{"openapi":"3.1.0","info":{"title":"Apizie","version":"2.0.0","description":"One API key, one envelope, many public data sources."},"servers":[{"url":"https://www.apizie.tech"}],"security":[{"ApiKeyAuth":[]}],"paths":{"/v1/cloud:aliyun-cloud-siem/add-data-source":{"post":{"operationId":"cloud_aliyun_cloud_siem_add_data_source","summary":"Adds a data source under the bound multi-cloud account","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["CloudCode"],"properties":{"AccountId":{"type":"string","description":"The cloud account ID"},"DataSourceType":{"type":"string","description":"The data source type. Valid values: obs: Huawei Cloud OBS. wafApi: Tencent Cloud WAF download API. ckafka: Tencent Cloud CKafka"},"DataSourceInstanceName":{"type":"string","description":"The data source name"},"DataSourceInstanceRemark":{"type":"string","description":"The data source remarks"},"DataSourceInstanceParams":{"type":"string","description":"The data source parameters in JSON array format"},"CloudCode":{"type":"string","enum":["qcloud","hcloud","aliyun"],"description":"The code of the cloud provider"},"RegionId":{"type":"string","description":"The region where the threat analysis data management center is located. Select the management center region based on the region of your…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/add-data-source-log":{"post":{"operationId":"cloud_aliyun_cloud_siem_add_data_source_log","summary":"Adds logs","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["DataSourceInstanceId","DataSourceInstanceLogs","AccountId","CloudCode"],"properties":{"LogCode":{"type":"string","description":"The log code"},"DataSourceInstanceId":{"type":"string","description":"The ID of the data source instance. You can call the ListBindDataSources operation to query the ID"},"DataSourceInstanceLogs":{"type":"string","description":"The details of the data source parameters in JSON array format"},"AccountId":{"type":"string","description":"The cloud account ID"},"CloudCode":{"type":"string","enum":["qcloud","hcloud","aliyun"],"description":"The multi-cloud code. Valid values: qcloud: Tencent Cloud. hcloud: Huawei Cloud. aliyun: Alibaba Cloud. This value is used only for…"},"RegionId":{"type":"string","description":"The region of the data management center for Threat Analysis. You must select the region of the management center based on the region…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/add-user-source-log-config":{"post":{"operationId":"cloud_aliyun_cloud_siem_add_user_source_log_config","summary":"Adds a log ingestion task to import the corresponding log data into Threat Analysis for subsequent alerting…","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["SubUserId","SourceLogInfo"],"properties":{"SourceProdCode":{"type":"string","description":"The product code"},"SourceLogCode":{"type":"string","description":"The log code"},"SubUserId":{"type":"integer","description":"The Alibaba Cloud account ID for which logs are to be ingested"},"SourceLogInfo":{"type":"string","description":"The detailed Simple Log Service (SLS) information for the logs to be ingested, in JSON format"},"DisPlayLine":{"type":"string","description":"The detailed Simple Log Service (SLS) information for the logs to be ingested"},"Deleted":{"type":"integer","description":"Specifies whether to add or delete the ingestion task. Valid values: -1: Deletes the ingestion task. 0: Adds the ingestion task"},"RegionId":{"type":"string","description":"The region where the data management center of Threat Analysis is located. You must select the region of the management center based on…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/bind-account":{"post":{"operationId":"cloud_aliyun_cloud_siem_bind_account","summary":"Binds a multi-cloud account configured in the multi-cloud assets of Security Center to Threat Analysis","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["AccessId","AccountName","AccountId","CloudCode"],"properties":{"AccessId":{"type":"string","description":"The AccessKey ID of the cloud account"},"AccountName":{"type":"string","description":"The name of the multi-cloud account"},"AccountId":{"type":"string","description":"The ID of the cloud account"},"CloudCode":{"type":"string","enum":["qcloud","hcloud"],"description":"The code of the multi-cloud provider. Valid values: hcloud: Huawei Cloud qcloud: Tencent Cloud"},"RegionId":{"type":"string","description":"The region of the data management center for Threat Analysis. Select the region of the management center based on the region where your…"},"RoleFor":{"type":"integer","description":"The ID of the user whose perspective the administrator switches to"},"RoleType":{"type":"integer","description":"The view type. Valid values: 0: The view of the current Alibaba Cloud account. 1: The view of all accounts in the enterprise"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/close-delivery":{"post":{"operationId":"cloud_aliyun_cloud_siem_close_delivery","summary":"Disables log delivery for an integrated cloud service. After the delivery is disabled, no new logs are…","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["ProductCode"],"properties":{"ProductCode":{"type":"string","description":"The code of the cloud service. Valid values: qcloud_waf qlcoud_cfw hcloud_waf hcloud_cfw ddos sas cfw config csk fc rds nas apigateway cdn…"},"LogCode":{"type":"string","description":"The log code of the cloud service, such as the process log in Security Center. For valid values, refer to the response of the ListDelivery…"},"RoleType":{"type":"integer","description":"The view type. Valid values: 0: the view of the current Alibaba Cloud account 1: the view of all accounts in the enterprise"},"RoleFor":{"type":"integer","description":"The ID of the user whose perspective the administrator switches to"},"RegionId":{"type":"string","description":"The region where the data management center of Threat Analysis is located. You must select the region of the management center based on…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/delete-automate-response-config":{"post":{"operationId":"cloud_aliyun_cloud_siem_delete_automate_response_config","summary":"Deletes the automated response rule with the specified ID","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"Id":{"type":"integer","description":"The ID of the automated response configuration rule"},"RoleType":{"type":"integer","description":"The view type. Valid values: 0: The view of the current Alibaba Cloud account. 1: The view of all accounts in the enterprise"},"RoleFor":{"type":"integer","description":"The ID of the user whose perspective the administrator switches to"},"RegionId":{"type":"string","description":"The region where the data management center for Threat Analysis is located. Select the region of the management center based on the region…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/delete-bind-account":{"post":{"operationId":"cloud_aliyun_cloud_siem_delete_bind_account","summary":"Unbinds a multi-cloud (Tencent Cloud or Huawei Cloud) sub-account AccessKey that is bound to the threat…","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["AccountId","AccessId","CloudCode"],"properties":{"BindId":{"type":"integer","description":"The binding ID. You can call ListBindAccount…"},"AccountId":{"type":"string","description":"The cloud account ID"},"AccessId":{"type":"string","description":"The AccessKey ID of the cloud account"},"CloudCode":{"type":"string","enum":["qcloud","hcloud"],"description":"The code of the multi-cloud provider. Valid values: qcloud: Tencent Cloud. aliyun: Alibaba Cloud. hcloud: Huawei Cloud"},"RegionId":{"type":"string","description":"The region where the threat analysis data management center is located. Select the management center based on the region of your assets.…"},"RoleType":{"type":"integer","description":"The view type. Valid values: 0: The view of the current Alibaba Cloud account. 1: The view of all accounts in the enterprise"},"RoleFor":{"type":"integer","description":"The ID of the member to which the administrator switches the view"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/delete-customize-rule":{"post":{"operationId":"cloud_aliyun_cloud_siem_delete_customize_rule","summary":"Deletes a custom rule based on a specified ID","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"RuleId":{"type":"integer","description":"The ID of the custom rule"},"RoleType":{"type":"integer","description":"The view type. Valid values: 0: the view of the current Alibaba Cloud account. 1: the view of all accounts in the enterprise"},"RoleFor":{"type":"integer","description":"The ID of the user to whom the administrator switches the view. This parameter allows an administrator to switch to the perspective of a…"},"RegionId":{"type":"string","description":"The region where the service resides"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/delete-data-source":{"post":{"operationId":"cloud_aliyun_cloud_siem_delete_data_source","summary":"Deletes a data source that is no longer in use","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["DataSourceInstanceId","AccountId","CloudCode"],"properties":{"DataSourceInstanceId":{"type":"string","description":"The data source ID, which is an MD5 hash generated by threat detection and response based on specific parameters. You can call…"},"AccountId":{"type":"string","description":"The Alibaba Cloud account ID"},"CloudCode":{"type":"string","enum":["qcloud","hcloud","aliyun"],"description":"The code of the cloud service provider. Valid values: qcloud: Tencent Cloud. aliyun: Alibaba Cloud. hcloud: Huawei Cloud"},"RegionId":{"type":"string","description":"The region where the threat detection and response data management center is located. Specify the management center based on the region of…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/delete-data-source-log":{"post":{"operationId":"cloud_aliyun_cloud_siem_delete_data_source_log","summary":"Deletes a log","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["LogInstanceId","DataSourceInstanceId","AccountId","CloudCode"],"properties":{"LogInstanceId":{"type":"string","description":"The log ID, which is an MD5 hash generated by Cloud Threat Detection and Response (CTDR) based on specific parameters. You can call…"},"DataSourceInstanceId":{"type":"string","description":"The data source ID, which is an MD5 hash generated by CTDR based on specific parameters. You can call ListDataSourceLogs…"},"AccountId":{"type":"string","description":"The Alibaba Cloud account ID"},"CloudCode":{"type":"string","enum":["qcloud","hcloud","aliyun"],"description":"The code of the cloud service provider. Valid values: qcloud: Tencent Cloud. aliyun: Alibaba Cloud. hcloud: Huawei Cloud"},"RegionId":{"type":"string","description":"The region where the CTDR data management center is located. Specify the management center based on the region of your assets. Valid…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/delete-white-rule-list":{"post":{"operationId":"cloud_aliyun_cloud_siem_delete_white_rule_list","summary":"Deletes the specified alert whitelist rule","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["Id"],"properties":{"Id":{"type":"integer","description":"The unique ID of the whitelist rule"},"RoleType":{"type":"integer","description":"The view type. Valid values: 0: The view of the current Alibaba Cloud account. 1: The view of all accounts in the enterprise"},"RoleFor":{"type":"integer","description":"The ID of the user whose perspective the administrator switches to"},"RegionId":{"type":"string","description":"The region where the data management center of Threat Analysis is located. Select the region of the management center based on the region…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/describe-aggregate-function":{"post":{"operationId":"cloud_aliyun_cloud_siem_describe_aggregate_function","summary":"Retrieves the list of aggregate functions supported by custom rules","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"RoleType":{"type":"integer","description":"The view type. Valid values: 0: the view of the current Alibaba Cloud account. 1: the view of all accounts in the enterprise"},"RoleFor":{"type":"integer","description":"The ID of the user whose perspective the administrator switches to"},"RegionId":{"type":"string","description":"The region where the data management center of Threat Analysis is located. Select the region of the management center based on the region…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/describe-alert-scene":{"post":{"operationId":"cloud_aliyun_cloud_siem_describe_alert_scene","summary":"Retrieves the scenarios for alert whitelisting","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"RoleType":{"type":"integer","description":"The view type. Valid values: 0: The view of the current Alibaba Cloud account. 1: The view of all accounts in the enterprise"},"RoleFor":{"type":"integer","description":"The ID of the user whose perspective the administrator switches to"},"RegionId":{"type":"string","description":"The region where the data management center of Threat Analysis is located. You must select the region of the management center based on…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/describe-alert-scene-by-event":{"post":{"operationId":"cloud_aliyun_cloud_siem_describe_alert_scene_by_event","summary":"Retrieves the alert whitelisting scenarios and the list of whitelisting targets","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["IncidentUuid"],"properties":{"IncidentUuid":{"type":"string","description":"The incident ID"},"RoleType":{"type":"integer","description":"The view type. Valid values: 0: Current Alibaba Cloud account view. 1: View of all accounts in the enterprise"},"RoleFor":{"type":"integer","description":"The ID of the user whose perspective the administrator switches to"},"RegionId":{"type":"string","description":"The region where the data management center of Threat Analysis is located. You must select the region of the management center based on…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/describe-alert-source":{"post":{"operationId":"cloud_aliyun_cloud_siem_describe_alert_source","summary":"Retrieves a list of alert data sources","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"Level":{"type":"string","description":"The threat level. The value is a JSON array. Valid values: serious: High. suspicious: Medium. remind: Low (JSON-encoded)"},"StartTime":{"type":"integer","description":"The start time of the query. Unit: milliseconds"},"EndTime":{"type":"integer","description":"The end time of the query. Unit: milliseconds"},"RoleType":{"type":"integer","description":"The view type. Valid values: 0: The view of the current Alibaba Cloud account. 1: The view of all accounts in the enterprise"},"RoleFor":{"type":"integer","description":"The ID of the user whose perspective the administrator switches to"},"RegionId":{"type":"string","description":"The region where the data management center of Threat Analysis is located. You must select the region of the management center based on…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/describe-alert-source-with-event":{"post":{"operationId":"cloud_aliyun_cloud_siem_describe_alert_source_with_event","summary":"Queries the list of alert data sources associated with an incident","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"IncidentUuid":{"type":"string","description":"The globally unique ID of the incident"},"RoleType":{"type":"integer","description":"The view type. Valid values: 0: the view of the current Alibaba Cloud account 1: the view of all accounts in the enterprise"},"RoleFor":{"type":"integer","description":"The ID of the user whose perspective the administrator switches to"},"RegionId":{"type":"string","description":"The region of the data management center for threat analysis. Select the region of the management center based on the region where your…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/describe-alert-type":{"post":{"operationId":"cloud_aliyun_cloud_siem_describe_alert_type","summary":"Retrieves the list of available threat types for custom rules","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"RuleType":{"type":"string","description":"The rule type. Valid values: predefine: Predefined. customize: Custom"},"RoleType":{"type":"integer","description":"The view type. Valid values: 0: The view of the current Alibaba Cloud account. 1: The view of all accounts in the enterprise"},"RoleFor":{"type":"integer","description":"The ID of the user whose perspective the administrator switches to"},"RegionId":{"type":"string","description":"The region where the data management center of Threat Analysis is deployed. Select the region of the management center based on the region…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/describe-alerts":{"post":{"operationId":"cloud_aliyun_cloud_siem_describe_alerts","summary":"Retrieves the list of alerts for the user","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["CurrentPage","PageSize"],"properties":{"AlertUuid":{"type":"string","description":"The ID of the alert associated with the event"},"Level":{"type":"string","description":"The threat level. Format: JSON array. Valid values: serious: High risk. suspicious: Medium risk. remind: Low risk (JSON-encoded)"},"Source":{"type":"string","description":"The source product of the alert associated with the event"},"IsDefend":{"type":"string","description":"Indicates whether the threat is blocked. Valid values: 0: Detected. 1: Blocked"},"AlertTitle":{"type":"string","description":"The title of the alert"},"AlertType":{"type":"string","description":"The alerting type"},"AlertName":{"type":"string","description":"The name of the alert"},"AssetName":{"type":"string","description":"The name of the asset"},"AssetId":{"type":"string","description":"The ID of the asset"},"EntityName":{"type":"string","description":"The name of the entity"},"EntityId":{"type":"string","description":"The ID of the entity"},"SubUserId":{"type":"string","description":"The ID of the Alibaba Cloud account actually associated with the alert"},"LabelType":{"type":"string","description":"The alert query type. Valid values: system: Aggregation analysis alert. custom: Custom analysis alert. cfw: Cloud Firewall. waf: Web…"},"AlertStatus":{"type":"string","description":"The status of the alert (JSON-encoded)"},"StartTime":{"type":"integer","description":"The start time of the query. Unit: milliseconds"},"EndTime":{"type":"integer","description":"The end time of the query. Unit: milliseconds"},"CurrentPage":{"type":"integer","description":"The current page number of the list. The value must be greater than or equal to 1"},"PageSize":{"type":"integer","description":"The number of entries per page. Maximum value: 100"},"RoleType":{"type":"integer","description":"The view type. Valid values: 0: View of the current Alibaba Cloud account. 1: View of all accounts in the enterprise"},"RoleFor":{"type":"integer","description":"The ID of the user whose perspective the administrator switches to"},"RegionId":{"type":"string","description":"The region where the data management center of Threat Analysis is located. You must select the region of the management center based on…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/describe-alerts-count":{"post":{"operationId":"cloud_aliyun_cloud_siem_describe_alerts_count","summary":"Retrieves the counts of alerts at different severity levels","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"QueryType":{"type":"string","description":"The query type"},"StartTime":{"type":"integer","description":"The start time of the query, in milliseconds"},"EndTime":{"type":"integer","description":"The end time of the query, in milliseconds"},"RoleType":{"type":"integer","description":"The view type. Valid values: 0: The view of the current Alibaba Cloud account. 1: The view of all accounts in the enterprise"},"RoleFor":{"type":"integer","description":"The ID of the user whose perspective the administrator switches to"},"RegionId":{"type":"string","description":"The region where the data management center of Threat Analysis is located. Select the region of the management center based on the region…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/describe-alerts-with-entity":{"post":{"operationId":"cloud_aliyun_cloud_siem_describe_alerts_with_entity","summary":"Retrieves the list of alerts associated with an entity","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["CurrentPage","PageSize"],"properties":{"IncidentUuid":{"type":"string","description":"The globally unique ID of the incident"},"SophonTaskId":{"type":"string","description":"The ID of the SOAR playbook"},"EntityId":{"type":"integer","description":"The ID of the entity"},"EntityUuid":{"type":"string","description":"The ID of the entity"},"StartTime":{"type":"integer","description":"The start time of the query. Unit: milliseconds"},"EndTime":{"type":"integer","description":"The end time of the query. Unit: milliseconds"},"CurrentPage":{"type":"integer","description":"The page number of the current page. The value must be greater than or equal to 1"},"PageSize":{"type":"integer","description":"The number of entries per page. Maximum value: 100"},"RoleType":{"type":"integer","description":"The view type. Valid values: 0: the view of the current Alibaba Cloud account 1: the view of all accounts in the enterprise"},"RoleFor":{"type":"integer","description":"The ID of the user whose view the administrator switches to"},"RegionId":{"type":"string","description":"The region where the data management center of Threat Analysis is located. You must select the region of the management center based on…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/describe-alerts-with-event":{"post":{"operationId":"cloud_aliyun_cloud_siem_describe_alerts_with_event","summary":"Queries the list of alerts associated with an incident","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["CurrentPage","PageSize"],"properties":{"IncidentUuid":{"type":"string","description":"The incident ID"},"Level":{"type":"string","description":"The threat level. The value is a JSON array. Valid values: serious: High. suspicious: Medium. remind: Low (JSON-encoded)"},"AlertTitle":{"type":"string","description":"The alert title"},"AlertType":{"type":"string","description":"The alert type"},"AlertName":{"type":"string","description":"The alert name"},"AssetName":{"type":"string","description":"The asset name"},"AssetId":{"type":"string","description":"The asset ID"},"EntityName":{"type":"string","description":"The entity name"},"EntityId":{"type":"string","description":"The entity ID"},"SubUserId":{"type":"integer","description":"The ID of the account associated with the alert"},"Source":{"type":"string","description":"The data source of the alert"},"IsDefend":{"type":"string","description":"Specifies whether the threat is blocked. Valid values: 0: Detected. 1: Blocked"},"StartTime":{"type":"integer","description":"The start time of the query. Unit: milliseconds"},"EndTime":{"type":"integer","description":"The end time of the query. Unit: milliseconds"},"CurrentPage":{"type":"integer","description":"The page number of the current page. The value must be greater than or equal to 1"},"PageSize":{"type":"integer","description":"The number of entries per page. Maximum value: 100"},"RoleType":{"type":"integer","description":"The view type. Valid values: 0: The view of the current Alibaba Cloud account. 1: The view of all accounts in the enterprise"},"RoleFor":{"type":"integer","description":"The ID of the member account in the resource directory"},"RegionId":{"type":"string","description":"The region where the data management center of Threat Analysis is located. You must select the region of the management center based on…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/describe-auth":{"post":{"operationId":"cloud_aliyun_cloud_siem_describe_auth","summary":"Checks whether the Alibaba Cloud account has authorized SIEM and created the…","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"RegionId":{"type":"string","enum":["ap-southeast-1","cn-hangzhou"],"description":"The region of the data management center for Threat Analysis. Select the management center region based on the region where your assets…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/describe-automate-response-config-counter":{"post":{"operationId":"cloud_aliyun_cloud_siem_describe_automate_response_config_counter","summary":"Queries the number of automated response rules","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"RoleType":{"type":"integer","description":"The view type. Valid values: 0: the view of the current Alibaba Cloud account 1: the view of all accounts in the enterprise"},"RoleFor":{"type":"integer","description":"The ID of the user whose perspective the administrator switches to"},"RegionId":{"type":"string","description":"The region where the data management center of Threat Analysis is located. Select the region of the management center based on the region…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/describe-automate-response-config-feature":{"post":{"operationId":"cloud_aliyun_cloud_siem_describe_automate_response_config_feature","summary":"Retrieves the configurable fields and operators for automated rule policies","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"AutoResponseType":{"type":"string","description":"The automated response type. Valid values: event: Event. alert: Alert"},"RoleType":{"type":"integer","description":"The view type. Valid values: 0: The view of the current Alibaba Cloud account. 1: The view of all accounts in the enterprise"},"RoleFor":{"type":"integer","description":"The ID of the user whose perspective the administrator switches to"},"RegionId":{"type":"string","description":"The region where the data management center of Threat Analysis is located. Select the region of the management center based on the region…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/describe-cloud-siem-assets":{"post":{"operationId":"cloud_aliyun_cloud_siem_describe_cloud_siem_assets","summary":"Retrieves the list of assets associated with an incident","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["CurrentPage","PageSize"],"properties":{"IncidentUuid":{"type":"string","description":"The UUID of the incident"},"AssetType":{"type":"string","description":"The asset type. Valid values: ip: IP address domain: domain name url: URL process: process file: file host: host"},"AssetName":{"type":"string","description":"The name of the asset"},"AssetUuid":{"type":"string","description":"The UUID of the asset"},"CurrentPage":{"type":"integer","description":"The number of the current page. The value must be greater than or equal to 1"},"PageSize":{"type":"integer","description":"The number of entries per page. Maximum value: 100"},"RoleType":{"type":"integer","description":"The type of the view. Valid values: 0: the view of the current Alibaba Cloud account 1: the view of all accounts in the enterprise"},"RoleFor":{"type":"integer","description":"The ID of the user whose perspective the administrator switches to"},"RegionId":{"type":"string","description":"The region where the data management center of Threat Analysis is located. You must select the region of the management center based on…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/describe-cloud-siem-assets-counter":{"post":{"operationId":"cloud_aliyun_cloud_siem_describe_cloud_siem_assets_counter","summary":"Queries the number of assets of each type that are associated with an event","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["IncidentUuid"],"properties":{"IncidentUuid":{"type":"string","description":"The UUID of the event"},"RoleType":{"type":"integer","description":"The type of view. 0: The view of the current Alibaba Cloud account. 1: The view of all accounts that belong to the enterprise"},"RoleFor":{"type":"integer","description":"The UID of the member. An administrator can use this parameter to switch to the member's view"},"RegionId":{"type":"string","description":"The region where the data management center of Threat Analysis is deployed. Select a region based on the location of your assets. Valid…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/describe-cloud-siem-event-detail":{"post":{"operationId":"cloud_aliyun_cloud_siem_describe_cloud_siem_event_detail","summary":"Retrieves the details of an incident","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["IncidentUuid"],"properties":{"IncidentUuid":{"type":"string","description":"The UUID of the incident"},"RoleType":{"type":"integer","description":"The view type"},"RoleFor":{"type":"integer","description":"The ID of the user whose perspective the administrator switches to"},"RegionId":{"type":"string","description":"The region where the data management center of Threat Analysis is located. Select the region of the management center based on the region…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/describe-cloud-siem-events":{"post":{"operationId":"cloud_aliyun_cloud_siem_describe_cloud_siem_events","summary":"Retrieves a list of Cloud Threat Detection and Response (CTDR) events","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["CurrentPage","PageSize"],"properties":{"StartTime":{"type":"integer","description":"The start time for querying events, in milliseconds"},"EndTime":{"type":"integer","description":"The end time for querying events, in milliseconds"},"ThreadLevel":{"type":"string","description":"The threat level of the event, in JSON array format. Valid values: serious: High. suspicious: Medium. remind: Low (JSON-encoded)"},"EventName":{"type":"string","description":"The name of the event"},"IncidentUuid":{"type":"string","description":"The ID of the event"},"AssetId":{"type":"string","description":"The ID of the asset associated with the event"},"EntityUuid":{"type":"string","description":"The UUID of the entity associated with the event"},"Status":{"type":"integer","description":"The status of the event. Valid values: 0: Unhandled. 1: Processing. 5: Failed. 10: Handled"},"OrderField":{"type":"string","description":"The field used to sort the event list. Valid values: GmtModified: Sorts by event generation time (default). ThreatScore: Sorts by event…"},"Order":{"type":"string","description":"The sort order of the event list. Valid values: desc: Descending order. asc: Ascending order"},"CurrentPage":{"type":"integer","description":"The current page number. The value must be greater than or equal to 1"},"PageSize":{"type":"integer","description":"The number of entries per page. Maximum value: 100"},"RoleType":{"type":"integer","description":"The view type. Valid values: 0: Current Alibaba Cloud account view. 1: View of all accounts in the enterprise"},"RoleFor":{"type":"integer","description":"The ID of the user whose view the administrator switches to"},"RegionId":{"type":"string","description":"The region where the data management center of Cloud Threat Detection and Response (CTDR) is located. Select the region of the management…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/describe-customize-rule-count":{"post":{"operationId":"cloud_aliyun_cloud_siem_describe_customize_rule_count","summary":"Retrieves the count of custom rules","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"RoleType":{"type":"integer","description":"The type of view. Valid values: 0: the view of the current Alibaba Cloud account. 1: the view of all accounts in the enterprise"},"RoleFor":{"type":"integer","description":"The user ID of a member. An administrator can use this ID to switch to the member's perspective"},"RegionId":{"type":"string","description":"The region of the management center for threat analysis. Select a region based on where your assets are located. Valid values:…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/describe-customize-rule-test":{"post":{"operationId":"cloud_aliyun_cloud_siem_describe_customize_rule_test","summary":"Retrieves historical simulated data from a test scenario","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"Id":{"type":"integer","description":"The ID of the custom rule"},"RoleType":{"type":"integer","description":"The view type. 0: The view of the current Alibaba Cloud account. 1: The view of all accounts within the enterprise"},"RoleFor":{"type":"integer","description":"The user ID of the member account to which the administrator switches"},"RegionId":{"type":"string","description":"The region of the Data Management center for Threat Analysis. Select a region based on where your assets are located. Valid values:…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/describe-customize-rule-test-histogram":{"post":{"operationId":"cloud_aliyun_cloud_siem_describe_customize_rule_test_histogram","summary":"Retrieves the chart of test results for a custom rule","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"Id":{"type":"integer","description":"The ID of the custom rule"},"RoleType":{"type":"integer","description":"The view type. 0: The view of the current Alibaba Cloud account. 1: The view of all accounts in your enterprise"},"RoleFor":{"type":"integer","description":"The user ID of the member. This parameter is used when an administrator switches to the perspective of a member"},"RegionId":{"type":"string","description":"The region where the Management Hub of threat analysis is located. Select the region of the Management Hub based on the region where your…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/describe-data-source-instance":{"post":{"operationId":"cloud_aliyun_cloud_siem_describe_data_source_instance","summary":"Queries the details of a data source","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["DataSourceInstanceId","AccountId","CloudCode"],"properties":{"DataSourceInstanceId":{"type":"string","description":"The data source ID, which is an MD5 hash generated by Cloud Threat Detection and Response (CTDR) based on specific parameters. You can…"},"AccountId":{"type":"string","description":"The Alibaba Cloud account ID"},"CloudCode":{"type":"string","enum":["qcloud","hcloud","aliyun"],"description":"The code of the cloud service provider. Valid values: qcloud: Tencent Cloud. aliyun: Alibaba Cloud. hcloud: Huawei Cloud"},"RegionId":{"type":"string","description":"The region where the CTDR data management center is located. Specify the management center based on the region of your assets. Valid…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/describe-data-source-parameters":{"post":{"operationId":"cloud_aliyun_cloud_siem_describe_data_source_parameters","summary":"Retrieves the details of data source parameters","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["DataSourceType","CloudCode"],"properties":{"DataSourceType":{"type":"string","description":"The type of the connected data source. Valid values: ckafka: Tencent Cloud ckafka. obs: Huawei Cloud obs. wafApi: Tencent Cloud WAF attack…"},"CloudCode":{"type":"string","enum":["qcloud","hcloud","aliyun"],"description":"The multi-cloud code"},"RegionId":{"type":"string","description":"The region where the data management center for threat analysis is located. Select the region of the management center based on the region…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/describe-dispose-and-playbook":{"post":{"operationId":"cloud_aliyun_cloud_siem_describe_dispose_and_playbook","summary":"Retrieves the list of entities and playbooks to be handled","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"EntityType":{"type":"string","description":"The entity type. Valid values: ip: IP address. process: Process. file: File"},"IncidentUuid":{"type":"string","description":"The incident UUID"},"EntityUuid":{"type":"string","description":"The entity UUID"},"CurrentPage":{"type":"integer","description":"The current page number. The value must be greater than or equal to 1"},"PageSize":{"type":"integer","description":"The number of entries per page. Maximum value: 100"},"RoleType":{"type":"integer","description":"The view type. Valid values: 0: Current Alibaba Cloud account view. 1: View of all accounts in the enterprise"},"RoleFor":{"type":"integer","description":"The ID of the user whose view the administrator switches to"},"RegionId":{"type":"string","description":"The region where the data management center of Threat Analysis is located. Select the region based on the region where your assets are…"},"AvailableOnly":{"type":"string","description":"Specifies whether to return only available remediation playbooks"},"EntityUuidList":{"type":"string","description":"The list of entity UUIDs. Separate multiple UUIDs with commas"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/describe-dispose-strategy-playbook":{"post":{"operationId":"cloud_aliyun_cloud_siem_describe_dispose_strategy_playbook","summary":"Retrieves the list of playbooks used by a disposal policy","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["StartTime","EndTime"],"properties":{"StartTime":{"type":"integer","description":"The start time of the query, in milliseconds"},"EndTime":{"type":"integer","description":"The end time of the query, in milliseconds"},"RoleType":{"type":"integer","description":"The view type. Valid values: 0: the view of the current Alibaba Cloud account. 1: the view of all accounts in the enterprise"},"RoleFor":{"type":"integer","description":"The ID of the user to which the administrator switches the view"},"RegionId":{"type":"string","description":"The region where the data management center of threat detection and response is located. Select the management center based on the region…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/describe-entity-info":{"post":{"operationId":"cloud_aliyun_cloud_siem_describe_entity_info","summary":"Retrieves the details of an entity","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"EntityId":{"type":"integer","description":"The logical ID of the entity"},"EntityIdentity":{"type":"string","description":"The feature value of the entity. You can perform a fuzzy search for the entity"},"IncidentUuid":{"type":"string","description":"The globally unique UUID of the event"},"SophonTaskId":{"type":"string","description":"The ID of the SOAR response policy"},"RoleType":{"type":"integer","description":"The view type. 0: the view of the current Alibaba Cloud account. 1: the view of all accounts that belong to the enterprise"},"RoleFor":{"type":"integer","description":"The user ID of the member. The administrator can use this ID to switch to the view of this member"},"RegionId":{"type":"string","description":"The region of the Data Management center. Select a region based on the region where your assets are located. Valid values: cn-hangzhou:…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/describe-event-count-by-threat-level":{"post":{"operationId":"cloud_aliyun_cloud_siem_describe_event_count_by_threat_level","summary":"Retrieves the count of events by type","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"StartTime":{"type":"integer","description":"The start time of the query, in milliseconds"},"EndTime":{"type":"integer","description":"The end time of the query, in milliseconds"},"RoleType":{"type":"integer","description":"The view type. Valid values: 0: the view of the current Alibaba Cloud account. 1: the view of all accounts in the enterprise"},"RoleFor":{"type":"integer","description":"The ID of the member account in the resource directory"},"RegionId":{"type":"string","description":"The region where the threat analysis data management center resides. Select the management center based on the region of your assets.…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/describe-event-dispose":{"post":{"operationId":"cloud_aliyun_cloud_siem_describe_event_dispose","summary":"Queries the policy handling history for an event","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"IncidentUuid":{"type":"string","description":"The globally unique UUID of the event"},"CurrentPage":{"type":"integer","description":"The number of the page to return. The value must be greater than or equal to 1"},"PageSize":{"type":"integer","description":"The number of entries to return on each page. The maximum value is 500"},"RoleType":{"type":"integer","description":"The view type. 0: The view of the current Alibaba Cloud account. 1: The view of all accounts that belong to the enterprise"},"RoleFor":{"type":"integer","description":"The user ID of the member. An administrator can use this parameter to switch to the perspective of a member"},"RegionId":{"type":"string","description":"The region where the Data Management center of Threat Analysis is located. Select the region based on the region where your assets are…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/describe-imported-log-count":{"post":{"operationId":"cloud_aliyun_cloud_siem_describe_imported_log_count","summary":"Queries the number of imported logs","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"RegionId":{"type":"string","description":"The region where the management hub of Threat Analysis is located. Select the region of the management hub based on the region where your…"},"RoleType":{"type":"string","description":"The type of the view. 0: The view of the current Alibaba Cloud account. 1: The view of all accounts that belong to the enterprise"},"RoleFor":{"type":"string","description":"The user ID of the member. An administrator can specify this parameter to switch to the perspective of the member"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/describe-log-fields":{"post":{"operationId":"cloud_aliyun_cloud_siem_describe_log_fields","summary":"Retrieves the list of configurable fields for custom rules","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"LogType":{"type":"string","description":"The log source for the rule"},"LogSource":{"type":"string","description":"The log source for the rule"},"RoleType":{"type":"integer","description":"The view type. 0: The view of the current Alibaba Cloud account. 1: The view of all accounts in the enterprise"},"RoleFor":{"type":"integer","description":"The user ID of the member whose view the administrator switches to"},"RegionId":{"type":"string","description":"The region where the threat analysis Management Hub is located. Select the region of the Management Hub based on the region where your…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/describe-log-source":{"post":{"operationId":"cloud_aliyun_cloud_siem_describe_log_source","summary":"Retrieves a list of configurable log sources for custom rules","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"LogType":{"type":"string","description":"The log type of the rule"},"RoleType":{"type":"integer","description":"The view type. 0: The view of the current Alibaba Cloud account. 1: The view of all accounts within the enterprise"},"RoleFor":{"type":"integer","description":"The user ID of the member. An administrator can use this parameter to switch to the perspective of a member"},"RegionId":{"type":"string","description":"The region where the Data Management center of Threat Analysis is deployed. You must select the region where your assets are located.…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/describe-log-type":{"post":{"operationId":"cloud_aliyun_cloud_siem_describe_log_type","summary":"Retrieves the log types that can be configured for custom rules","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"RoleType":{"type":"integer","description":"The type of the view. Valid values: 0: The view of the current Alibaba Cloud account. 1: The view of all accounts in an enterprise"},"RoleFor":{"type":"integer","description":"The user ID of the member. An administrator can use this parameter to switch to the perspective of a specific member"},"RegionId":{"type":"string","description":"The region of the Data Management center. Select a region based on where your assets are located. Valid values: cn-hangzhou: for assets in…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/describe-operators":{"post":{"operationId":"cloud_aliyun_cloud_siem_describe_operators","summary":"Retrieves the list of operators for custom rules","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"SceneType":{"type":"string","description":"The scenario for the operator. Valid values: If you leave this parameter empty, the default scenario is used. AGGREGATE: The aggregate…"},"RoleType":{"type":"integer","description":"The view type. 0: The view of the current Alibaba Cloud account. 1: The view of all accounts that are managed by your enterprise"},"RoleFor":{"type":"integer","description":"The user ID of the member. An administrator can use this parameter to switch to the perspective of this member"},"RegionId":{"type":"string","description":"The region of the Data Management center for threat analysis. Select a region based on your asset location. Valid values: cn-hangzhou:…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/describe-prod-count":{"post":{"operationId":"cloud_aliyun_cloud_siem_describe_prod_count","summary":"Queries the number of Alibaba Cloud, Tencent Cloud, and Huawei Cloud products that can be integrated with…","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"RoleType":{"type":"integer","description":"The type of the view. 0: the view of the current Alibaba Cloud account. 1: the view of all accounts that belong to the enterprise"},"RoleFor":{"type":"integer","description":"The user ID of a member. This parameter allows an administrator to switch to the perspective of the member"},"RegionId":{"type":"string","description":"The region where the Data Management center of Threat Analysis is located. Select a region for the Management Center based on the region…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/describe-scope-users":{"post":{"operationId":"cloud_aliyun_cloud_siem_describe_scope_users","summary":"Retrieves the list of users in the playbook scope","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"RoleType":{"type":"integer","description":"The view type. 0: The view of the current Alibaba Cloud account. 1: The view of all accounts that belong to the enterprise"},"RoleFor":{"type":"integer","description":"The user ID of the member. This parameter is used when an administrator switches to the view of a member"},"RegionId":{"type":"string","description":"The region of the Data Management center. Select the region based on where your assets are located. Valid values: cn-hangzhou: Assets are…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/describe-service-status":{"post":{"operationId":"cloud_aliyun_cloud_siem_describe_service_status","summary":"Checks whether a resource directory is authorized for threat analysis","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"RegionId":{"type":"string","description":"The region of the Data Management hub. Select a region based on the location of your assets. Valid values: cn-hangzhou: For assets in the…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/describe-storage":{"post":{"operationId":"cloud_aliyun_cloud_siem_describe_storage","summary":"Checks the status of the storage for the threat analysis feature. The storage is a Logstore in Simple Log…","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"RoleType":{"type":"integer","description":"The type of view. Valid values: 0: The view of the current Alibaba Cloud account. 1: The view of all accounts in your enterprise"},"RoleFor":{"type":"integer","description":"The user ID of the member whose view you want to use. This parameter is available only for administrators"},"RegionId":{"type":"string","description":"The region of the Data Management center for threat analysis. Select a region for the center based on the location of your assets. Valid…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/describe-user-buy-status":{"post":{"operationId":"cloud_aliyun_cloud_siem_describe_user_buy_status","summary":"Checks whether the current Alibaba Cloud account or its associated enterprise organization has purchased…","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"SubUserId":{"type":"integer","description":"The ID of the Alibaba Cloud account"},"RegionId":{"type":"string","description":"The region of the Data Management center for threat analysis. Select a region for the management center based on where your assets are…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/describe-user-siem-order-status":{"post":{"operationId":"cloud_aliyun_cloud_siem_describe_user_siem_order_status","summary":"Queries the purchase status of a user's SIEM","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"RoleType":{"type":"integer","description":"The view type. Valid values: 0: the current Alibaba Cloud account view. 1: the view of all accounts in the enterprise"},"RoleFor":{"type":"integer","description":"The user ID that the administrator uses to switch to another member's perspective"},"RegionId":{"type":"string","description":"The region of the data management center for threat detection and response. Select the data management center based on the region where…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/describe-waf-scope":{"post":{"operationId":"cloud_aliyun_cloud_siem_describe_waf_scope","summary":"Retrieves the list of domain names protected by Web Application Firewall (WAF) instances","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"EntityId":{"type":"integer","description":"The entity ID"},"RoleType":{"type":"integer","description":"The view type. 0: the view of the current Alibaba Cloud account. 1: the view of all accounts within the enterprise"},"RoleFor":{"type":"integer","description":"The ID of a member. An administrator can use this parameter to assume the permissions of the member"},"RegionId":{"type":"string","description":"The region where the Data Management center of threat analysis is located. Select a region based on the location of your assets. Valid…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/describe-white-rule-list":{"post":{"operationId":"cloud_aliyun_cloud_siem_describe_white_rule_list","summary":"Queries the rules in the alert whitelist","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["CurrentPage","PageSize"],"properties":{"AlertType":{"type":"string","description":"The alert type"},"AlertName":{"type":"string","description":"The alert name"},"IncidentUuid":{"type":"string","description":"The universally unique identifier (UUID) of the event"},"CurrentPage":{"type":"integer","description":"The page number. The value must be greater than or equal to 1"},"PageSize":{"type":"integer","description":"The number of entries per page. The maximum value is 100"},"RoleType":{"type":"integer","description":"The view type. 0: the view of the current Alibaba Cloud account. 1: the view of all accounts that are managed by the administrator account"},"RoleFor":{"type":"integer","description":"The ID of the member. This parameter is used in a multi-account management scenario. An administrator can specify this parameter to query…"},"RegionId":{"type":"string","description":"The region where the data management center of Threat Analysis is deployed. You must select the region where your assets are located.…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/enable-access-for-cloud-siem":{"post":{"operationId":"cloud_aliyun_cloud_siem_enable_access_for_cloud_siem","summary":"Authorizes the user and creates the threat detection and response service-linked role…","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"ClientToken":{"type":"string","description":"The idempotency token"},"AutoSubmit":{"type":"integer","description":"Specifies whether to automatically integrate alert logs from Security Center, Web Application Firewall (WAF), and Cloud Firewall. By…"},"RoleType":{"type":"integer","description":"The view type. 0: the view of the current Alibaba Cloud account. 1: the view of all accounts in the enterprise"},"RoleFor":{"type":"integer","description":"The ID of the member account to which the administrator switches the view"},"RegionId":{"type":"string","description":"The region where the threat detection and response data management center resides. Select the management center based on the region of…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/enable-service-for-cloud-siem":{"post":{"operationId":"cloud_aliyun_cloud_siem_enable_service_for_cloud_siem","summary":"Enables resource directory authorization for threat analysis. This operation can be called only by a…","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"RegionId":{"type":"string","description":"The region of the Data Management center for threat analysis. Select a region based on where your assets are located. Valid values:…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/get-capacity":{"post":{"operationId":"cloud_aliyun_cloud_siem_get_capacity","summary":"Retrieves the current billable storage usage and subscription purchase volume for threat analysis. Units are…","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"RoleType":{"type":"integer","description":"View type. 0: View for the current Alibaba Cloud account. 1: View for all accounts under your enterprise"},"RoleFor":{"type":"integer","description":"User ID of the member whose view the administrator switches to"},"RegionId":{"type":"string","description":"Region where the Data Management Center for threat analysis is located. Choose a region based on where your assets are located.…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/get-data-storage":{"post":{"operationId":"cloud_aliyun_cloud_siem_get_data_storage","summary":"Retrieves the details of user data storage on the Log Management page","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"RegionId":{"type":"string","description":"The region where the threat analysis data management center is located. Specify the management center based on the region of your assets.…"},"Lang":{"type":"string","description":"The language of the response. Valid values: zh (default): Chinese. en: English"},"RoleFor":{"type":"integer","description":"The user ID of the member to which the administrator switches the view"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/get-entitiy-stat":{"post":{"operationId":"cloud_aliyun_cloud_siem_get_entitiy_stat","summary":"Queries the entity count","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["IncidentUuid"],"properties":{"IncidentUuid":{"type":"string","description":"The incident ID"},"EntityType":{"type":"string","description":"The ID of the asset associated with the incident"},"AssetName":{"type":"string","description":"The ID of the asset associated with the incident"},"AssetUuid":{"type":"string","description":"The ID of the asset associated with the incident"},"EntityName":{"type":"string","description":"The ID of the asset associated with the incident"},"EntityUuid":{"type":"string","description":"The ID of the asset associated with the incident"},"IsAsset":{"type":"string","description":"The ID of the asset associated with the incident"},"IsMalwareEntity":{"type":"string","description":"The sort order of the incident list. Valid values: desc: descending order asc: ascending order"},"Tags":{"type":"string","description":"The entity tags. The value is a JSON array string in the following format: \"[{\"tagKey1\":\"tagValue1\"},{\"tagKey2\":\"tagValue2\"}]\""},"RoleType":{"type":"integer","description":"The role type. Valid values: 0: single-account logon 1: global view 2: switched view 3: local view"},"RoleFor":{"type":"integer","description":"The ID of the user whose view the administrator switches to"},"RegionId":{"type":"string","description":"The region where the data management center of Threat Analysis is located. Select the region of the management center based on the region…"},"EntityUuids":{"type":"string","description":"The list of entity UUIDs. Separate multiple UUIDs with commas"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/get-storage":{"post":{"operationId":"cloud_aliyun_cloud_siem_get_storage","summary":"Retrieves the storage settings created by the Threat Analysis and Response product in your Simple Log…","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"RoleType":{"type":"integer","description":"The type of the view. Valid values: 0: The view of the current Alibaba Cloud account. 1: The view of all accounts that belong to the…"},"RoleFor":{"type":"integer","description":"The user ID of the member. This parameter is used by an administrator to switch to the perspective of a member"},"RegionId":{"type":"string","description":"The region where the Data Management hub for threat analysis is located. Select a region for the management hub based on the region of…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/list-account-access-id":{"post":{"operationId":"cloud_aliyun_cloud_siem_list_account_access_id","summary":"Queries the list of multi-cloud AccessKeyIds that are already bound","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["CloudCode"],"properties":{"CloudCode":{"type":"string","enum":["qcloud","hcloud"],"description":"The code of the multi-cloud provider"},"RegionId":{"type":"string","description":"The location of the data management center for threat detection and response. Select the management center location based on the region of…"},"RoleFor":{"type":"integer","description":"The ID of the member to which the administrator switches the view"},"RoleType":{"type":"integer","description":"The view type. Valid values: 0: the view of the current Alibaba Cloud account. 1: the view of all accounts in the enterprise"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/list-accounts-by-log":{"post":{"operationId":"cloud_aliyun_cloud_siem_list_accounts_by_log","summary":"Queries the list of accounts by log","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["ProdCode","LogCodes","CloudCode"],"properties":{"ProdCode":{"type":"string","description":"The code of the product"},"LogCodes":{"type":"string","description":"The list of log codes. This parameter is a repeatList array parameter that must be passed in dot-separated expanded form, for example,…"},"CloudCode":{"type":"string","enum":["qcloud","hcloud","aliyun","idc"],"description":"The code of the cloud provider"},"RoleType":{"type":"integer","description":"The view type. 0: the view of the current Alibaba Cloud account. 1: the view of all accounts in the enterprise"},"RoleFor":{"type":"integer","description":"The ID of the member to which the administrator switches the view"},"RegionId":{"type":"string","description":"The region where the CTDR data management center is located. Select the management center based on the region of your assets. Valid…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/list-all-prods":{"post":{"operationId":"cloud_aliyun_cloud_siem_list_all_prods","summary":"Queries the list of cloud services that are supported for data ingestion by threat detection and response","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"RoleType":{"type":"integer","description":"The view type. 0: the view of the current Alibaba Cloud account. 1: the view of all accounts in the enterprise"},"RoleFor":{"type":"integer","description":"The ID of the user to which the administrator switches the view"},"RegionId":{"type":"string","description":"The region where the data management center of threat detection and response is located. Specify the management center based on the region…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/list-automate-response-configs":{"post":{"operationId":"cloud_aliyun_cloud_siem_list_automate_response_configs","summary":"Retrieves a list of automated response rules","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["CurrentPage","PageSize"],"properties":{"Id":{"type":"integer","description":"The ID of the automated response rule"},"SubUserId":{"type":"integer","description":"The ID of the user who created the rule"},"PlaybookUuid":{"type":"string","description":"The unique identifier of the playbook"},"RuleName":{"type":"string","description":"The name of the automated response rule"},"AutoResponseType":{"type":"string","description":"The type of the automated response. Valid values: event alert"},"ActionType":{"type":"string","description":"The type of the handling action. Valid values: doPlaybook: executes a playbook. changeEventStatus: changes the status of an event.…"},"Status":{"type":"integer","description":"The status of the rule. Valid values: 0: disabled 100: enabled"},"CurrentPage":{"type":"integer","description":"The page number. The value must be 1 or greater"},"PageSize":{"type":"integer","description":"The number of entries per page. The maximum value is 100"},"RoleType":{"type":"integer","description":"The view type. 0: the view of the current Alibaba Cloud account. 1: the view of all accounts that belong to the enterprise"},"RoleFor":{"type":"integer","description":"The ID of the member to which the administrator switches"},"RegionId":{"type":"string","description":"The region of the Data Management center. Select a region based on the region where your assets are located. Valid values: cn-hangzhou:…"},"ResponseRuleType":{"type":"string","description":"The type of the response rule. preset: predefined custom: custom"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/list-bind-account":{"post":{"operationId":"cloud_aliyun_cloud_siem_list_bind_account","summary":"Lists the multi-cloud accounts that are bound to threat detection and response","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["CloudCode"],"properties":{"CloudCode":{"type":"string","enum":["qcloud","hcloud"],"description":"The code of the multi-cloud provider. Valid values: qcloud: Tencent Cloud. hcloud: Huawei Cloud"},"RegionId":{"type":"string","description":"The region where the threat detection and response data management center resides. Specify the management center based on the region where…"},"RoleFor":{"type":"integer","description":"The ID of the member to which the administrator switches the view"},"RoleType":{"type":"integer","description":"The view type. Valid values: 0: the current Alibaba Cloud account view. 1: the view of all accounts in the enterprise"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/list-bind-data-sources":{"post":{"operationId":"cloud_aliyun_cloud_siem_list_bind_data_sources","summary":"Enumerates all data sources","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["AccountId","CloudCode"],"properties":{"AccountId":{"type":"string","description":"The cloud account ID"},"CloudCode":{"type":"string","enum":["qcloud","hcloud","aliyun"],"description":"The code of the multi-cloud provider"},"RegionId":{"type":"string","description":"The region where the threat analysis data management center resides. Select the management center region based on the region of your…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/list-cloud-siem-customize-rules":{"post":{"operationId":"cloud_aliyun_cloud_siem_list_cloud_siem_customize_rules","summary":"Retrieves a list of custom rules","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["CurrentPage","PageSize"],"properties":{"Id":{"type":"string","description":"The ID of the custom rule"},"StartTime":{"type":"integer","description":"The start time of the query. The value is a UNIX timestamp. Unit: milliseconds"},"EndTime":{"type":"integer","description":"The end time of the query. The value is a UNIX timestamp. Unit: milliseconds"},"ThreatLevel":{"type":"string","description":"The threat level. The value is a JSON array. Valid values: serious: high suspicious: medium remind: low (JSON-encoded)"},"AlertType":{"type":"string","description":"The alert type"},"RuleName":{"type":"string","description":"The name of the rule. The name can contain letters, digits, underscores (_), and periods (.)"},"RuleType":{"type":"string","description":"The type of the rule. Valid values: predefine: predefined customize: custom"},"Status":{"type":"integer","description":"The status of the rule. Valid values: 0: initial 10: testing with simulated data 15: testing with business data 20: testing with business…"},"OrderField":{"type":"string","description":"The field that you use to sort the custom rules. Valid values: GmtModified: sorts the rules by modification time. Id: sorts the rules by…"},"Order":{"type":"string","description":"The order in which you want to sort the custom rules. Valid values: desc: descending order asc: ascending order"},"CurrentPage":{"type":"integer","description":"The page number. Pages start from page 1"},"PageSize":{"type":"integer","description":"The number of entries per page. Maximum value: 100"},"RoleType":{"type":"integer","description":"The view type. 0: the view of the current Alibaba Cloud account. 1: the view of all members in the enterprise"},"RoleFor":{"type":"integer","description":"The user ID that is used to switch the administrator's view to the view of a member"},"RegionId":{"type":"string","description":"The region where the data management center of Threat Analysis is deployed. You must select the region where your assets reside. Valid…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/list-cloud-siem-predefined-rules":{"post":{"operationId":"cloud_aliyun_cloud_siem_list_cloud_siem_predefined_rules","summary":"Retrieves a list of predefined rules","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["CurrentPage","PageSize"],"properties":{"Id":{"type":"string","description":"The rule ID"},"StartTime":{"type":"integer","description":"The start of the time range to query. This value is a UNIX timestamp in milliseconds"},"EndTime":{"type":"integer","description":"The end of the time range to query. This value is a UNIX timestamp in milliseconds"},"ThreatLevel":{"type":"string","description":"The threat level. The value is a JSON array. Valid values: serious: high suspicious: medium remind: low (JSON-encoded)"},"AlertType":{"type":"string","description":"The alert type"},"RuleName":{"type":"string","description":"The rule name. The name can contain only letters, digits, underscores (_), and periods (.)"},"RuleType":{"type":"string","description":"The rule type. Valid values: predefine: predefined customize: custom"},"EventTransferType":{"type":"string","description":"The event generation method. Valid values: default: the default built-in method singleToSingle: An event is generated for each alert.…"},"AttCk":{"type":"string","description":"The ATT\\&CK technique"},"LogSource":{"type":"string","description":"The log source"},"Status":{"type":"integer","description":"The rule status. Valid values: 0: initial 10: testing with simulated data 15: testing with production data 20: testing with production…"},"OrderField":{"type":"string","description":"The field to sort the rules by. Valid values: GmtModified: Sorts by modification time. Id: Sorts by rule ID. This is the default value"},"Order":{"type":"string","description":"The sort order. Valid values: desc: descending asc: ascending"},"CurrentPage":{"type":"integer","description":"The page number. The value must be greater than or equal to 1"},"PageSize":{"type":"integer","description":"The number of entries per page. The maximum value is 100"},"RoleType":{"type":"integer","description":"The view type. 0: the view of the current Alibaba Cloud account. 1: the view of all accounts in the enterprise"},"RoleFor":{"type":"integer","description":"The user ID that the administrator uses to switch to the perspective of a member"},"RegionId":{"type":"string","description":"The region where the Data Management center of the threat analysis feature is located. Select the region where your assets are located.…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/list-customize-rule-test-result":{"post":{"operationId":"cloud_aliyun_cloud_siem_list_customize_rule_test_result","summary":"Queries the list of test results for custom rules","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["CurrentPage","PageSize"],"properties":{"Id":{"type":"integer","description":"The ID of the custom rule"},"CurrentPage":{"type":"integer","description":"The current page number. The value must be greater than or equal to 1"},"PageSize":{"type":"integer","description":"The number of entries per page. Maximum value: 100"},"RoleType":{"type":"integer","description":"The view type. Valid values: 0: the view of the current Alibaba Cloud account 1: the view of all accounts in the enterprise"},"RoleFor":{"type":"integer","description":"The ID of the user whose view the administrator switches to"},"RegionId":{"type":"string","description":"The region where the data management center of Threat Analysis is located. Select the region of the management center based on the region…"},"DetectionRuleId":{"type":"string","description":"The ID of the custom rule. You can obtain the rule ID by calling the rule list API operation"},"VerifyType":{"type":"string","description":"The verification result of the accuracy of alert fields based on the alert template. Valid values: true: Passed. Alerts from enabled rules…"},"StartTime":{"type":"integer","description":"The start time. The value is a UNIX timestamp in milliseconds"},"EndTime":{"type":"integer","description":"The end time. The value is a UNIX timestamp in milliseconds"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/list-data-source-logs":{"post":{"operationId":"cloud_aliyun_cloud_siem_list_data_source_logs","summary":"Queries the list of logs under a data source","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["DataSourceInstanceId","AccountId","CloudCode"],"properties":{"DataSourceInstanceId":{"type":"string","description":"The data source ID, which is an MD5 hash generated by Cloud Threat Detection and Response (CTDR) based on specific parameters"},"AccountId":{"type":"string","description":"The Alibaba Cloud account ID"},"CloudCode":{"type":"string","enum":["qcloud","hcloud","aliyun"],"description":"The code of the cloud service provider. Valid values: qcloud: Tencent Cloud. aliyun: Alibaba Cloud. hcloud: Huawei Cloud"},"RegionId":{"type":"string","description":"The region in which the data management center of threat detection and response resides. Select the management center based on the region…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/list-data-source-types":{"post":{"operationId":"cloud_aliyun_cloud_siem_list_data_source_types","summary":"Enumerates the multi-cloud data source types that are supported by threat analysis","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["CloudCode"],"properties":{"CloudCode":{"type":"string","enum":["qcloud","hcloud"],"description":"The code of the multi-cloud provider"},"RegionId":{"type":"string","description":"The region where the threat analysis data management center resides. Specify the management center based on the region of your assets.…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/list-delivery":{"post":{"operationId":"cloud_aliyun_cloud_siem_list_delivery","summary":"Lists the products and logs that are connected to threat analysis for an enterprise or a member, and the…","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"RoleType":{"type":"integer","description":"The type of view. Valid values: 0: The view for the current Alibaba Cloud account. 1: The view for all accounts in the enterprise"},"RoleFor":{"type":"integer","description":"The Alibaba Cloud account ID of a member. An administrator can use this parameter to view data from the perspective of the member"},"RegionId":{"type":"string","description":"The region of the data management center for threat analysis. Select the region based on where your assets are located. Valid values:…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/list-dispose-strategy":{"post":{"operationId":"cloud_aliyun_cloud_siem_list_dispose_strategy","summary":"Queries the list of system-recommended response policies","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["StartTime","EndTime","CurrentPage","PageSize"],"properties":{"SophonTaskId":{"type":"string","description":"The ID of the Security Orchestration, Automation, and Response (SOAR) response policy"},"EntityIdentity":{"type":"string","description":"The identity value of the entity. You can use this parameter to perform a fuzzy search for the entity"},"EntityType":{"type":"string","description":"The type of the entity. Valid values: ip: IP address. process: Process. file: File"},"PlaybookName":{"type":"string","description":"The unique name of the playbook"},"PlaybookUuid":{"type":"string","description":"The UUID of the playbook"},"PlaybookTypes":{"type":"string","description":"The type of the playbook. Valid values: system: Manual response. custom: Event-triggered playbook. custom_alert: Alert-triggered playbook.…"},"EffectiveStatus":{"type":"integer","description":"The status of the policy. Valid values: 0: Invalid. 1: Valid"},"OrderField":{"type":"string","description":"The field by which to sort the results. Valid values: GmtModified: Sort by update time. GmtCreate: Sort by creation time. FinishTime: Sort…"},"Order":{"type":"string","description":"The sort order. Valid values: desc: Descending order. asc: Ascending order"},"StartTime":{"type":"integer","description":"The start time of the query. Unit: milliseconds"},"EndTime":{"type":"integer","description":"The end time of the query. Unit: milliseconds"},"Status":{"type":"integer","description":"The status of the response policy"},"CurrentPage":{"type":"integer","description":"The page number of the current page. The value must be greater than or equal to 1"},"PageSize":{"type":"integer","description":"The number of entries per page. Maximum value: 100"},"RoleType":{"type":"integer","description":"The type of the view. Valid values: 0: The view of the current Alibaba Cloud account. 1: The view of all accounts in the enterprise"},"RoleFor":{"type":"integer","description":"The Alibaba Cloud account ID of the member whose view the administrator switches to"},"RegionId":{"type":"string","description":"The region where the data management center of Threat Analysis and Response is located. You must select the region of the management…"},"IncidentUuid":{"type":"string","description":"The ID of the incident"},"QueryMode":{"type":"string","description":"The query mode"},"GroupBy":{"type":"string","description":"The grouping dimension"},"GroupKey":{"type":"string","description":"The grouping key"},"ResponseRuleId":{"type":"string","description":"The ID of the response rule"},"MaxResults":{"type":"integer","description":"The maximum number of records to return for a single query"},"NextToken":{"type":"string","description":"The pagination token for the next page"},"StrategyId":{"type":"string","description":"The ID of the response policy"},"AlertUuid":{"type":"string","description":"The UUID of the alert"},"EntityUuidList":{"type":"string","description":"The list of entity UUIDs (JSON-encoded)"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/list-entities":{"post":{"operationId":"cloud_aliyun_cloud_siem_list_entities","summary":"Queries a list of entities","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["IncidentUuid","CurrentPage","PageSize"],"properties":{"IncidentUuid":{"type":"string","description":"The incident ID"},"EntityType":{"type":"string","description":"The entity type. Valid values:"},"EntityName":{"type":"string","description":"The entity name"},"EntityUuid":{"type":"string","description":"The entity UUID"},"EntityUuids":{"type":"string","description":"The list of entity UUIDs"},"MalwareType":{"type":"string","description":"The malware entity type"},"IsMalwareEntity":{"type":"string","description":"Specifies whether the entity is malicious. Valid values:"},"Tags":{"type":"string","description":"The entity tags. The value is a JSON array string: `\"[{\"tagKey1\":\"tagValue1\"},{\"tagKey2\":\"tagValue2\"}]\"`"},"CurrentPage":{"type":"integer","description":"The current page number, which must be greater than or equal to 1"},"PageSize":{"type":"integer","description":"The number of entries per page, up to a maximum of 100"},"RoleType":{"type":"integer","description":"The view type"},"RoleFor":{"type":"integer","description":"The user ID of the member to which the administrator switches the view"},"RegionId":{"type":"string","description":"The region where the data management center of threat analysis is located. Select the management center based on the region of your…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/list-imported-logs-by-prod":{"post":{"operationId":"cloud_aliyun_cloud_siem_list_imported_logs_by_prod","summary":"Queries the log onboarding details for a product","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["ProdCode","CloudCode"],"properties":{"ProdCode":{"type":"string","description":"The product code"},"CloudCode":{"type":"string","enum":["qcloud","hcloud","aliyun","idc"],"description":"The multi-cloud code. Valid values: hcloud: Huawei Cloud. qcloud: Tencent Cloud. aliyun: Alibaba Cloud"},"RoleType":{"type":"integer","description":"The view type. Valid values: 0: View of the current Alibaba Cloud account. 1: View of all accounts in the enterprise"},"RoleFor":{"type":"integer","description":"The ID of the user whose perspective the administrator switches to"},"RegionId":{"type":"string","description":"The region where the data management center of Threat Analysis is located. Select the region of the management center based on the region…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/list-project-log-stores":{"post":{"operationId":"cloud_aliyun_cloud_siem_list_project_log_stores","summary":"Queries projects and Logstores based on the name patterns of the default SLS project and Logstore for an…","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["SourceProdCode","SourceLogCode","SubUserId"],"properties":{"SourceProdCode":{"type":"string","description":"The code of the product to query"},"SourceLogCode":{"type":"string","description":"The code of the log to query"},"SubUserId":{"type":"integer","description":"The ID of the Alibaba Cloud account to query"},"RegionId":{"type":"string","description":"The region of the Data Management center for threat analysis. Specify the region based on where your assets are located. Valid values:…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/list-rd-users":{"post":{"operationId":"cloud_aliyun_cloud_siem_list_rd_users","summary":"Lists the Alibaba Cloud accounts that are managed by the multi-account control feature of Threat Analysis.…","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"RegionId":{"type":"string","description":"The region where the Data Management center of Threat Analysis is located. Select the region of the Management Center based on the region…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/modify-bind-account":{"post":{"operationId":"cloud_aliyun_cloud_siem_modify_bind_account","summary":"Modifies a bound cloud account","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["BindId","AccountId","CloudCode"],"properties":{"AccessId":{"type":"string","description":"The AccessKey ID of the cloud account"},"AccountName":{"type":"string","description":"The name of the multi-cloud account"},"BindId":{"type":"integer","description":"The ID of the binding record. This is the BindId returned by the ListBindAccount operation"},"AccountId":{"type":"string","description":"The ID of the cloud account"},"CloudCode":{"type":"string","enum":["qcloud","hcloud"],"description":"The code of the multi-cloud provider. Valid values: hcloud: Huawei Cloud. qcloud: Tencent Cloud"},"RegionId":{"type":"string","description":"The region where the threat detection and response (CTDR) data management center resides. Select the management center based on the region…"},"RoleFor":{"type":"integer","description":"The ID of the member account to which the administrator switches the view"},"RoleType":{"type":"integer","description":"The view type. Valid values: 0: The view of the current Alibaba Cloud account. 1: The view of all accounts in the enterprise"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/modify-data-source":{"post":{"operationId":"cloud_aliyun_cloud_siem_modify_data_source","summary":"Modifies the description of an existing data source","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["DataSourceType","DataSourceInstanceId","CloudCode"],"properties":{"AccountId":{"type":"string","description":"The cloud account ID"},"DataSourceType":{"type":"string","description":"The data source type. Valid values: ckafka: Tencent Cloud CKafka. obs: Huawei Cloud OBS. wafApi: Tencent Cloud WAF attack log download API"},"DataSourceInstanceId":{"type":"string","description":"The data source ID, which is an MD5 hash generated by threat detection and response based on specific parameters. You can call…"},"DataSourceInstanceName":{"type":"string","description":"The name of the data source"},"DataSourceInstanceRemark":{"type":"string","description":"The remarks of the data source"},"DataSourceInstanceParams":{"type":"string","description":"The data source parameters in JSON array format"},"CloudCode":{"type":"string","enum":["qcloud","hcloud","aliyun"],"description":"The code of the cloud provider. Valid values: qcloud: Tencent Cloud. aliyun: Alibaba Cloud. hcloud: Huawei Cloud"},"RegionId":{"type":"string","description":"The region where the Cloud Threat Detection and Response (CTDR) data management center is located. Specify the management center based on…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/modify-data-source-log":{"post":{"operationId":"cloud_aliyun_cloud_siem_modify_data_source_log","summary":"Modifies the description of a log added to a data source","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["DataSourceInstanceId","DataSourceInstanceLogs","LogInstanceId","CloudCode"],"properties":{"LogCode":{"type":"string","description":"The log code"},"AccountId":{"type":"string","description":"The Alibaba Cloud account ID"},"DataSourceType":{"type":"string","description":"The data source type. Valid values: obs: Huawei Cloud OBS. wafApi: Tencent Cloud WAF download API. ckafka: Tencent Cloud CKafka"},"DataSourceInstanceId":{"type":"string","description":"The data source ID, which is an MD5 hash generated by Cloud Threat Detection and Response (CTDR) based on specific parameters. You can…"},"DataSourceInstanceLogs":{"type":"string","description":"The details of the data source parameters, in JSON array format"},"LogInstanceId":{"type":"string","description":"The log ID, which is an MD5 hash generated by CTDR based on specific parameters. You can call…"},"CloudCode":{"type":"string","enum":["qcloud","hcloud","aliyun"],"description":"The code of the cloud service provider. Valid values: qcloud: Tencent Cloud. aliyun: Alibaba Cloud. hcloud: Huawei Cloud"},"RegionId":{"type":"string","description":"The region where the CTDR data management center resides. Select the management center based on the region of your assets. Valid values:…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/open-delivery":{"post":{"operationId":"cloud_aliyun_cloud_siem_open_delivery","summary":"Enables log delivery for onboarded cloud services","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["ProductCode"],"properties":{"ProductCode":{"type":"string","description":"The code of the cloud service. Valid values: qcloud_waf qlcoud_cfw hcloud_waf hcloud_cfw ddos sas cfw config csk fc rds nas apigateway cdn…"},"LogCode":{"type":"string","description":"The log code of the cloud service, such as the process log in Security Center. This parameter is optional. If you do not specify this…"},"RoleType":{"type":"integer","description":"The view type. Valid values: 0: the view of the current Alibaba Cloud account. 1: the view of all accounts in the enterprise"},"RoleFor":{"type":"integer","description":"The ID of the member whose perspective the administrator switches to"},"RegionId":{"type":"string","description":"The region where the data management center of Threat Analysis is located. You must select the region of the management center based on…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/post-automate-response-config":{"post":{"operationId":"cloud_aliyun_cloud_siem_post_automate_response_config","summary":"Adds or updates an automated response rule","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"Id":{"type":"integer","description":"The ID of the automated response rule"},"SubUserId":{"type":"integer","description":"The ID of the user who created the rule"},"RuleName":{"type":"string","description":"The name of the automated response rule"},"AutoResponseType":{"type":"string","description":"The type of the automated response. Valid values: event: event alert: alert"},"ExecutionCondition":{"type":"string","description":"The trigger condition of the automated response rule, in JSON format"},"ActionType":{"type":"string","description":"The type of the action. Separate multiple values with commas. Valid values: doPlaybook: execute playbook changeEventStatus: change event…"},"ActionConfig":{"type":"string","description":"The action configuration of the automated response rule, in JSON array format"},"RoleType":{"type":"integer","description":"The view type. Valid values: 0: The view of the current Alibaba Cloud account. 1: The view of all accounts in the enterprise"},"RoleFor":{"type":"integer","description":"The ID of the user whose perspective the administrator switches to"},"RegionId":{"type":"string","description":"The region where the data management center of Threat Analysis is located. Select the region of the management center based on the region…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/post-customize-rule":{"post":{"operationId":"cloud_aliyun_cloud_siem_post_customize_rule","summary":"Adds or updates a custom rule","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"Id":{"type":"integer","description":"The ID of the custom rule"},"RuleName":{"type":"string","description":"The name of the rule"},"RuleDesc":{"type":"string","description":"The description of the rule"},"ThreatLevel":{"type":"string","description":"The threat level. Valid values: serious: high suspicious: medium remind: low"},"AttCk":{"type":"string","description":"The ATT\\&CK technique"},"AlertType":{"type":"string","description":"The threat type"},"AlertTypeMds":{"type":"string","description":"The Medusa code of the threat type"},"LogType":{"type":"string","description":"The log type of the rule"},"LogTypeMds":{"type":"string","description":"The Medusa code of the log type"},"LogSource":{"type":"string","description":"The log source of the rule"},"LogSourceMds":{"type":"string","description":"The Medusa code of the log source"},"RuleCondition":{"type":"string","description":"The query condition of the rule. The value is a JSON string"},"RuleGroup":{"type":"string","description":"The fields that are used to group logs. The value is a JSON array"},"RuleThreshold":{"type":"string","description":"The threshold configuration of the rule. The value is a JSON string"},"QueryCycle":{"type":"string","description":"The length of the rule window"},"EventTransferSwitch":{"type":"integer","description":"Specifies whether to convert alerts into events. Valid values: 0: no 1: yes"},"EventTransferType":{"type":"string","description":"The event generation method. Valid values: default: the default method singleToSingle: An event is generated for each alert. allToSingle:…"},"EventTransferExt":{"type":"string","description":"The extended information for event generation. This parameter is returned only when EventTransferType is set to allToSingle. The value…"},"RoleType":{"type":"integer","description":"The view type. 0: the view of the current Alibaba Cloud account. 1: the view of all accounts that are managed by the administrator"},"RoleFor":{"type":"integer","description":"The user ID that is used to switch the administrator's perspective to a member's perspective"},"RegionId":{"type":"string","description":"The region where the data management center of Threat Analysis is located. Select the region where your assets are located. Valid values:…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/post-customize-rule-test":{"post":{"operationId":"cloud_aliyun_cloud_siem_post_customize_rule_test","summary":"Submits a custom rule for testing","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"Id":{"type":"integer","description":"The ID of the custom rule"},"TestType":{"type":"string","description":"The test type. Valid values: simulate: tests the rule with simulated data business: tests the rule with business data"},"SimulatedData":{"type":"string","description":"The simulated data for the test. This parameter is required only when TestType is set to simulate"},"RoleType":{"type":"integer","description":"The view type. 0: the view of the current Alibaba Cloud account. 1: the view of all accounts in the enterprise"},"RoleFor":{"type":"integer","description":"The user ID of the member that the administrator wants to impersonate to view data"},"RegionId":{"type":"string","description":"The region where the Data Management center of threat analysis is located. Select the region based on the region where your assets are…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/post-event-dispose-and-whiterule-list":{"post":{"operationId":"cloud_aliyun_cloud_siem_post_event_dispose_and_whiterule_list","summary":"Submits incident handling information, updates the incident status, and updates the incident severity level","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"ClientToken":{"type":"string","description":"The idempotency token"},"IncidentUuid":{"type":"string","description":"The globally unique UUID of the incident"},"Status":{"type":"integer","description":"The incident status. Valid values: 0: unhandled 1: handling 5: handling failed 10: handled"},"Remark":{"type":"string","description":"The remarks for the incident"},"EventDispose":{"type":"string","description":"The incident handling configuration as a JSON object"},"ReceiverInfo":{"type":"string","description":"The alert recipient configuration as a JSON object"},"RoleType":{"type":"integer","description":"The view type. Valid values: 0: the China account view. 1: the view of all accounts in the enterprise"},"RoleFor":{"type":"integer","description":"The ID of the user for whom the administrator switches to a member view"},"RegionId":{"type":"string","description":"The region where the threat analysis data management center resides. Specify the management center based on the region of your assets.…"},"ThreatLevel":{"type":"string","description":"The threat level. Valid values: serious: high suspicious: medium remind: low"},"Owner":{"type":"string","description":"The account UID of the incident owner"},"ResponseSource":{"type":"string","description":"The source of the handling policy"},"DisposeStrategyIds":{"type":"string","description":"The list of handling policy IDs"},"SyncAlertStatus":{"type":"string","description":"Specifies whether to restore associated handled alerts to unhandled status when reopening the incident"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/post-event-whiterule-list":{"post":{"operationId":"cloud_aliyun_cloud_siem_post_event_whiterule_list","summary":"Submits alert whitelisting rules","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["WhiteruleList"],"properties":{"IncidentUuid":{"type":"string","description":"The globally unique ID of the event"},"WhiteruleList":{"type":"string","description":"The alert whitelisting rule, which is a JSON object"},"RoleType":{"type":"integer","description":"The account scope to which the rule applies. Valid values: 0: The current Alibaba Cloud account. 1: All accounts within the enterprise"},"RoleFor":{"type":"integer","description":"The ID of a member account. An administrator can use this parameter to switch to the perspective of the member account"},"RegionId":{"type":"string","description":"The region where the threat analysis feature is deployed. Select the region where your assets are located. Valid values: cn-hangzhou: For…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/post-finish-customize-rule-test":{"post":{"operationId":"cloud_aliyun_cloud_siem_post_finish_customize_rule_test","summary":"Stops the custom rule test","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"Id":{"type":"integer","description":"The ID of the custom rule"},"RoleType":{"type":"integer","description":"The view type. Valid values: 0: the view of the current Alibaba Cloud account 1: the view of all accounts in the enterprise"},"RoleFor":{"type":"integer","description":"The ID of the user whose perspective the administrator switches to"},"RegionId":{"type":"string","description":"The region where the data management center of Threat Analysis is located. Select the region of the management center based on the region…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/post-rule-status-change":{"post":{"operationId":"cloud_aliyun_cloud_siem_post_rule_status_change","summary":"Updates the status of a custom rule","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"Ids":{"type":"string","description":"The list of rule IDs in JSON array format"},"RuleType":{"type":"string","description":"The rule type. Valid values: predefine: Predefined. customize: Custom"},"InUse":{"type":"string","description":"The enabling status of the rule. Valid values: true: Enabled. false: Disabled"},"RoleType":{"type":"integer","description":"The view type. Valid values: 0: The view of the current Alibaba Cloud account. 1: The view of all accounts in the enterprise"},"RoleFor":{"type":"integer","description":"The ID of the user whose perspective the administrator switches to"},"RegionId":{"type":"string","description":"The region where the data management center of Threat Analysis is located. Select the region based on the region where your assets are…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/restore-capacity":{"post":{"operationId":"cloud_aliyun_cloud_siem_restore_capacity","summary":"Releases storage space. This operation is irreversible and causes data loss. Use with caution","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"RoleType":{"type":"integer","description":"The type of view. Valid values: 0: The view for the current Alibaba Cloud account. 1: The view for all accounts that belong to the…"},"RoleFor":{"type":"integer","description":"The user ID of the member. An administrator can use this parameter to switch to the perspective of a specific member"},"RegionId":{"type":"string","description":"The region where the Data Management center is located. Select a region based on the location of your assets. Valid values: cn-hangzhou:…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/set-storage":{"post":{"operationId":"cloud_aliyun_cloud_siem_set_storage","summary":"Saves user-configured storage information such as the storage duration and storage region","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["Ttl"],"properties":{"Ttl":{"type":"integer","description":"The log storage duration in days. Default value: 180. Minimum value: 30. Maximum value: 3000"},"Region":{"type":"string","description":"The log storage region. If the data management center is located in cn-hangzhou, the default value of Region is Shanghai (cn-shanghai). If…"},"RoleType":{"type":"integer","description":"The view type. Valid values: 0: the view of the current Alibaba Cloud account. 1: the view of all accounts in the enterprise"},"RoleFor":{"type":"integer","description":"The ID of the user whose perspective the administrator switches to"},"RegionId":{"type":"string","description":"The region of the data management center for Threat Analysis. Select the region of the management center based on the region where your…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/submit-import-log-tasks":{"post":{"operationId":"cloud_aliyun_cloud_siem_submit_import_log_tasks","summary":"Submits log collection tasks in batches","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["ProdCode","CloudCode"],"properties":{"ProdCode":{"type":"string","description":"The code of the product"},"LogCodes":{"type":"string","description":"The list of logs to be collected, in JSON array format"},"Accounts":{"type":"string","description":"The list of accounts to be collected, in JSON array format. Valid values: AccountId: the ID of the account to be collected. Imported:…"},"AutoImported":{"type":"integer","description":"Specifies whether to automatically collect logs from accounts that have the specified log configured. Valid values: 1: Automatically…"},"CloudCode":{"type":"string","enum":["qcloud","hcloud","aliyun","idc"],"description":"The code of the cloud provider"},"RegionId":{"type":"string","description":"The location of the data management center of threat detection and response. Specify the management center location based on the region of…"},"RoleFor":{"type":"integer","description":"The user ID used when an administrator switches to the perspective of another member"},"RoleType":{"type":"integer","description":"The view type. Valid values: 0: the view of the current Alibaba Cloud account. 1: the view of all accounts in the enterprise"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/update-automate-response-config-status":{"post":{"operationId":"cloud_aliyun_cloud_siem_update_automate_response_config_status","summary":"Updates the status of automated response rules","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"Ids":{"type":"string","description":"The IDs of the automated response rules, formatted as a JSON array"},"InUse":{"type":"string","description":"The enabling status of the rule. Valid values: true: Enabled. false: Disabled"},"RoleType":{"type":"integer","description":"The view type. Valid values: 0: the view of the current Alibaba Cloud account. 1: the view of all accounts in the enterprise"},"RoleFor":{"type":"integer","description":"The ID of the user whose perspective the administrator switches to"},"RegionId":{"type":"string","description":"The region where the data management center of Threat Analysis is located. Select the region of the management center based on the region…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/update-white-rule-list":{"post":{"operationId":"cloud_aliyun_cloud_siem_update_white_rule_list","summary":"Adds or updates alert whitelist rules","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["WhiteRuleId","Expression"],"properties":{"WhiteRuleId":{"type":"integer","description":"The unique ID of the whitelist rule"},"IncidentUuid":{"type":"string","description":"The global unique ID of the event"},"Expression":{"type":"string","description":"The alert whitelist rule. This is a JSON object"},"RoleType":{"type":"integer","description":"The view type. 0: The view of the current Alibaba Cloud account. 1: The view of all accounts that belong to the enterprise"},"RoleFor":{"type":"integer","description":"The user ID of the member. This parameter is used when an administrator switches to the perspective of a member"},"RegionId":{"type":"string","description":"The region of the Data Management center for threat analysis. Select a region for the Data Management center based on the region of your…"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-cloud-siem/version":{"post":{"operationId":"cloud_aliyun_cloud_siem_version","summary":"version","description":"POST /","tags":["cloud"],"parameters":[],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}}},"components":{"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","in":"header","name":"x-api-key"}},"schemas":{"RunEnvelope":{"type":"object","required":["project","data","timestamp"],"properties":{"project":{"type":"string","example":"dev-tools:hash"},"data":{},"timestamp":{"type":"string","format":"date-time"}}},"ErrorEnvelope":{"type":"object","properties":{"content":{},"message":{"type":"string"},"errors":{"type":"array","items":{}},"error":{"type":"object","properties":{"code":{"type":"string"},"message":{"type":"string"}}}}}},"responses":{"Error":{"description":"Invalid key, plan gate, rate limit or upstream failure","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorEnvelope"}}}}}}}