Example: 1
ModifyTime	no	yes	String	Modification time. Example: 2024-10-30 02:18:51
Quuids	no	yes	String	Host QUUIDs, separated by semicolons (;). Example: ea71992a-b484-4d9c-882a-419fb6d0a5b0
Scope	no	yes	Uint64	0: A group of Quuid 1: All hosts Example: 1
SrcIP	no	yes	String	Source IP. Single IP: 1.1.1.1, IP Range: 1.1.1.1-1.1.2.1, IP Range: 1.1.1.0/24, separated by semicolons (;) Example: 127.0.0.1

ScreenEventsCnt

Intrusion detection statistics.

Referenced by the following interfaces: DescribeScreenEventsCnt

name	required	NULL allowed	type	description
Category	yes	no	Array of ScreenNameValue	Name: displays the content type, including the attack event, potential risk, compromised asset, and potential asset at risk. Value: counts the number of events. Example:View
Title	yes	no	String	Content displayed, including the total number of pending risks and the total number of affected assets. Example: Total number of risks pending processing
Total	yes	no	Uint64	Number of events. Example: 12

BaselineHost

Baseline server information.

Referenced by the following interfaces: DescribeBaselineHostIgnoreList, DescribeIgnoreHostAndItemConfig

name	required	NULL allowed	type	description
HostId	no	no	String	Server ID. Example: 11cb73df-ea71-4678-8114-5af94e63ayay
HostIp	no	yes	String	Private IP address. Example: 192.168.0.204
HostName	no	yes	String	Server name. Example: redis_node_cvm
HostTag	no	yes	String	Server tags. Example: ["tag-01"]
MachineExtraInfo	no	yes	MachineExtraInfo	Host Additional Information Example:View
WanIp	no	yes	String	Public IP address. Example: 192.168.0.204

LicenseBindDetail

License binding details.

Referenced by the following interfaces: DescribeLicenseBindList

name	required	NULL allowed	type	description
AgentStatus	no	no	String	CWP client status: OFFLINE, ONLINE, and UNINSTALL. Example: OFFLINE
IsSwitchBind	no	no	Bool	Whether the license can be unbound from a server and bound to another server. false: the bound server cannot be changed. Example: false
IsUnBind	no	no	Bool	Whether the license can be unbound. false: unbinding is not allowed. Example: false
MachineExtraInfo	no	yes	MachineExtraInfo	Host Additional Information Example:View
MachineIp	no	no	String	Private IP address of the server. Example: 1.1.1.1
MachineName	no	no	String	Alias of the server. Example: redis_node_cvm
MachineWanIp	no	no	String	Public IP address of the server. Example: 1.1.1.1
Quuid	no	no	String	UUID of the cloud server. Example: 935e27b1-d675-4509-80bf-96fbf0764237
Tags	no	no	Array of String	Tag information Example: ["redis_cvm_01"]
Uuid	no	no	String	CWP client UUID. Example: 935e27b1-d675-4509-80bf-96fbf0764237

MachineClearHistory

Machine Cleanup Record Object

Referenced by the following interfaces: DescribeMachineClearHistory

name	required	NULL allowed	type	description
AgentLastOfflineTime	yes	no	String	Client Last Offline Time Example: 2020-03-28 17:33:04
CreateTime	yes	no	String	Creation time. Example: 2019-03-28 17:33:04
Id	yes	no	Uint64	ID Value Example: 1
InstanceId	yes	no	String	Instance ID. Example: ins-vdfy7df
InstanceName	yes	no	String	Instance name. Example: redis_node_cvm
PrivateIp	yes	no	String	Private IP. Example: 10.0.0.1
PublicIp	yes	no	String	Public IP Example: 8.8.8.8

ScreenRegionMachines

3D server charts in the dashboard.

Referenced by the following interfaces: DescribeScreenMachines

name	required	NULL allowed	type	description
AttackCnt	yes	no	Uint64	Number of servers with potential risks. Example: 12
IgnoreCnt	yes	no	Uint64	Number of servers that are ignored in the display. A value of 0 indicates that all servers are displayed. Example: 1
Machines	yes	no	Array of ScreenMachine	Server list Example:View
Region	yes	no	String	Region. Example: ap-bangkok
RegionName	yes	no	String	Region description. Example: region1
RiskCnt	yes	no	Uint64	Number of servers at risk. Example: 1
SafetyCnt	yes	no	Uint64	Number of servers with no risks. Example: 12
TotalCount	yes	no	Uint64	Number of servers in the region. Example: 34
UnAgentOfflineCnt	yes	no	Uint64	Number of offline servers or servers with no agent installed. Example: 12

VulInfoList

Vulnerability list in the CWP vulnerability management module.

Referenced by the following interfaces: DescribeVulList

name	required	NULL allowed	type	description
AttackLevel	no	yes	Uint64	Attack level. If the value is 3 or higher, the attack is a notable attack. Example: 1
CveId	yes	yes	String	CVE ID. Example: CVE-2021-3156
CvssScore	yes	yes	Float	CVSS score. Example: 9
DefenseAttackCount	yes	yes	Uint64	Number of prevented attack attempts. Example: 12
Descript	yes	yes	String	Description. Example: Vulnerability description
DescriptWisteria	yes	yes	String	Deprecated parameter. Example: Obsolete
FirstAppearTime	yes	yes	String	First occurrence time. Example: 2021-03-30 19:17:28
FixNoNeedRestart	no	yes	Bool	Whether a restart is required after vulnerability repair. Example: true
FixSwitch	yes	yes	Uint64	Whether automatic fixing is supported and servers that support automatic fixing are included. 0: no. 1: yes. Example: 1
From	yes	yes	Uint64	Deprecated parameter. Example: 0
HostCount	yes	no	Uint64	Number of affected servers. Example: 2
Ids	yes	no	String	One or more event IDs. Multiple event IDs are separated with commas (,). Example: 1
IsSupportDefense	yes	yes	Uint64	Whether to support attack defense. 0: not supported. 1: supported. Example: 1
Labels	yes	yes	String	Vulnerability tags. Multiple tags are separated by a comma. EXP exists: EXP. Zero-day attack: KNOWN_EXPLOITED. Local exploitation: LOCAL. Mandatory vulnerabilities to be fixed: NEED_FIX. Remote exploitation: NETWORK. POC exists: POC. System restart: RESTART. Example: LOCAL,NETWORK
LastTime	yes	no	String	Last detection time. Example: 2021-03-16 16:21:51
Level	yes	no	Uint64	Vulnerability severity. 1: low. 2: medium. 3: high. 4: critical. Example: 1
Method	no	yes	Uint64	Detection method. 0: version comparison, 1: POC verification. Example: 1
Name	yes	no	String	Vulnerability name. Example: Apache HTTP/2 DoS vulnerability (CVE-2023-44487)
NameWisteria	yes	yes	String	Deprecated parameter. Example: Obsolete
PublishTime	yes	no	String	Time when the vulnerability was published. Example: 2021-03-16 16:21:51
PublishTimeWisteria	yes	yes	String	Deprecated parameter. Example: Obsolete
Status	yes	no	Uint64	0: to be handled. 1: ignored. 3: fixed. 5: checking. 6: fixing. 8: fix failed. Example: 1
StatusStr	yes	yes	String	Event status after aggregation. Example: 1,2
TaskId	yes	yes	Uint64	ID of the last scan task. Example: 12
VulCategory	yes	yes	Uint64	Vulnerability category. 1: Web-CMS vulnerability. 2: application vulnerability. 4: Linux software vulnerability. 5: Windows system vulnerability. Example: 1
VulFixSwitch	no	yes	Uint64	Whether vulnerability fixing is supported. 0: not supported; 1: supported. Example: 1
VulId	yes	no	Uint64	Vulnerability ID. Example: 1

ProtectEventLists

List of protection events.

Referenced by the following interfaces: DescribeWebPageEventList

name	required	NULL allowed	type	description
CreateTime	no	no	String	Detection time. Example: 2020-10-01 01:01:10
EventDir	no	no	String	Event directory. Example: event
EventStatus	no	no	Uint64	Event status. 1: recovered. 0: not recovered. Example: 0
EventType	no	no	Uint64	Event type. 0: the content was modified and recovered. 1: the permissions were modified and recovered. 2: the ownership was modified and recovered. 3: deleted and recovered. 4: the newly added content was deleted. Example: 0
FileType	no	no	Uint64	File type. 0: regular file. 1: directory. 2: soft link. Example: 0
HostIp	no	no	String	Server IP address. Example: 172.16.100.1
HostName	no	no	String	Server name. Example: host1
Id	no	no	Uint64	Unique ID. Example: 1
MachineExtraInfo	no	yes	MachineExtraInfo	Host Additional Information Example:View
Quuid	no	yes	String	Machine instance UUID. Example: 8c09e1b1-5611-45b3-9c02-737996011b81
RestoreTime	no	no	String	Time when the alarm was cleared. Example: 2020-10-01 01:01:10

ProtectStat

Protection information.

Referenced by the following interfaces: DescribeWebPageProtectStat

name	required	NULL allowed	type	description
Name	yes	no	String	Name. Example: /tmp
Num	yes	no	Uint64	Total number. Example: 56

LogHistogram

Histogram statistics collected within a period.

Referenced by the following interfaces: DescribeLogHistogram

name	required	NULL allowed	type	description
Count	yes	no	Int64	Number of log entries within a statistical period. Example: 0
TimeStamp	yes	no	Int64	UNIX timestamp rounded by period. Unit: milliseconds. Example: 0

MaliciousRequestWhiteListInfo

Information about the allowlist of the Anti-Malicious Requests feature.

Referenced by the following interfaces: DescribeMaliciousRequestWhiteList

name	required	NULL allowed	type	description
CreateTime	yes	no	String	Creation time. Example: 2021-02-08 14:46:25
Domain	yes	no	String	Domain name. Example: www.domain.com
Id	yes	no	Uint64	Allowlist ID. Example: 1
Mark	yes	no	String	Description. Example: add redis cvm
ModifyTime	yes	no	String	Update time. Example: 2021-02-08 14:46:25

ReverseShellEventInfo

Reverse shell event details.

Referenced by the following interfaces: DescribeReverseShellEventInfo

name	required	NULL allowed	type	description
CmdLine	yes	no	String	Command details. Example: ./reverse_out
CmdLineQuote	no	no	String	Escaped content of command details. It is used when regular expressions match allowlisted full strings. Example: ./reverse_out
CreateTime	yes	no	String	Time when the command was generated. Example: 2021-05-20 17:00:33
DetectBy	yes	no	Uint64	Detection method. Example: 1
DstIp	yes	no	String	Target IP address. Example: 127.0.0.1
DstPort	yes	no	Uint64	Target port. Example: 12
FullPath	yes	no	String	Process path. Example: /home
HarmDescribe	yes	no	String	Description. Example: After hacking a server, hackers may perform operations such as downloading malicious files, connecting to a mining pool, adding public keys, and viewing sensitive files for further malicious actions.
HostIp	yes	no	String	Private IP address of the server. Example: 127.0.0.1
Id	yes	no	Uint64	Primary key ID. Example: 11
MachineName	yes	no	String	Server name. Example: redis_node_cvm
MachineStatus	yes	no	String	Connection status of the server. Valid values: OFFLINE and ONLINE. Example: OFFLINE
MachineWanIp	yes	no	String	Public IP address of the server. Example: 124.2.4.55
ModifyTime	yes	no	String	Handling time. Example: 2021-03-30 19:17:28
ParentProcGroup	yes	no	String	User group of the parent process. Example: root
ParentProcName	yes	no	String	Parent process name. Example: 2.exe
ParentProcPath	yes	no	String	Path of the parent process. Example: /home
ParentProcUser	yes	no	String	User of the parent process. Example: root
ProcessName	yes	no	String	Process name. Example: reverse_out
PsTree	yes	yes	String	Process tree in the JSON format. pid: process ID. exe: file path. account: user group and user to which the process belongs. cmdline: command to be run. ssh_service: SSH service. ssh_souurce: login source. Example: [{"pid":"1"}]
Quuid	yes	no	String	Host UUID. Example: e8fc6e04-5b3d-405d-ab61-da7cc8be2583
References	yes	no	Array of String	Reference link. Example: ["http://www.domain.com"]
Status	yes	no	Uint64	Handling status. 0: to be handled. 2: added to the allowlist. 3: handled. 4: ignored. Example: 2
SuggestScheme	yes	no	String	Suggestion scheme. Example: 1. Check for malicious processes and invalid ports, and delete suspicious startup items and scheduled tasks. 2. Isolate or delete relevant Trojan files.
Tags	yes	no	Array of String	Tag. Example: ["Tag 1","tag 2"]
UserGroup	yes	no	String	User group that performs execution. Example: root
UserName	yes	no	String	User who performs execution. Example: root
Uuid	yes	no	String	UUID of the CWP agent. Example: e8fc6e04-5b3d-405d-ab61-da7cc8be2583

RiskDnsEvent

Malicious request event.

Referenced by the following interfaces: DescribeRiskDnsEventInfo, DescribeRiskDnsEventList

name	required	NULL allowed	type	description
AccessCount	no	no	Int64	Number of access requests. Example: 10
AgentId	no	no	String	Client ID Example: a1f53e38-3f03-4a72-bf16-afa78dd698f3
CmdLine	no	no	String	Command line. Example: cmd
Domain	no	no	String	Access domain name. Example: re.r3r3.org
FirstTime	no	no	String	First access time. Example: 2021-04-26 15:19:04
HandleStatus	no	no	Int64	Handling status. 0: to be handled. 2: added to the allowlist. 3: untrusted. 4: handled. 5: ignored. Example: 1
HostId	no	no	String	Server ID. Example: d1f53e38-3f03-4a72-bf16-afa78ed698f2
HostIp	no	no	String	IP address of the server. Example: 10.0.0.1
HostName	no	no	String	Server name. Example: security-data-seayay
HostStatus	no	no	String	Connection status of the server. Valid values: OFFLINE, ONLINE, and UNKNOWN. Example: ONLINE
Id	no	no	Int64	Event ID. Example: 153
LastTime	no	no	String	Last access time. Example: 2022-07-15 11:27:01
MachineExtraInfo	no	yes	MachineExtraInfo	Supplementary Information Example:View
OsType	no	yes	Int64	[1:CentOS
Pid	no	no	Int64	Process ID. Example: 1
PolicyId	no	no	Int64	Policy ID. Example: 10000
PolicyName	no	no	String	Name of the hit policy. Example: System rule (standard)
PolicyType	no	no	Int64	Hit policy type. -1: unknown. 0: system policy. 1: custom policy. Example: 1
ProcessMd5	no	no	String	MD5 value of the process. Example: 3c59dc048e8850243be8079a5c74d079
ProcessName	no	no	String	Process name. Example: bash
ProtectLevel	no	no	Int64	Protection level. 0: Basic Edition. 1: Professional Edition. 2: Ultimate Edition. Example: 1
ReferenceLink	no	no	String	Reference link. Example: http://www.vxjump.net/files/virus_analysis/virut%20botnet%20anal
SuggestSolution	no	no	String	Fix solution. Example: 1. Check for malicious processes and invalid ports, and delete suspicious startup items and scheduled tasks. 2. Isolate or delete relevant Trojan files.
Tags	no	no	Array of String	Tags. Example: ["vueir","mle"]
ThreatDesc	no	no	String	Threat description. Example: It is detected that your host has accessed malicious IP addresses/domain names. Your host may have been compromised.\nMalicious IP addresses/domain names could be remote control servers, malware download sources, or mining pool addresses.
WanIp	no	no	String	Public IP address. Example: 13.22.3.1

NetAttackTopInfo

Referenced by the following interfaces: DescribeAttackTop

name	required	NULL allowed	type	description
Agent	no	yes	Array of TopInfo	Top Statistical Data on Network Attack Host Dimension Example:View
DstPort	no	yes	Array of TopInfo	Top Statistical Data on Network Attack Target Port Dimension Example:View
SrcIp	no	yes	Array of TopInfo	Top Statistical Data on Network Attack IP Source Dimension Example:View
Vul	no	yes	Array of TopInfo	Top Statistical Data on Network Attack Vulnerability Dimension Example:View

RansomDefenseStrategyMachineDetail

Anti-Ransomware Host List

Referenced by the following interfaces: DescribeRansomDefenseStrategyMachines

name	required	NULL allowed	type	description
CloudTags	yes	yes	Array of Tag	Cloud tag Example:View
DiskInfo	yes	yes	String	Hard Disk Information, effective for all disks when empty: diskId1
HostVersion	yes	yes	Uint64	Edition. 0: Basic Edition. 1: Professional Edition. 2: Ultimate Edition. 3: General Edition. Example: 0
InstanceId	yes	no	String	Host Instance ID Example: cvm-asasa
MachineIp	yes	no	String	Private IP address. Example: 10.0.0.22
MachineName	yes	no	String	Server name. Example: redis_node_cvm
MachineWanIp	yes	yes	String	Public IP. Example: 112.11.33.22
Quuid	yes	no	String	Host QUUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116
RegionInfo	yes	yes	RegionInfo	Information on availability zones. Example:View
Status	yes	yes	Uint64	Protection status: 0 Disabled, 1 Enabled. Example: 0
StrategyId	yes	yes	Uint64	Policy ID. 0 indicates no binding to any policy. Example: 0
StrategyName	yes	yes	String	Policy name. Example: tt1
Tag	yes	yes	Array of MachineTag	Host Security Tag Example:View
Uuid	yes	no	String	Host UUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116

OpenPortStatistics

Port statistics list

Referenced by the following interfaces: DescribeOpenPortStatistics

name	required	NULL allowed	type	description
MachineNum	yes	no	Uint64	Number of hosts. Example: 100
Port	yes	no	Uint64	Port number. Example: 8080

BaselineItemInfo

Baseline information.

Referenced by the following interfaces: DescribeBaselineItemIgnoreList, DescribeBaselineItemInfo, DescribeIgnoreHostAndItemConfig

name	required	NULL allowed	type	description
FixMethod	yes	no	String	Fix solution of the check item. Example: Weak password rectification
ItemDesc	yes	no	String	Description of the check item. Example: Weak password
ItemId	yes	no	Int64	ID of the baseline check item. Example: 1
ItemName	yes	no	String	Name of the check item. Example: Set password expiration time.
Level	yes	no	Int64	Baseline risk level. 0: low; 1: medium; 2: high; 3: critical. Example: 1
RelatedCustomRuleInfo	yes	yes	Array of BaselineCustomRuleIdName	Information about the referenced custom rule. Example:View
RuleId	yes	yes	Uint64	ID of the rule to which the check item belongs. Example: 43617
RuleName	yes	no	String	Name of the rule to which the check item belongs. Example: Weak password
SysRuleId	yes	yes	Int64	ID of the system rule. Example: 1

UpdateHostLoginWhiteObj

Object used to modify an allowlist.

Referenced by the following interfaces: ModifyLoginWhiteInfo

name	required	NULL allowed	type	description
EndTime	no	no	String	End time. Example: 2024-01-01 23:59:59
Id	yes	no	Uint64	ID of the data record that you want to update. Example: 128
Places	yes	no	Array of Place	Region information. Example:View
Remark	yes	no	String	Remarks. Example: updateRemark1
SrcIp	yes	no	String	Source IP. Example: 1.2.3.4
StartTime	no	no	String	Start time. Example: 2024-01-01 00:00:00
UserName	yes	no	String	User name. Example: username

VulDetailInfo

Vulnerability details.

Referenced by the following interfaces: DescribeScanTaskDetails

name	required	NULL allowed	type	description
CveId	yes	no	String	CVE ID. Example: cve_ay
Cvss	yes	no	String	CVSS details. Example: dadad
CvssScore	yes	no	Float	CVSS score. Example: 1.1
Descript	yes	no	String	Vulnerability description. Example: desc of this vul
Fix	yes	no	String	Fix suggestions. Example: Repair
Level	yes	no	Uint64	Vulnerability severity. Example: 1
Name	yes	no	String	Vulnerability name. Example: Vulnerability
PublishTime	yes	no	String	Release time. Example: 11
Reference	yes	no	String	Reference link. Example: http://www.domain.com/any/any
VulCategory	yes	no	Uint64	1: Web-CMS vulnerability. 2: application vulnerability. 4: Linux software vulnerability. 5: Windows system vulnerability. 0: emergency vulnerability. Example: 1
VulId	yes	no	Uint64	Vulnerability ID. Example: 1

CloudVendorAccountAK

Cloud vendor account AK information.

Referenced by the following interfaces: DescribeCloudVendorAccountAKList

name	required	NULL allowed	type	description
AccessKey	no	yes	String	AccessKeyId Example: LtDsgdo
CloudType	no	yes	Int64	Cloud vendor type. 1: Alibaba Cloud. Example: 1
Id	no	yes	Uint64	The record ID. Example: 1
Message	no	yes	String	Prompt Message Example: some message
Reason	no	yes	String	Reason Example: any reason
Status	no	yes	Int64	AK status. 0: normal. 1: abnormal. Example: 0
Uid	no	yes	String	Root Account ID Example: 15443424353

AttackSourceEvent

Attack backtracking event.

Referenced by the following interfaces: DescribeAttackSourceEvents

name	required	NULL allowed	type	description
Content	yes	no	String	For file scanning and cleaning, the content includes VirusName, FileName, FilePath, FileSize, MD5, CreateTime, LatestScanTime, HarmDescribe, and SuggestScheme. For logins from unusual locations, the content includes SrcIp, Location, UserName, and LoginTime. For password cracking, the content includes SrcIp, City, Country, Protocol, UserName, Port, Count, CreateTime, and ModifyTime. For malicious requests, the content includes Url, ProcessName, ProcessMd5, Pid, AccessCount, MergeTime, HarmDescribe, and SuggestScheme. For high-risk commands, the content includes RuleName, RuleCategory, BashCmd, DetectBy, User, Pid, CreateTime, HarmDescribe, and SuggestScheme. Example: VirusName
CreatedTime	yes	no	String	Intrusion time. Example: 2021-03-30 19:17:28
EventType	yes	no	Uint64	Event type. 0: file scanning and cleaning. 1: login from an unusual location. 2: password cracking. 3: malicious request. 4: high-command risk. Example: 1
Id	yes	no	Uint64	Event ID. Example: 12
Level	yes	no	Uint64	Uniform event severity. 0: informational. 1: low-risk. 2: medium-risk. 3: high-risk. 4: critical. Example: 1
LevelZh	yes	no	String	Level name Example: Critical
Uuid	yes	no	String	Host UUID. Example: e5b4724c-49af-46ab-bd84-cdbae897e7e0

AssetPortBaseInfo

Basic account information in the asset management module.

Referenced by the following interfaces: DescribeAssetPortInfoList

name	required	NULL allowed	type	description
BindIp	no	no	String	Binds the IP address. Example: 192.168.0.1
FirstTime	no	no	String	First collection time. Example: 2022-07-15 11:27:01
GroupName	no	no	String	User group. Example: staffs
IsNew	no	no	Int64	Whether it is newly added. 0: no. 1: yes. Example: 1
MachineExtraInfo	no	yes	MachineExtraInfo	Host information Example:View
MachineIp	no	no	String	Private IP address of the server. Example: 10.33.0.155
MachineName	no	no	String	Server name. Example: 1
MachineWanIp	no	no	String	Public IP address of the server. Example: 112.44.64.99
Md5	no	no	String	MD5 value of the process. Example: c2caaa18e873ddae87c6167791ff97a8
OsInfo	no	no	String	OS information. Example: Centos 64Bit
Param	no	no	String	Boot parameters. Example: /usr/sbin/cupsd -l
ParentProcessName	no	no	String	Name of the parent process. Example: root
Pid	no	no	String	Process ID. Example: 1024
Port	no	no	String	Port. Example: 22
Ppid	no	no	String	ID of the parent process. Example: 1
ProcessName	no	no	String	Process name. Example: a.out
ProcessPath	no	no	String	Process path. Example: /root
ProcessVersion	no	no	String	Process version. Example: 1.1.1
ProjectId	no	no	Uint64	ID of the project to which the server belongs. Example: 1
Proto	no	no	String	Port protocol, which can be UDP or TCP. Example: tcp
Quuid	no	no	String	Host QUUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116
StartTime	no	no	String	Start time. Example: 2024-10-23 14:12:54
Tag	no	yes	Array of MachineTag	Server tags. Example:View
Teletype	no	no	String	Process TTY. Example: ?
UpdateTime	no	yes	String	Data update time. Example: 2011-11-11 12:12:12
User	no	no	String	Run user. Example: root
Uuid	no	no	String	Host UUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116

Vul

Vulnerability list data

Referenced by the following interfaces: DescribeVuls

name	required	NULL allowed	type	description
ImpactedHostNum	yes	no	Uint64	Number of affected servers. Example: 1
LastScanTime	yes	no	Datetime	Last scan time. Example: 2020-02-01 12:00:00
VulId	yes	no	Uint64	Vulnerability category ID. Example: 1
VulLevel	yes	no	String	Risk severity of the vulnerability. HIGH: high MIDDLE: medium LOW: low NOTICE: informational Example: LOW
VulName	yes	no	String	Vulnerability name. Example: Apache
VulStatus	yes	no	String	Vulnerability status. UN_OPERATED: pending. FIXED: fixed. Example: UN_OPERATED

BaselineHostDetect

Baseline check on a server.

Referenced by the following interfaces: DescribeBaselineHostDetectList

name	required	NULL allowed	type	description
DetectStatus	no	no	Int64	0: checked not passed. 1: ignored. 3: check passed. 5: checking. Example: 0
FirstTime	no	no	String	First scan time. Example: 2021-02-01 12:00:00
HostId	no	no	String	Server ID. Example: 7b2effb9-d1d9-4bb7-9b5d-d80c88ddayay
HostIp	no	no	String	Private IP address. Example: 192.168.0.204
HostName	no	no	String	Server name. Example: redis_node_cvm
ItemCount	no	no	Int64	Number of associated check items. Example: 1
LastTime	no	no	String	Last detection time. Example: 2021-02-01 12:00:00
MachineExtraInfo	no	yes	MachineExtraInfo	Host Additional Information Example:View
NotPassedItemCount	no	no	Int64	Number of check items that are not passed. Example: 1
PassedItemCount	no	no	Int64	Number of check items that are passed. Example: 0
Uuid	no	yes	String	UUID of the CWP agent. Example: 1bc7422a-2366-11e9-a4c5-525400f7ayay
WanIp	no	no	String	Public IP address. Example: 192.168.0.204

OsName

OS name.

Referenced by the following interfaces: DescribeMachineOsList

name	required	NULL allowed	type	description
MachineOSType	yes	no	Uint64	Operating system type. 1: CentOS; 2: Debian; 3: Gentoo; 4: Red Hat; 5: Ubuntu; 6: Windows Server; 7: TOS; 8: CoreOS; 9: FreeBSD; 10: SUSE; 11: Aliyun Linux; 12: OpenCloud. Example: 1
Name	yes	no	String	OS name. Example: Linux

ReverseShell

Reverse shell data.

Referenced by the following interfaces: DescribeReverseShellEvents

name	required	NULL allowed	type	description
CmdLine	no	no	String	Command details. Example: dadad
CmdLineQuote	no	no	String	Escaped content of command details. It is used when regular expressions match allowlisted full strings. Example: c2ggcmVkaXMuc2g=
CreateTime	no	no	String	Time when the command was generated. Example: 2021-05-20 17:00:33
DetectBy	no	no	Uint64	Detection method: 0: behavior analysis; 1 command feature detection Example: 1
DstIp	no	no	String	Target IP address. Example: 127.0.0.1
DstPort	no	no	Uint64	Target port. Example: 12
FullPath	no	no	String	Process path. Example: /home
Hostip	no	no	String	Private IP address of the server. Example: 127.0.0.1
Id	no	no	Uint64	Primary key ID. Example: 11
MachineExtraInfo	no	yes	MachineExtraInfo	Host Additional Information Example:View
MachineName	no	no	String	Server name. Example: redis_node_cvm
ParentProcGroup	no	no	String	User group of the parent process. Example: root
ParentProcName	no	no	String	Parent process name. Example: check_reverse
ParentProcPath	no	no	String	Path of the parent process. Example: /home
ParentProcUser	no	no	String	User of the parent process. Example: root
Pid	no	yes	Int64	Process ID. Example: 1
ProcTree	no	no	String	Process tree. Example: bash(25605),python3.7(25604),bash(25603),bash(25579),bash(25578),bash(3477),login(1307)
ProcessName	no	no	String	Process name. Example: 1.exe
Quuid	no	no	String	Server ID. Example: check_reverse
RiskLevel	no	yes	Uint64	Threat level. 0: medium risk, 1: high risk. Example: 1
Status	no	no	Uint64	Processing status. 0 - pending processing; 2 - allowlisted; 3 - processed; 4 - ignored; 6 - blocked. Example: 2
UserGroup	no	no	String	User group that performs execution. Example: root
UserName	no	no	String	User who performs execution. Example: root
Uuid	no	no	String	UUID of the CWP agent. Example: 5a540076-d38a-4078-aa98-q45rt371d322

AssetWebAppBaseInfo

Web application information in the asset management module.

Referenced by the following interfaces: DescribeAssetWebAppList

name	required	NULL allowed	type	description
Desc	no	no	String	The description of the application. Example: no name
Domain	no	no	String	Domain name of the website. Example: www.ay.com
FirstTime	no	no	String	First collection time. Example: 2022-07-15 11:27:01
Id	no	no	String	Application ID. Example: 10001
IsNew	no	no	Int64	Whether it is newly added. 0: no. 1: yes. Example: 1
MachineExtraInfo	no	yes	MachineExtraInfo	Supplementary Information Example:View
MachineIp	no	no	String	Private IP address of the server. Example: 10.0.0.11
MachineName	no	no	String	Server name. Example: agent-domain
MachineWanIp	no	no	String	Public IP address of the server. Example: 192.168.0.204
Name	no	no	String	Application name. Example: Nginx
OsInfo	no	no	String	OS information. Example: Centos 64Bit
PluginCount	no	no	Uint64	Number of plug-ins. Example: 10
ProjectId	no	no	Uint64	ID of the project to which the server belongs. Example: 1
Quuid	no	no	String	Host QUUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116
RootPath	no	no	String	Root path. Example: /root
ServiceType	no	no	String	Service Type Example: Web
Tag	no	yes	Array of MachineTag	Server tags. Example:View
UpdateTime	no	yes	String	Data update time. Example: 2011-11-11 12:12:12
Uuid	no	no	String	Host UUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116
Version	no	no	String	Version. Example: 1.0.1
VirtualPath	no	no	String	Virtual path. Example: /data/tmp

ScreenNameValue

Name-value data in the dashboard visualization module for cloud security alarming.

Referenced by the following interfaces: DescribeScreenEventsCnt, DescribeScreenGeneralStat, DescribeScreenRiskAssetsTop

name	required	NULL allowed	type	description
Name	yes	no	String	Data type. The value varies by API. Example: offline/shut down
Value	yes	no	Uint64	Number of data records. Example: 12

LogStorageRecord

Record of stored log size

Referenced by the following interfaces: DescribeLogStorageRecord

name	required	NULL allowed	type	description
InquireSize	no	yes	Uint64	Total volume, in bytes. Example: 0
Month	no	yes	String	Year and month. Example: 202304
UsedSize	no	yes	Uint64	Storage amount, in bytes. Example: 0

AssetCoreModuleParam

Kernel module parameters in the asset management module.

Referenced by the following interfaces: DescribeAssetCoreModuleInfo

name	required	NULL allowed	type	description
Data	yes	no	String	Data. Example: 16384
Name	yes	no	String	Name. Example: hashsize

BaselineDetectParam

Baseline check parameters.

Referenced by the following interfaces: StartBaselineDetect

name	required	NULL allowed	type	description
HostIds	no	no	Array of String	IDs of servers to be checked. Example: ['df00265c-081a-4e47-8b92-3e59d902ayay']
ItemIds	no	no	Array of Int64	Set of check items. Example: [1001,1002]
PolicyIds	no	no	Array of Int64	Set of check policies. Example: [101,102,103]
RuleIds	no	no	Array of Int64	Set of check rules. Example: [30]

AssetWebLocationBaseInfo

Website information in the asset management module.

Referenced by the following interfaces: DescribeAssetWebLocationList

name	required	NULL allowed	type	description
FirstTime	no	no	String	First collection time. Example: 2022-07-15 11:27:01
Id	no	no	String	ID of the website. Example: 1
IsNew	no	yes	Int64	Whether it is newly added. 0: no. 1: yes. Example: 1
MachineExtraInfo	no	yes	MachineExtraInfo	Supplementary Information Example:View
MachineIp	no	no	String	Private IP. Example: 10.0.11
MachineName	no	no	String	Server name. Example: any-ins
MachineWanIp	no	no	String	Public IP address. Example: 112.54.121.11
MainPath	no	no	String	Main directory. Example: /root
MainPathOwner	no	no	String	Owner of the main directory. Example: 1
Name	no	no	String	Domain name. Example: any.com
OsInfo	no	no	String	Operating system. Example: centos 64bit
PathCount	no	no	Uint64	Number of website paths. Example: 1
Permission	no	no	String	Owner permissions. Example: 1
Port	no	no	String	Port of the website. Example: 22
ProjectId	no	no	Uint64	ID of the project to which the server belongs. Example: 1
Proto	no	no	String	Protocol of the website. Example: http
Quuid	no	no	String	Host QUUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116
ServiceType	no	no	String	Service type. Valid values: Tomcat, Apache, Nginx, WebLogic, Websphere, JBoss, Jetty, IHS, and Tengine. Example: Tomcat
Tag	no	no	Array of MachineTag	Server tags. Example:View
UpdateTime	no	yes	String	Data update time. Example: 2011-11-11 12:12:12
User	no	no	String	Run user. Example: root
Uuid	no	no	String	Host UUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116

Filters

Key-value pair filters for conditional filtering queries. For example, IDs, names, and states can be filtered.

If multiple filters exist, the AND relationship is used between the filters.
If you specify multiple values for 1 filter, the OR relationship is used between the values.

Referenced by the following interfaces: DescribeBaselineEffectHostList, DescribeBaselineList, DescribeCanNotSeparateMachine, DescribeEmergencyResponseList, DescribeEmergencyVulList, DescribeFileTamperEvents, DescribeFileTamperRules, DescribeGeneralStat, DescribeIgnoreRuleEffectHostList, DescribeImportMachineInfo, DescribeJavaMemShellList, DescribeJavaMemShellPluginInfo, DescribeJavaMemShellPluginList, DescribeLicenseBindList, DescribeLicenseList, DescribeMaPodList, DescribeMachineClearHistory, DescribeMaliciousRequestWhiteList, DescribeOrderList, DescribeRansomDefenseBackupList, DescribeRansomDefenseEventsList, DescribeRansomDefenseMachineList, DescribeRansomDefenseRollBackTaskList, DescribeRansomDefenseStrategyList, DescribeRansomDefenseStrategyMachines, DescribeScanState, DescribeScanTaskDetails, DescribeShellPolicyList, DescribeTags, DescribeVulList, ExportAttackEvents, ExportAttackLogs, ExportBaselineEffectHostList, ExportBaselineList, ExportBashEvents, ExportBashEventsNew, ExportBashPolicies, ExportBruteAttacks, ExportFileTamperEvents, ExportIgnoreRuleEffectHostList, ExportLicenseDetail, ExportMaliciousRequests, ExportMalwares, ExportPrivilegeEvents, ExportRansomDefenseBackupList, ExportRansomDefenseEventsList, ExportRansomDefenseMachineList, ExportRansomDefenseStrategyList, ExportRansomDefenseStrategyMachines, ExportReverseShellEvents, ExportScanTaskDetails, ExportVulDetectionReport, ModifyEventAttackStatus, ModifyRiskEventsStatus, OpenProVersionActivity

name	required	NULL allowed	type	description
ExactMatch	no	no	Bool	Whether to use fuzzy matching. This parameter will be passed in for frontend frameworks and can be ignored. Example: false
Name	yes	no	String	Name of the filter key. Example: Name
Values	yes	no	Array of String	One or more filter values. Example: ["value"]

MalwareWhiteListAffectEvent

Component list data.

Referenced by the following interfaces: DescribeMalwareWhiteListAffectList

name	required	NULL allowed	type	description
CreateTime	yes	no	String	Time when a policy is added. Example: 2024-10-30 09:12:21
FilePath	yes	no	String	File path. Example: /tmp/any
HostIp	yes	no	String	IP address of the server. Example: 10.0.0.1
Id	yes	no	Uint64	Unique ID. Example: 1
Md5	yes	no	String	MD5 value. Example: 708cae4cf814c3deda4208da228fad4e

OrderList

Order list object members.

Referenced by the following interfaces: DescribeOrderList

name	required	NULL allowed	type	description
Alias	no	yes	String	Alias of the resource. Example: redis_node_cvm
AutoRenewFlag	no	yes	Uint64	Auto-renewal flag. 0: Disabled by default (auto-renewal available for key accounts). 1: Automatically renew. 2: Manually set to not automatically renew (auto-renewal not available for key accounts). Example: 0
BeginTime	no	yes	String	Order start time. Example: 0000-00-00 00:00:00
DealName	no	yes	String	Current sub-order number. Example: name-anyone
EndTime	no	yes	String	Order end time. Example: 0000-00-00 00:00:00
ExtraParam	no	yes	OrderExtraParam	Additional parameters for orders. Example:View
InquireKey	no	yes	String	4-tier billable item name, which starts with sv_. Example: sv_yunjing_ue_x
InquireNum	no	yes	Uint64	Resource purchase quantity. Example: 1
PayMode	no	yes	Uint64	Billing mode. 0: pay-as-you-go, 1: prepaid (monthly subscription). Example: 0
ProductCode	no	yes	String	Associated product p_. Example: p_azaz
ProjectID	no	yes	Uint64	Project ID. Example: 0
RegionID	no	yes	Uint64	Region ID. Example: 1
ResourceId	no	yes	String	Resource ID. Example: any data
SourceType	no	yes	Uint64	Order type. 0: default billing order; 1: trial order; 2: gift; 3: experience. Example: 0
Status	no	yes	Uint64	Order status. 1: normal, 2: isolated, 3: terminated. Example: 1
SubProductCode	no	yes	String	Subproduct SP_ Example: sp_yunjing_0014
TagList	no	yes	Array of Tags	Cloud tag Example:View
UsedNum	no	yes	Uint64	Resource usage Example: 0
ZoneID	no	yes	Uint64	Zone ID Example: 100001

FileTamperRuleInfo

API for querying core file monitoring rules

Referenced by the following interfaces: DescribeFileTamperRules

name	required	NULL allowed	type	description
AddWhiteType	no	yes	String	Allowlisting type. cur: Add only the current item to an allowlist. all: Add all items that meet conditions to an allowlist. Example: cur
CreateTime	yes	no	String	Creation time. Example: 2021-03-30 19:17:28
FileAction	yes	yes	String	Monitoring behavior. read: read files. write: modify files. read-write: read and modify files. Example: read
HostCount	yes	yes	Uint64	Number of affected servers. Example: 12
Id	yes	no	Uint64	Rule ID. The value of this parameter for a system rule is 0. Example: 12
IsGlobal	yes	no	Uint64	Whether it is a global rule. 0: no. 1: yes. Example: 1
Level	yes	no	Uint64	Risk severity. 0: no risk. 1: high. 2: medium. 3: low. Example: 3
ModifyTime	yes	no	String	Update time. Example: 2021-03-30 19:17:28
Name	yes	yes	String	Rule Name Example: Deny Access
ReadRuleCount	yes	no	Uint64	Number of read entries for a subrule. Example: 1
ReadWriteRuleCount	yes	no	Uint64	Number of read and write entries for a subrule. Example: 1
RuleCategory	yes	no	Uint64	Rule type. 0: system rule. 1: custom rule. Example: 1
Status	yes	no	Uint64	Status. 0: enabled. 1: disabled. Example: 1
WriteRuleCount	yes	no	Uint64	Number of write entries for a subrule. Example: 1

VulEmergentMsgInfo

Emergent notification information.

Referenced by the following interfaces: DescribeVulEmergentMsg

name	required	NULL allowed	type	description
Name	yes	no	String	Vulnerability name. Example: Apache HTTP/2 DoS vulnerability (CVE-2023-44487)
NameEn	no	no	String	Vulnerability name in English. Example: Apache HTTP/2 DoS vulnerability (CVE-2023-44487)
PublishTime	yes	no	String	Time when the vulnerability was published. Example: 2021-02-01 12:00:00
VulId	yes	no	Uint64	Vulnerability ID. Example: 105375

OrderExtraParam

Additional parameters for orders.

Referenced by the following interfaces: DescribeOrderList

name	required	NULL allowed	type	description
DisposableStatus	no	yes	Bool	One-time service delivery status, which is only available for one-time resource orders. false: not accepted. true: accepted. Example: true
Mode	no	yes	String	PrePay: monthly subscription. PostPay: pay-as-you-go. Disposable: one-time delivery. Example: PrePay

ScreenVulInfo

Vulnerability list in the dashboard.

Referenced by the following interfaces: DescribeScreenHostInvasion

name	required	NULL allowed	type	description
Category	yes	yes	Uint64	Vulnerability category. 1: Web-CMS vulnerability. 2: application vulnerability. 4: Linux software vulnerability. 5: Windows system vulnerability. Example: 1
Id	yes	no	Uint64	ID of the vulnerability event. Example: 1
LastTime	yes	no	String	Last detection time. Example: 2021-03-16 16:21:51
Level	yes	no	Uint64	Vulnerability severity. 1: low. 2: medium. 3: high. 4: informational. Example: 1
Name	yes	no	String	Vulnerability name. Example: Git injection
Uuid	yes	yes	String	UUID of the server. Example: e5b4724c-49af-46ab-bd84-cdbae897e7e0
VulId	yes	no	Uint64	Vulnerability ID. Example: 1

MaHost

Referenced by the following interfaces: DescribeMaHostList

name	required	NULL allowed	type	description
AlarmCount	no	yes	Int64	Number of exception accesses. Example: 10
HostIp	no	yes	String	Private IP. Example: 10.0.0.1
Id	no	yes	Int64	ID Example: 1
InstanceId	no	yes	String	Instance ID. Example: ins-hnwf3y81
IsEnabled	no	yes	Int64	Monitoring switch [1: On
IsNew	no	yes	Int64	Whether it is added in 15 days [1: Yes; 0: No]. Example: 1
IsSupportMa	no	yes	Int64	Whether to support micro-alarms [1: Yes; 0: No]. Example: 0
Labels	no	yes	Array of MaLabel	Associate Tag Example:View
LearnEndTime	no	yes	String	End time of learning for a single workload. Example: 2024-01-01 00:00:00
LearnStartTime	no	yes	String	Start time of learning for a single workload. Example: 2024-01-01 00:00:00
Name	no	yes	String	Server name. Example: redis_node_cvm
NotSupportMaCode	no	yes	Int64	Reason for not supporting micro-alarms [0: Supported; 1: Low client version; 2: Not premium edition; 3: Client not installed]. Example: 0
OsName	no	yes	String	Operating system. Example: CentOS Linux release 7.8.2003 (Core)
PublicIp	no	yes	String	Public IP Example: 8.8.8.8
Region	no	yes	String	Region. Example: ap-region1
Uuid	no	yes	String	UUID of the server. Example: b538f4cc-e666-408a-aa94-fc5280b5d629
VpcId	no	yes	String	Network Example: vpc-82h54yji

FileTamperEvent

Core file monitoring event.

Referenced by the following interfaces: DescribeFileTamperEvents

name	required	NULL allowed	type	description
CreateTime	no	no	String	Event time. Example: 2024-10-28 20:23:23
Description	no	no	String	Risk description. Example: It is detected that the user configuration file '/opt/redis/redis.cfg' is tampered with.
EventCount	no	no	Uint64	Number of event occurrences. Example: 1
ExeMd5	no	no	String	Process name. Example: 0c0f9309e69d2912ae5242d144bcayay
ExeName	no	yes	String	Process name. Example: vim
ExePermission	no	no	String	Process permission. Example: rwx
ExePid	no	no	Uint64	Process pid. Example: 1
ExeSize	no	no	Uint64	Size of the process file. Example: 100
ExeTime	no	no	Uint64	Execution duration of the process. Example: 1000
FileAction	no	yes	String	File threat behavior. read: Read files. write: Modify files. Example: read
HostIp	no	no	String	Server IP address. Example: 10.0.0.1
HostName	no	no	String	The instance name Example: redis_node_cvm
Id	no	no	Uint64	Event ID. Example: 1
Level	no	no	Uint64	Risk severity. 0: no risk. 1: high. 2: medium. 3: low. Example: 1
MachineExtraInfo	no	yes	MachineExtraInfo	Host Additional Information Example:View
MachineStatus	no	no	String	Connection status of the server. Valid values: ONLINE and OFFLINE. Example: ONLINE
ModifyTime	no	no	String	Last occurrence time. Example: 2024-10-28 20:23:23
PrivateIp	no	no	String	Private IP address. Example: 10.0.0.1
ProcessArgv	no	no	String	Process parameter. Example: vim /home/seadmin/.bashrc
ProcessExe	no	no	String	Process path. Example: /tmp/any
Pstree	no	no	String	Event details in the JSON format. Example: [{"pid":2403140,"exe":"/usr/bin/vim","account":"1000:1000","cmdline":"vim /home/seadmin/.bashrc","ssh_service":"10.31.132.68:22"}]
Quuid	no	no	String	cvm id Example: e5b4724c-49af-46ab-bd84-cdbae897e7e0
Reference	no	no	String	Reference link. Example: http://www.ay.com/ay
RuleCategory	no	no	Uint64	Rule type. 0: system rule. 1: custom rule. Example: 0
RuleId	no	no	Uint64	Rule ID. Example: 1
RuleName	no	no	String	Rule Name Example: redis_node_check
Status	no	no	Uint64	Handling status. 0: to be handled. 1: added to the allowlist. 2: deleted. 3: ignored. 4: manually handled. Example: 0
Suggestion	no	no	String	Maintenance suggestions. Example: Check whether the modification is required for normal businesses.
Target	no	no	String	Path of the target file. Example: /home/seadmin/.bashrc
TargetCreatTime	no	yes	String	Time when the target file was created. Example: 2021-01-02 15:04:05
TargetModifyTime	no	yes	String	Time when the target file was updated. Example: 2021-01-02 15:04:05
TargetName	no	no	String	The file name. Example: .bashrc
TargetPermission	no	no	String	Permissions on the target file. Example: rwx
TargetSize	no	no	Uint64	Size of the target file. Example: 1000
Type	no	no	Uint64	Event type or action. 0: alarming. Example: 0
UserGroup	no	no	String	User Group Example: root
UserName	no	no	String	User name. Example: root
Uuid	no	no	String	Host UUID. Example: e5b4724c-49af-46ab-bd84-cdbae897e7e0

BashEvent

High-risk command data.

Referenced by the following interfaces: DescribeBashEvents

name	required	NULL allowed	type	description
BashCmd	yes	no	String	Command to run. Example: rm
CreateTime	yes	no	String	Event time. Example: 2021-03-30 19:17:28
DetectBy	yes	yes	Uint64	0: bash command. 1: real-time monitoring (Thunder Edition) Example: 1
Exe	yes	yes	String	Process name. Example: 1.exe
HostName	no	yes	String	Host name. Example: redis_node_cvm
Hostip	yes	no	String	Private IP address of the server. Example: 127.0.0.1
Id	yes	no	Uint64	Data ID. Example: 1
MachineName	yes	no	String	Server name. Example: redis_node_cvm
ModifyTime	yes	yes	String	Handling time. Example: 2021-03-30 19:17:28
Pid	yes	yes	String	Process ID. Example: 1
Platform	yes	no	Uint64	System type. 2: Windows; 4: Linux. Example: 4
Quuid	yes	no	String	Server ID. Example: 380add75-bb06-4cc4-84c5-cf806d102fba
RegexBashCmd	yes	yes	String	Auto-generated regular expression. Example: rm -rf /tmp/t*
RuleCategory	yes	yes	Uint64	Rule type. 0: system rule. 1: custom rule. Example: 0
RuleId	yes	no	Uint64	Rule ID. Example: 1
RuleLevel	yes	no	Uint64	Rule severity. 1: high. 2: medium. 3: low. Example: 1
RuleName	yes	no	String	Rule Name Example: redis_node_use
Status	yes	no	Uint64	Handling status. 0: to be handled. 1: handled. 2: added to the allowlist. 3: ignored. Example: 1
User	yes	no	String	User who performs execution. Example: root
Uuid	yes	no	String	CWP ID. Example: 380add75-bb06-4cc4-84c5-cf806d102fba

VulInfoByCveId

Vulnerability details queried based on CVE IDs.

Referenced by the following interfaces: DescribeVulCveIdInfo

name	required	NULL allowed	type	description
FixSwitch	yes	no	Uint64	Fixing support status: 0 - not support fixing for Windows and Linux; 1 - support fixing for both Windows and Linux; 2 - support fixing for Linux only; 3 - support fixing for Windows only. Example: 1
VulId	yes	no	Uint64	Vulnerability ID. Example: 12

LoginWhiteListsNew

Referenced by the following interfaces: DescribeLoginWhiteListNew

name	required	NULL allowed	type	description
CreateTime	yes	no	String	Time when the blocklist was created. Example: 2020-02-01 12:00:00
EndTime	yes	yes	String	End time. Example: 2020-02-01 12:00:00
HostIp	yes	no	String	Server IP address. Example: 192.168.0.10
Id	yes	no	Uint64	The record ID. Example: 1
IsGlobal	yes	no	Uint64	Whether the rule is valid globally. 1: valid globally. 0: valid only for a single server. Example: 1
Locale	yes	no	String	Region string. Example: locale1
MachineName	yes	no	String	The host name. Example: redis_node_cvm
ModifyTime	yes	no	String	Time when the blocklist was modified. Example: 2020-02-01 12:00:00
Places	yes	yes	Array of Place	Region of the allowlist. Example:View
Quuid	yes	no	String	Host QUUID. Example: 5a540076-d38a-4078-aa98-qwert371d322
Remark	yes	yes	String	Description. Example: add redis cvm ip
SrcIp	yes	no	String	IP addresses in the allowlist. Multiple IP addresses are separated with commas (,). Example: 192.168.0.1
StartTime	yes	yes	String	Start time. Example: 2020-02-01 12:00:00
UserName	yes	no	String	Users in the allowlist. Separate multiple usernames with commas (,). Example: Alice
Uuid	yes	no	String	ID of the CWP agent. Example: 5a540076-d38a-4078-aa98-qwert371d322

PolicyRules

Policy rule expression.

Referenced by the following interfaces: CheckBashPolicyParams, DescribeBashPolicies, ModifyBashPolicy

name	required	NULL allowed	type	description
AProcess	no	yes	CommandLine	Ancestral Process Example:View
PProcess	no	yes	CommandLine	Parent Process Example:View
Process	no	yes	CommandLine	Processes Example:View

UuidHostip

Machine that passed the check and the corresponding host IP address.

Referenced by the following interfaces: DescribeMemShellRules, DescribeReverseShellRulesAggregation

name	required	NULL allowed	type	description
Hostip	no	yes	String	Server IP address. Example: 172.16.0.9
Uuid	no	yes	String	Server ID Example: 82727b6e-3676-4660-ac4e-c281dba1b23f

AssetLoadDetail

Load information in the asset management module.

Referenced by the following interfaces: DescribeAssetLoadInfo

name	required	NULL allowed	type	description
Desc	yes	no	String	Description. Example: 4G
MachineName	yes	no	String	Server name. Example: redis_node_cvm
Quuid	yes	no	String	Host QUUID. Example: d99a1b46-cc2d-4633-a11f-4a7663d2523e
Uuid	yes	no	String	Host UUID. Example: d99a1b46-cc2d-4633-a11f-4a7663d2523e
Value	yes	no	Float	Load. Example: 0.4

MachineTag

Server tag information

Referenced by the following interfaces: DescribeAssetAppList, DescribeAssetDatabaseList, DescribeAssetMachineList, DescribeAssetPortInfoList, DescribeAssetProcessInfoList, DescribeAssetWebAppList, DescribeAssetWebFrameList, DescribeAssetWebLocationList, DescribeAssetWebServiceInfoList, DescribeImportMachineInfo, DescribeLoginWhiteHostList, DescribeMachineList, DescribeMachines, DescribeMachinesSimple, DescribeRansomDefenseMachineList, DescribeRansomDefenseStrategyMachines

name	required	NULL allowed	type	description
Name	yes	no	String	Tag name. Example: redis_node
Rid	yes	no	Int64	Associated tag ID. Example: 10
TagId	yes	no	Uint64	Tag ID. Example: 1010

RansomDefenseStrategy

Tag information of a server returned from the server list query API.

Referenced by the following interfaces: DescribeRansomDefenseStrategyList

name	required	NULL allowed	type	description
BackupType	yes	yes	Uint64	Backup pattern: 0 weekly, 1 daily Example: 0
CreateTime	yes	yes	String	Creation time. Example: 2022-12-12 12:12:12
Description	yes	yes	String	Policy Remarks Example: subtitle
ExcludeDir	yes	yes	String	Includes directories, separated by semicolons (;). Example: /usr
Hour	yes	no	String	Backup Execution Time Point (0-23): 11:00; 12:00 Example: 11:00
Id	yes	no	Int64	Policy ID. Example: 1
IncludeDir	yes	yes	String	Includes directories, separated by semicolons (;). Example: /root
IsAll	yes	no	Uint64	Whether it takes effect for all hosts. Example: 1
MachineCount	yes	yes	Uint64	Number of Bound Machines Example: 12
ModifyTime	yes	yes	String	The point in time when the namespace was last modified. Example: 2022-12-12 12:12:12
Name	yes	no	String	Policy name. Example: strategyName
SaveDay	yes	no	Uint64	Storage Days, 0 for Permanent Example: 5
Status	yes	no	Uint64	Enabling Status: 0 Disabled, 1 Enabled. Example: 1
Uin	yes	yes	String	Operating UIN Example: 1
Weekday	yes	yes	String	Backup days in a week (1-7): 1; 2; 3; 4. Example: 1;2;3

LicenseUnBindRsp

License unbinding information.

Referenced by the following interfaces: ModifyLicenseUnBinds

name	required	NULL allowed	type	description
ErrMsg	yes	no	String	Cause of failure. Example: Insufficient unbinding attempts
Quuid	yes	no	String	UUID of the server. Example: 93b5fa8f-f5bc-4cf9-8253-d2739e5aa484

BashPolicy

Anti-high-risk command policy.

Referenced by the following interfaces: DescribeBashPolicies, ModifyBashPolicy

name	required	NULL allowed	type	description
BashAction	yes	no	Int64	0: alarming. 1: allowlisting. 2: blocking. Example: 1
Category	no	no	Int64	Policy type. 0: system policy. 1: custom policy. Example: 1
CreateTime	no	no	String	Creation time. Example: 2020-12-12 00:00:00
DealOldEvents	no	yes	Int64	Whether to add previous events to the allowlist. 0: no. 1: yes. Example: 1
Descript	no	yes	String	Policy description. Example: System rule (standard)
Enable	yes	no	Int64	1: valid. 0: invalid. Example: 0
EventId	no	yes	Int64	ID of the event, which must be passed in when you add the event to the allowlist. Example: 1
Id	no	no	Int64	Policy ID. Example: 1
Level	yes	no	Int64	Risk severity. 0: no risk. 1: high. 2: medium. 3: low. Example: 1
ModifyTime	no	no	String	Modification time. Example: 2020-12-12 00:00:00
Name	yes	no	String	Policy name. Example: policy
Quuids	no	yes	Array of String	QUUIDs of the servers on which the policy becomes invalid. Example: ['d99a1b46-cc2d-4633-a11f-4a7663d25ay*']
Rule	yes	no	String	Regular expression, encrypted with Base64. This field is deprecated. If you enter this parameter, it will be automatically replaced with Rules.Process.CmdLine. Example: L2RhdGEvZGlybmFtZS8=
Rules	no	yes	PolicyRules	Rule expression Example:View
Scope	yes	no	Int64	Effective scope. 0: a set of QUUIDs. 1: all servers with CWP Pro, including servers with CWP Ultimate. 1: all servers with CWP Ultimate. 3: all servers. Example: 1
Uuids	no	no	Array of String	This is parameter is used for compatibility with the previous version. Example: ['d99a1b46-cc2d-4633-a11f-4a7663d25ay*']
White	yes	no	Int64	0: blocklist. 1: allowlist. Example: 1

LogInfo

Log details

Referenced by the following interfaces: SearchLog

name	required	NULL allowed	type	description
Content	yes	no	String	Serialized string of the log data in the JSON format. Example: {"quuid":"fb934eba-1f06-491a-a9c6-ca679fd733dd","recv_time":"1730423894","hostip":"192.168.11.19","count":"1","pid":"5820","appid":"1258352045","cls_event_type":"dns_log"}
FileName	yes	no	String	Name of the log file. Example: fielaName.txt
Source	yes	no	String	Source IP address of the log. Example: 1.1.1.1
TimeStamp	yes	no	Int64	Log timestamp. Unit: ms. Example: 0

ProtectDirRelatedServer

Information about server associations with protected directories.

Referenced by the following interfaces: DescribeProtectDirRelatedServer

name	required	NULL allowed	type	description
Authorization	no	no	Bool	Whether the server is associated with a license. Example: true
AutoRestoreSwitchStatus	no	no	Uint64	Automatic recovery switch. Example: 0
Exception	no	no	Uint64	Exception status. Example: 0
ExceptionMessage	no	no	String	Exception message. Example: Starting
HostIp	no	no	String	Server IP. Example: 192.168.0.204
HostName	no	no	String	Server name. Example: redis_node_cvm
Id	no	no	String	Unique ID. Example: 6961
MachineExtraInfo	no	yes	MachineExtraInfo	Host Additional Information Example:View
MachineOs	no	no	String	Operating system of the server. Example: CentOS 192.168.0.204
Progress	no	no	Uint64	Progress. Example: 0
ProtectStatus	no	no	Uint64	Protection status. Example: 6
ProtectSwitch	no	no	Uint64	Protection status. Example: 0
Quuid	no	no	String	Unique ID of the server. Example: 8ce366dc-624e-429c-a8da-5ab870ecayay
RelateDirNum	no	no	Uint64	Number of associated directories. Example: 0

LicenseOrder

License order information.

Referenced by the following interfaces: DescribeImportMachineInfo, DescribeMachinesSimple

name	required	NULL allowed	type	description
LicenseId	yes	no	Uint64	License ID. Example: 667445
LicenseType	yes	no	Uint64	License type. 0: Pro Edition license; 5: Ultimate Edition license. Example: 1
ResourceId	yes	no	String	Resource ID. Example: resource_id
SourceType	yes	no	Uint64	Order type. 0: default billing order; 1: trial order; 2: gift; 3: experience. Example: 0
Status	yes	no	Uint64	Status of the resource in the license order. 1: normal; 2: isolated; 3: terminated. Example: 1

AgentInstallTaskResult

Agent installation task details in the Security Center.

Referenced by the following interfaces: DescribeAgentInstallTaskResult

name	required	NULL allowed	type	description
Assets	no	yes	Array of AgentInstallResult	All Instances Example:View
CreateTime	no	yes	String	Task Start Time Example: 2020-02-01 12:00:00
Id	no	yes	Int64	Task ID Example: 1

AssetSystemPackageInfo

System installation package information in the asset management module.

Referenced by the following interfaces: DescribeAssetSystemPackageList

name	required	NULL allowed	type	description
Desc	yes	no	String	Description. Example: utils
FirstTime	yes	no	String	First collection time. Example: 2022-07-15 11:27:01
InstallTime	yes	no	String	Installation time. Example: 2024-10-23 14:17:00
IsNew	yes	no	Int64	Whether it is newly added. 0: no. 1: yes. Example: 1
MachineExtraInfo	no	yes	MachineExtraInfo	Supplementary Information Example:View
MachineIp	yes	no	String	IP address of the server. Example: 1.1.1.1
MachineName	yes	no	String	Server name. Example: redis_node_cvm
Name	yes	no	String	Package name. Example: libevdev
OsInfo	yes	no	String	Operating system. Example: Centos
Quuid	no	yes	String	Server ID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116
Type	yes	no	String	package type (rpm dpkg java system) Example: rpm
UpdateTime	yes	yes	String	Data update time. Example: 2011-11-11 12:12:12
Uuid	no	yes	String	Agent Id Example: acdd5474-6360-4fd4-bfc7-843162cb8116
Version	yes	no	String	Version. Example: 1.0.1

AssetDatabaseDetail

Database information in the asset management module.

Referenced by the following interfaces: DescribeAssetDatabaseInfo

name	required	NULL allowed	type	description
BinPath	yes	no	String	Binary path. Example: /usr/local/bin
ConfigPath	yes	no	String	Path of the configuration file. Example: /etc/mysqld
DataPath	yes	no	String	The data path. Example: /data/mysql
ErrorLogPath	yes	no	String	Path of the error log. Example: /var/log
Ip	yes	no	String	Binds the IP address. Example: 0.0.0.0
LogPath	yes	no	String	Path of the log file. Example: /data/log
MachineIp	yes	no	String	Private IP address of the server. Example: 10.0.0.11
MachineWanIp	yes	no	String	Public IP address of the server. Example: 1.1.1.1
Name	yes	no	String	Database name. Example: MySQL
OsInfo	yes	no	String	OS information. Example: Centos 64Bit
Param	yes	no	String	Boot parameters. Example: --configsvr --port 27019 --keyFile /etc/mongodb/key --dbpath /data/db --replSet d1j49h6z --wiredTigerCacheSizeGB 0.43 --maxConns 10000 --auth --bind_ip_all
Permission	yes	no	String	Running permissions. Example: polkitd
PlugInPath	yes	no	String	Path of the plug-in. Example: /etc/mysql
Port	yes	no	String	Listening port. Example: 3306
Proto	yes	no	String	Protocol. Example: tcp
Quuid	yes	no	String	Host QUUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116
UpdateTime	yes	yes	String	Data update time. Example: 2011-11-11 12:12:12
User	yes	no	String	Run user. Example: nginx
Uuid	yes	no	String	Host UUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116
Version	yes	no	String	Version. Example: 5.6.7

BaselineItemsCategory

Baseline detection item category tree structure.

Referenced by the following interfaces: DescribeBaselineItemInfo

name	required	NULL allowed	type	description
CategoryCount	no	yes	Int64	Number of baseline detection item subcategories. Example: 53
CategoryLists	no	yes	Array of BaselineCategory	Baseline detection item subcategory list. Example:View
ParentCategoryId	no	yes	Int64	Parent category ID of a baseline detection item. Example: 1
ParentCategoryName	no	yes	String	Parent category name of a baseline detection item. Example: Weak password

RansomDefenseEvent

Prevention of Ransomware, Bait and Tamper Events

Referenced by the following interfaces: DescribeRansomDefenseEventsList

name	required	NULL allowed	type	description
BaitFilePath	yes	no	String	Tampered File Path Example: /var/www/index.html
CreateTime	yes	no	String	Event Sending Time Example: 2024-10-30 09:12:21
FileMd5	yes	no	String	Malicious File MD5 Example: 708cae4cf814c3deda4208da228fad4e
FilePath	yes	no	String	Malicious File Path Example: /tmp/any
FileSize	yes	no	Uint64	Malicious File Size Example: 1
HostIp	yes	no	String	Public IP address of the server. Example: 10.0.0.1
HostName	yes	no	String	Server name. Example: redis_node_cvm
Id	yes	no	Uint64	Event ID. Example: 1
InstanceId	yes	no	String	CVM Instance ID Example: ins-eubxdt5
ModifyTime	yes	no	String	Event Modification Event Example: 2024-10-30 09:12:21
Pid	yes	no	Uint64	Malicious Process ID Example: 1
PidParam	yes	no	String	Malicious Process Parameters Example: bash -c echo "Csip data any" >> /home/.yjfile/121hcXh.doc ayay
ProcessStartTime	yes	no	String	Process start time Example: 2024-10-30 09:12:21
PsTree	yes	no	String	Process Tree Base64 Json Example: W3sicGlkIjozMjI1NCwiZXhlIjoiL3Vzci9iaW*
Quuid	yes	no	String	CVM UUID Example: e5b4724c-49af-46ab-bd84-cdbae897e7e0
SnapshotNum	yes	no	Uint64	Number of Snapshot Backups Owned by the Host Example: 1
Status	yes	no	Uint64	Event Status: 0-Pending, 1-Processed, 2-Trusted, 3-In Process, 4-Backup Resumed Example: 1
StrategyId	yes	no	Uint64	Policy ID. Example: 1
StrategyName	yes	no	String	Policy name. Example: anyname
Type	yes	no	Uint64	Event Type: 0 Encrypted Ransom, 1 File Tampering Example: 0
Uuid	yes	no	String	Host UUID. Example: e5b4724c-49af-46ab-bd84-cdbae897e7e0
WanIp	yes	no	String	Host Intranet IP Example: 10.0.0.1

RansomDefenseRollbackTask

Anti-Ransomware Rollback Task

Referenced by the following interfaces: DescribeRansomDefenseRollBackTaskList

name	required	NULL allowed	type	description
BackupTime	yes	no	String	Snapshot Time Example: 2022-11-11 11:00:00
CreateTime	yes	no	String	Operation Time Example: 2022-11-11 11:00:00
Disks	yes	no	String	Hard drive ID list, separated by semicolons (;) Example: dsk-dsdsds;dsk-dssds
Id	yes	no	Uint64	Task ID Example: 1
MachineName	yes	no	String	Server name. Example: redis_node_cvm
ModifyTime	yes	no	String	Status!=0 indicates the completion time. Example: 2022-11-11 11:00:00
Quuid	yes	no	String	Host QUUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116
RegionInfo	yes	no	RegionInfo	Information on availability zones. Example:View
Status	yes	no	Uint64	Rollback Task Status: 0 - In Progress, 1 - Succeeded, 2 - Failed Example: 1
Uuid	yes	no	String	Host UUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116

AssetWebServiceBaseInfo

Web service information in the asset management module.

Referenced by the following interfaces: DescribeAssetWebServiceInfoList

name	required	NULL allowed	type	description
BinPath	no	no	String	Binary path. Example: /usr/bin
ConfigPath	no	no	String	The configuration file path. Example: /root
Desc	no	no	String	Description. Example: 1
FirstTime	no	no	String	First collection time. Example: 2022-07-15 11:27:01
Id	no	no	String	ID of the web service. Example: 1001
InstallPath	no	no	String	Installation path. Example: /root
IsNew	no	no	Int64	Whether it is newly added. 0: no. 1: yes. Example: 1
MachineExtraInfo	no	yes	MachineExtraInfo	Supplementary Information Example:View
MachineIp	no	no	String	Private IP address of the server. Example: 10.0.0.11
MachineName	no	no	String	Server name. Example: agentinstance
MachineWanIp	no	no	String	Public IP address of the server. Example: 1.1.1.1
Name	no	no	String	Service Name Example: Nginx
OsInfo	no	no	String	OS information. Example: Centos 64Bit
ProcessCount	no	no	Uint64	Number of associated processes. Example: 1
ProjectId	no	no	Uint64	ID of the project to which the server belongs. Example: 1
Quuid	no	no	String	Host QUUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116
Tag	no	yes	Array of MachineTag	Server tags. Example:View
UpdateTime	no	yes	String	Data update time. Example: 2011-11-11 12:12:12
User	no	no	String	User who triggers initialization. Example: root
Uuid	no	no	String	Host UUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116
Version	no	no	String	Version. Example: 1.0.1

ProtectHostConfig

Protected server information.

Referenced by the following interfaces: CreateProtectServer, ModifyWebPageProtectDir

name	required	NULL allowed	type	description
AutoRecovery	yes	no	Uint64	Status of automatic recovery. 0: disabled. 1: enabled. Example: 0
ProtectSwitch	yes	no	Uint64	Protection status. 0: disabled. 1: enabled. Example: 0
Quuid	yes	no	String	Unique ID of the server. Example: 15c76928-e4e1-4f0d-8a2a-46c7de78ayay

MachineFileTamperRule

Details of the core file monitoring rule associated with specified servers.

Referenced by the following interfaces: DescribeMachineFileTamperRules

name	required	NULL allowed	type	description
Id	yes	no	Uint64	The unique ID of the user. Example: 11
Name	yes	yes	String	Rule Name Example: Deny Access
Rule	yes	no	Array of FileTamperRule	Rule. Example:View
RuleCategory	yes	no	Uint64	Rule type. 0: system rule. 1: custom rule. Example: 1

BanWhiteList

Blocklist rules.

Referenced by the following interfaces: CreateBanWhiteList, ModifyBanWhiteList

name	required	NULL allowed	type	description
CreateTime	no	no	Datetime	Time when the blocklist was created. Example: 2021-01-01 00:00:00
Id	no	no	String	Allowlist ID. Example: id_10001
IsGlobal	no	yes	Bool	Whether the blocklist is global. Example: false
ModifyTime	no	no	Datetime	Time when the blocklist was modified. Example: 2021-01-01 00:00:00
Quuids	no	yes	Array of String	QUUIDs of the servers for which the blocklist is configured. Example: ["1ce68339-8828-457f-b358-d5b1b34e4fe9"]
Remark	no	no	String	Alias of the blocklist. Example: Alias
SrcIp	no	no	String	Source IP address in the blocklist. Example: 1.1.1.1
Uuid	no	yes	String	UUID of the server for which the blocklist is configured. Example: 1ce68339-8828-457f-b358-d5b1b34e4fe9

Strategy

Information about a custom baseline security policy.

Referenced by the following interfaces: DescribeBaselineStrategyList

name	required	NULL allowed	type	description
CategoryIds	yes	yes	String	Baseline ID. Example: 1
Enabled	yes	yes	Uint64	Whether it is available. Example: 1
HostCount	yes	yes	Uint64	Number of hosts. Example: 42
IsDefault	yes	yes	Uint64	Specifies whether to use a default policy. Example: 0
PassRate	yes	yes	Uint64	Pass rate. Example: 100
RuleCount	yes	yes	Uint64	Total number of baseline check items. Example: 9
ScanAt	yes	yes	String	Scan time. Example: 01:35:30
ScanCycle	yes	yes	Uint64	Scan cycle. Example: 7
StrategyId	yes	yes	Uint64	Policy ID. Example: 1089429
StrategyName	yes	yes	String	Policy name. Example: check_redis_node

OrderData

Order Parameters

Referenced by the following interfaces: ModifyOrder

name	required	NULL allowed	type	description
AutoRenewFlag	no	yes	Uint64	Auto-renewal flag. 0: Disabled by default (auto-renewal available for key accounts). 1: Automatically renew. 2: Manually set to not automatically renew (auto-renewal not available for key accounts). Example: 1
InquireKey	yes	yes	String	Billing Item sv_ Example: sv_yunjing_ue_x
InquireNum	no	yes	Uint64	Purchase quantity, with a maximum value of 99999. Example: 1
NewConfig	no	yes	OrderModifyConfig	New order configuration, which is required for configuration adjustment. Example:View
OldConfig	no	yes	OrderModifyConfig	Old order configuration, which is required for configuration adjustment. Example:View
PayMode	yes	yes	Uint64	Billing mode. 0: pay-as-you-go, 1: prepaid (monthly subscription). Example: 1
ProjectID	no	yes	Uint64	Project ID. Example: 1
RegionID	yes	yes	Uint64	Region ID. Example: 1
RenewConfig	no	yes	OrderRenewConfig	Renewal configuration parameter. Example:View
ResourceId	no	yes	String	Resource ID. Example: fgtw324qerg3423221dsa231
SubProductCode	yes	yes	String	Subproduct SP_ Example: sp_yunjing_0014
Tags	no	yes	Array of Tags	Cloud tag, which is required when the tag needs to be bound. Example:View
TimeSpan	no	yes	Uint64	Purchase duration. For new purchase and renewal orders, it is an int. It is not required for configuration adjustment. Example: 1
TimeUnit	no	yes	String	Purchase Time Unit. Year-y, Month-m, Day-d, Time-h, Minute-M, Second-s, No Billing Cycle-p. Example: 2020-02-01 12:00:00
ZoneID	yes	yes	Uint64	Zone ID Example: 1

CommandLine

Command line content.

Referenced by the following interfaces: CheckBashPolicyParams, DescribeBashPolicies, ModifyBashPolicy

name	required	NULL allowed	type	description
Cmdline	no	yes	String	Command line, which needs to be encrypted using Base64. Example: c2ggcmVkaXMuc2g=
Exe	no	yes	String	Path, which needs to be encrypted using Base64. Example: L2RhdGEvZGlybmFtZS8=

EffectiveMachineInfo

Server information in a batch import operation.

Referenced by the following interfaces: DescribeImportMachineInfo

name	required	NULL allowed	type	description
CloudFrom	no	yes	Int64	CVM source. Example: 0
CloudTags	no	yes	Array of Tags	Cloud tag information. Example:View
InstanceID	no	yes	String	Machine Instance ID Example: ins-sdsds
KernelVersion	no	yes	String	Kernel version. Example: 3.5
LicenseOrder	no	yes	LicenseOrder	License order object. Example:View
MachineName	no	yes	String	The instance name Example: redis_node_cvm
MachinePrivateIp	no	yes	String	Private IP address of the server. Example: 1.2.3.4
MachinePublicIp	no	yes	String	Public IP address of the server. Example: 1.2.3.4
MachineStatus	no	yes	String	Connection status. Valid values: OFFLINE and ONLINE. Example: OFFLINE
MachineTag	no	yes	Array of MachineTag	Server tag. Example:View
Quuid	no	yes	String	QUUID of the server. Example: e5b4724c-49af-46ab-bd84-cdbae897e7e0
Uuid	no	yes	String	Host UUID. Example: e5b4724c-49af-46ab-bd84-cdbae897e7e0
VulNum	no	yes	Uint64	Number of vulnerabilities. Example: 1

VulLevelInfo

Vulnerability count distribution statistics based on severity levels.

Referenced by the following interfaces: DescribeVulLevelCount

name	required	NULL allowed	type	description
Count	yes	no	Uint64	Total number. Example: 100
VulLevel	yes	no	Uint64	Risk severity. 1: low. 2: medium. 3: high. 4: critical. Example: 1

BaselineRuleInfo

Baseline check item information.

Referenced by the following interfaces: DescribeBaselineRule

name	required	NULL allowed	type	description
Description	yes	no	String	Description of the check item. Example: Configure the maximum size of the audit log file. Once the log reaches the maximum size, it will be rotated and a new log file will be started.
EventId	yes	no	Uint64	Unique event ID. Example: 3634
FixMessage	yes	no	String	Fix suggestions. Example: Set the /etc/audit/auditd.conf parameter according to the site policy:
LastScanAt	yes	no	String	Last detection time. Example: 2024-11-04 09:57:28
Level	yes	no	Uint64	Baseline risk level. 0: low; 1: medium; 2: high; 3: critical. Example: 3
RuleId	yes	no	Uint64	ID of the check item. Example: 1026
RuleName	yes	no	String	Detection item name. Example: Ensure that the audit log storage size is configured for low risks.
RuleRemark	yes	no	String	Reason description. Example: Log remark
Status	yes	no	Uint64	State. Example: 0
Uuid	yes	no	String	Unique user ID. Example: df131b24-8528-4809-9d07-a9e4d58ad566

CKafkaRouteInfo

CKafka domain name information.

Referenced by the following interfaces: DescribeLogDeliveryKafkaOptions

name	required	NULL allowed	type	description
AccessType	yes	no	Int64	Access type. 0: PLAINTEXT (plaintext, without containing user information, supported by the earlier versions and community edition). 1: SASL_PLAINTEXT (plaintext, with SASL login authentication at the beginning of data transmission, only supported by the community edition). 2: SSL (SSL-based encrypted communication, without containing user information, supported by the earlier versions and community edition). 3: SASL_SSL (SSL-based encrypted communication, with SASL login authentication at the beginning of data transmission, only supported by the community edition). Example: 1
Domain	yes	no	String	Domain name. Example: www.a.com
DomainPort	yes	no	Uint64	Domain name and port. Example: 80
RouteID	yes	no	Int64	Route ID. Example: 1
Vip	yes	no	String	Virtual IP address. Example: 1.1.1.1
VipType	yes	no	Int64	Virtual IP address type. 1: public network TGW; 2: basic network; 3: VPC; 4: supporting network (standard edition); 5: SSL public network access; 6: VPC in the bare metal environment; 7: supporting network (Pro). Example: 1

NetAttackEvent

Referenced by the following interfaces: DescribeAttackEvents

name	required	NULL allowed	type	description
Count	no	yes	Uint64	Attacks Example: 1
DstPort	no	yes	Uint64	Target port. Example: 443
Id	no	yes	Uint64	Log ID. Example: 49992719
Location	no	yes	String	Source location Example: location1-location2
MachineExtraInfo	no	yes	MachineExtraInfo	Host Additional Information Example:View
MergeTime	no	yes	String	Attack time. Example: 2021-02-01 12:00:00
New	no	yes	Bool	Whether to add new hosts today Example: false
PayVersion	no	yes	Uint64	Machine payment edition. 0: Basic Edition; 1: Professional Edition; 2: Premium Edition; 3: General Discount Edition Example: 1
Quuid	no	yes	String	CVM UUID Example: ebc62d3a-a4de-46ad-a0d5-b94cb8fdayay
SrcIP	no	yes	String	Source IP address. Example: 192.168.0.204
Status	no	yes	Uint64	Processing Status: 0 Pending, 1 Processed, 2 Allowlisted, 3 Ignored, 4 Deleted, 5: Defense Enabled. Example: 0
Type	no	yes	Uint64	Attack Status: 0: Attack Attempt 1: Confirmed Attack (Successful Attack). Example: 0
Uuid	no	yes	String	Client ID Example: ebc62d3a-a4de-46ad-a0d5-b94cb8fdayay
VulDefenceStatus	no	yes	Uint64	Whether to enable vulnerability defense: 0 - No, 1 - Yes Example: 0
VulId	no	yes	Uint64	Vulnerability ID. Example: 100377
VulName	no	yes	String	Vulnerability name. Example: Apache HTTP/2 DoS vulnerability (CVE-2023-44487)
VulSupportDefense	no	yes	Uint64	Whether vulnerabilities support defense. 0: No 1: Yes Example: 0

AssetWebAppPluginInfo

Web application plug-in details in the asset management module.

Referenced by the following interfaces: DescribeAssetWebAppPluginList

name	required	NULL allowed	type	description
Desc	yes	no	String	Description. Example: memo
Link	yes	no	String	Upload link. Example: /usr/bin/name
Name	yes	no	String	Name. Example: any-app
Version	yes	no	String	Version. Example: 10.0.1

ScreenRegionInfo

Region information.

Referenced by the following interfaces: DescribeScreenMachineRegions

name	required	NULL allowed	type	description
Region	yes	no	String	Region. Example: ap-region1
RegionCode	yes	no	String	Region code, such as gz, sh, bj. Example: gz
RegionId	yes	no	Uint64	Region ID. Example: 1
RegionName	yes	no	String	Region name Example: region1
RegionNameEn	yes	no	String	English name of the region. Example: ap-region1

RansomDefenseBackup

Host Snapshot Backup List

Referenced by the following interfaces: DescribeRansomDefenseBackupList

name	required	NULL allowed	type	description
BackupStatus	yes	no	Uint64	Backup Status: 0 - Backing up, 1 - Normal, 2, 3 - Failed, 4 - Snapshot expired, 9 - Snapshot deleted Example: 1
BackupTime	yes	no	String	Backup time Example: 2022-11-11 11:00:00
DiskCount	yes	no	Uint64	Backup Disk Quantity Example: 1
Disks	yes	no	String	Hard Disk Information, separated by semicolons (;). Example: id1
EventStatus	yes	no	Uint64	Ransom Status: 0 - No Alarm, 1 - Alarm Present Example: 1
SnapshotIds	yes	no	String	Snapshot List, separated by semicolons (;) Example: id1;id2
StrategyId	yes	no	Uint64	Policy ID. Example: 1
StrategyName	yes	no	String	Policy name. Example: tt1
StrategyStatus	yes	no	Uint64	Policy Status: 0 Disabled, 1 Enabled, 9 Deleted Example: 1

RegionInfo

Region information.

Referenced by the following interfaces: DescribeMachineList, DescribeMachineRegionList, DescribeMachineRegions, DescribeMachines, DescribeMachinesSimple, DescribeRansomDefenseMachineList, DescribeRansomDefenseRollBackTaskList, DescribeRansomDefenseStrategyMachines

name	required	NULL allowed	type	description
Region	yes	no	String	Region. Example: region1
RegionCode	yes	no	String	Region code, such as gz, sh, bj. Example: gz
RegionId	yes	no	Uint64	Region ID. Example: 1
RegionName	yes	no	String	Region name Example: region1
RegionNameEn	yes	no	String	English name of the region. Example: ap-region1

VulDefencePluginDetail

Status of the single-process exploit prevention plug-in.

Referenced by the following interfaces: DescribeVulDefencePluginDetail

name	required	NULL allowed	type	description
ErrorLog	yes	no	String	Error log. Example: [Error] Injection failed.
InjectLog	yes	no	String	Injection log. Example: [Info] Injection is successful.
MainClass	yes	no	String	Name of the main class of the injection process. Example: Main.class
Pid	yes	no	Int64	ID of the injection process. Example: 1
Status	yes	no	Int64	Plug-in status. 0: injecting. 1: injected successfully. 2: plug-in timeout. 3: plug-in exit. 4: injection failed. 5: logically deleted. Example: 2

MaCustomPolicyWorkload

Referenced by the following interfaces: DescribeMaCustomPolicyList, ModifyMaCustomPolicy

name	required	NULL allowed	type	description
Id	yes	yes	Uint64	Workload ID. Example: 1
Name	yes	yes	String	Workload name. Example: workload1
Type	yes	yes	Uint64	Workload type. 0: Server workload 1: Pod workload Example: 1

ExportInfo

Log download task list.

Referenced by the following interfaces: DescribeLogExports

name	required	NULL allowed	type	description
CosPath	yes	no	String	Log export path. Example: /tmp/data/
Count	yes	no	Int64	Number of log entries to export. Example: 12
CreateTime	yes	no	String	Time when the log export task was created. Example: 2021-02-01 12:00:00
EndTime	yes	no	Int64	End of the time range to export log entries. The value is a UINX timestamp in milliseconds. Example: 0
ExportId	yes	no	String	ID of the log export task. Example: export-d0ef1b2c-64f6-4193-b251-e583a810ayay
FileName	yes	no	String	Name of the exported log file. Example: fielaName.txt
FileSize	yes	no	Int64	Size of the log file. Example: 0
Format	yes	no	String	Format in which to export log entries. Example: json
Order	yes	no	String	Exported log sorting by time. Example: desc
Query	yes	no	String	Query statement for the log export. Example: dev
StartTime	yes	no	Int64	Beginning of the time range to export log entries. The value is a UINX timestamp in milliseconds. Example: 0
Status	yes	no	String	Log download status. Processing: the export task is in progress. Complete: the export task is complete. Failed: the export task has failed. Expired: the exported log file has expired (valid within 3 days). Example: Complete

BruteAttackRuleList

List of rules for determining a brute force attack.

Referenced by the following interfaces: DescribeBruteAttackRules

name	required	NULL allowed	type	description
Enable	yes	no	Bool	Whether the rule is empty. If yes, the default rule is populated. Example: true
LoginFailTimes	yes	no	Uint64	Number of failed brute force attack events. Example: 5
LoginFailTimesDefault	yes	no	Uint64	Number of failed brute force attack events. This parameter applies to the default rule. Example: 10
TimeRange	yes	no	Uint64	Time period during which brute-force attack events occurred. Unit: seconds. Example: 5
TimeRangeDefault	yes	no	Uint64	Time period during which brute force attack events occur. Unit: seconds. This parameter applies to the default rule. Example: 1

JavaMemShellPluginSetting

Configuration of the Java memory trojan plug-in.

Referenced by the following interfaces: DescribeJavaMemShellPluginList

name	required	NULL allowed	type	description
Alias	yes	no	String	Server name. Example: redis_node_cvm
CreateTime	yes	no	String	Creation time. Example: 2021-01-20 16:17:11
Exception	yes	no	Uint64	Whether the plug-in is abnormal. 0: normal. 1: exceptional. Example: 0
HostIp	yes	no	String	Server IP address. Example: 192.168.255.10
JavaShellStatus	yes	no	Uint64	Status of the Java shell plug-in. 0: disabled. 1: enabled. Example: 1
MachineExtraInfo	no	yes	MachineExtraInfo	Host Additional Information Example:View
ModifyTime	yes	no	String	Modification time. Example: 2021-01-20 16:17:1
Quuid	yes	no	String	QUUID of the container. Example: e1f081aa-7777-4fdf-a2f7-88f3faa3d302
Uuid	no	yes	String	UUID of the server. Example: e1f081aa-7777-4fdf-a2f7-88f3faa3d302

WarningObject

Parameters for updating or inserting alarms.

Referenced by the following interfaces: DescribeSaveOrUpdateWarnings, ModifyWarningSetting

name	required	NULL allowed	type	description
BeginTime	no	no	String	Start time. Format: HH:mm Example: 19:17:28
ControlBits	no	no	String	Binary control bit of the vulnerability severity. Each bit corresponds to the enabling status of each vulnerability severity: low, medium, and high (0: disabled. 1: enabled). For example, a value of 101 indicates that both the low and high severities are selected, and a value of 01 indicates that no alarms are generated for suspicious events and alarms are generated for high-risk events (login audits). Example: 101
DisablePhoneWarning	no	no	Uint64	1: disables alarming. 0: enables alarming. Example: 1
EndTime	no	no	String	End time. Format: HH:mm Example: 19:17
HostRange	no	yes	Int64	Alarm host range type: 0: all hosts; 1: by project; 2: by cloud tag; 3: by CWP tag; 4: custom hosts. Example: 0
Type	no	no	Uint64	Event Alarm Type. 1: Offline; 2: Trojan; 3: Exceptional login; 4: Brute force; 5: Vulnerability (split into four types ranging from 9 to 12); 6: High-risk command; 7: Reverse sell; 8: Local privilege escalation;, 9: System component vulnerabilities; 10: Web application vulnerabilities; 11: Emergency vulnerabilities; 12: Security baseline; 14: Malicious request; 15: Network attack; 16: Windows system vulnerabilities; 17: Linux software vulnerabilities Example: 2

LoginWhiteLists

Referenced by the following interfaces: DescribeLoginWhiteList

name	required	NULL allowed	type	description
CreateTime	yes	no	Datetime	Time when the blocklist was created. Example: 2020-10-01 00:00:01
EndTime	yes	no	String	End time. Example: 2020-10-01 00:00:02
HostIp	yes	no	String	Server IP address. Example: 10.20.30.40
Id	yes	no	Uint64	The record ID. Example: 1
IsGlobal	yes	no	Bool	Whether it is a global rule. Example: false
MachineName	yes	no	String	The host name. Example: stone
ModifyTime	yes	no	Datetime	Time when the blocklist was modified. Example: 2020-10-01 00:00:02
Places	yes	no	Array of Place	Region of the allowlist. Example:View
SrcIp	yes	no	String	IP addresses in the allowlist. Multiple IP addresses are separated with commas (,). Example: 1.2.2.3
StartTime	yes	no	String	The start time. Example: 2020-10-01 00:00:01
UserName	yes	no	String	Users in the allowlist. Separate multiple usernames with commas (,). Example: user
Uuid	yes	no	String	UUID of the CWP agent. Example: 8c09e1b1-5611-45b3-9c02-737996011b81

DuplicateHosts

Duplicated servers during batching adding servers to the allowlist.

Referenced by the following interfaces: AddLoginWhiteLists, CreateBanWhiteList

name	required	NULL allowed	type	description
Id	yes	no	Uint64	Id Example: 1
Quuid	yes	yes	String	Quuid Example: 05f0bcab-726c-4ea4-8109-bcd03d5598f7
Uuid	yes	yes	String	Uuid Example: 05f0bcab-726c-4ea4-8109-bcd03d5598f7

ScreenAttackHotspot

Attack hotspot on the entire network in the dashboard.

Referenced by the following interfaces: DescribeScreenAttackHotspot

name	required	NULL allowed	type	description
CreatedTime	yes	no	String	Time. Example: 2021-03-30
DstIp	yes	no	String	IP address of the victim server. Example: 12.23.212.2
EventName	yes	no	String	Event name. Example: Command injection attack
Region	yes	no	String	Region. Example: region1
SrcIp	yes	no	String	IP address of the attacker. Example: 12.23.212.2

VulInfoHostInfo

Pop-up information displayed for batch vulnerability fixing.

Referenced by the following interfaces: DescribeCanFixVulMachine

name	required	NULL allowed	type	description
HostIp	yes	yes	String	IP address of the server. Example: 10.13.45.12
HostName	yes	yes	String	Server name. Example: redis_node_cvm
InstanceId	yes	yes	String	Instance ID of the server. Example: ins-dhuahsd
IsSupportAutoFix	yes	yes	Uint64	0: the vulnerability cannot be automatically fixed. 1: the vulnerability can be automatically fixed. 2: the agent is offline. 3: the server is not associated with a CWP Ultimate license, and the vulnerability can only be manually fixed. 4: automatic vulnerability fixing is not supported for this device model. 5: the vulnerability is being fixed. 6: the vulnerability has been fixed. 7: the vulnerability is being checked. 10: the vulnerability has failed to be fixed. 10: the vulnerability has been ignored. 11: only Linux system vulnerabilities are supported. Windows system vulnerabilities are not supported. 12: only Windows system vulnerabilities are supported. Linux system vulnerabilities are not supported. Example: 1
Quuid	yes	yes	String	QUUID of the server. Example: e5b4724c-49af-46ab-bd84-cdbae897e7e0
Tags	yes	yes	Array of String	Server tags. Example: ["tag1","tag2"]
Uuid	yes	yes	String	Host UUID. Example: e5b4724c-49af-46ab-bd84-cdbae897e7e0

RansomDefenseStrategyDetail

Tag information of a server returned from the server list query API.

Referenced by the following interfaces: DescribeRansomDefenseStrategyDetail

name	required	NULL allowed	type	description
BackupType	yes	yes	Uint64	Backup pattern: 0 weekly, 1 daily Example: 0
CreateTime	yes	yes	String	Creation time. Example: 2022-12-12 12:12:12
Description	yes	yes	String	Policy Remarks Example: subtitle
EventCount	yes	yes	Uint64	Policy Associated Event Count Example: 11
ExcludeDir	yes	yes	String	Includes directories, separated by semicolons (;). Example: /usr
Hour	yes	no	String	Backup Execution Time Point (0-23): 11:00; 12:00 Example: 11:00
Id	yes	no	Int64	Policy ID. Example: 666
IncludeDir	yes	yes	String	Includes directories, separated by semicolons (;). Example: /root
IsAll	yes	no	Uint64	Whether it takes effect for all hosts. Example: 1
MachineCount	yes	yes	Uint64	Number of Bound Machines Example: 12
ModifyTime	yes	yes	String	The point in time when the namespace was last modified. Example: 2022-12-12 12:12:12
Name	yes	no	String	Policy name. Example: policy-1
SaveDay	yes	no	Uint64	Storage Days, 0 for Permanent Example: 5
Status	yes	no	Uint64	Enabling Status: 0 Disabled, 1 Enabled. Example: 1
Uin	yes	yes	String	Operating UIN Example: 666
Weekday	yes	yes	String	Backup days in a week (1-7): 1; 2; 3; 4. Example: 1;2;3

MalwareInfo

Malicious file details.

Referenced by the following interfaces: DescribeMalwareInfo

name	required	NULL allowed	type	description
Breadth	no	yes	String	Width of the impact. This parameter is currently unavailable. Example: Breadth
CheckPlatform	no	yes	String	Trojan detection platforms. Multiple platforms are separated with commas (,). 1: cloud scanning and cleaning engine. 2: TAV. 3: binaryAi. 4: suspicious behavior. 5: threat intelligence. Example: 1
CreateTime	no	no	String	First time when it was found. Example: 2021-04-26 15:19:04
FileCreateTime	no	no	String	Time when the file was first run. Example: 2021-04-26 15:19:04
FileExists	no	yes	Bool	Whether any Trojan file exists. Example: true
FileModifierTime	no	no	String	Time when the file was last run. Example: 2021-04-26 15:19:04
FileName	no	no	String	The file name. Example: FileName
FilePath	no	no	String	File path. Example: /usr/local/services/tnginx_1_0_0-1.0/lib/luajit/lib
FileSize	no	no	Int64	File size. Example: 1024
FirstDetectionMethod	no	yes	Uint64	Method by which the file was detected for the first time. 0: scanning; 1: real-time monitoring. Example: 0
HarmDescribe	no	no	String	Risk description. Example: This is a description.
Heat	no	yes	String	Query heat. This parameter is currently unavailable. Example: Heat
HostIp	no	no	String	Server IP. Example: 15.2.3.442
Id	no	no	Uint64	Unique ID. Example: 1
LatestScanTime	no	no	String	Last scan time. Example: 2021-04-26 15:19:04
Level	no	yes	Uint64	Risk severity. 0: informational. 1: low. 2: medium. 3: high. 4: critical. Example: 1
MD5	no	no	String	File MD5. Example: e10adc3949ba59abbe56e057f20f883e
MachineExtraInfo	no	yes	MachineExtraInfo	Supplementary Information Example:View
MachineStatus	no	yes	String	Connection status of the server. Valid values: OFFLINE and ONLINE. Example: OFFLINE
MachineWanIp	no	yes	String	Public IP. Example: 15.2.3.442
ModifyTime	no	yes	String	The point in time when the namespace was last modified. Example: 2021-04-26 15:19:04
ProcessExists	no	yes	Bool	Whether any Trojan process exists. Example: true
ProcessID	no	no	String	Process ID. Example: 116
ProcessName	no	no	String	Process name. Example: nginx
PsTree	no	yes	String	Process tree in the JSON format. pid: process ID. exe: file path. account: user group and user to which the process belongs. cmdline: command to be run. ssh_service: SSH service. ssh_souurce: login source. Example: [{"pid":"13"}]
Reference	no	no	String	Reference link. Example: http://www.vxjump.net/files/virus_analysis/virut%20botnet%20anal
References	no	yes	Array of String	Reference link. Example: ["https://domain.com"]
ServersName	no	no	String	Server name. Example: nginx
Status	no	yes	Uint64	Status. 4: to be handled. 5: trusted. 6: quarantined. Example: 1
StrFileAccessTime	no	yes	String	Last access time. Example: 2021-04-26 15:19:04
SuggestScheme	no	no	String	Suggestion scheme. Example: 1. Check for malicious processes and invalid ports, and delete suspicious startup items and scheduled tasks. 2. Isolate or delete relevant Trojan files.
Tags	no	no	Array of String	Tags. Example: ["tewt","wekk"]
Uuid	no	yes	String	Host UUID. Example: e5b4724c-49af-46ab-bd84-cdbae897e7e0
VirusName	no	no	String	Virus name. Example: Linux.Trojan.Downloader.Snkl

AssetJarDetail

JAR package details in the asset management module.

Referenced by the following interfaces: DescribeAssetJarInfo

name	required	NULL allowed	type	description
MachineIp	yes	no	String	Server IP. Example: 10.0.0.11
MachineName	yes	no	String	Server name. Example: redis_node_cvm
Md5	yes	yes	String	MD5 value of the JAR package. Example: fc702c8398071ea3697d449c2b894dae
Name	yes	no	String	Name. Example: com.apple.utils
OsInfo	yes	no	String	Operating system. Example: 1
Path	yes	no	String	Path Example: /root
Process	yes	yes	Array of AssetAppProcessInfo	List of referenced processes. Example:View
Status	yes	no	Uint64	Whether it can be executed. 0: unknown. 1: yes. 2: no. Example: 1
Type	yes	no	Int64	Type. 1: application program. 1: system library. 3: built-in library of a web service. 8: others. Example: 1
UpdateTime	yes	yes	String	Data update time. Example: 2011-11-11 12:12:12
Version	yes	no	String	Version. Example: 1.0.0

VulFixStatusHostInfo

Vulnerability fixing details, including the fixing status of each vulnerability on each server.

Referenced by the following interfaces: DescribeVulFixStatus

name	required	NULL allowed	type	description
FailReason	yes	yes	String	Reason for the fix failure. Example: Fixing timeout
HostIp	yes	no	String	IP address of the server. Example: 10.13.45.12
HostName	yes	no	String	Server name. Example: redis_node_cvm
ModifyTime	yes	no	String	Time when it was fixed. Example: 2021-03-30 19:17:28
Quuid	yes	no	String	QUUID of the server. Example: e5b4724c-49af-46ab-bd84-cdbae897e7e0
Status	yes	no	Uint64	Status. 0: initial status. 1: task delivered (fixing). 2: completed (successful). 3: fix failed (failed). 4: fix failed due to the failure to create a snapshot (not fixed). Example: 1

VulDefenceEventDetail

Vulnerability details.

Referenced by the following interfaces: DescribeDefenceEventDetail

name	required	NULL allowed	type	description
Alias	no	no	String	Server name. Example: redis_node_cvm
City	no	no	String	City where the attack source IP address resides. Example: city1
Count	no	no	Int64	Number of occurrences of the event. Example: 1
CreateTime	no	no	String	Time when the event was created. Example: 2021-01-20 16:17:11
CveId	no	no	String	CVE ID. Example: cve-ay
Description	no	no	String	Description of the vulnerability. Example: Description
EventDetail	no	no	String	Event details related to the vulnerability ID in the JSON Array format. This parameter is available only for RASP. Example: [ { "name": "jndiurl", "value": "http://whoa
EventType	no	no	Uint64	0: attempted attack (available for WeDetect). 1: successful attack attempt (available for WeDetect). 2: RASP defense event. Example: 1
ExceptionPstree	no	no	String	Process tree of the server compromising event in the JSON format. This parameter is available only for WeDetect. Example: ppid ssh
Fix	no	no	String	Fix suggestions. Example: Suggestions
Id	no	no	Int64	ID of the vulnerability event. Example: 1
MachineExtraInfo	no	yes	MachineExtraInfo	Host Additional Information Example:View
MachineStatus	no	no	String	ONLINE OFFLINE Example: ONLINE
MainClass	no	no	String	Main class name of the associated process. Example: sf.class
MergeTime	no	no	String	Time when the event was updated. Example: 2021-01-20 16:17:11
NetworkPayload	no	no	String	Attack payload. Example: GET /$%7BClass.forName(%22com.opensymphony.webwork.ServletActionContext%22).getMethod
Pid	no	no	Int64	ID of the associated process. Example: 116
PrivateIp	no	no	String	Private IP address. Example: 10.2.3.1
PublicIp	no	no	String	Public IP address. Example: 111.2.3.1
Quuid	no	no	String	QUUID of the server. Example: d92d723e-4aac-4f4a-bbf9-e5430e29d289
SourceIp	no	no	String	Attack source IP address. Example: 11.2.3.1
SourcePort	no	yes	Array of Uint64	Attack source port. Example: [1,3]
StackTrace	no	no	String	Stack information. This parameter is available only for RASP. Example: at org.java.util
Status	no	no	Int64	Status. 0: to be handled. 1: prevented. 2: handled. 3: ignored. 4: deleted. Example: 1
VulName	no	no	String	Vulnerability name. Example: Vulnerability

ProtectMachineInfo

Licensed server information.

Referenced by the following interfaces: DescribeWebPageServiceInfo

name	required	NULL allowed	type	description
CreateTime	yes	no	String	Point in time when it was enabled. Example: 2020-11-21 15:16:00
ExpireTime	yes	no	String	The point in time when it expires. Example: 2020-11-21 15:16:00
HostIp	yes	no	String	Server IP address. Example: 10.0.1.92
HostName	yes	no	String	The instance name Example: host1

DefendAttackLog

Cyberattack log.

Referenced by the following interfaces: DescribeAttackLogs

name	required	NULL allowed	type	description
CreatedAt	no	no	String	Attack time. Example: 2020-01-01 00:00:00
DstIp	no	no	String	Target IP address. Example: 1.1.1.1
DstPort	no	no	Uint64	Target port. Example: 8080
HttpCgi	no	no	String	Attack description. Example: any attack msg
HttpContent	no	no	String	Attack content. Example: content
HttpMethod	no	no	String	Attack method. Example: POST
HttpParam	no	no	String	Attack parameter. Example: POST /demo3-1/baseServlet HTTP/1.1
Id	no	no	Uint64	Log ID. Example: 10001
MachineExtraInfo	no	yes	MachineExtraInfo	Host Additional Information Example:View
MachineIp	no	no	String	IP address of the target server. Example: 1.1.1.1
MachineName	no	no	String	Name of the target server. Example: 1.1.1.1
SrcIp	no	no	String	Source IP address. Example: 1.1.1.1
SrcPort	no	no	Uint64	Source port. Example: 32456
Uuid	no	no	String	Client ID Example: 93b5fa8f-f5bc-4cf9-8253-d2739e5aa484
VulType	no	no	String	Threat type. Example: tcp

PriceDetail

Quotation Parameters

Referenced by the following interfaces: DescribePrice

name	required	NULL allowed	type	description
GoodsCategoryId	yes	no	Uint64	Order Classification Example: 1
GoodsDetail	yes	no	String	Order Details Parameters Example: {"pid":1004928,"license":1,"productCode":"p_yunjing","subProductCode":"sp_yunjing_vip","sv_yunjing_protection_vip":"3","timeSpan":1,"timeUnit":"d","yunjing_pro":1}
GoodsNum	yes	no	Uint64	Order Count Example: 1
PayMode	yes	no	Uint64	Billing Pattern: 0 Postpaid, 1 Prepaid Example: 1
RegionId	yes	no	Uint64	Region. Example: 1
ZoneId	yes	no	Uint64	Availability zone. Example: 1

ScanTaskDetails

Scan task details.

Referenced by the following interfaces: DescribeScanTaskDetails

name	required	NULL allowed	type	description
Description	no	no	String	Description. Example: Failed
FailType	no	no	Uint64	Failure type. 3: offline; 4: timeout; 5: failed; 8: early agent version. Example: 4
HostIp	no	no	String	Server IP. Example: 10.0.0.1
HostName	no	no	String	Server name. Example: any-agent
Id	no	no	Uint64	Unique ID. Example: 1
MachineExtraInfo	no	yes	MachineExtraInfo	Supplementary Information Example:View
MachineWanIp	no	no	String	Public IP. Example: 172.22.11.12
OsName	no	no	String	Operating system. Example: win64
Quuid	no	no	String	QUUID. Example: badea25d-d702-4f68-8906-0580c0a13170
RiskNum	no	no	Uint64	Number of risks. Example: 1
ScanBeginTime	no	no	String	Start time of the scan. Example: 2024-10-29 10:35:50
ScanEndTime	no	no	String	Time when the scan ends. Example: 2024-10-29 10:39:50
Status	no	no	String	Status code: Scanning; Ok; Fail. Example: Fail
Uuid	no	no	String	Unique user ID. Example: badea25d-d702-4f68-8906-0580c0a13170

BaselineFix

Baseline password fixing.

Referenced by the following interfaces: DescribeBaselineFixList

name	required	NULL allowed	type	description
CreateTime	no	no	String	First scan time. Example: 2021-02-01 12:00:00
FixTime	no	no	String	Time when it was fixed. Example: 2021-02-01 12:00:00
HostIp	no	no	String	IP address of the server. Example: 192.168.0.204
Id	no	no	Int64	Result ID of the baseline check item. Example: 1
ItemName	no	no	String	Name of the fix item. Example: Ensure the SSH idle timeout time.
MachineExtraInfo	no	yes	MachineExtraInfo	Host Additional Information Example:View
ModifyTime	no	no	String	Last detection time. Example: 2021-02-01 12:00:00

AssetType

Description of an asset fingerprint type.

Referenced by the following interfaces: DescribeAssetTypes

name	required	NULL allowed	type	description
Id	yes	no	Uint64	Type ID. Example: 1
Name	yes	no	String	Type name. Example: Accounts

CanNotSeparateInfo

Information about servers on which trojans cannot be quarantined.

Referenced by the following interfaces: DescribeCanNotSeparateMachine

name	required	NULL allowed	type	description
Alias	yes	no	String	Server name. Example: redis_node_cvm
PrivateIp	yes	no	String	Private IP address. Example: 127.12.1.1
PublicIp	yes	no	String	Public IP. Example: 192.2.23.1
Quuid	yes	no	String	QUUID of the server. Example: e5b4724c-49af-46ab-bd84-cdbae897e7e0
Reason	yes	no	Uint64	Cause of the quarantine failure. 1: the agent is offline. Example: 1
Uuid	yes	no	String	Host UUID. Example: e5b4724c-49af-46ab-bd84-cdbae897e7e0

MachineLicenseDetail

License binding information of a server.

Referenced by the following interfaces: DescribeMachineLicenseDetail

name	required	NULL allowed	type	description
InquireKey	yes	no	String	This field has been deprecated. Example: sv_yunjing_ue_x
PayMode	yes	no	Uint64	Billing mode. 0: pay-as-you-go; 1: prepaid. Example: 1
Quuid	yes	no	String	QUUID of the server. Example: e5b4724c-49af-46ab-bd84-cdbae897e7e0
ResourceId	yes	no	String	Resource ID. Example: anyid
SourceType	yes	no	Uint64	Order type. 0: default billing order; 1: trial order; 2: gift; 3: experience. Example: 1

MaWhitelist

Referenced by the following interfaces: DescribeMaWhitelist, ModifyMaWhitelist

name	required	NULL allowed	type	description
CreateTime	no	yes	String	Creation time. Example: 2023-10-10 00:00:00
Dest	yes	yes	String	Access target, which supports IPs/IP ranges. Multiple entries are separated by semicolons. The default is All. Example: 1.1.1.1-1.1.1.2
DestPort	no	yes	String	Target port. Multiple entries are separated by semicolons. If not specified, it indicates all. Example: 80;8080
Enable	yes	yes	Uint64	Whether it is enabled. 0: Not enabled. 1: Enabled. Example: 1
From	yes	yes	Uint64	Configuration source of the allowlist. 1: Tenant console. 0: CMGT console. The tenant console cannot delete or disable global configuration allowlists from the CMGT console. Example: 1
Id	no	yes	Uint64	ID of the allowlist configuration item. Example: 1
ModifyTime	no	yes	String	Update time. Example: 2023-10-10 00:00:00
Name	yes	yes	String	Allowlist name. Example: Allowlist 1
Source	yes	yes	String	Access source, which supports IPs/IP ranges. Multiple entries are separated by semicolons. The default is All. Example: 1.1.1.1/24
Updater	yes	yes	String	Allowlist creator/updater. Example: Alice

HostLoginList

Referenced by the following interfaces: DescribeHostLoginList

name	required	NULL allowed	type	description
City	no	yes	Uint64	City ID. Example: 23
Country	no	yes	Uint64	Country ID. Example: 1
Desc	no	yes	String	High-risk Information Explanation: ABROAD - Overseas IP; XTI - Threat Intelligence. Example: ABROAD
Id	no	no	Uint64	Record ID. Example: 10001
IsRiskArea	no	yes	Uint64	Whether it is determined as a login from an unusual location. 1: yes. 0: no. Example: 1
IsRiskSrcIp	no	yes	Uint64	Whether it is determined as a suspicious IP address. 1: yes. 0: no. Example: 1
IsRiskTime	no	yes	Uint64	Whether it is determined as a suspicious login time. 1: yes. 0: no. Example: 1
IsRiskUser	no	yes	Uint64	Whether it is determined as a suspicious user. 1: yes. 0: no. Example: 1
Location	no	yes	String	Location name. Example: location1:location2:location3
LoginTime	no	yes	String	Login time. Example: 2024-10-30 15:58:43
MachineExtraInfo	no	yes	MachineExtraInfo	Supplementary Information Example:View
MachineIp	no	yes	String	IP address of the server. Example: 192.168.0.204
MachineName	no	yes	String	Server name. Example: redis_node_cvm
ModifyTime	no	yes	String	Modification time. Example: 2024-10-30 15:58:43
Port	no	yes	Int64	Request destination port. Example: 3306
Province	no	yes	Uint64	Province ID. Example: 101
Quuid	no	yes	String	QUUID of the server. Example: 935e27b1-d675-4509-80bf-96fbf0764237
RiskLevel	no	yes	Uint64	Risk severity. 0: high. 1: suspicious. Example: 1
SrcIp	no	yes	String	Source IP. Example: 192.168.0.204
Status	no	no	Uint64	1: usual login. 2: login from an unusual location. 5: added to the allowlist. 14: handled. 15: ignored. Example: 1
UserName	no	yes	String	User name. Example: root
Uuid	no	yes	String	Host UUID. Example: 380add75-bb06-4cc4-84c5-cf806d102fba

BaselinePolicyDetect

Baseline check policy.

Referenced by the following interfaces: DescribeBaselineDetectList

name	required	NULL allowed	type	description
FailedCount	yes	no	Int64	Number of servers that failed the check due to timeouts. Example: 1
FinishTime	yes	no	String	End time. Example: 2021-02-01 12:00:00
HostCount	yes	no	Int64	Number of associated servers. Example: 52
PolicyDetectStatus	yes	yes	Int64	1: checking. 2: check completed. Example: 1
PolicyId	yes	no	Int64	Policy ID. Example: 1523
PolicyName	yes	no	String	Policy name. Example: Unauthorized access
StartTime	yes	no	String	Start time. Example: 2021-02-01 12:00:00
SuccessCount	yes	no	Int64	Number of servers that passed the check. Example: 1
TaskId	yes	no	Int64	ID of the check task. Example: 38644956
TimeoutCount	yes	no	Int64	Number of servers that failed the check due to timeouts. Example: 1

RansomDefenseStrategyMachineBackupInfo

Details of Host Backup Bound to Anti-Ransomware Policy

Referenced by the following interfaces: DescribeRansomDefenseMachineList

name	required	NULL allowed	type	description
BackupCount	yes	yes	Uint64	Number of Backups Example: 1
BackupSuccessCount	yes	yes	Uint64	Backup Success Count Example: 1
CloudTags	yes	yes	Array of Tag	Cloud tag Example:View
DiskInfo	yes	yes	String	Hard Disk Information, effective for all disks when empty: diskId1
InstanceId	yes	no	String	Host Instance ID Example: cvm-dwcs
LastBackupMessage	yes	yes	String	Reason for the Last Backup Failure Example: fail
LastBackupStatus	yes	yes	Uint64	Latest Backup Status: 0 - Backing Up, 1 - Normal, 2 - Failed, 9 - No Backup Yet Example: 1
LastBackupTime	yes	yes	String	Last Backup Time Example: 2022-11-11 11:11:11
MachineIp	yes	no	String	Private IP address. Example: 10.0.0.22
MachineName	yes	no	String	Server name. Example: redis_node_cvm
MachineWanIp	yes	yes	String	Public IP. Example: 112.11.33.22
Quuid	yes	no	String	Host QUUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116
RegionInfo	yes	yes	RegionInfo	Information on availability zones. Example:View
RollBackPercent	yes	yes	Uint64	Latest Rollback Progress Percentage Example: 1
RollBackStatus	yes	yes	Uint64	Latest Rollback Status: 0 - In Progress, 1 - Succeeded, 2 - Failed Example: 1
Status	yes	yes	Uint64	Protection status: 0 Disabled, 1 Enabled. Example: 0
StrategyId	yes	yes	Uint64	Policy ID. 0 indicates no binding to any policy. Example: 0
StrategyName	yes	yes	String	Policy name. Example: any1
Tag	yes	yes	Array of MachineTag	Host Security Tag Example:View
Uuid	yes	no	String	Host UUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116

JavaMemShellDetail

Details of a Java memory trojan event.

Referenced by the following interfaces: DescribeJavaMemShellInfo

name	required	NULL allowed	type	description
Annotations	no	no	String	Comment. Example: Note
Args	no	no	String	Parameters of the Java process command. Example: org.apache.jasper.servlet.JasperLoader
ClassContent	no	no	String	Base64 encoded binary code of the Java memory trojan. Example: cGFja2FnZSBjb20uY29tcGFueTsgIHB1YmxpYyBjbGFzcyBNYWluIHsgICAgICBwdWJsaWMgc3RhdGljIHZvaQ==
ClassContentPretty	no	no	String	Decompiled Java memory trojan code. Example: package com.company; public class Main { public static voi
ClassLoaderName	no	no	String	Java loader class name. Example: org.apache.jasper.servlet.JasperLoader
ClassName	no	no	String	Class name. Example: main.class
CreateTime	no	no	String	First time when it was found. Example: 2021-01-20 16:17:11
Description	no	no	String	Help. Example: Trojan is detected in the org.apache.catalina.startup.Bootstrap class of the Java process (PID: 1128220).
EventDescription	no	no	String	Event description. Example: A Webshelll is detected in Java service processes. Java Webshell can reside in the memory for a long time and receive input submitted by attackers for long-term remote control of servers.
Exe	no	no	String	Path of the Java process. Example: /usr/lib/jvm/java-6-openjdk-amd64/jre/bin/java
InstanceName	no	no	String	Container name. Example: redis_node_cvm
InstanceState	no	no	String	Instance status. Valid values: RUNNING, STOPPED, and SHUTDOWN. Example: RUNNING
Interfaces	no	no	String	Inherited interfaces. Example: java.IO.Writer,java.IO.Reader
MachineExtraInfo	no	yes	MachineExtraInfo	Host Additional Information Example:View
MachineState	no	no	String	Agent status: OFFLINE; ONLINE. Example: OFFLINE
Md5	no	no	String	MD5 value of the class file. Example: 37e54fce63f1ca6c82927caf7aa1c412
Pid	no	no	Uint64	Process pid. Example: 1
PrivateIp	no	no	String	Private IP. Example: 192.168.255.10
PublicIp	no	no	String	Public IP Example: 110.40.207.98
RecentFoundTime	no	no	String	Last detection time. Example: 2021-01-20 16:17:11
SecurityAdvice	no	no	String	Security suggestion. Example: Check Java service access logs and assess whether memory shells have been accessed. Check for high-risk vulnerabilities on the host, fix the high-risk vulnerabilities, and restart the Java service.
Status	no	no	Uint64	Handling status. 0: to be handled. 1: added to the allowlist. 2: deleted. 3: ignored. 4: manually handled. Example: 0
SuperClassName	no	no	String	Parent class name. Example: java.lang.Object
Type	no	no	Uint64	Trojan memory type. 0: Filter. 1: Listener. 2: Servlet. 3: Interceptors. 4: Agent. 5: others. Example: 1

EventStat

Statistics about pending security events.

Referenced by the following interfaces: DescribeSecurityEventStat

name	required	NULL allowed	type	description
EventsNum	yes	no	Uint64	Number of events. Example: 0
MachineAffectNum	yes	no	Uint64	Number of affected servers. Example: 0

JavaMemShellInfo

Java memory trojan event information.

Referenced by the following interfaces: DescribeJavaMemShellList

name	required	NULL allowed	type	description
Alias	no	yes	String	Server name. Example: dev-centos8
Annotations	no	yes	String	Comment. Example: @Override
ClassName	no	yes	String	Class name. Example: org.apache.catalina.startup.Bootstrap
CreateTime	no	no	String	First time when it was found. Example: 2021-01-20 16:17:11
Description	no	no	String	Help. Example: Trojan is detected in the org.apache.catalina.startup.Bootstrap class of the Java process (PID: 1128220).
HostIp	no	yes	String	Server IP. Example: 192.168.255.10
Id	no	no	Uint64	Event ID. Example: 142
Interfaces	no	yes	String	Inherited interfaces. Example: org.apache.catalina.startup.Bootstrap
LoaderClassName	no	yes	String	Associated class loader. Example: org.apache.catalina.startup.Bootstrap
MachineExtraInfo	no	yes	MachineExtraInfo	Host Additional Information Example:View
Quuid	no	no	String	QUUID of the server. Example: e1f081aa-7777-4fdf-a2f7-88f3faa3d302
RecentFoundTime	no	no	String	Last detection time. Example: 2021-01-20 16:17:11
Status	no	no	Uint64	Handling status. 0: to be handled. 1: added to the allowlist. 2: deleted. 3: ignored. 4: manually handled. Example: 0
SuperClassName	no	yes	String	Parent class name. Example: org.apache.catalina.startup.Bootstrap
Type	no	no	Uint64	Trojan memory type. 0: Filter. 1: Listener. 2: Servlet. 3: Interceptors. 4: Agent. 5: others. Example: 1
Uuid	no	yes	String	UUID of the server. Example: e1f081aa-7777-4fdf-a2f7-88f3faa3d302

VulFixStatusSnapshotInfo

Snapshot information of a server.

Referenced by the following interfaces: DescribeVulFixStatus

name	required	NULL allowed	type	description
FailReason	yes	yes	String	Reason for failed snapshot creation. Example: Failed to get authorization
HostIp	yes	yes	String	IP address of the server. Example: 145.12.3.12
HostName	yes	yes	String	Server name. Example: redis_node_cvm
Id	yes	no	Uint64	Unique ID of the record. Example: 12
ModifyTime	yes	yes	String	Time when the snapshot was created. Example: 2021-03-11 18:15:17
Quuid	yes	no	String	cvm id Example: 380add75-bb06-4cc4-84c5-cf806d102fba
SnapshotId	yes	yes	String	Snapshot ID. Example: snp-dhusaay
SnapshotName	yes	yes	String	Name of the snapshot. Example: Backup on 2021-03-01
Status	yes	no	Uint64	Snapshot status. 0: initial status. 1: the snapshot was created successfully. 2: the snapshot failed to be created. Example: 1

MalwareWhiteListInfo

Component list data.

Referenced by the following interfaces: DescribeMalwareWhiteList

name	required	NULL allowed	type	description
CreateTime	yes	no	String	The point in time when the rule was created. Example: 2024-10-30 09:12:21
EventsCount	yes	no	Uint64	Number of event records. Example: 1
FileDirectory	yes	no	String	File directory. Multiple file directories are separated with commas (,). Example: /tmp
FileExtension	yes	no	String	File extension. Multiple file extensions are separated with commas (,). Example: php
FileName	yes	no	String	File name. Multiple file names are separated with commas (,). Example: run.sh
Id	yes	no	Uint64	Unique ID. Example: 1
IsGlobal	yes	no	Uint64	Whether the allowlist takes effect on all servers. 0: no. 1: yes. Example: 1
MatchType	yes	no	Uint64	Match mode. 0: exact match. 1: fuzzy match. Example: 1
Md5List	yes	no	String	List of MD5 values. Multiple MD5 values are separated with commas (,). Example: 708cae4cf814c3deda4208da228fad4e
Mode	yes	no	Uint64	Allowlist mode. 1: MD5 allowlist. 1: custom allowlist. Example: 1
ModifyTime	no	no	String	Rule modification time. Example: 2024-10-30 09:12:21
QuuidList	yes	no	String	QUUIDs of servers. Multiple QUUIDs are separated with commas (,). Example: e5b4724c-49af-46ab-bd84-cdbae897e7e0

MachineExtraInfo

Server Basic Information

Referenced by the following interfaces: DescribeAssetAppList, DescribeAssetCoreModuleList, DescribeAssetDatabaseList, DescribeAssetEnvList, DescribeAssetInitServiceList, DescribeAssetJarList, DescribeAssetMachineDetail, DescribeAssetMachineList, DescribeAssetPlanTaskList, DescribeAssetPortInfoList, DescribeAssetProcessInfoList, DescribeAssetSystemPackageList, DescribeAssetUserList, DescribeAssetWebAppList, DescribeAssetWebFrameList, DescribeAssetWebLocationList, DescribeAssetWebServiceInfoList, DescribeAttackEventInfo, DescribeAttackEvents, DescribeAttackLogs, DescribeBaselineFixList, DescribeBaselineHostDetectList, DescribeBaselineHostIgnoreList, DescribeBaselineItemList, DescribeBashEventsNew, DescribeBruteAttackList, DescribeDefenceEventDetail, DescribeFileTamperEvents, DescribeHostLoginList, DescribeIgnoreHostAndItemConfig, DescribeJavaMemShellInfo, DescribeJavaMemShellList, DescribeJavaMemShellPluginList, DescribeLicenseBindList, DescribeLicenseBindSchedule, DescribeMachineList, DescribeMachines, DescribeMalWareList, DescribeMalwareInfo, DescribePrivilegeEvents, DescribeProtectDirRelatedServer, DescribeReverseShellEvents, DescribeRiskDnsEventInfo, DescribeRiskDnsEventList, DescribeRiskProcessEvents, DescribeScanTaskDetails, DescribeScreenMachines, DescribeVulDefenceEvent, DescribeVulEffectHostList, DescribeWebPageEventList

name	required	NULL allowed	type	description
HostName	no	yes	String	Server name. Example: redis_node_cvm
InstanceID	no	yes	String	Instance ID. Example: ins-1s7mkggc
NetworkName	no	yes	String	Network Name, returns vpc_id in the case of a VPC network Example: vpc-9m7rhl6w
NetworkType	no	yes	Int64	Network type: 1: VPC network; 2: basic network; 3: non-cloud network. Example: 1
PrivateIP	no	yes	String	Private IP. Example: 1.1.1.1
WanIP	no	yes	String	Public IP Example: 1.1.1.1

MaCustomPolicy

Referenced by the following interfaces: DescribeMaCustomPolicyList, ModifyMaCustomPolicy

name	required	NULL allowed	type	description
ActionType	no	yes	Uint64	Policy action, currently only 0. 0: Allow 1: Alarm Example: 0
ConEventId	no	yes	Array of Uint64	ID of the historical event when added into the allowlist. Example: [201]
CreateTime	no	yes	String	Creation time. Example: 2023-10-10 00:00:00
DestHostWorkloadNum	no	yes	Uint64	Number of the target server workloads. Example: 1
DestIPs	no	yes	Array of String	Target IP configuration. Example: ["192.168.0.204"]
DestLabels	no	yes	Array of MaLabel	Target tag configuration. Example:View
DestPodWorkloadNum	no	yes	Uint64	Number of the target pod workloads. Example: 1
DestPorts	no	yes	Array of String	Target port, which defaults to All if not specified, indicating all. Example: ["80"]
DestType	yes	yes	Uint64	Target configuration type. 0: Tag 1: IP 2: Workload 3: All Example: 1
DestWorkloads	no	yes	Array of MaCustomPolicyWorkload	Target workload configuration. Example:View
Enable	yes	yes	Uint64	Custom allowlist status. 0: Disabled 1: Enabled Example: 1
HandleHistory	no	yes	Int64	Whether to process historical events. 0: Do not process 1: Process Example: 0
Id	no	yes	Uint64	Custom allowlist rule ID. Example: 1
ModifyTime	no	yes	String	Update time. Example: 2023-10-10 00:00:00
Name	yes	yes	String	Name of the custom allowlist rule. Example: policy1
SrcHostWorkloadNum	no	yes	Uint64	Number of the source server workloads. Example: 1
SrcIPs	no	yes	Array of String	Source IP configuration. Example: ["192.168.0.1"]
SrcLabels	no	yes	Array of MaLabel	Source tag configuration. Example:View
SrcPodWorkloadNum	no	yes	Uint64	Number of the source pod workloads. Example: 1
SrcType	yes	yes	Uint64	Source configuration type. 0: Tag 1: IP 2: Workload 3: All Example: 1
SrcWorkloads	no	yes	Array of MaCustomPolicyWorkload	Source workload configuration. Example:View
Updater	yes	yes	String	Creator/updater. Example: user1

OrderModifyConfig

Order configuration adjustment object.

Referenced by the following interfaces: ModifyOrder

name	required	NULL allowed	type	description
InquireKey	yes	yes	String	Billable item name, which starts with sv. Example: sv_yunjing_ue_x
InquireNum	yes	yes	Uint64	Purchase Quantity Example: 10
SubProductCode	yes	yes	String	Subproduct SP_ Example: sp_yunjing_0014

SearchTemplate

Quick search template.

Referenced by the following interfaces: CreateSearchTemplate, DescribeSearchTemplates

name	required	NULL allowed	type	description
Condition	yes	no	String	Search statement. Example: count is_one_of 200
DisplayData	yes	no	String	Data displayed. Example: [{"id":369266774838,"patternsField":"count","selectedtype":"is"}]
Flag	yes	no	String	Search method. Valid values for searches in a search box: standard and filter. Valid value for simple searches: simple. Example: simple
Id	no	no	Uint64	Rule ID. Example: 198
LogType	yes	no	String	Search index type. Example: userlog-vul
Name	yes	no	String	Search name. Example: nOqBFVNMgONSxKmSGYZpekKdZJKFMtuGyxMcJeoMsGEIScvKeDcpSFuzHkTlEjqkGVWameNFwntVRRkEbdoDG@Uayay
Query	yes	no	String	Query statement after conversion. Example: {"index":["userlog-vul"], "body":{"query":{},"sort":[{"create_time":"desc"}]}
TimeRange	yes	no	String	Time range. Example: From 2021-11-11 00:00:00 to 2022-02-01 12:00:00

AssetLoadSummary

Resource load overview.

Referenced by the following interfaces: DescribeAssetLoadInfo

name	required	NULL allowed	type	description
Counts	yes	no	Array of Uint64	Load counts. [ 0% or an unknown number. 0% to 20%. 20% to 50%. 50% to 80%. 80% to 100%. ] Example: [0,1,1,2,3,1]
Top5	yes	yes	Array of AssetLoadDetail	Top 5 loads. Example:View

BaselinePolicy

Baseline policy information.

Referenced by the following interfaces: DescribeBaselinePolicyList, ModifyBaselinePolicy

name	required	NULL allowed	type	description
AssetType	yes	no	Int64	Asset type. 0: all servers with CWP Pro and all servers with CWP Ultimate. 1: server ID. 2: server IP address. Example: 0
DetectInterval	yes	no	Int64	Check interval. 1: 1 day. 3: 3 days. 5: 5 days. 7: 7 days. Example: 7
DetectTime	yes	no	String	Scan time. Example: 09:00:00
HostCount	no	no	Int64	Number of servers associated with the baseline. Example: 0
HostIds	no	no	Array of String	Server ID. Example: ['116d84e9-22d3-4fa3-a31b-a1e58f2bayay']
HostIps	no	no	Array of String	IP address of the server. Example: ["1.1.1.1"]
IsDefault	no	no	Int64	Whether it is the system default policy. Example: 0
IsEnabled	yes	no	Int64	Whether it is enabled. 0: not enabled. 1: enabled. Example: 0
ItemCount	no	no	Int64	Number of associated baseline items. Example: 1419
PolicyId	no	no	Int64	Policy ID. Example: 902471
PolicyName	yes	no	String	Policy name. The maximum length is 128 characters. Example: International standard baseline
RuleCount	no	no	Int64	Number of associated baseline items. Example: 12
RuleIds	no	no	Array of Int64	Rule ID. Example: [11]

AssetEnvBaseInfo

List of environment variables in the asset management module.

Referenced by the following interfaces: DescribeAssetEnvList

name	required	NULL allowed	type	description
FirstTime	no	no	String	First collection time. Example: 2022-07-15 11:27:01
IsNew	no	no	Int64	Whether it is newly added. 0: no. 1: yes. Example: 1
MachineExtraInfo	no	yes	MachineExtraInfo	Supplementary Information Example:View
MachineIp	no	no	String	Server IP. Example: 1.1.1.1
MachineName	no	no	String	Server name. Example: hname
MachineWanIp	no	no	String	Public IP address of a server. Example: 1.1.1.1
Name	no	no	String	Name. Example: BASHOPTS
OsInfo	no	no	String	Operating system. Example: Linux
Quuid	no	no	String	Host QUUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116
Type	no	no	Uint64	The attribute type. Valid values: 0: user variable 1: system variable Example: 1
UpdateTime	no	yes	String	Data update time. Example: 2011-11-11 12:12:12
User	no	no	String	User who triggers initialization. Example: root
Uuid	no	no	String	Host UUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116
Value	no	no	String	The environment variable value. Example: checkwinsize:cmdhist:complete_fullquote:extquote:force_fignore:globasciiranges:hostcomplete:interactive_comments:login_shell:progcomp:promptvars:sourcepath

Place

Referenced by the following interfaces: AddLoginWhiteLists, DescribeLoginWhiteCombinedList, DescribeLoginWhiteList, DescribeLoginWhiteListNew, ModifyLoginWhiteInfo, ModifyLoginWhiteRecord

name	required	NULL allowed	type	description
CityId	yes	no	Uint64	City ID. Example: 99
CountryId	yes	no	Uint64	Country ID Example: 1
Location	no	no	String	Location name. Example: location1:location2:location3
ProvinceId	yes	no	Uint64	Province ID. Example: 23

VulLevelCountInfo

Number of vulnerabilities at each severity level.

Referenced by the following interfaces: DescribeVulHostTop

name	required	NULL allowed	type	description
VulCount	yes	no	Uint64	Number of vulnerabilities. Example: 10
VulLevel	yes	no	Uint64	Vulnerability severity. 1: low. 2: medium. 3: high. 4: critical. Example: 3

SecurityEventInfo

Security event statistics.

Referenced by the following interfaces: DescribeSecurityEventsCnt

name	required	NULL allowed	type	description
EventCnt	yes	no	Uint64	Number of security events. Example: 37
UuidCnt	yes	no	Uint64	Number of affected servers. Example: 6

AssetUserBaseInfo

Basic account information in the asset management module.

Referenced by the following interfaces: DescribeAssetUserList

name	required	NULL allowed	type	description
FirstTime	no	no	String	First collection time. Example: 2011-11-11 12:12:12
Gid	no	no	String	Account GID. Example: 16
HomePath	no	no	String	Home directory. Example: /var/lib/oprofile
IsDomain	no	no	Uint64	Whether a domain account: 0: no; 1: yes; 2: no; 999: null (Windows only). Example: 1
IsNew	no	no	Int64	Whether it is newly added. 0: no. 1: yes. Example: 1
IsRoot	no	no	Uint64	Whether it is granted the root permissions. 0: no. 1: yes. 999: empty string. This parameter is applicable only to Linux systems. Example: 1
IsSshLogin	no	no	Uint64	Whether SSH logins are allowed. 1: allowed. 0: not allowed. 999: empty string. This parameter is applicable only to Linux systems. Example: 1
IsSudo	no	no	Uint64	Whether it is granted the sudo permissions. 1: yes. 0: no. 999: empty string. This parameter is applicable only to Linux systems. Example: 1
LastLoginTime	no	no	String	Last login time. Example: 1
LoginType	no	no	Uint64	Login type. 0: logins are not allowed. 1: only logins with keys are allowed. 2: only logins with passwords are allowed. 3: logins with keys or passwords are allowed. 999: empty string. This parameter is applicable only to Linux systems. Example: 1
MachineExtraInfo	no	yes	MachineExtraInfo	Host information Example:View
MachineIp	no	no	String	Private IP address of the server. Example: 10.0.0.11
MachineName	no	no	String	Server name. Example: redis_node_cvm
MachineWanIp	no	no	String	Public IP address of the server. Example: 112.65.22.19
Name	no	no	String	The username. Example: admin
OsInfo	no	no	String	OS information. Example: Centos 64bit
PasswordChangeTime	no	no	String	Password reset time. Example: 2024-10-22 19:40:38
PasswordDueTime	no	no	String	Time when the password expires. This parameter is applicable only to Linux systems. Example: 2024-10-22 19:40:38
PasswordLockDays	no	no	Int64	Number of days for which the password is locked. -1: never locked. 999: empty string. This parameter is applicable only to Linux systems. Example: 1
PasswordStatus	no	no	Int64	Password status. 1: normal. 2: expire soon. 3: expired. 4: locked. 999: empty string. This parameter is applicable only to Linux systems. Example: 1
ProjectId	no	no	Uint64	ID of the project to which the server belongs. Example: 1
Quuid	no	no	String	Host QUUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116
Shell	no	no	String	Path of the shell. This parameter is applicable only to Linux systems. Example: /bin/bash
ShellLoginStatus	no	no	Uint64	Whether it is a shell login. 0: no. 1: yes. This parameter is applicable only to Linux systems. Example: 1
Status	no	no	Uint64	Account status. 0: disabled. 1: enabled. Example: 1
Uid	no	no	String	Account UID. Example: 16
UpdateTime	no	yes	String	Update time. Example: 2011-11-11 12:12:12
UserType	no	no	Uint64	Account type: 0: guest user; 1: standard user; 2: administrator user; 999: null (Windows only). Example: 1
Uuid	no	no	String	Host UUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116

ScreenBroadcasts

Security notice information in the dashboard visualization module.

Referenced by the following interfaces: DescribeScreenBroadcasts

name	required	NULL allowed	type	description
Id	yes	no	Uint64	Notice ID. Example: 10003
Level	yes	no	Uint64	Severity of the notice. 0: no risk. 1: critical. 2: high. 3: medium. 4: low. Example: 1
Time	yes	no	String	Release time. Example: 2021-03-30 19:17:28
Title	yes	no	String	Title of the notice. Example: The Apache HTTP/2 DoS vulnerability (CVE-2023-44487) has been detected.

ScreenProtection

Attack defense status in the dashboard visualization module.

Referenced by the following interfaces: DescribeScreenProtectionStat

name	required	NULL allowed	type	description
Name	yes	no	String	Type value, which includes file scanning and cleaning, brute force attack, vulnerability scanning, and baseline check. Example: Virus Scanning
Status	yes	no	Uint64	File scanning and cleaning: 0: never checked or no paid asset found. 1: checked and malicious files detected. 2: checked and quarantine protection not enabled. 3: checked, protection enabled, and no risks detected. Brute force attack: 0: protection not enabled and no paid asset found. 1: automatic blocking enabled. Vulnerability scanning: 0: never checked or no paid asset found. 1: vulnerability risks detected. 2: no risks detected. Baseline check: 0: never checked or no paid asset found. 1: baseline risks detected. 2: no risks detected. Example: 1

AttackSource

Attack backtracking information.

Referenced by the following interfaces: DescribeAttackSource

name	required	NULL allowed	type	description
Edges	yes	yes	Array of AttackSourceEdge	Node paths. Example:View
EventInfoParam	yes	yes	String	Event details parameters related to request nodes. Example: params
Nodes	yes	yes	Array of AttackSourceNode	Node description. Example:View

BashEventsInfo

High-risk command details.

Referenced by the following interfaces: DescribeBashEventsInfo

name	required	NULL allowed	type	description
BashCmd	yes	no	String	Command to run. Example: rm
CreateTime	yes	no	String	Event time. Example: 2021-03-30 19:17:28
DetectBy	no	yes	Int64	Data Source Example: agent
Exe	yes	yes	String	Process name. Example: 1.exe
HarmDescribe	yes	yes	String	Description. Example: desc of event
HostIp	yes	no	String	Private IP address of the server. Example: 127.0.0.1
Id	yes	no	Uint64	Data ID. Example: 1001
MachineName	yes	no	String	Server name. Example: redis_node_cvm
MachineStatus	yes	yes	String	Connection status of the server. Valid values: OFFLINE and ONLINE. Example: ONLINE
MachineWanIp	yes	yes	String	Public IP address of the server. Example: 124.2.4.55
ModifyTime	yes	yes	String	Handling time. Example: 2021-03-30 19:17:28
Pid	yes	yes	String	Process ID. Example: 1
Platform	yes	no	Uint64	System type. 2: Windows; 4: Linux. Example: 1
PsTree	yes	yes	String	Process tree in the JSON format. pid: process ID. exe: file path. account: user group and user to which the process belongs. cmdline: command to be run. ssh_service: SSH service. ssh_souurce: login source. Example: "[{"pid":134,"exe":"/usr/bin/bash","account":"root:root","cmdl"
Quuid	yes	no	String	Server ID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116
References	yes	yes	Array of String	Reference link. Example: ["http://www.domain.com"]
RegexBashCmd	yes	yes	String	Auto-generated regular expression. Example: rm -rf /tmp/t*
RuleCategory	yes	yes	Uint64	Rule type. 0: system rule. 1: custom rule. Example: 0
RuleId	yes	no	Uint64	Rule ID. A value of 0 indicates that the rule has been deleted or the effective scope has been modified. Example: 1
RuleLevel	yes	no	Uint64	Rule severity. 1: high. 2: medium. 3: low. Example: 1
RuleName	yes	no	String	Rule Name Example: redis_node_use
Status	yes	no	Uint64	Handling status. 0: to be handled. 1: handled. 2: added to the allowlist. 3: ignored. Example: 1
SuggestScheme	yes	yes	String	Suggestion scheme. Example: attempt to repair
Tags	yes	yes	Array of String	Tag. Example: ["tag-redis","tag-nginx"]
User	yes	yes	String	Login user. Example: root
Uuid	yes	no	String	Host UUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116

RiskMainClass

Risk service during Java Webshell and RASP injection.

Referenced by the following interfaces: DescribeInjectRiskyServiceSwitch

name	required	NULL allowed	type	description
ServiceName	no	yes	String	Risk service during RASP injection. Example: 1

AssetMachineBaseInfo

Basic server information in the asset fingerprint module.

Referenced by the following interfaces: DescribeAssetMachineList

name	required	NULL allowed	type	description
Cpu	no	no	String	CPU information. Example: Intel(R) Xeon(R) Gold 6148 CPU @ 2.40GHz
CpuLoad	no	no	String	CPU utilization in percentage. Example: 54.2
CpuLoadNum	no	yes	String	CPU load readings (only valid for Linux systems). Example: 0
CpuSize	no	no	Uint64	Number of CPU cores. Example: 1
DiskLoad	no	no	String	Disk usage in percentage. Example: 22.4
DiskSize	no	no	Uint64	Disk capacity. Unit: GB. Example: 100
FirstTime	no	no	String	First collection time. Example: 2022-07-15 11:27:01
IsNew	no	no	Int64	Whether it is newly added. 0: no. 1: yes. Example: 1
MachineExtraInfo	no	yes	MachineExtraInfo	Supplementary Information Example:View
MachineIp	no	no	String	Server private IP address. Example: 10.0.0.11
MachineName	no	no	String	Server name. Example: any-machine
MachineWanIp	no	no	String	Public IP address of the server. Example: 112.22.662.11
MemLoad	no	no	String	Memory utilization in percentage. Example: 22.5
MemSize	no	no	Uint64	Memory capacity. Unit: GB. Example: 1024
OsInfo	no	no	String	OS name. Example: windows
PartitionCount	no	no	Uint64	Number of partitions Example: 1
ProjectId	no	no	Uint64	Project ID. Example: 1
Quuid	no	no	String	QUUID of the server. Example: acdd5474-6360-4fd4-bfc7-843162cb8116
Tag	no	yes	Array of MachineTag	Tag. Example:View
UpdateTime	no	yes	String	Data update time. Example: 2011-11-11 12:12:12
Uuid	no	no	String	UUID of the server. Example: acdd5474-6360-4fd4-bfc7-843162cb8116

PrivilegeEventInfo

Local privilege escalation data.

Referenced by the following interfaces: DescribePrivilegeEventInfo

name	required	NULL allowed	type	description
CmdLine	yes	no	String	Command to run. Example: /bin/nginx
CreateTime	yes	no	String	Event time. Example: 2024-10-30 02:19:08
FullPath	yes	no	String	Process path. Example: /bin/nginx
HarmDescribe	yes	no	String	Risk description. Example: After hacking a server, hackers may perform operations such as downloading malicious files, connecting to a mining pool, adding public keys, and viewing sensitive files for further malicious actions.
HostIp	yes	no	String	Private IP address of the server. Example: 10.0.0.1
Id	yes	no	Uint64	Data ID. Example: 1
MachineName	yes	no	String	The host name. Example: ins-agent
MachineStatus	yes	no	String	Connection status of the server. Valid values: OFFLINE and ONLINE. Example: ONLINE
MachineWanIp	yes	no	String	Public IP address of the server. Example: 124.2.4.55
ModifyTime	yes	no	String	Handling time. Example: 2021-03-30 19:17:28
NewCaps	yes	no	String	List of permissions. Multiple permissions are separated with vertical lines (
ParentProcGroup	yes	no	String	User group of the parent process. Example: root
ParentProcName	yes	no	String	Parent process name. Example: /bin/ssh
ParentProcPath	yes	no	String	Path of the parent process. Example: /bin/ssh
ParentProcUser	yes	no	String	Username of the parent process. Example: root
ProcFilePrivilege	yes	no	String	Permissions on the process file. Example: rwx
ProcessName	yes	no	String	Process name. Example: nginx
PsTree	yes	no	String	Process tree in the JSON format. pid: process ID. exe: file path. account: user group and user to which the process belongs. cmdline: command to be run. ssh_service: SSH service. ssh_souurce: login source. Example: {"pid":"143","account":"root","exe":"/tmp"}
Quuid	yes	no	String	Host UUID. Example: e5b4724c-49af-46ab-bd84-cdbae897e7e0
References	yes	no	Array of String	Reference link. Example: ["http://www.domain.com"]
Status	yes	no	Uint64	Handling status. 0: to be handled. 2: added to the allowlist. 3: handled. 4: ignored. Example: 0
SuggestScheme	yes	no	String	Suggestion scheme. Example: 1. Check for malicious processes and invalid ports, and delete suspicious startup items and scheduled tasks. 2. Isolate or delete relevant Trojan files.
Tags	yes	no	Array of String	Tag. Example: ["redis_use","nginx_use"]
UserGroup	yes	no	String	User Group Example: root
UserName	yes	no	String	User name. Example: root
Uuid	yes	no	String	UUID of the CWP agent. Example: e5b4724c-49af-46ab-bd84-cdbae897e7e0

ComponentStatistics

Component statistics.

Referenced by the following interfaces: DescribeComponentStatistics

name	required	NULL allowed	type	description
ComponentName	yes	no	String	Component name. Example: nginx
ComponentType	yes	no	String	Component type. WEB: web component. SYSTEM: system component Example: WEB
Description	yes	no	String	Description of the component. Example: nginx web
Id	yes	no	Uint64	Component ID. Example: 100010
MachineNum	yes	no	Uint64	Number of servers. Example: 10

BashEventsInfoNew

High-risk command details (new).

Referenced by the following interfaces: DescribeBashEventsInfoNew

name	required	NULL allowed	type	description
BashCmd	yes	no	String	Command to run. Example: rm
CreateTime	yes	no	String	Event time. Example: 2021-03-30 19:17:28
DetectBy	yes	yes	Int64	Detection source. 0: bash command. 1: real-time monitoring. Example: 0
Exe	yes	yes	String	Process name. Example: 1.exe
HarmDescribe	yes	yes	String	Description. Example: desc of event
HostIp	yes	no	String	Private IP address of the server. Example: 127.0.0.1
Id	yes	no	Uint64	Data ID. Example: 1
MachineName	yes	no	String	Server name. Example: redis_node_cvm
MachineStatus	yes	yes	String	Connection status of the server. Valid values: OFFLINE and ONLINE. Example: ONLINE
MachineType	yes	yes	Int64	0: Basic Edition. 1: Professional Edition. 2: Ultimate Edition. Example: 1
MachineWanIp	yes	yes	String	Public IP address of the server. Example: 124.2.4.55
ModifyTime	yes	yes	String	Handling time. Example: 2021-03-30 19:17:28
Pid	yes	yes	String	Process ID. Example: 1
Platform	yes	no	Uint64	System type. 2: Windows; 4: Linux. Example: 1
PsTree	yes	yes	String	Process tree in the JSON format. pid: process ID. exe: file path. account: user group and user to which the process belongs. cmdline: command to be run. ssh_service: SSH service. ssh_souurce: login source. Example: "[{"pid":134,"exe":"/usr/bin/bash","account":"root:root","cmdl"
Quuid	yes	no	String	Server ID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116
References	yes	yes	Array of String	Reference link. Example: ["http://www.domain.com"]
RegexBashCmd	yes	yes	String	Auto-generated regular expression. Example: rm -rf /tmp/t*
RuleCategory	yes	yes	Uint64	Rule type. 0: system rule. 1: custom rule. Example: 0
RuleId	yes	no	Uint64	Rule ID. A value of 0 indicates that the rule has been deleted or the effective scope has been modified. Example: 1
RuleLevel	yes	no	Uint64	Rule severity. 1: high. 2: medium. 3: low. Example: 1
RuleName	yes	no	String	Rule Name Example: redis_node_use
Status	yes	no	Uint64	Handling status. 0: to be handled. 1: handled. 2: added to the allowlist. 3: ignored. Example: 1
SuggestScheme	yes	yes	String	Suggestion scheme. Example: attempt to repair
Tags	yes	yes	Array of String	Tag. Example: ["tag-redis","tag-nginx"]
User	yes	yes	String	Login user. Example: user1
Uuid	yes	no	String	CWP ID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116

StandardModeConfig

Configuration of standard blocking.

Referenced by the following interfaces: DescribeBanMode

name	required	NULL allowed	type	description
Ttl	yes	no	Uint64	Blocking period. Unit: seconds. Example: 300

HostLoginWhiteObj

Newly added login audit allowlist.

Referenced by the following interfaces: AddLoginWhiteLists

name	required	NULL allowed	type	description
EndTime	no	no	String	End time. Example: 2024-11-03 18:37:03
HostInfos	yes	no	Array of HostInfo	Information about the servers on which an allowlist takes effect. Example:View
IsGlobal	yes	no	Uint64	Whether it takes effect globally. 1: globally effective. 0: effective only on a single server. Example: False
Places	no	no	Array of Place	Regions in the allowlist. Example:View
Remark	no	no	String	Description. Example: Internal use
SrcIp	yes	no	String	Source IP addresses or CIDR blocks in the allowlist. Multiple IP addresses or CIDR blocks are separated with commas (,). Example: 10.0.1.11
StartTime	no	no	String	Start time. Example: 2024-11-03 18:37:03
UserName	yes	no	String	Users in the allowlist. Multiple usernames are separated with commas (,). Example: root

BaselineCustomRuleIdName

ID and name of a custom baseline rule.

Referenced by the following interfaces: DescribeBaselineItemIgnoreList, DescribeBaselineItemInfo, DescribeIgnoreHostAndItemConfig

name	required	NULL allowed	type	description
RuleId	yes	yes	Int64	Custom rule ID. Example: 1
RuleName	yes	yes	String	Custom rule name. Example: Custom

AttackSourceEdge

Path description in attack backtracking.

Referenced by the following interfaces: DescribeAttackSource

name	required	NULL allowed	type	description
From	yes	no	String	Starting node. Example: node_a
To	yes	no	String	Target node. Example: node_b

DefaultStrategyInfo

Basic information about the default policy.

Referenced by the following interfaces: DescribeBaselineDefaultStrategyList

name	required	NULL allowed	type	description
StrategyId	yes	no	Uint64	Policy ID. Example: 1
StrategyName	yes	no	String	Policy name. Example: International standard baseline

MaSelfLearnPolicy

Referenced by the following interfaces: DescribeMaSelfLearnPolicyList

name	required	NULL allowed	type	description
CreateTime	no	yes	String	Creation time. Example: 2023-10-10 00:00:00
DestIP	no	yes	String	Policy IP, assigned here when DestLabels is empty. Example: 2.2.2.2
DestLabels	no	yes	Array of MaLabel	Target tags Example:View
DestPort	no	yes	Uint64	Target port. Example: 8080
Id	no	yes	Uint64	Self-Learning policy ID. Example: 1
MatchCount	no	yes	Uint64	Number of packets hit. Example: 1
ModifyTime	no	yes	String	Update time. Example: 2023-10-10 00:00:00
SrcIP	no	yes	String	Policy IP, assigned here when SrcLabels is empty. Example: 1.1.1.1
SrcLabels	no	yes	Array of MaLabel	Source label Example:View
UniqueId	no	yes	String	Unique ID of the self-learning policy. Example: uniqdgs

BruteAttackRule

Standard blocking rule.

Referenced by the following interfaces: ModifyBruteAttackRules

name	required	NULL allowed	type	description
LoginFailTimes	yes	no	Uint64	Number of failed brute force attack events. Example: 6
TimeRange	yes	no	Uint64	Time period during which brute-force attack events occurred. Unit: seconds. Example: 1

KeyValueInfo

Key-Value index configuration

Referenced by the following interfaces: DescribeLogIndex

name	required	NULL allowed	type	description
CaseSensitive	yes	no	Bool	Whether it is case-sensitive. Example: false
KeyValues	yes	yes	Array of KeyValueArrayInfo	Key-value pair information for which you want to create an index. Example:View

MalwareRisk

Risk notifications for malicious files.

Referenced by the following interfaces: DescribeMalwareRiskWarning

name	required	NULL allowed	type	description
CreateTime	yes	no	String	Detection time. Example: 2022-01-01 00:00:00
Id	yes	no	Uint64	Unique ID. Example: 10001
MachineIp	yes	no	String	Server IP address. Example: 1.1.1.1
VirusName	yes	no	String	Virus name. Example: Linux.Trojan.Downloader.Snkl

CKafkaTopicInfo

Name of the CKafka topic.

Referenced by the following interfaces: DescribeLogDeliveryKafkaOptions

name	required	NULL allowed	type	description
TopicID	yes	no	String	Topic ID. Example: topic_gsyds
TopicName	yes	no	String	Topic name. Example: topic_dsyg

SecurityTrend

Security trend statistics.

Referenced by the following interfaces: DescribeSecurityTrends

name	required	NULL allowed	type	description
Date	yes	no	Date	Time when the event occurred. Example: 2023-07-11
EventNum	yes	no	Uint64	Number of events. Example: 10

BroadcastInfo

Security notice details.

Referenced by the following interfaces: DescribeSecurityBroadcastInfo

name	required	NULL allowed	type	description
Content	yes	no	String	Rick text. Example: Vulnerability details
CreateTime	yes	no	String	Release time. Example: 2021-03-30 19:17:28
GotoType	yes	yes	Uint64	Location to redirect to. 0: no redirection. 1: file scanning and cleaning. 2: vulnerability scanning. 3: baseline check. Example: 1
Id	yes	no	Uint64	Unique ID of the notice. Example: 12
Subtitle	yes	no	String	Subtitle of the notice. Example: The new version supports vulnerability fixing.
Title	yes	yes	String	Title of the notice. Example: Vulnerability outbreak
Type	yes	no	Uint64	Type. 0: emergent notification. 1: feature update. 2: industrial honor. 3: version release. Example: 1

AssetDiskPartitionInfo

Information about asset management disk partitions.

Referenced by the following interfaces: DescribeAssetDiskList, DescribeAssetMachineDetail

name	required	NULL allowed	type	description
Name	yes	no	String	Partition name. Example: /dev/vda1
Path	yes	no	String	Mount directory. Example: /data
Percent	yes	no	Float	Partition usage rate. Example: 78.81294
Size	yes	no	Uint64	Partition size in GB. Example: 50
Type	yes	no	String	File system type. Example: ext4
Used	yes	no	Uint64	Used space size in GB. Example: 26

AssetAppBaseInfo

Basic resource information in the asset management module.

Referenced by the following interfaces: DescribeAssetAppList

name	required	NULL allowed	type	description
BinPath	no	no	String	Binary path. Example: /root
ConfigPath	no	no	String	Path of the configuration file. Example: /root
Desc	no	no	String	The description of the application. Example: app info
FirstTime	no	no	String	First collection time. Example: 2022-07-15 11:27:01
IsNew	no	yes	Int64	Whether it is newly added. 0: no. 1: yes. Example: 1
MachineExtraInfo	no	yes	MachineExtraInfo	Supplementary Information Example:View
MachineIp	no	no	String	Private IP address of the server. Example: 10.0.0.11
MachineName	no	no	String	Server name. Example: agentyo
MachineWanIp	no	no	String	Public IP address of the server. Example: 192.168.0.204
Name	no	no	String	Application name. Example: php
OsInfo	no	no	String	OS information. Example: centos 64bit
ProcessCount	no	no	Uint64	Number of associated processes. Example: 1
ProjectId	no	no	Uint64	ID of the project to which the server belongs. Example: 1
Quuid	no	no	String	Host QUUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116
Tag	no	yes	Array of MachineTag	Server tags. Example:View
Type	no	no	Uint64	Application type. 1: OPS. 2: database 3: security 4: suspicious application 5: system architecture 6: system application 7: web service 99: others Example: 1
UpdateTime	no	yes	String	Data update time. Example: 2011-11-11 12:12:12
Uuid	no	no	String	Host UUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116
Version	no	no	String	Version number. Example: 1.0

AgentInstallResult

Agent installation result of a host.

Referenced by the following interfaces: DescribeAgentInstallResult, DescribeAgentInstallTaskResult, ModifyAssetsProtectionStatus

name	required	NULL allowed	type	description
AppId	no	yes	Uint64	App ID information Example: 1255080011
AssetId	no	yes	String	Asset ID Example: ins-fsguhjbf
Code	no	yes	String	Error code. Empty: Successful. ErrLicenseNotEnough: Insufficient license. ErrStrTatNotOnline: TAT client not online. ErrStrAgentInstallTimeout: Task timeout. ErrStrLicenseLocked: Authorization operation in progress. Example: ErrStrLicenseLocked
MemberId	no	yes	String	member-id Example: member-jdkaghdjag
Message	no	yes	String	Error message. Example: PayResourceChangingQuota
Region	no	yes	String	Region. Example: ap-region1

AssetWebLocationPath

Virtual directory of a website in the asset management module.

Referenced by the following interfaces: DescribeAssetWebLocationPathList

name	required	NULL allowed	type	description
Group	yes	no	String	Group to which the file belongs. Example: root
Permission	yes	no	String	File permissions. Example: rwxay
RealPath	yes	no	String	Physical path. Example: /var/www/html
User	yes	no	String	File owner. Example: root
VirtualPath	yes	no	String	Virtual path. Example: /var/www/html

CreateVulFixTaskQuuids

QUUIDs of the servers for which the fix task is created.

Referenced by the following interfaces: CreateVulFix

name	required	NULL allowed	type	description
FixMethod	no	yes	Uint64	Repair method. 0: Update components or install patches. 1: Disable service. Example: 0
Quuids	yes	no	Array of String	Servers for which you want to fix the vulnerability. The vulnerability specified by VulId must be detected and in the To Be Fixed state on all specified servers. Example: ["e5b4724c-49af-46ab-bd84-cdbae897e7e0"]
VulId	yes	no	Uint64	Vulnerability ID. Example: 1089

RegionListDetail

Details of the region list

Referenced by the following interfaces: DescribeMachineRegionList

name	required	NULL allowed	type	description
CloudFrom	no	yes	Uint64	0: cloud. 1: IDC. 2: Alibaba Cloud. 3: Huawei Cloud. 4: Amazon. 5: Microsoft. 6: Google. 7: Oracle. 8: Digital Ocean. Example: 0
MachineType	no	yes	String	Machine type. CVM: CVM. LH: Cloud Platform Lighthouse. ECM: Edge Computing Machine. BM: Bare Metal Service 1.0 Server. Other: Other servers (non-cloud servers). Example: CVM
RegionList	no	yes	Array of RegionInfo	Region List Example:View

AssetJarBaseInfo

List of JAR packages in the asset management module.

Referenced by the following interfaces: DescribeAssetJarList

name	required	NULL allowed	type	description
FirstTime	no	no	String	First collection time. Example: 2022-07-15 11:27:01
Id	no	no	String	ID of the JAR package. Example: 1024
IsNew	no	no	Int64	Whether it is newly added. 0: no. 1: yes. Example: 1
MachineExtraInfo	no	yes	MachineExtraInfo	Supplementary Information Example:View
MachineIp	no	no	String	Server IP. Example: 10.0.0.11
MachineName	no	no	String	Server name. Example: any-instance
MachineWanIp	no	no	String	Public IP address of a server. Example: 1.1.1.1
Md5	no	no	String	MD5 value of the JAR package. Example: fc702c8398071ea3697d449c2b894dae
Name	no	no	String	Name. Example: com.apple.util
OsInfo	no	no	String	Operating system. Example: centos 64bit
Path	no	no	String	Path Example: /root
Quuid	no	no	String	Host QUUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116
Status	no	no	Uint64	Whether it can be executed. 0: unknown. 1: yes. 2: no. Example: 1
Type	no	no	Int64	Type. 1: application program. 1: system library. 3: built-in library of a web service. 8: others. Example: 1
UpdateTime	no	yes	String	Data update time. Example: 2011-11-11 12:12:12
Uuid	no	no	String	Host UUID. Example: acdd5474-6360-4fd4-bfc7-843162cb8116
Version	no	no	String	Version. Example: 1.0.1

ClsLogsetInfo

CLS Log Set Information

Referenced by the following interfaces: DescribeClsLogsets

name	required	NULL allowed	type	description
AssumerName	no	yes	String	Cloud Product Identifier Example: CWP
CreateTime	no	yes	String	Creation Time Example: 2021-04-01 08:00:00
LogsetId	no	yes	String	Logset ID Example: 25425
LogsetName	no	yes	String	Logset Name Example: redis_node_log
TopicCount	no	yes	Uint64	Total number of log topics. Example: 10

BaselineDownload

Parameters used to download exported baseline results.

Referenced by the following interfaces: DescribeBaselineDownloadList

name	required	NULL allowed	type	description
DownloadUrl	yes	no	String	The download URL. Example: https://cwp-1258344699.cos.ap-region1.mydomain.com/baseline-rule-view-result-20220823-095a9c44-7cc5-49c0-a02b-9a3e3442d5d6.csv?q-sign-algorithm=sha1
EndTime	yes	no	String	Completion time. Example: 2021-02-01 12:00:00
StartTime	yes	no	String	Start time. Example: 2021-02-01 12:00:00
Status	yes	no	Int64	Status. 0: not completed. 1: completed. Example: [0: not completed
TaskId	yes	no	Int64	Task ID. Example: 1661258891
TaskName	yes	no	String	Task Name Example: baseline_rule_view_result_2021-02-01 12:00:00

AttackSourceNode

Attack backtracking node.

Referenced by the following interfaces: DescribeAttackSource

name	required	NULL allowed	type	description
EndTime	yes	no	String	End time. Example: 2021-03-30 19:17:28
EventId	yes	no	Uint64	Event ID. If no value is returned, no corresponding event is queried. Example: 1
EventType	yes	no	String	BRUTEFORCE: password cracking. MALWARE: trojan attack. BASH: high-risk command. RISK_DNS: malicious request. LOGIN: login from an unusual location. HOST: server node. TIME_ORDER: general node. Example: BRUTEFORCE
Ip	yes	no	String	Node IP address. This parameter is available when the value of EventType is HOST. Example: 10.0.0.1
Level	yes	no	Uint64	Severity. 0: informational. 1: low-risk. 2: medium-risk. 3: high-risk. 4: critical. Example: 0
NodeDesc	yes	no	String	Description of the general node. Example: desc
NodeDetail	yes	no	String	Node details. Example: detail
NodeId	yes	no	String	Node ID. Example: node-uniqueid
StartTime	yes	no	String	Start time. Example: 2021-03-30 19:17:28
TimeLineNum	yes	no	Uint64	Timeline ID. Nodes with the same timeline ID belong to the same timeline. Example: 1

DeliverTypeDetails

Details of a log shipping type.

Referenced by the following interfaces: DescribeLogClsDeliverInfo, DescribeLogKafkaDeliverInfo, ModifyLogKafkaAccess

name	required	NULL allowed	type	description
ErrInfo	no	no	String	Error message. Example: kafka: client has run out of available brokers to talk to: dial tcp 9.151.101.93:6232: i/o timayay
LogName	no	yes	String	Logset name Example: web_logs
LogSetId	no	yes	String	Logset ID Example: 269e5897-009a-4c5e-9350-5898964ayayay
LogType	yes	no	Array of Int64	Log type of the security module. Valid values when the security module type is "1: virus scanning": 1: file scan; 2: abnormal login; 3: password cracking; 4: malicious request; 5: high-risk command; 6: local privilege escalation; 7: reverse shell; 8: abnormal process.\nValid values when the security module type is "2: vulnerability management": 1: emergency vulnerability; 2: Linux software vulnerability; 3: Windows system vulnerability; 4: Web-CMS vulnerability; 5: application vulnerability; 6: vulnerability defense.\nValid values when the security module type is "3: baseline management": 1: security baseline.\nValid values when the security module type is "4: advanced defense": 1: Java Webshell; 2: core file monitoring; 3: attack detection; 4: webpage tampering prevention.\nValid values when the security module type is "5: client-related": 1: client offline; 2: client uninstalled.\nValid values when the security module type is "6: asset fingerprint": 1: resource monitoring; 2: account; 3: port; 4: process; 5: software application; 6: database; 7: web application; 8: web service; 9: web framework; 10: website; 11: JAR package; 12: startup service; 13: scheduled task; 14: environment variable; 15: kernel module.\nValid values when the security module type is "7: host list": 1: host list.\nValid values when the security module type is "8: client log": 1: client log; 2: DNS log; 3: process snapshot; 4: network 5-tuple; 5: file write; 6: login record. Example: [1,2]
Region	no	yes	String	Logset region Example: ap-region1
SecurityType	yes	no	Uint64	Security module type. 1: intrusion detection; 2: vulnerability management; 3: baseline management; 4: advanced defense; 5: client security; 6: asset fingerprint; 7: host list; 8: client reporting. Example: 1
Status	no	no	Uint64	Log shipping status. 1: not enabled. 1: normal. 2: abnormal. Example: 1
StatusTime	no	no	Int64	Timestamp of last status reporting. Example: 1
Switch	yes	no	Uint64	Log shipping status. 0: disabled. 1: enabled. Example: 1
TopicId	yes	no	String	Topic ID. Example: topic-70s2ayay
TopicName	yes	no	String	Topic Name Example: log-recive

RegionSet

Region information.

Referenced by the following interfaces: DescribeBanRegions

name	required	NULL allowed	type	description
RegionName	yes	no	String	The region name. Example: region1
ZoneSet	yes	no	Array of ZoneInfo	Information on availability zones. Example:View

PushTaskResult

Scan result of a task delivered for quick protection.

Referenced by the following interfaces: CreateQuickProtectSetting

name	required	NULL allowed	type	description
FailureReason	yes	no	String	Reason for the delivery failure. Example: Checking…
IsSuccess	yes	no	Bool	Whether the task is successfully delivered. Example: true
TaskId	yes	no	Uint64	Task ID. Example: 1
TaskType	yes	no	String	Task type. Vul: vulnerability detection. Malware: file scanning and cleaning. Baseline: baseline check. AutoBan: automatic blocking. Example: Vul

MaPod

Referenced by the following interfaces: DescribeMaPodList

name	required	NULL allowed	type	description
AlarmCount	no	yes	Int64	Number of workload alarms. Example: 10
ClusterId	no	yes	String	cluster ID Example: cls-ogbbasz4
ClusterName	no	yes	String	Cluster Name Example: any_dev1
Id	no	yes	Int64	ID Example: 1
IsEnabled	no	yes	Int64	Whether monitoring is enabled [1: Enabled; 0: Disabled]. Example: 1
IsNew	no	yes	Int64	Whether it is added in 15 days [1: Yes; 0: No]. Example: 1
IsSupportMa	no	yes	Int64	Whether to support micro-alarms [1: Yes; 0: No]. Example: 0
Labels	no	yes	Array of MaLabel	Tag. Example:View
LearnEndTime	no	yes	String	End time of learning for a single workload. Example: 2024-01-01 00:00:00
LearnStartTime	no	yes	String	Start time of learning for a single workload. Example: 2024-01-01 00:00:00
Name	no	yes	String	Server name. Example: redis_node_cvm
Namespace	no	yes	String	Namespace of the pod. Example: system
NotSupportMaCode	no	yes	Int64	Reason for not supporting micro-alarms [0: Supported; 1: Low client version; 2: Not premium edition; 3: Client not installed]. Example: 0
PodIp	no	yes	String	Pod IP Example: 10.0.0.1
Status	no	yes	String	Pod status. Example: Running

name	required	NULL allowed	type	description
TagKey	yes	no	String	Tag key. Example: business1
TagValue	yes	no	String	Tag value Example: businessValue