com.aliyun.sdk.service.sas20181203.models

类 AdvanceSecurityEventOperationsResponseBody.SecurityEventOperationsResponse.Builder

java.lang.Object

com.aliyun.sdk.service.sas20181203.models.AdvanceSecurityEventOperationsResponseBody.SecurityEventOperationsResponse.Builder

封闭类:

AdvanceSecurityEventOperationsResponseBody.SecurityEventOperationsResponse

public static final class AdvanceSecurityEventOperationsResponseBody.SecurityEventOperationsResponse.Builder
extends Object

方法概要

限定符和类型	方法和说明
AdvanceSecurityEventOperationsResponseBody.SecurityEventOperationsResponse	build()
AdvanceSecurityEventOperationsResponseBody.SecurityEventOperationsResponse.Builder	markField(List<AdvanceSecurityEventOperationsResponseBody.MarkField> markField) The object on which the operation is performed.
AdvanceSecurityEventOperationsResponseBody.SecurityEventOperationsResponse.Builder	markFieldsSource(List<AdvanceSecurityEventOperationsResponseBody.MarkFieldsSource> markFieldsSource) The metadata configuration returned by the advanced whitelist rule.
AdvanceSecurityEventOperationsResponseBody.SecurityEventOperationsResponse.Builder	operationCode(String operationCode) The operation performed to handle the alert.
AdvanceSecurityEventOperationsResponseBody.SecurityEventOperationsResponse.Builder	operationParams(String operationParams) The configuration of the operation performed to handle the alert event.
AdvanceSecurityEventOperationsResponseBody.SecurityEventOperationsResponse.Builder	userCanOperate(Boolean userCanOperate) Indicates whether the operation can be performed.

从类继承的方法 java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

方法详细资料

markField

public AdvanceSecurityEventOperationsResponseBody.SecurityEventOperationsResponse.Builder markField(List<AdvanceSecurityEventOperationsResponseBody.MarkField> markField)

The object on which the operation is performed. This parameter is required when you set the OperationCode parameter to advance_mark_mis_info.

markFieldsSource

public AdvanceSecurityEventOperationsResponseBody.SecurityEventOperationsResponse.Builder markFieldsSource(List<AdvanceSecurityEventOperationsResponseBody.MarkFieldsSource> markFieldsSource)

The metadata configuration returned by the advanced whitelist rule.

operationCode

public AdvanceSecurityEventOperationsResponseBody.SecurityEventOperationsResponse.Builder operationCode(String operationCode)

The operation performed to handle the alert. Valid values:

• block_ip: blocks the alert.
• advance_mark_mis_info: adds the alert to the whitelist.
• ignore: ignores the alert.
• manual_handled: marks the alert as manually handled.
• kill_process: terminates the malicious process.
• cleanup: performs in-depth virus detection and removal.
• kill_and_quara: performs virus detection and removal.
• disable_malicious_defense: turns off malicious defense behavior.
• client_problem_check: performs troubleshooting.
• quara: performs quarantine operations.

example:

advance_mark_mis_info

operationParams

public AdvanceSecurityEventOperationsResponseBody.SecurityEventOperationsResponse.Builder operationParams(String operationParams)

The configuration of the operation performed to handle the alert event.

example:

{"subOperation":"killByMd5andPath"}

userCanOperate

public AdvanceSecurityEventOperationsResponseBody.SecurityEventOperationsResponse.Builder userCanOperate(Boolean userCanOperate)

Indicates whether the operation can be performed.

• true: The operation can be performed.
• false: The operation cannot be performed.

example:

false

build

public AdvanceSecurityEventOperationsResponseBody.SecurityEventOperationsResponse build()