HandleSecurityEventsRequest.Builder (alibabacloud-sas20181203 8.0.1 API)

java.lang.Object
- com.aliyun.sdk.service.sas20181203.models.HandleSecurityEventsRequest.Builder

所有已实现的接口:

darabonba.core.RequestModel.Builder<HandleSecurityEventsRequest,HandleSecurityEventsRequest.Builder>

封闭类:

HandleSecurityEventsRequest
```
public static final class HandleSecurityEventsRequest.Builder
extends Object
```

方法概要

所有方法实例方法具体方法
限定符和类型	方法和说明
`HandleSecurityEventsRequest`	`build()`
`HandleSecurityEventsRequest.Builder`	`markBatch(String markBatch)` Specifies whether to add multiple alert events to the whitelist at a time.
`HandleSecurityEventsRequest.Builder`	`markMissParam(String markMissParam)` The whitelist rule.
`HandleSecurityEventsRequest.Builder`	`operationCode(String operationCode)` The operation that you want to perform to handle the alert events.
`HandleSecurityEventsRequest.Builder`	`operationParams(String operationParams)` The configuration of the operation that you want to perform to handle the alert events.
`HandleSecurityEventsRequest.Builder`	`remark(String remark)` The remarks of the handling operation.
`HandleSecurityEventsRequest.Builder`	`resourceDirectoryAccountId(Long resourceDirectoryAccountId)` The Alibaba Cloud account ID of the member in the resource directory.
`HandleSecurityEventsRequest.Builder`	`securityEventIds(List<String> securityEventIds)` The IDs of the alert events.
`HandleSecurityEventsRequest.Builder`	`sourceIp(String sourceIp)` The source IP address of the request.

从类继承的方法 java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

- 方法详细资料
  - markBatch
```
public HandleSecurityEventsRequest.Builder markBatch(String markBatch)
```
    Specifies whether to add multiple alert events to the whitelist at a time. Valid values:
    - true: yes
    - false: no
    example:
    true
  - markMissParam
```
public HandleSecurityEventsRequest.Builder markMissParam(String markMissParam)
```
    The whitelist rule. The value of this parameter is in the JSON format and contains the following fields:
    - field: The field based on which alert events are added to the whitelist.
    - operate: The method that is used to added alert events to the whitelist. Valid values:
      
      notContains: does not contain
      
      contains: contains
      
      regex: matches by regular expression
      
      strEqual: equals
      
      strNotEqual: does not equal
    - fieldValue: The value of the field based on which alert events are added to the whitelist.
    - uuid: The application scope of the whitelist rule. Valid values:
      
      part: the current asset
      
      ALL: all assets
    You can call the DescribeSecurityEventOperations operation to obtain the fields that you can specify for field.
    
    example:
    [{"uuid":"part","field":"gmtModified","operate":"contains","fieldValue":"asd"},{"uuid":"part","field":"loginUser","operate":"contains","fieldValue":"vff"}]
  - operationCode
```
public HandleSecurityEventsRequest.Builder operationCode(String operationCode)
```
    The operation that you want to perform to handle the alert events. Valid values:
    - block_ip: blocks the source IP address.
    - advance_mark_mis_info: adds the alert events to the whitelist.
    - ignore: ignores the alert events.
    - manual_handled: marks the alert events as manually handled.
    - kill_process: terminates the malicious process.
    - cleanup: performs in-depth virus detection and removal.
    - kill_and_quara: kills the malicious processes and quarantines the source file.
    - disable_malicious_defense: stops the container on which the alerting files or processes exist.
    - client_problem_check: performs troubleshooting.
    - quara: quarantines the source file of the malicious process.
    This parameter is required.
    example:
    block_ip
  - operationParams
```
public HandleSecurityEventsRequest.Builder operationParams(String operationParams)
```
    The configuration of the operation that you want to perform to handle the alert events.
    
    If you set OperationCode to kill_and_quara or block_ip, you must specify OperationParams. If you set OperationCode to other values, you can leave OperationParams empty.
    
    example:
    {}
  - remark
```
public HandleSecurityEventsRequest.Builder remark(String remark)
```
    The remarks of the handling operation.
    example:
    remark test.
  - resourceDirectoryAccountId
```
public HandleSecurityEventsRequest.Builder resourceDirectoryAccountId(Long resourceDirectoryAccountId)
```
    The Alibaba Cloud account ID of the member in the resource directory.
    
    You can call the DescribeMonitorAccounts operation to obtain the IDs.
    
    example:
    16670360956*****
  - securityEventIds
```
public HandleSecurityEventsRequest.Builder securityEventIds(List<String> securityEventIds)
```
    The IDs of the alert events.
    
    This parameter is required.
    example:
    ["909361"]
  - sourceIp
```
public HandleSecurityEventsRequest.Builder sourceIp(String sourceIp)
```
    The source IP address of the request.
    example:
    1.2.XX.XX
  - build
```
public HandleSecurityEventsRequest build()
```

类 HandleSecurityEventsRequest.Builder

方法概要

从类继承的方法 java.lang.Object

方法详细资料

markBatch

markMissParam

operationCode

operationParams

remark

resourceDirectoryAccountId

securityEventIds

sourceIp

build