# Alibaba Cloud Security Center API > Alibaba Cloud Security Center API on Apizie: 400 endpoints (Adds assets to an asset selection operation, Creates a baseline whitelist record, Adds instances to the whitelist at the instance level for a specific check item in cloud platform…, Adds check items to the whitelist for cloud platform configuration checks, …) returned as clean JSON through one API key. Send your own provider key in the x-upstream-key header. Call it over REST at https://www.apizie.tech/v1/cloud:aliyun-sas/{endpoint} or from Claude, ChatGPT and Cursor through the Apizie MCP server. Free plan: 1,000 requests a month. - Project key: `cloud:aliyun-sas` - Category: Cloud - Status: byok - Source: https://api.alibabacloud.com/product/sas - Page: https://www.apizie.tech/api/cloud/aliyun-sas - OpenAPI: https://www.apizie.tech/api/cloud/aliyun-sas/openapi.json Alibaba Cloud OpenAPI for Security Center (sas, version 2018-12-03). Calls are signed with ACS3-HMAC-SHA256 using your AccessKey ID and secret. ## Endpoints ### Adds assets to an asset selection operation `POST https://www.apizie.tech/v1/cloud:aliyun-sas/add-asset-selection-criteria` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | SelectionKey | string | yes | The unique identifier of the asset selection | | Criteria | string | no | The conditions for searching assets. This parameter is in JSON format. Pay attention to the letter case when you specify this parameter.… | | CriteriaOperation | string | no | The operation type for the criteria. Valid values: add: adds assets. del: deletes assets | | TargetOperationList | string | no | The list of assets (JSON-encoded) | | ClientToken | string | no | The client token that is used to ensure the idempotence of the request. Different requests must use different tokens. The token supports… | | DryRun | string | no | Specifies whether to perform only a dry run. true: performs only a dry run without executing the actual operation. false: performs the… | ### Creates a baseline whitelist record `POST https://www.apizie.tech/v1/cloud:aliyun-sas/add-baseline-check-white-record` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | Lang | string | no | The language of the request and response. Default value: zh. Valid values: zh: Chinese en: English | | Source | string | no | The data source. If this parameter is left empty, servers are queried by default. Valid values: default: server agentless: agentless | | CheckId | integer | no | The ID of the check item. You can call the [ListCheckItemWarningSummary](~~ListCheckItemWarningSummary~~) operation to obtain the check… | | TargetType | string | no | The type of the target to which the whitelist applies. Valid values: all_instance: all servers instance: specified servers | | Reason | string | no | The reason for adding the item to the whitelist | ### Adds instances to the whitelist at the instance level for a specific check item in cloud platform… `POST https://www.apizie.tech/v1/cloud:aliyun-sas/add-check-instance-result-white-list` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | CheckGroupId | string | no | The ID of the check group to which the check item belongs | | CheckId | integer | no | The ID of the check item. Call the [ListCheckResult](~~ListCheckResult~~) operation to obtain this parameter | | InstanceIds | string | no | The collection of asset instance IDs (JSON-encoded) | | InstanceList | string | no | The collection of asset instance information (JSON-encoded) | | RuleType | string | no | The rule type. Default value: WHITE. Valid values: WHITE: whitelist | | Remark | string | no | The remarks. Maximum length: 65,535 bytes | | ClientToken | string | no | The client token that is used to ensure the idempotence of the request. Different requests should use different tokens. The token supports… | | DryRun | string | no | Specifies whether to perform only a dry run. Valid values: true: performs only a dry run without executing the actual operation. false:… | ### Adds check items to the whitelist for cloud platform configuration checks `POST https://www.apizie.tech/v1/cloud:aliyun-sas/add-check-result-white-list` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | CheckIds | string | no | The IDs of the check items. Call the [ListCheckResult](~~ListCheckResult~~) operation to obtain this parameter (JSON-encoded) | | RuleType | string | no | The rule type. Default value: WHITE. Valid values: WHITE: Add to whitelist | | Remark | string | no | The remarks. Maximum length: 65,535 bytes | | ClientToken | string | no | The client token that is used to ensure the idempotence of the request. Different requests should use different tokens. The token can… | | InstanceIds | string | no | The instance IDs of the cloud service instances to add to the whitelist. Separate multiple instance IDs with commas (,) (JSON-encoded) | | DryRun | string | no | Specifies whether to perform only a dry run. Valid values: true: performs only a dry run without executing the actual operation. false:… | ### Creates a user-defined defense rule `POST https://www.apizie.tech/v1/cloud:aliyun-sas/add-client-user-define-rule` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | Name | string | yes | The name of the custom rule | | Type | integer | yes | The rule type. Valid values: 1: process hash 2: command line 3: process network 4: file read/write 5: registry operation 6: dynamic-link… | | Md5List | string | no | The list of process hashes | | ActionType | integer | yes | The action type. Valid values: 0: allow 1: block | | ProcPath | string | no | The process path | | Cmdline | string | no | The command line | | Platform | string | no | The operating system type. Valid values: windows: Windows linux: Linux all: all | | IP | string | no | The IP address | | Port | integer | no | The port number. This parameter is deprecated | | FilePath | string | no | The file path | | RegistryKey | string | no | The registry key | | RegistryContent | string | no | The registry value | | NewFilePath | string | no | The new file path for file rename | | ParentProcPath | string | no | The parent process path | | ParentCmdline | string | no | The parent command line | | PortStr | string | no | The port number. Valid values: 1 to 65535 | | Domain | string | no | The domain name | | TargetDefault | string | no | Specifies whether machines are automatically added to the rule. Default value: add. Valid values: add: Automatically added by default.… | ### Creates multi-cloud asset configuration information `POST https://www.apizie.tech/v1/cloud:aliyun-sas/add-cloud-vendor-account-ak` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | Vendor | string | yes | The cloud asset vendor. Valid values: Tencent: Tencent Cloud HUAWEICLOUD: Huawei Cloud Azure: Azure AWS: AWS VOLCENGINE: Volcengine… | | AkType | string | yes | The AccessKey type. Valid values: primary: Primary account sub: Sub-account ctdr: Agentic SOC When the vendor is CHAITIN, FORTINET,… | | SecretId | string | yes | The AccessKey ID. Valid values: If AkType is set to primary: Tencent: AccessKey ID of the primary account HUAWEICLOUD: AccessKey ID of the… | | SecretKey | string | yes | The AccessKey secret. Valid values: If AkType is set to primary: Tencent: AccessKey secret of the primary account HUAWEICLOUD: AccessKey… | | Regions | string | no | The list of regions used to verify the AccessKey information. This parameter is valid only when Vendor is set to AWS or OracleCloud. You… | | SubscriptionIds | string | no | The list of subscription IDs. This parameter is deprecated (JSON-encoded) | | TenantId | string | no | The tenant ID. This parameter is valid only when Vendor is set to Azure or OracleCloud | | Domain | string | no | The domain to which the connected account belongs. Valid values: china: China global: Global europe: Huawei Cloud Europe This parameter is… | | AuthModules | string | no | The list of modules associated with the AccessKey. When AkType is set to ctdr, this parameter is required and at least one module must be… | | Lang | string | no | The language of the request and response. Default value: zh. Valid values: zh: Chinese en: English | | VendorAuthAlias | string | no | The name of the AccessKey account. This parameter is used to identify the account to which the third-party host assets belong | | ExtendInfo | string | no | The extension information. This parameter is used to record the extension information of different vendors. Google Cloud is accessed… | | CtdrCloudUserId | string | no | The account ID. The account ID of the connected cloud vendor. This parameter is required when the permission description includes Cloud… | ### Adds an audit log access configuration for third-party cloud assets `POST https://www.apizie.tech/v1/cloud:aliyun-sas/add-cloud-vendor-trial-config` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | AuthId | integer | yes | The unique ID of the AccessKey pair. You can call [DescribeCloudVendorAccountAKList](~~DescribeCloudVendorAccountAKList~~) to obtain the… | | Vendor | string | yes | The cloud asset vendor. Valid values: Tencent: Tencent Cloud. HUAWEICLOUD: Huawei Cloud. Azure: Azure. AWS: AWS. VOLCENGINE: Volcengine.… | | AuthInfo | string | yes | The multi-cloud configuration information: AWS: Input parameters sqsQueueName and sqsRegion. Tencent: Input parameters kafkaUserName,… | ### Creates a non-image process defense rule `POST https://www.apizie.tech/v1/cloud:aliyun-sas/add-container-defense-rule` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | RuleId | integer | no | The rule ID. You do not need to specify this parameter when creating a rule | | RuleAction | integer | no | The action to take when the rule is matched. Valid values: 1: Alert. 2: Block | | RuleSwitch | integer | no | The rule switch. Valid values: 0: Disabled. 1: Enabled | | RuleName | string | no | The rule name | | Description | string | no | The description | | RuleType | integer | no | The rule type. Valid values: 2: user rule Only the value 2 is supported.> | | Whitelist | string | no | The whitelist (JSON-encoded) | | Scope | string | no | The scope. This parameter is required. Specify at least one Scope entry, such as Scope.1.AllNamespace=1, which indicates that the rule… | ### Creates a defense rule against container escapes `POST https://www.apizie.tech/v1/cloud:aliyun-sas/add-container-plugin-rule` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | Lang | string | no | The language of the content within the request and response. Default value: zh. Valid values: zh: Chinese en: English | | RuleName | string | yes | The name of the rule. The name must be 1 to 80 characters in length, and can contain letters, digits, hyphens (-), forward slashes (/),… | | RuleTemplateId | integer | yes | The ID of the rule template. You can call the ListSystemClientRules operation to query the ID of the rule template | | Mode | integer | yes | The action that you want to specify for the rule. Valid values: 1: triggers alerts. 2: blocks escapes | | SelectedPolicy | string | yes | The check items that are enabled for the rule (JSON-encoded) | | RuleType | integer | no | The type of the rule. Valid values: 0: custom rule 1: system rule | | WhiteImages | string | no | The images that are added to the whitelist (JSON-encoded) | ### Creates a file protection rule `POST https://www.apizie.tech/v1/cloud:aliyun-sas/add-file-protect-bind-machine` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | BlockUuids | string | no | The list of servers with tamper-proofing enabled (JSON-encoded) | | AlertUuids | string | no | The list of servers with the alert protection level enabled (JSON-encoded) | | NoneUuids | string | no | The list of servers with the file protection feature disabled (JSON-encoded) | ### Creates an IDC probe to add assets in a data center to Security Center and manage the assets by using the… `POST https://www.apizie.tech/v1/cloud:aliyun-sas/add-idc-probe` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | IdcName | string | yes | The name of the data center | | IpSegments | string | yes | The settings of the CIDR block | | WinPort | string | yes | The Windows port | | LinuxPort | string | yes | The Linux port | | IdcRegion | string | yes | The region ID | | PeriodUnit | string | yes | The unit of the scan interval. Valid values: day hour | | IntervalPeriod | integer | yes | The scan interval | | Uuids | string | yes | The UUID of the server. Separate multiple UUIDs with commas (,). You can call the… | ### Adds an image alert handling rule `POST https://www.apizie.tech/v1/cloud:aliyun-sas/add-image-event-operation` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | EventType | string | no | The Alarm Metric for alerting. Valid values: sensitiveFile: Sensitive file | | OperationCode | string | no | The operation code. Valid values: whitelist: Whitelist | | Conditions | string | no | The rule conditions. The value is in JSON format. Valid keys: condition: The matching condition. type: The matching type. value: The… | | Scenarios | string | no | The rule scope. The value is in JSON format. Valid keys: type: The scope type. value: The scope value. This parameter and Source cannot be… | | EventKey | string | no | The alert metric keyword | | EventName | string | no | The alert metric name | | Source | string | no | The source of the whitelist. Valid values: image: Image. agentless: Agentless detection. This parameter and Scenarios cannot be empty at… | | Note | string | no | The note to add | ### Adds image vulnerabilities to the whitelist `POST https://www.apizie.tech/v1/cloud:aliyun-sas/add-image-vul-white-list` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | Target | string | no | The operation target. This parameter is in JSON format and contains the following fields: type: the target type. Set the value to repo.… | | Whitelist | string | no | The whitelist. This parameter is in JSON format and contains the following fields: Type: the vulnerability type. Valid values: cve and… | | Type | string | no | The vulnerability type. Valid values: cve: system vulnerability sca: application vulnerability | | Reason | string | no | The reason for adding the whitelist | | Lang | string | no | The language of the request and response. Default value: zh. Valid values: zh: Chinese en: English | | Source | string | no | The source of the whitelist. Valid values: image: image agentless: agentless | ### Creates a command that is used to install the Security Center agent `POST https://www.apizie.tech/v1/cloud:aliyun-sas/add-install-code` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | GroupId | integer | no | The ID of the asset group to which you want to add the asset. You can call the [DescribeAllGroups](~~DescribeAllGroups~~) operation to… | | Os | string | no | The operating system of the asset. Default value: linux. Valid values: linux windows | | ExpiredDate | integer | no | The validity period of the installation command. The value is a 13-digit timestamp. The installation command is valid only within the… | | VendorName | string | no | The name of the service provider for the asset. Default value: ALIYUN. You can call the [DescribeVendorList](~~DescribeVendorList~~)… | | OnlyImage | string | no | Specifies whether to create an image. Default value: false. Valid values: false: does not create an image. true: creates an image | | ProxyCluster | string | no | The name of the proxy cluster | | PrivateLinkId | integer | no | The ID of the PrivateLink endpoint | ### Connects to a self-managed image registry `POST https://www.apizie.tech/v1/cloud:aliyun-sas/add-private-registry` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | RegistryType | string | yes | The type of the private image registry. Valid values: harbor: Harbor environment. quay: Quay environment | | RegistryVersion | string | yes | The version of the image registry. Valid values: V1: Version 1.0. V2: Version 2.0 | | ProtocolType | integer | yes | The protocol type. Valid values: 1: HTTP. 2: HTTPS | | NetType | integer | yes | The network type. Valid values: 1: Internet. 2: VPC | | VpcId | string | no | The instance ID of the VPC | | RegistryHostIp | string | yes | The IP address of the registry. Enter a valid IPv4 address that can be used to connect to the image registry. To specify a domain name for… | | DomainName | string | yes | The domain name of the registry | | UserName | string | yes | The username of the image registry | | Password | string | yes | The password | | RegistryRegionId | string | yes | The region ID. You can call the [ListImageRegistryRegion](~~ListImageRegistryRegion~~) operation to query the supported region IDs | | TransPerHour | integer | no | The number of images scanned per hour | | ExtraParam | string | no | The additional parameters for the image registry. This parameter is required when you use quay. The parameters include: namespace: The… | | Port | integer | no | The port number | ### Add or update the whitelist for VPC purchases `POST https://www.apizie.tech/v1/cloud:aliyun-sas/add-protect-vpc-list` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | AddVpcInstanceIdList | string | no | Collection of new VPC instance IDs. Call the [DescribeVpcList](~~DescribeVpcList~~) interface to obtain this parameter | | DelVpcInstanceIdList | string | no | Collection of VPC instance IDs to be deleted. Call the [DescribeVpcList](~~DescribeVpcList~~) interface to obtain this parameter | ### Creates a release batch for Security Center upgrades `POST https://www.apizie.tech/v1/cloud:aliyun-sas/add-publish-batch` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | UpgradeVersion | string | yes | The target version to which you want to upgrade | | BatchName | string | yes | The name of the release batch | | Interval | integer | yes | The interval between release batches | | OperationBase | integer | no | The dimension for asset selection. Valid values: 0: server instance 1: server group 2: VPC-connected instance ID | ### Creates a rule for container tamper-proofing `POST https://www.apizie.tech/v1/cloud:aliyun-sas/add-sas-container-web-defense-rule` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | RuleName | string | no | The name of the rule | | PathConfDTOList | string | no | The paths that you want to protect (JSON-encoded) | ### Adds a trial for the value-added modules of Security Center, including vulnerability remediation and threat… `POST https://www.apizie.tech/v1/cloud:aliyun-sas/add-sas-module-trial` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | ModuleCode | string | no | The module code. Valid values: vulFix: vulnerability remediation cloudSiem: threat analysis and response | | Lang | string | no | The language of the request and response. Valid values: zh: Chinese en: English | ### Adds a tag to assets `POST https://www.apizie.tech/v1/cloud:aliyun-sas/add-tag-with-uuid` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | TagName | string | yes | The name of the tag | | UuidList | string | no | The UUIDs of the servers. Separate multiple UUIDs with commas (,). You can call the… | ### Adds servers from which you want to uninstall the Security Center agent `POST https://www.apizie.tech/v1/cloud:aliyun-sas/add-uninstall-clients-by-uuids` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | SourceIp | string | no | The source IP address of the request. You do not need to specify this parameter. It is automatically obtained by the system | | Uuids | string | yes | The UUID of the server that you want to unbind. Separate multiple UUIDs with commas (,). You can call the… | | Region | string | no | The region in which the server resides | | CallMethod | string | no | The method name. Default value: init | | Feedback | string | no | The feedback | ### Adds a process to behavior analytics `POST https://www.apizie.tech/v1/cloud:aliyun-sas/add-unknown-threat-detect-process` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | ProcessList | string | no | The list of processes (JSON-encoded) | | UuidList | string | no | The list of asset UUIDs for which the process is to be added (JSON-encoded) | | EventIdList | string | no | The list of event IDs (JSON-encoded) | | HandleRemark | string | no | The handling remarks | ### Creates a honeypot `POST https://www.apizie.tech/v1/cloud:aliyun-sas/add-vpc-honey-pot` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | VpcId | string | yes | The ID of the virtual private cloud (VPC) in which you want to create a honeypot. You can call the [DescribeVpcList](~~DescribeVpcList~~)… | ### Queries the advanced whitelist editing information `POST https://www.apizie.tech/v1/cloud:aliyun-sas/advance-security-event-operations` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | RuleId | integer | no | The rule ID | | EventName | string | no | The alert name. The EventName and EventType parameters must be specified together. If only one of them is specified, the API returns a 400… | | EventType | string | no | The type of the alerting event. Valid values: Abnormal process behavior Web shell Unusual logon Abnormal event Sensitive file tampering… | | ResourceDirectoryAccountId | integer | no | The member account ID in the resource directory (Alibaba Cloud account) | ### Adds notes to multiple security alerts `POST https://www.apizie.tech/v1/cloud:aliyun-sas/batch-create-malicious-note` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | ImageMaliciousFileList | string | no | The batch list (JSON-encoded) | ### Deletes multiple whitelist rules for sensitive file alerts in agentless detection `POST https://www.apizie.tech/v1/cloud:aliyun-sas/batch-delete-malicious-file-whitelist-config` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | ConfigIdList | string | no | The list of sensitive file whitelist rule IDs. Call [ListMaliciousFileWhitelistConfigs](~~ListMaliciousFileWhitelistConfigs~~) to obtain… | ### Enables or disables multiple features in proactive defense at a time `POST https://www.apizie.tech/v1/cloud:aliyun-sas/batch-operate-common-overall-config` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | Config | string | yes | The status of the feature. Valid values: on: enabled off: disabled | | TypeList | string | yes | The type of the feature in proactive defense. Valid values: kdump_switch: Active defense experience optimization threat_detect: Dynamic… | ### Modifies multiple whitelist rules for sensitive file alerts in agentless detection `POST https://www.apizie.tech/v1/cloud:aliyun-sas/batch-update-malicious-file-whitelist-config` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | ConfigList | string | no | The list of whitelist rules for sensitive file alerts in agentless detection (JSON-encoded) | ### Binds authorization information to servers `POST https://www.apizie.tech/v1/cloud:aliyun-sas/bind-auth-to-machine` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | Criteria | string | no | The conditions for searching for assets. This parameter is in JSON format. Pay attention to letter case when you specify this parameter.… | | LogicalExp | string | no | The logical relationship among multiple search conditions. Default value: OR. Valid values: OR: The search conditions are evaluated with a… | | BindAll | string | no | Specifies whether to bind all assets. Default value: false. Valid values: true: Bind all assets. false: Do not bind all assets | | AuthVersion | integer | no | The authorization version of the asset. Valid values: 6: Anti-virus Edition 5: Advanced Edition 3: Enterprise Edition 7: Ultimate Edition… | | AutoBind | integer | no | Specifies whether to enable automatic binding. Valid values: 0: Disabled. 1: Enabled | | IsPreBind | integer | no | Specifies whether this is a pre-binding operation. Valid values: 0: No. 1: Yes. After pre-binding is enabled, the corresponding… | | PreBindOrderId | integer | no | The order ID associated with the pre-binding | | NtmVersion | string | no | The order version associated with the pre-binding. Valid values: level7: Anti-virus Edition level3: Advanced Edition level2: Enterprise… | | Bind | string | no | The collection of UUIDs to bind. Bind and UnBind cannot both be empty (JSON-encoded) | | UnBind | string | no | The collection of UUIDs to unbind. Bind and UnBind cannot both be empty (JSON-encoded) | | ResourceDirectoryAccountId | integer | no | The ID of the member account in the resource folder (Alibaba Cloud account). Call the… | | ProductCode | string | no | The ProductCode | | ClientToken | string | no | The client token that is used to ensure the idempotence of the request. Use a different token for each request. The token supports only… | | DryRun | string | no | Specifies whether to perform a dry run. Valid values: true: performs a dry run without executing the actual operation. false: performs the… | ### Connects servers to a proxy server. After you create a cluster and deploy the proxy server, you can add… `POST https://www.apizie.tech/v1/cloud:aliyun-sas/bind-hybrid-proxy` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | ClusterName | string | yes | The name of the proxy cluster | | YundunUuids | string | yes | The UUIDs of the servers connected to the proxy (JSON-encoded) | ### Cancels the main task `POST https://www.apizie.tech/v1/cloud:aliyun-sas/cancel-once-task` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | TaskId | string | yes | The ID of the task. You can call the [GenerateOnceTask](~~GenerateOnceTask~~) operation to query the IDs of tasks | ### Modifies the custom refresh cycle configuration for assets `POST https://www.apizie.tech/v1/cloud:aliyun-sas/change-asset-refresh-task-config` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | AssetRefreshConfigs | string | no | The list of asset refresh configurations (JSON-encoded) | | RegionId | string | no | The region of the Security Center instance | ### Modifies the configuration items for cloud platform configuration checks `POST https://www.apizie.tech/v1/cloud:aliyun-sas/change-check-config` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | RegionId | string | no | The region of the Security Center instance. Valid values: cn-hangzhou: China ap-southeast-1: Singapore | | CycleDays | string | no | The periodic check schedule (JSON-encoded) | | StartTime | integer | no | The start hour of the check time window, indicating the hour of the day. The start time and end time must fall within one of the following… | | EndTime | integer | no | The end hour of the check time window, indicating the hour of the day. The start time and end time must fall within one of the following… | | StandardIds | string | no | This parameter is deprecated and does not need to be specified (JSON-encoded) | | ConfigRequirementIds | string | no | Configures the check policy by specifying requirement IDs. Call the [ListCheckResult](~~ListCheckResult~~) operation to obtain requirement… | | ConfigStandardIds | string | no | Configures the check policy by specifying standard IDs. Call the [ListCheckResult](~~ListCheckResult~~) operation to obtain standard IDs… | | EnableAutoCheck | string | no | Specifies whether to enable automatic periodic checks. Valid values: true: Enabled. false: Disabled | | EnableAddCheck | string | no | Specifies whether to automatically check newly added check items in the selected requirements. Valid values: true: Enabled. false: Disabled | | AddedCheck | string | no | The list of check items to add to the policy. If the ConfigStandardIds or ConfigRequirementIds parameter is specified, this parameter does… | | RemovedCheck | string | no | The list of check items to remove from the policy. If the ConfigStandardIds or ConfigRequirementIds parameter is specified, this parameter… | | Vendors | string | no | The list of cloud service providers (JSON-encoded) | | Configure | string | no | The field configuration. Valid values: all: adds all check items | | SystemConfig | string | no | Specifies whether to use the system-generated configuration. Valid values: true: Yes. false: No | | ClientToken | string | no | The client token that is used to ensure the idempotence of the request. Use a different token for each request. Only ASCII characters are… | | ResourceDirectoryAccountId | integer | no | The ID of the member account in the resource directory (Alibaba Cloud account). Call the… | | DryRun | string | no | Specifies whether to perform only a dry run, without performing the actual request. Valid values: true: performs only a dry run without… | ### Modifies the custom configuration of a check item `POST https://www.apizie.tech/v1/cloud:aliyun-sas/change-check-custom-config` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | RegionId | string | no | The region of the Security Center instance. Valid values: cn-hangzhou: China ap-southeast-1: Singapore | | CheckId | integer | no | The ID of the check item. You can call the [ListCheckResult](~~ListCheckResult~~) operation to obtain the check item ID | | CustomConfigs | string | no | The list of custom configuration items for the check item (JSON-encoded) | | RepairConfigs | string | no | The repair parameters supported by the repair feature of the check item (JSON-encoded) | ### Modifies the check scope configuration instance `POST https://www.apizie.tech/v1/cloud:aliyun-sas/change-check-scope-config-instance` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | ConfigId | string | yes | The ID of the scan scope configuration. Call the [GetCheckScopeConfig](~~GetCheckScopeConfig~~) operation to obtain this parameter | | AddAssetUuids | string | no | The list of unique IDs of cloud assets to add (JSON-encoded) | | DeleteAssetUuids | string | no | The list of unique IDs of cloud assets to delete (JSON-encoded) | | SelectionKey | string | no | The key for cross-page select-all | ### Modifies custom security score rules `POST https://www.apizie.tech/v1/cloud:aliyun-sas/change-security-score-rule` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | SecurityScoreRuleList | string | no | The list of legacy security score rules (JSON-encoded) | | SecurityScoreCategoryList | string | no | The list of new version security score rule deductions (JSON-encoded) | | ResetSecurityScoreRule | string | no | Specifies whether to reset to the system default rules. Valid values: true: Yes. false: No | | CalType | string | no | Specifies whether to modify the new version or legacy security score rules. If the value is home_security_score, the new version security… | | ResourceDirectoryAccountId | integer | no | The ID of the Alibaba Cloud account of the member accounts in the resource directory. Call the… | ### Modifies the language settings of log analysis. The modification on the language settings takes effect… `POST https://www.apizie.tech/v1/cloud:aliyun-sas/change-user-lang` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | UserLang | string | no | The new language. Valid values: zh: Chinese en: English | ### Checks whether one or more alerts are generated on a specified server based on alert IDs `POST https://www.apizie.tech/v1/cloud:aliyun-sas/check-security-event-id` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | Uuid | string | yes | The UUID of the server. You can call the [DescribeCloudCenterInstances](~~DescribeCloudCenterInstances~~) operation to query the UUIDs of… | | SecurityEventIds | string | no | The IDs of alert events. You can specify up to 100 IDs. If you do not specify this parameter, the value of the response parameter Data is… | ### Authenticates an STS token and returns the Alibaba Cloud account ID `POST https://www.apizie.tech/v1/cloud:aliyun-sas/check-sts-token-auth` (byok) ### Checks whether the remaining quota of the vulnerability fixing feature is sufficient for a free trial user… `POST https://www.apizie.tech/v1/cloud:aliyun-sas/check-trial-fix-count` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | Type | string | yes | The type of the vulnerability that you want to fix. Valid values: cve: Linux software vulnerability. sys: Windows system vulnerability.… | | Info | string | no | The information about the vulnerability. The value of this parameter is in the JSON format and contains the following fields: name: the… | | VulNames | string | no | The names of the vulnerabilities (JSON-encoded) | | Uuids | string | no | The UUIDs of the servers (JSON-encoded) | ### Checks whether Elastic Compute Service (ECS) instances exist `POST https://www.apizie.tech/v1/cloud:aliyun-sas/check-user-has-ecs` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | Lang | string | no | The language of the content within the request and response. Default value: zh. Valid values: zh: Chinese en: English | ### Confirms the handling of a trojan scan alert `POST https://www.apizie.tech/v1/cloud:aliyun-sas/confirm-virus-events` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | OperationCode | string | yes | The method to handle the alert event. Valid values: default: deep scan and removal ignore: ignore advance_mark_mis_info: add to whitelist… | | OperationRange | string | no | The scope of the trojan scan alert handling. This parameter is required when OperationAll is set to 0. This parameter is ignored when… | | OperationAll | integer | yes | Specifies whether to handle all alerts. Valid values: 1: Yes. 0: No | ### Clones an existing security report. The new security report has the same configuration as the existing… `POST https://www.apizie.tech/v1/cloud:aliyun-sas/copy-customize-report-config` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | SourceIp | string | no | The source IP address of the request | | Lang | string | no | The language of the content within the request and response. Default value: zh. Valid values: zh: Chinese en: English | | ReportId | integer | yes | The ID of the report. You can call the [DescribeCustomizeReportList](~~DescribeCustomizeReportList~~) operation to query the ID | ### Creates an agentless detection task `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-agentless-scan-task` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | TargetType | integer | yes | The target type. Valid values: 1: Host detection - detection by snapshot. 2: Host detection - detection by image. 3: User snapshot… | | UuidList | string | no | The UUIDs of the assets to be detected. You can call the [DescribeCloudCenterInstances](~~DescribeCloudCenterInstances~~) operation to… | | AutoDeleteDays | integer | no | The image retention period, in days. This parameter takes effect only for host detection. It does not take effect for user snapshot… | | ScanDataDisk | string | no | Specifies whether to detect data cloud disks. Valid values: true: Detected. false: Not detected | | ReleaseAfterScan | string | no | Specifies whether to enable the cost-saving mode. Valid values: true: Enabled. false: Disabled | | AssetSelectionType | string | no | The asset selection identifier | | RegionId | string | no | The region ID, which is usually automatically populated by the gateway | | ResourceRegionId | string | no | The region ID of the resource to be detected, such as cn-hangzhou | | From | string | no | The source of the API call, which is used to collect statistics on scan task volume and scan data volume by source. If this parameter is… | | ClientToken | string | no | The idempotency key | | Targets | string | no | The list of targets for image security remediation. Each target specifies the source image, the region, the name of the remediated image,… | ### Creates a defense rule against brute-force attacks `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-anti-brute-force-rule` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | SourceIp | string | no | The source IP address of the request | | Name | string | yes | The name of the defense rule | | Span | integer | yes | The maximum period of time during which failed logon attempts from an account can occur. Unit: minutes. Valid values: 1 2 5 10 15 To… | | FailCount | integer | yes | The maximum number of failed logon attempts from an account. Valid values: 2, 3, 4, 5, 10, 50, 80, and 100 | | ForbiddenTime | integer | yes | The period of time during which logons from an account are not allowed. Unit: minutes. Valid values: 5 15 30 60 120 360 720 1440 10080… | | DefaultRule | string | no | Specifies whether to set the defense rule as the default rule. Valid values: true: yes false: no | | UuidList | string | yes | The UUIDs of the servers to which you want to apply the defense rule (JSON-encoded) | | ProtocolType | string | no | The types of protocols supported for interception by the brute force attack rule creation (JSON-encoded) | ### Creates an asset selection configuration `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-asset-selection-config` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | BusinessType | string | yes | The business type of the asset selection. Valid values: VIRUS_SCAN_CYCLE_CONFIG: trojan scan configuration. VIRUS_SCAN_ONCE_TASK: trojan… | | TargetType | string | yes | The Asset Type of the target. Valid values: all_instance: all servers. instance: selected by server. group: selected by group. vpc:… | | Platform | string | no | The operating system of the target asset. Valid values: all: all operating systems. windows: Windows operating system. linux: Linux… | | ClientToken | string | no | The client token that is used to ensure the idempotence of the request. Use a different token for each request. The token can contain only… | | DryRun | string | no | Specifies whether to perform only a dry run, without performing the actual request. Valid values: true: performs only a dry run without… | ### Creates the sensitive asset configuration for attack paths `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-attack-path-sensitive-asset-config` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | AttackPathAssetList | string | yes | The list of cloud service assets (JSON-encoded) | | ConfigType | string | yes | The configuration type. Valid values: asset_instance: asset | ### Creates an attack path whitelist `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-attack-path-whitelist` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | AttackPathAssetList | string | no | The list of cloud service assets in the attack path (JSON-encoded) | | PathType | string | yes | The path type. You can call [ListAvailableAttackPath](~~ListAvailableAttackPath~~) to query the path type | | PathName | string | no | The path name. You can call [ListAvailableAttackPath](~~ListAvailableAttackPath~~) to query the path name. This parameter is required. If… | | WhitelistType | string | yes | The whitelist type. Valid values: ALL_ASSET: all assets. PART_ASSET: partial assets | | Remark | string | no | The remarks | | WhitelistName | string | yes | The whitelist name | ### Creates a witness `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-attestor` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | SourceIp | string | no | The source IP address | | Name | string | no | The name of the witness | | KeyRegionId | string | no | The region ID of the Key Management Service (KMS) key | | KeyId | string | no | The ID of the KMS key | | KeyVersionId | string | no | The version ID of the KMS key | | Remark | string | no | The description | ### Creates an anti-ransomware policy for servers `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-backup-policy` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | Name | string | yes | Sets the name of the anti-ransomware policy to create | | Policy | string | yes | IsDefault: The type of the anti-ransomware policy to create. Valid values: - 1: recommended policy - 0: custom policy Include: The file… | | PolicyVersion | string | yes | The version of the anti-ransomware policy. Fixed value: 2.0.0 | | PolicyRegionId | string | no | The region ID of the server that is not deployed on Alibaba Cloud. You can call the [DescribeSupportRegion](~~DescribeSupportRegion~~)… | | UuidList | string | no | The UUIDs of the servers to protect (JSON-encoded) | | ServerType | string | no | The server type. Valid values: ALIYUN: Alibaba Cloud server OUT_CLOUD: server that is not deployed on Alibaba Cloud TRIPARTITE: simple… | | SelectType | string | no | The method to cover assets. Valid values: ALL_MACHINE: all assets To cover all assets of the specified type, set this parameter to… | ### Queries the parameters that are required to upload a file for detection `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-batch-upload-url` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | Md5List | string | yes | The identifiers of files. Only MD5 hash values are supported (JSON-encoded) | | Type | integer | yes | The type of the file. Valid values: 0: unknown file 1: binary file 2: webshell file 4: script file If you do not know the type of the… | ### Creates a binary security policy `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-binary-security-policy` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | SourceIp | string | no | The source IP address | | Name | string | no | The name of the policy | | Remark | string | no | The description | | Policy | string | yes | The content of the policy. Specify a value in the JSON format. You can specify the following keys: policyMode: the type of the policy.… | | Clusters | string | yes | The information about the cluster | | Status | string | no | The status of the policy. Valid values: enable disable | ### Creates a custom check item in the Cloud Security Posture Management (CSPM) custom check item feature `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-check-item` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | SectionIds | string | yes | The IDs of the sections associated with the check item (JSON-encoded) | | Vendor | string | yes | The cloud asset vendor. You can call the [ListCloudAssetSchemas](~~ListCloudAssetSchemas~~) operation to obtain the available vendors | | InstanceType | string | yes | The asset type of the cloud service. You can call the [ListCloudAssetSchemas](~~ListCloudAssetSchemas~~) operation to obtain this parameter | | InstanceSubType | string | yes | The asset subtype of the cloud service. You can call the [ListCloudAssetSchemas](~~ListCloudAssetSchemas~~) operation to obtain this… | | CheckShowName | string | yes | The name of the custom check item | | RiskLevel | string | yes | The risk level of the check item. Valid values: HIGH: High risk. MEDIUM: Medium risk. LOW: Low risk | | Status | string | yes | The status of the check item. Valid values: EDIT: Being edited. RELEASE: Published. Changing the status from Published to Being edited… | | Remark | string | no | The remarks | | Description | string | no | The description of the check item (JSON-encoded) | | AssistInfo | string | no | The help information of the check item (JSON-encoded) | | Solution | string | no | The solution information of the check item (JSON-encoded) | | CheckRule | string | yes | The rule definition of the custom check item | ### Create Policy `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-check-policy` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | PolicyType | string | yes | The policy category type for custom check rules: STANDARD: Add to a standard. REQUIREMENT: Add to a requirement. SECTION: Add to a section | | PolicyShowName | string | yes | The name of the custom policy | | DependentPolicyId | integer | no | The ID of the parent policy. (The specific dependency order from low to high is Section -> Requirement -> Standard) | | Type | string | no | The name of the major policy category (required when PolicyType is STANDARD): AISPM: AI Configuration Management (AISPM).… | ### Creates a container scan task `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-container-scan-task` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | ClusterId | string | no | The ID of the container cluster. You can call the https://help.aliyun.com/document_detail/182997.html operation to obtain this parameter | | Lang | string | no | Specifies the language of the request and response. Default value: zh. Valid values: zh: Chinese en: English | | ContainerIds | string | no | The container IDs. This parameter is required. A scan task cannot be created if no container ID is provided | ### Creates a container runtime scan task in the appNames dimension `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-container-scan-task-by-app-name` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | ClusterId | string | no | The cluster ID | | AppNames | string | no | The container application names | | Lang | string | no | The language of the request and response. Valid values: zh: Chinese en: English | ### Adds custom IP blocking policies for one or more specific servers based on your requirements `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-custom-block-record` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | Uuids | string | yes | The UUIDs of the asset instances. Separate multiple UUIDs with commas (,). You can call DescribeCloudCenterInstances to obtain the UUIDs… | | BlockIp | string | yes | The IP address to block. Traffic from this IP address to the server is blocked | | Bound | string | yes | The direction of traffic to block between the custom IP address and the server. Valid values: in: inbound out: outbound | | ExpireTime | integer | yes | The expiration time of the policy. This value is a UNIX timestamp in milliseconds | ### Creates custom weak password rules `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-customized-dict` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | SourceIp | string | no | The source IP address | | Lang | string | no | The language of the content within the request and response. Default value: zh. Valid values: zh: Chinese en: English | | Override | string | no | Whether to overwrite. Value range: - true: Overwrite. - false: Do not overwrite | ### Creates an epoch scan task, including image scans, emergency vulnerability scans, and virus scans `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-cycle-task` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | TaskName | string | yes | The task name. This is a custom string used to identify the periodic scan task | | TaskType | string | yes | The task type. Valid values: VIRUS_VUL_SCHEDULE_SCAN: virus scan. IMAGE_SCAN: image scan. EMG_VUL_SCHEDULE_SCAN: emergency vulnerability… | | PeriodUnit | string | yes | The unit of the scan period. Valid values: day: day. hour: hour | | IntervalPeriod | integer | yes | The interval period | | FirstDateStr | integer | yes | The time of the first execution | | TargetStartTime | integer | yes | The start time of the task, in hours | | TargetEndTime | integer | yes | The end time of the task, in hours | | Param | string | no | The extended information field. Note: This parameter is required. If you do not specify this parameter, the API returns an error. The… | | Enable | integer | yes | Specifies whether to enable the task. Valid values: 1: Enable. 0: Disable | | Source | string | no | The source from which the task is created | | ClientToken | string | no | The client token that is used to ensure the idempotence of the request. You can use the client to generate the token, but you must make… | | DryRun | string | no | Specifies whether to perform only a dry run, without performing the actual request. Valid values: true: performs only a dry run without… | ### Initiates deep analysis for a malicious file `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-file-deep-analyze` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | SourceIp | string | no | The IP address of the access source | | Source | string | no | The request source. The system verifies the purchased edition based on the request source. Valid values: edr: AgenticEDR. secOpsAgent:… | | EventId | integer | no | The event ID. If a file-related alert event already exists, you can use this parameter to trigger deep analysis | | Context | string | no | The request context information | | Hash | string | no | The file hash. If the file already exists in the cloud, you can use this parameter to trigger deep analysis | ### Pushes a file to the cloud for detection `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-file-detect` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | SourceIp | string | no | The IP address of the access source | | Type | integer | yes | The type of the file to be detected. Valid values: 0: malicious file detection | | HashKey | string | no | The unique identifier of the file. This parameter is required and must be the MD5 or SHA-256 hash of the file | | OssKey | string | no | The storage key of the file in the OSS bucket. If you push the file for detection by using DownloadUrl, this parameter is optional. You… | | DownloadUrl | string | no | The download URL of the file. You can pass in a file download URL (public URL) to directly trigger file detection without uploading the… | | Decompress | string | no | Specifies whether to identify and decompress compressed files. Valid values: true: Yes. false: No | | DecompressMaxLayer | integer | no | The maximum number of decompression layers when compressed files are nested within a compressed package. Maximum value: 5. This parameter… | | DecompressMaxFileCount | integer | no | The maximum number of files to decompress. Maximum value: 1000. This parameter is required if Decompress is set to true | ### Queries the parameters that are required to upload a file for detection `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-file-detect-upload-url` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | HashKeyList | string | no | The identifiers of files. Only MD5 hash values are supported. You must specify at least one of the HashKeyList and HashKeyContextList… | | Type | integer | yes | The type of the file. Valid values: 0: unknown file 1: binary file 2: webshell file 4: script file If you do not know the type of the… | | HashKeyContextList | string | no | The hash values of files. You must specify at least one of the HashKeyList and HashKeyContextList parameters (JSON-encoded) | ### Creates a file protection rule `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-file-protect-client-rule` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | RuleName | string | yes | The name of the rule | | ProcPaths | string | yes | The list of process monitoring paths. Wildcards are supported (JSON-encoded) | | FilePaths | string | yes | The list of monitored file paths. Wildcards are supported (JSON-encoded) | | FileOps | string | yes | The list of operations performed on files (JSON-encoded) | | FileTypes | string | no | The list of monitored file types (JSON-encoded) | | RuleAction | string | yes | The action to take when the policy is hit. Valid values: monitor: Alert. block: Block. pass: Allow | | AlertLevel | integer | no | The alert notification level. Valid values: 0: No alert. 1: Reminder. 2: Suspicious. 3: High-risk | | SwitchId | string | no | The switch ID that corresponds to the rule | | Status | integer | yes | The rule status. Valid values: 0: Disabled. 1: Enabled | | Platform | string | no | The operating system type. Valid values: windows: Windows. linux: Linux | | ExcludeUsers | string | no | The list of excluded users (JSON-encoded) | | ClientToken | string | no | The client token that is used to ensure the idempotence of the request. You can use the client to generate the token, but you must make… | ### Creates a core file protection rule `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-file-protect-rule` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | RuleName | string | yes | The name of the rule | | ProcPaths | string | yes | The list of process paths to monitor. Wildcards are supported (JSON-encoded) | | FilePaths | string | yes | The list of file paths to monitor. Wildcards are supported (JSON-encoded) | | FileOps | string | yes | The list of file operations (JSON-encoded) | | RuleAction | string | yes | The action that the rule takes on the client. Valid values: pass: allow alert: alert | | AlertLevel | integer | no | The alert notification level. Valid values: 0: no alert 1: reminder 2: suspicious 3: high-risk | | SwitchId | string | no | The switch ID associated with the rule | | Status | integer | no | The rule status. Valid values: 1: Enabled. 0: Disabled | | Platform | string | no | The operating system type. Valid values: windows: Windows linux: Linux | ### Specifies the queries per second (QPS) limit on the files uploaded from the client `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-file-upload-limit` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | Limit | integer | yes | The QPS limit on the files uploaded from the client. Valid values: 100 to 10000 | ### Creates a honeypot instance `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-honeypot` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | HoneypotImageName | string | yes | The honeypot image name. You can obtain this value from the HoneypotImageName field returned by the… | | HoneypotName | string | yes | The custom name of the honeypot | | NodeId | string | yes | The ID of the honeypot management node. Call the [ListHoneypotNode](~~ListHoneypotNode~~) operation to obtain this value | | HoneypotImageId | string | yes | The honeypot image ID. You can obtain this value from the HoneypotImageId field returned by the… | | Meta | string | no | The custom configuration of the honeypot in JSON format. The following fields are included: trojan_git: The Git counter-intelligence… | ### Creates a honeypot management node `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-honeypot-node` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | NodeName | string | yes | The name of the management node | | AvailableProbeNum | integer | no | The number of available probes. This parameter is required. If this parameter is not specified, the API returns InvalidParam (400). The… | | AllowHoneypotAccessInternet | string | no | Specifies whether to allow the honeypot to access the Internet. Valid values: true: Allowed. false: Not allowed | | SecurityGroupProbeIpList | string | no | The list of allowed CIDR blocks. This parameter is required. At least one allowed CIDR block must be specified, such as 0.0.0.0/0. If this… | ### Creates a honeypot template `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-honeypot-preset` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | HoneypotImageName | string | yes | The name of the honeypot image | | PresetName | string | yes | The custom name of the honeypot template | | Meta | string | yes | The custom configurations of the honeypot template. The value is a JSON string that contains the following fields: portrait_option: Social… | | NodeId | string | yes | The ID of the management node to which you want to deploy honeypots. You can call the [ListHoneypotNode](~~ListHoneypotNode~~) operation… | | Lang | string | no | The language of the content within the request and response. Default value: zh. Valid values: zh: Chinese en: English | ### Creates a honeypot probe `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-honeypot-probe` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | ControlNodeId | string | yes | The management node ID. You can call the [ListHoneypotNode](~~ListHoneypotNode~~) operation to obtain this value | | ProbeType | string | yes | The probe type. Valid values: host_probe: host probe vpc_black_hole_probe: VPC blackhole probe | | DisplayName | string | yes | The probe name | | ProbeVersion | string | no | The probe version | | Uuid | string | no | The instance UUID. This parameter is required when ProbeType is set to host_probe | | BusinessGroupId | string | no | The business group | | HoneypotBindList | string | no | The collection of service configurations (JSON-encoded) | | Ping | string | no | Specifies whether to enable ping scan detection. Valid values: true: Enabled. false: Disabled | | Arp | string | no | Specifies whether to enable ARP spoof detection. Valid values: true: Enabled. false: Disabled | | VpcId | string | no | The ID of the virtual private cloud (VPC). This parameter is required when ProbeType is set to vpc_black_hole_probe. You can call the… | | ProxyIp | string | no | The proxy IP address | ### Creates a listener or forwarding service for a specified probe `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-honeypot-probe-bind` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | ProbeId | string | no | The probe ID. Call the [ListHoneypotProbe](~~ListHoneypotProbe~~) operation to obtain this parameter. This parameter is required. If this… | | HoneypotId | string | no | The honeypot ID. Call the [ListHoneypot](~~ListHoneypot~~) operation to obtain this value. This parameter is required. If this parameter… | | ServiceIpList | string | no | The list of listener IP addresses (JSON-encoded) | | BindPortList | string | no | The list of port bindings (JSON-encoded) | | Lang | string | no | The language of the request and response. Default value: zh. Valid values: zh: Chinese en: English | ### Creates a hybrid-cloud proxy cluster `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-hybrid-proxy-cluster` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | ClusterName | string | yes | The name of the cluster | | Remark | string | no | The description of the cluster | | Ip | string | no | The endpoint of the cluster. You can specify an IP address or a domain name | ### Creates a container firewall blocking rule `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-interception-rule` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | ClusterId | string | yes | The ID of the container cluster to query. You can call the [DescribeGroupedContainerInstances](~~DescribeGroupedContainerInstances~~)… | | RuleName | string | yes | The name of the rule | | RuleSwitch | integer | yes | Specifies whether to enable the rule. Valid values: 0: Disabled. 1: Enabled | | SrcTarget | string | no | The source object. The metric description is as follows: targetId: The ID of the source object. You can invoke the… | | DstTargetList | string | no | The list of destination objects. The metric descriptions are as follows: targetId: The ID of the destination object. You can invoke the… | | RuleType | string | no | The type of the rule. Valid values: customize: user-defined rule | | ClusterName | string | yes | The name of the cluster | | OrderIndex | integer | yes | The priority of the rule. Valid values: 1 to 1000. A smaller value indicates a higher priority | | InterceptType | integer | yes | The interception mode. Valid values: 1: Block Mode. 2: Alert mode. 3: Allow mode | ### Creates a defense object `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-interception-target` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | TargetName | string | yes | The name of the object to be blocked | | TargetType | string | yes | The object type. Valid value: IMAGE | | Namespace | string | yes | The namespace to which the network object belongs | | AppName | string | no | The name of the application to which the network object belongs | | ImageList | string | no | An array that consists of the images of the network object (JSON-encoded) | | TagList | string | no | An array that consists of the labels specified for the network object (JSON-encoded) | | ClusterId | string | no | The cluster ID | | ClusterName | string | no | The cluster name | ### Creates a Jenkins image repository `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-jenkins-image-registry` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | RegistryName | string | no | The alias of the image repository | | RegistryType | string | no | The type of the image repository. Valid values: CI/CD: Jenkins | | RegistryVersion | string | no | The version of the image repository. Default value: -. Valid values: -: the default version V1: V1.0 V2: V2.0 | | ProtocolType | integer | no | The type of the protocol. Valid values: 1: HTTP 2: HTTPS | | NetType | integer | no | The network type. Valid values: 1: Internet 2: Virtual Private Cloud (VPC) | | VpcId | string | no | The ID of the VPC | | RegistryHostIp | string | no | The IP address of the image repository | | DomainName | string | no | The domain name of the image repository | | UserName | string | no | The username | | Password | string | no | The password | | RegionId | string | no | The region ID of the image repository | | WhiteList | string | no | The whitelist of IP addresses | | TransPerHour | integer | no | The number of images that can be scanned per hour | | ExtraParam | string | no | The additional parameters of the image repository. The value of this parameter contains the following fields: namespace: the namespace… | | PersistenceDay | integer | no | The number of days during which assets can be retained | | SourceIp | string | no | The source IP address of the request | ### Creates a Jenkins scan task `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-jenkins-image-scan-task` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | Token | string | no | The access token for the Jenkins image repository. Obtain the token from the homepage of the Chinese documentation center > Security… | | Namespace | string | no | The namespace | | RepoName | string | no | The repository name | | Tag | string | no | The image label | | Digest | string | no | The image summary | | ImageId | string | no | The image ID | | ImageSize | integer | no | The image size. Unit: bytes | | ImageCreate | integer | no | The image creation time | | ImageUpdate | integer | no | The image update time. The value is a UNIX timestamp. Unit: milliseconds | | Uuid | string | no | The UUID of the image asset | | SourceIp | string | no | The access source IP address | | JenkinsEnv | string | no | The Jenkins environment context. Leave this parameter empty or set it to the fixed value: release | ### Get alert whitelist configuration details `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-malicious-file-whitelist-config` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | EventName | string | no | Alert name: ALL: All alerts | | Field | string | no | Field used for whitelist in sensitive file alerts | | Operator | string | no | Rule judgment operator: strEqual: String equals | | FieldValue | string | no | Expected value of the field to be whitelisted | | TargetType | string | no | Effective target type: ALL: All assets SELECTION_KEY: Assets selected via the asset selection component | | TargetValue | string | no | Target effective scope: ALL: All assets Other: Key of the asset range selected by the asset selection component | | Source | string | no | Business source: agentless: Agentless detection | | Remark | string | no | Remarks | ### Adds remarks to alert events for agentless detection `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-malicious-note` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | Note | string | yes | The remarks that you want to add | | EventId | integer | yes | The ID of the alert event to which you want to add remarks. You can call the… | ### Creates a list of members of the account monitored by Security Center type by using the multi-account… `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-monitor-account` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | AccountIds | string | no | The account IDs of members in the resource directory. You can call the… | ### Installs the components that are required by at-risk image blocking. The components are… `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-opa-cluster-plugin` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | ClusterIds | string | yes | The cluster IDs. You can call the [DescribeGroupedContainerInstances](~~DescribeGroupedContainerInstances~~) operation to query the IDs of… | ### Creates a rule to block at-risk images `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-opa-strategy-new` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | StrategyId | integer | no | The rule ID. You can call the https://help.aliyun.com/document_detail/2623574.html operation to query the rule ID. This parameter is… | | StrategyTemplateId | integer | no | The ID of the rule template. You can call the https://help.aliyun.com/document_detail/2539952.html operation to query the ID of the rule… | | ClusterId | string | no | The cluster ID. This parameter is deprecated | | StrategyName | string | no | The rule name | | Description | string | no | The rule description | | ClusterName | string | no | The cluster name. This parameter is deprecated | | UnScanedImage | string | no | Specifies whether the rule supports unscanned images. Valid values: true false | | MaliciousImage | string | no | Specifies whether the rule supports malicious Internet images. Valid values: true false | | ImageName | string | no | The image names (JSON-encoded) | | Label | string | no | The container tags (JSON-encoded) | | RuleAction | integer | no | The action that is performed when the rule is hit. Valid values: 1: trigger alerts 2: block 3: allow | | WhiteList | string | no | The whitelist (JSON-encoded) | | AlarmDetail | string | no | The risks that you want to detect by using the rule (JSON-encoded) | | Scopes | string | no | The application scope of the rule (JSON-encoded) | ### Modifies the mapping between an asset and an asset group. For example, you can call this operation to modify… `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-or-update-asset-group` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | Uuids | string | no | The UUID of the server in the server group that you want to create or the server group for which you want to add or remove servers.… | | GroupName | string | no | The name of the server group that you want to create or the server group for which you want to add or remove a server. To modify the… | | GroupId | integer | no | The ID of the server group for which you want to add to or remove servers. To modify the mapping between an asset and an asset group, you… | ### Creates an asset auto-tagging rule or modifies an asset auto-tagging rule that is created on the Asset… `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-or-update-auto-tag-rule` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | RuleId | integer | no | The ID of the rule. You can call the [ListAutoTagRules](~~ListAutoTagRules~~) operation to query the ID | | RuleName | string | yes | The name of the rule | | RuleDesc | string | no | The description of the rule | | Expression | string | no | The expression of the rule | | TagType | string | yes | The operation type of the rule. Valid values: group tag | | TagContext | string | no | The tag specified by the operation type of the rule. If TagType is set to group, set this parameter to {"groupId":XXX}. XXX specifies the… | | CheckAll | string | no | Specifies whether to check the rule on the backend. Valid values: true false | ### Creates or modifies a DingTalk chatbot that sends notifications `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-or-update-ding-talk` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | Id | integer | no | The ID of the chatbot. You can call the DescribeDingTalk… | | RuleActionName | string | yes | The name of the chatbot. The name of a chatbot must be 2 to 64 characters in length | | SendUrl | string | yes | The webhook URL | | IntervalTime | integer | no | The time interval at which the chatbot sends notifications. The value 0 indicates unlimited | | ConfigList | string | no | The alerts for which you want the chatbot to send notifications. The value is a JSON array that contains the following fields: type: the… | | GroupIdList | string | no | The IDs of asset groups for which you want the chatbot to send notifications. The value is a JSON array. You can call the… | | DingTalkLang | string | no | The language of the notifications. Valid values: zh: Chinese en: English | ### Creates a bucket scan task `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-oss-bucket-scan-task` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | BucketNameList | string | yes | The list of bucket names. The specified buckets must already exist in OSS and must have been synchronized to Security Center by calling… | | ExcludeKeySuffixList | string | no | The list of file suffixes to exclude from scanning (JSON-encoded) | | ScanMode | integer | yes | The scan mode. Valid values: 1: Full file scan. 2: Incremental file scan | | KeySuffixList | string | no | The list of file suffixes (JSON-encoded) | | KeyPrefixList | string | no | The prefix list of files (JSON-encoded) | | AllKeyPrefix | string | no | Specifies whether to match all prefixes. If this parameter is set to true, the KeyPrefixList parameter does not take effect | | DecompressMaxLayer | integer | no | The maximum number of decompression layers when multiple levels of nested compressed files exist. The minimum value is 1 and the maximum… | | DecompressMaxFileCount | integer | no | The maximum number of files to decompress. The minimum value is 1 and the maximum value is 1000. When the maximum number of decompressed… | | DecryptionList | string | no | The list of decryption types (JSON-encoded) | | LastModifiedStartTime | integer | no | Specifies that only files whose last modification time is after the specified timestamp are scanned. Unit: milliseconds | | Source | string | no | The business source. Valid values: OSS: OSS. NAS: NAS | ### Creates a scan policy for detecting malicious files in OSS under the malicious file detection feature `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-oss-scan-config` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | Enable | integer | no | Specifies whether to enable the policy. Valid values: 1: Enable. 0: Disable | | ScanDayList | string | no | The scan schedule. The number indicates the day of the week (JSON-encoded) | | BucketNameList | string | no | The list of bucket names (JSON-encoded) | | KeySuffixList | string | no | The list of file suffixes to scan (JSON-encoded) | | StartTime | string | no | The scan start time, in the HH:mm:ss format | | EndTime | string | no | The scan stop time, in the HH:mm:ss format | | Name | string | no | The policy name | | KeyPrefixList | string | no | The file prefix list (JSON-encoded) | | AllKeyPrefix | string | no | Specifies whether to match all prefixes. If this parameter is set to true, the KeyPrefixList parameter does not take effect | | DecompressMaxLayer | integer | no | The maximum number of decompression layers when nested compressed files exist. Minimum value: 1. Maximum value: 5. When the maximum number… | | DecompressMaxFileCount | integer | no | The maximum number of files to decompress. Minimum value: 1. Maximum value: 1000. When the maximum number of decompressed files is… | | DecryptionList | string | no | The list of decryption types (JSON-encoded) | | LastModifiedStartTime | integer | no | Scans files whose last modification time is after the specified timestamp. Unit: milliseconds | | RealTimeIncr | string | no | Specifies whether to enable real-time incremental scanning. If this parameter is set to true, the ScanDayList, StartTime, and EndTime… | | Source | string | no | The business source. Valid values: OSS: OSS. NAS: NAS | | AutoAdd | integer | no | Specifies whether OSS buckets are automatically added to this policy. Valid values: true: Enabled. false: Disabled | | ClientToken | string | no | The client token that is used to ensure the idempotence of the request. You can use the client to generate the token, but you must make… | | DryRun | string | no | Specifies whether to perform only a dry run, without performing the actual request. Valid values: true: performs only a dry run without… | ### Creates an automatic control policy for new accounts in the multi-account security management feature of… `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-rd-default-sync-list` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | FolderIds | string | no | The IDs of folders in the resource directory. You can call [GetRdTree](~~GetRdTree~~) to obtain folder IDs. Separate multiple folder IDs… | ### Creates a restoration task `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-restore-job` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | Uuid | string | yes | The UUID of the server whose data you want to restore | | SnapshotId | string | yes | The ID of the snapshot that you want to use for restoration. You can call the [DescribeSnapshots](~~DescribeSnapshots~~) operation to… | | SnapshotHash | string | yes | The hash value of the snapshot. You can call the [DescribeSnapshots](~~DescribeSnapshots~~) operation to obtain the value of this parameter | | Target | string | yes | The path to which you want to restore data | | SourceType | string | no | The type of the data source. Valid values: ECS_FILE: backup snapshots for Elastic Compute Service (ECS) files File: backup snapshots for… | | VaultId | string | yes | The ID of the backup vault that is used in the restoration task. You can call the [DescribeSnapshots](~~DescribeSnapshots~~) operation to… | | SnapshotVersion | string | yes | The version of the backup data. You can call the [DescribeSnapshots](~~DescribeSnapshots~~) operation to obtain the value of this parameter | | Includes | string | yes | The directory in which the files included in the restoration task are located. This parameter is specified when you create the… | ### Starts a Security Center trial `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-sas-trial` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | TryVersion | integer | no | The trial edition. Valid values: 3: Enterprise Edition 7: Ultimate Edition Call the https://help.aliyun.com/document_detail/2623574.html… | | FromEcs | string | no | Specifies whether the request originates from the ECS console. Valid values: true: Yes false: No | | TryType | integer | no | The trial type. Valid values: 0: Trial not allowed. 1: First-time trial. 2: Second trial. Call the… | | RequestForm | string | no | The reason for applying for a trial. A reason is required for a second trial (JSON-encoded) | | Lang | string | no | The language of the request and response messages. Valid values: zh: Chinese en: English | | ClientToken | string | no | The client token used to ensure request idempotence. Use a different token for each request. Only ASCII characters are supported. The… | | DryRun | string | no | Specifies whether to perform only a dry run for this request. Valid values: true: performs only a dry run without executing the actual… | ### Creates a service-linked role and authorizes Security Center to access cloud resources `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-service-linked-role` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | ServiceLinkedRole | string | no | The service-linked role. Default value: AliyunServiceRoleForSas. Valid values: AliyunServiceRoleForSas: The service-linked role for… | | ClientToken | string | no | The client token that is used to ensure the idempotence of the request. Different requests must use different tokens. The token can… | | DryRun | string | no | Specifies whether to perform only a dry run. Valid values: true: performs only a dry run without executing the actual operation. false:… | ### Creates a service trail `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-service-trail` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | RegionId | string | no | The region ID of the instance to query. Valid values: cn-hangzhou (default): Chinese mainland. ap-southeast-1: outside the Chinese mainland | ### Creates a node to query alerting events triggered by the same rule or Alarm Metric `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-similar-security-events-query-task` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | SourceIp | string | no | The IP address of the access source | | SecurityEventId | integer | yes | The ID of the alert event | | SimilarEventScenarioCode | string | no | The code of the alerting event that has the same type or rule hits | | ClientToken | string | no | The client token that is used to ensure the idempotence of the request. Different requests should use different tokens. The token supports… | | ResourceDirectoryAccountId | integer | no | The ResourceDirectoryAccountId | | DryRun | string | no | Specifies whether to perform only a dry run of the request. Valid values: true: performs only a dry run without executing the actual… | ### Creates a task under My Policies in Task Center `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-soar-strategy-task` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | StrategyId | integer | yes | The ID of the policy. You can call the [DescribeSoarSubscribedStrategy](~~DescribeSoarSubscribedStrategy~~) operation to query this… | | StrategyTaskName | string | yes | The name of the policy task | | StrategyName | string | yes | The Policy Name. Set the value to Automated Batch Vulnerability Fix Policy | | StrategyTaskParams | string | yes | The parameter settings of the policy. The value is a character string in JSON array format. Details: Vulnerability configuration item.… | | StrategyTaskPlanExeTime | integer | no | The scheduled execution timestamp of the policy task. Unit: milliseconds | ### Creates a note for a security alert event `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-susp-event-note` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | EventId | integer | yes | The ID of the alert event for which you want to add a note. Call https://help.aliyun.com/document_detail/251497.html to obtain the alert… | | Note | string | yes | The note to add | | ResourceDirectoryAccountId | integer | no | The Alibaba Cloud account ID of the member account in the resource directory. Invoke… | ### Creates a database anti-ransomware policy `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-uni-backup-policy` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | PolicyName | string | yes | The name of the anti-ransomware backup policy | | InstanceId | string | yes | The ID of the ECS instance. You can call the [DescribeUniBackupDatabase](~~DescribeUniBackupDatabase~~) operation to obtain this parameter | | Uuid | string | no | The UUID of the server that is backed up by the database anti-ransomware feature. You can call the… | | DatabaseType | string | yes | The type of the database. Valid values: MYSQL ORACLE MSSQL | | Retention | integer | yes | The number of days for which backup data is retained | | SpeedLimiter | integer | yes | The network bandwidth throttling for backup network bandwidth. Unit: bytes | | AccountName | string | no | The username of the database account | | AccountPassword | string | no | The password of the database account | | DatabaseAddByUser | string | no | Specifies whether the database is manually added by the user. Valid values: true: The database is manually added. false: The database is… | | UniRegionId | string | yes | The region in which the server protected by the backup policy resides | | FullPlan | string | yes | The full backup policy. The value is in JSON format and contains the following fields: start: the start time of the backup. interval: the… | | IncPlan | string | yes | The incremental backup policy. The value is in JSON format and contains the following fields: start: the start time of the backup.… | ### Creates a recovery task for database anti-ransomware `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-uni-restore-plan` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | TimePoint | integer | yes | The point in time to which you want to restore the database. Call the [DescribeRestorePlans](~~DescribeRestorePlans~~) operation to obtain… | | PolicyId | integer | yes | The ID of the database anti-ransomware backup policy. Call the [DescribeUniBackupPolicies](~~DescribeUniBackupPolicies~~) operation to… | | Database | string | no | The name of the database | | InstanceUuid | string | no | The unique identifier of the database backup client on the destination server for restoration. Call the… | | ResetTime | string | no | The reset_time value of the selected record from the recoverable points in time when you query backups for an Oracle database. Call the… | | ResetScn | string | no | The reset_scn value of the selected record from the recoverable points in time when you query backups for an Oracle database. Call the… | | RestoreInfo | string | no | The database restoration information when the database type is MSSQL. The value is a JSON string. Valid values: name: the name of the… | ### Creates an intelligent behavior analytics policy `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-unknown-threat-detect-strategy` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | Name | string | no | The policy name | | StudyMode | string | no | The whitelist mode. Valid values: hash: process hash path: process path | | AssetSelectionType | string | no | The asset selection identifier | | DurationDaysAfterInit | integer | no | The number of days after the model is initially created before the learning phase ends | | DurationDaysAfterStop | integer | no | The number of days after which the model ends when no new processes are added | ### Saves the risk level settings for baseline checks of a user `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-user-setting` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | SourceIp | string | no | The IP address of the access source | | InvalidWarningKeepDays | integer | no | The number of days to retain false positive alerts | | AlertLevels | string | no | The list of alert notification levels | ### Creates a one-time virus scan task `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-virus-scan-once-task` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | SelectionKey | string | no | The key that stores asset information. You can call the [GetAssetSelectionConfig](~~GetAssetSelectionConfig~~) operation to obtain this… | | ScanType | string | no | The scan type of the virus scan. Valid values: system: system scan user: custom scan | | ScanPath | string | no | The scan path information to be transmitted if the scan type is custom scan (JSON-encoded) | | Param | string | no | The extended information field: additionType: the extended scan type | | ClientToken | string | no | The client token that is used to ensure the idempotence of the request. Different requests should use different tokens. The token supports… | | DryRun | string | no | Specifies whether to perform only a dry run of the request. Valid values: true: performs only a dry run without executing the actual… | ### Creates a batch list of vulnerabilities that can be automatically fixed. After creation, the list is used… `POST https://www.apizie.tech/v1/cloud:aliyun-sas/create-vul-auto-repair-config` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | Type | string | yes | The type of the vulnerability. Valid values: cve: Linux software vulnerability. sys: Windows system vulnerability | | VulAutoRepairConfigList | string | yes | The list of vulnerabilities that can be automatically fixed (JSON-encoded) | | Reason | string | no | The reason for adding the vulnerabilities that can be automatically fixed | ### Deletes a specified anti-brute-force attacks rule `POST https://www.apizie.tech/v1/cloud:aliyun-sas/delete-anti-brute-force-rule` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | Ids | string | yes | The IDs of the brute-force attacks defense rules that you want to delete (JSON-encoded) | ### Delete attack path sensitive asset `POST https://www.apizie.tech/v1/cloud:aliyun-sas/delete-attack-path-sensitive-asset-config` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | AttackPathSensitiveAssetConfigId | string | yes | ID of the attack path sensitive asset configuration | ### Deletes an attack path whitelist entry `POST https://www.apizie.tech/v1/cloud:aliyun-sas/delete-attack-path-whitelist` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | AttackPathWhitelistId | string | yes | The ID of the attack path whitelist entry. You can call [ListAttackPathWhitelist](~~ListAttackPathWhitelist~~) to query attack path… | ### Deletes an attestor `POST https://www.apizie.tech/v1/cloud:aliyun-sas/delete-attestor` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | SourceIp | string | no | The IP address of the access source | | Name | string | no | The name of the attestor | ### Deletes an automatic asset tagging rule. This operation is used with the system configuration, feature… `POST https://www.apizie.tech/v1/cloud:aliyun-sas/delete-auto-tag-rules` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | RuleIdList | string | yes | The IDs of the rules. Separate multiple IDs with commas (,). Call the [ListAutoTagRules](~~ListAutoTagRules~~) operation to obtain this… | ### Deletes ransomware mitigation policies `POST https://www.apizie.tech/v1/cloud:aliyun-sas/delete-backup-policy` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | Id | integer | yes | The ID of the mitigation policies that you want to delete. Invoke the [DescribeBackupPolicies](~~DescribeBackupPolicies~~) operation to… | | PolicyVersion | string | no | The version of the mitigation policies that you want to delete. You can invoke the [DescribeBackupPolicies](~~DescribeBackupPolicies~~)… | ### Deletes a server from a specified anti-ransomware policy `POST https://www.apizie.tech/v1/cloud:aliyun-sas/delete-backup-policy-machine` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | Uuid | string | no | The UUID of the server to which the anti-ransomware policy is applied. You must specify at least one of the `UuidList` and `Uuid` parameters | | PolicyId | integer | yes | The ID of the anti-ransomware policy. You can call the [DescribeBackupPolicies](~~DescribeBackupPolicies~~) operation to query the IDs of… | | PolicyVersion | string | yes | The version of the anti-ransomware policy. Valid values: 1.0.0 2.0.0 You can call the [DescribeBackupPolicies](~~DescribeBackupPolicies~~)… | | UuidList | string | no | The UUIDs of the servers to which the anti-ransomware policy is applied. You must specify at least one of the `UuidList` and `Uuid`… | ### Deletes the snapshots of anti-ransomware backups for servers in Security Center `POST https://www.apizie.tech/v1/cloud:aliyun-sas/delete-backup-snapshot` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | RetainLatestSnapshot | string | no | Specifies whether to retain the latest snapshot. Valid values: true: Yes. false: No | | BackupSnapshotList | string | no | The backup snapshots (JSON-encoded) | | BackupRegionIdList | string | no | The backup regions (JSON-encoded) | ### Deletes baseline whitelist records `POST https://www.apizie.tech/v1/cloud:aliyun-sas/delete-baseline-check-white-record` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | CheckIds | string | no | The list of check item IDs (JSON-encoded) | | RecordIds | string | no | The list of whitelist record IDs (JSON-encoded) | | Source | string | no | The data source. Valid values: default: server baseline agentless: agentless baseline | | Lang | string | no | The language of the request and response. Default value: zh. Valid values: zh: Chinese en: English | ### Deletes a binary security policy from the container signature feature `POST https://www.apizie.tech/v1/cloud:aliyun-sas/delete-binary-security-policy` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | SourceIp | string | no | The source IP address of the request | | Name | string | no | The name of the binary security policy | ### Deletes user-defined check items in the Cloud Security Posture Management (CSPM) custom check item feature `POST https://www.apizie.tech/v1/cloud:aliyun-sas/delete-check-item` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | CheckIds | string | yes | The list of check item IDs (JSON-encoded) | ### Delete custom scope directories in Cloud Security Posture Management (CSPM) custom checks. You can remove… `POST https://www.apizie.tech/v1/cloud:aliyun-sas/delete-check-policy` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | PolicyIds | string | yes | Array of policies to delete (JSON-encoded) | | PolicyType | string | yes | Policy type for custom check rule: STANDARD: Standard-level policy REQUIREMENT: Requirement-level policy SECTION: Section-level policy | ### Deletes specified custom defense rules `POST https://www.apizie.tech/v1/cloud:aliyun-sas/delete-client-user-define-rule` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | IdList | string | yes | The IDs of the custom defense rules (JSON-encoded) | ### Delete multi-cloud asset synchronization configuration `POST https://www.apizie.tech/v1/cloud:aliyun-sas/delete-cloud-vendor-account-ak` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | AuthId | integer | yes | The unique ID of the AccessKey pair | | AuthModules | string | no | The modules that are associated with the AccessKey pair (JSON-encoded) | ### Deletes a rule for non-image program defense `POST https://www.apizie.tech/v1/cloud:aliyun-sas/delete-container-defense-rule` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | RuleIds | string | no | The IDs of the rules that you want to delete. You can call the https://help.aliyun.com/document_detail/2590599.html operation to query the… | ### Deletes a container escape prevention rule `POST https://www.apizie.tech/v1/cloud:aliyun-sas/delete-container-plugin-rule` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | Lang | string | no | The language of the request and response. Default value: zh. Valid values: zh: Chinese en: English | | RuleId | integer | yes | The ID of the rule. You can call the addContainerWebDefenseRule operation to obtain the rule ID | ### Deletes the blocking records for specific IP addresses on one or more user-defined servers `POST https://www.apizie.tech/v1/cloud:aliyun-sas/delete-custom-block-record` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | Id | integer | yes | The ID of the data to delete. Call the [DescribeCustomBlockRecords](~~DescribeCustomBlockRecords~~) operation to obtain this parameter | ### Deletes a specified custom security report `POST https://www.apizie.tech/v1/cloud:aliyun-sas/delete-customize-report` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | ReportId | integer | yes | The report ID. Call [DescribeCustomizeReportList](~~DescribeCustomizeReportList~~) to obtain this parameter | ### Deletes a custom weak password file `POST https://www.apizie.tech/v1/cloud:aliyun-sas/delete-customized-dict` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | SourceIp | string | no | The source IP address | ### Deletes an epoch-based scan node, including image scans, emergency vulnerability scanning, and virus scans `POST https://www.apizie.tech/v1/cloud:aliyun-sas/delete-cycle-task` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | ConfigId | string | yes | The ID of the configuration. Call the [DescribeCycleTaskList](~~DescribeCycleTaskList~~) operation to obtain this parameter | ### Deletes a DingTalk chatbot on the DingTalk Chatbot tab of the Notification Settings page `POST https://www.apizie.tech/v1/cloud:aliyun-sas/delete-ding-talk` (byok) | Parameter | Type | Required | Description | |---|---|---|---| | Ids | string | yes | The ID of the notification from the DingTalk chatbot. Separate multiple IDs with commas (,). You can call the… | …and 280 more. See the OpenAPI spec. ## Example ``` curl "https://www.apizie.tech/v1/cloud:aliyun-sas/add-asset-selection-criteria" \ -H "x-api-key: $APIZIE_KEY" \ -H "x-upstream-key: $PROVIDER_KEY" ``` ## FAQ ### How do I call the Alibaba Cloud Security Center API? Create a free Apizie key, then send POST https://www.apizie.tech/v1/cloud:aliyun-sas/add-asset-selection-criteria with the header x-api-key. Every endpoint returns { project, data, timestamp }. ### Is the Alibaba Cloud Security Center API free on Apizie? Yes. The Free plan includes 1,000 requests a month at 100 requests a minute, no credit card. Alibaba Cloud Security Center itself also needs your own key from aliyuncs.com. ### Can AI agents use the Alibaba Cloud Security Center API? Yes. Add the Apizie MCP server (https://www.apizie.tech/mcp) to Claude, ChatGPT, Cursor or VS Code, then ask in plain language. The agent calls run_scraper with project key cloud:aliyun-sas. ### What is the status of the Alibaba Cloud Security Center API? Needs your own provider key (bring your own key)