com.aliyun.sdk.service.sas20181203.models

类 HandleSimilarSecurityEventsRequest.Builder

java.lang.Object

com.aliyun.sdk.service.sas20181203.models.HandleSimilarSecurityEventsRequest.Builder

所有已实现的接口:

darabonba.core.RequestModel.Builder<HandleSimilarSecurityEventsRequest,HandleSimilarSecurityEventsRequest.Builder>

封闭类:

HandleSimilarSecurityEventsRequest

public static final class HandleSimilarSecurityEventsRequest.Builder
extends Object

方法概要

限定符和类型	方法和说明
HandleSimilarSecurityEventsRequest	build()
HandleSimilarSecurityEventsRequest.Builder	markMissParam(String markMissParam) The whitelist rule.
HandleSimilarSecurityEventsRequest.Builder	operationCode(String operationCode) The operation that you want to perform to handle the alert events.
HandleSimilarSecurityEventsRequest.Builder	operationParams(String operationParams) The configuration of the operation that you want to perform to handle the alert events.
HandleSimilarSecurityEventsRequest.Builder	remark(String remark) The remark of the operation.
HandleSimilarSecurityEventsRequest.Builder	resourceOwnerId(Long resourceOwnerId) ResourceOwnerId.
HandleSimilarSecurityEventsRequest.Builder	sourceIp(String sourceIp) The source IP address of the request.
HandleSimilarSecurityEventsRequest.Builder	taskId(Long taskId) The ID of the task that handles the alert events at a time.

从类继承的方法 java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

方法详细资料

markMissParam

public HandleSimilarSecurityEventsRequest.Builder markMissParam(String markMissParam)

The whitelist rule. For example, if you want to add a file that contains the string a to the whitelist based on the MD5 hash value, set this parameter to {"field":"md5","operate":"contains","fieldValue":"aa"}.

example:

{"field":"md5","operate":"contains","fieldValue":"aa"}

operationCode

public HandleSimilarSecurityEventsRequest.Builder operationCode(String operationCode)

The operation that you want to perform to handle the alert events.

You can call the DescribeSecurityEventOperations operation to query the operations.

This parameter is required.

example:

offline_handled

operationParams

public HandleSimilarSecurityEventsRequest.Builder operationParams(String operationParams)

The configuration of the operation that you want to perform to handle the alert events. The value of this parameter is in the JSON format.

If you set OperationCode to kill_and_quara, block_ip, or virus_quara, you must specify OperationParams. If you set OperationCode to other values, you can leave OperationParams empty. If you set OperationCode to block_ip, the value of OperationParams must consist of the following fields:

• expireTime: the end time of locking. Unit: milliseconds.

If you set OperationCode to kill_and_quara, the value of OperationParams must consist of the following fields:

• subOperation: the method of detection and removal. Valid values:

*   **killAndQuaraFileByMd5andPath**: terminates the process and quarantines the source file of the process.
 *   **killByMd5andPath**: terminates the running process.
 

If you set OperationCode to virus_quara, the value of OperationParams consists of the following fields:

• subOperation: the method of detection and removal. Valid values:

*   **quaraFileByMd5andPath**: quarantines the source file of the process.
 

example:

{"expireTime":1646208726195}

remark

public HandleSimilarSecurityEventsRequest.Builder remark(String remark)

The remark of the operation.

example:

remark test.

resourceOwnerId

public HandleSimilarSecurityEventsRequest.Builder resourceOwnerId(Long resourceOwnerId)

ResourceOwnerId.

sourceIp

public HandleSimilarSecurityEventsRequest.Builder sourceIp(String sourceIp)

The source IP address of the request.

example:

192.168.XX.XX

taskId

public HandleSimilarSecurityEventsRequest.Builder taskId(Long taskId)

The ID of the task that handles the alert events at a time.

You can call the CreateSimilarSecurityEventsQueryTask operation to query the IDs of tasks.

This parameter is required.

example:

666038

build

public HandleSimilarSecurityEventsRequest build()