com.aliyun.sdk.service.sas20181203.models

类 DescribeSecurityEventOperationsResponseBody.SecurityEventOperationsResponse.Builder

java.lang.Object

com.aliyun.sdk.service.sas20181203.models.DescribeSecurityEventOperationsResponseBody.SecurityEventOperationsResponse.Builder

封闭类:

DescribeSecurityEventOperationsResponseBody.SecurityEventOperationsResponse

public static final class DescribeSecurityEventOperationsResponseBody.SecurityEventOperationsResponse.Builder
extends Object

方法概要

限定符和类型	方法和说明
DescribeSecurityEventOperationsResponseBody.SecurityEventOperationsResponse	build()
DescribeSecurityEventOperationsResponseBody.SecurityEventOperationsResponse.Builder	mappingMarkFields(List<DescribeSecurityEventOperationsResponseBody.MappingMarkFields> mappingMarkFields) The objects on which the operations are performed.
DescribeSecurityEventOperationsResponseBody.SecurityEventOperationsResponse.Builder	markField(List<DescribeSecurityEventOperationsResponseBody.MarkField> markField) The configurations that are used when the value of the OperationCode parameter is advance_mark_mis_info.
DescribeSecurityEventOperationsResponseBody.SecurityEventOperationsResponse.Builder	markFieldsSource(List<DescribeSecurityEventOperationsResponseBody.MarkFieldsSource> markFieldsSource) The configuration items that can be used when the value of the OperationCode parameter is advance_mark_mis_info.
DescribeSecurityEventOperationsResponseBody.SecurityEventOperationsResponse.Builder	operationCode(String operationCode) The operation that is performed to handle the alert.
DescribeSecurityEventOperationsResponseBody.SecurityEventOperationsResponse.Builder	operationParams(String operationParams) The configuration of the operation that is performed to handle the alert.
DescribeSecurityEventOperationsResponseBody.SecurityEventOperationsResponse.Builder	userCanOperate(Boolean userCanOperate) Indicates whether you can handle the alert in the current edition of Security Center.

从类继承的方法 java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

方法详细资料

mappingMarkFields

public DescribeSecurityEventOperationsResponseBody.SecurityEventOperationsResponse.Builder mappingMarkFields(List<DescribeSecurityEventOperationsResponseBody.MappingMarkFields> mappingMarkFields)

The objects on which the operations are performed. This parameter is required when you add the alert to the whitelist by configuring precise defense rules.

markField

public DescribeSecurityEventOperationsResponseBody.SecurityEventOperationsResponse.Builder markField(List<DescribeSecurityEventOperationsResponseBody.MarkField> markField)

The configurations that are used when the value of the OperationCode parameter is advance_mark_mis_info.

markFieldsSource

public DescribeSecurityEventOperationsResponseBody.SecurityEventOperationsResponse.Builder markFieldsSource(List<DescribeSecurityEventOperationsResponseBody.MarkFieldsSource> markFieldsSource)

The configuration items that can be used when the value of the OperationCode parameter is advance_mark_mis_info.

operationCode

public DescribeSecurityEventOperationsResponseBody.SecurityEventOperationsResponse.Builder operationCode(String operationCode)

The operation that is performed to handle the alert. Valid values:

• block_ip: blocks the source IP address.
• advance_mark_mis_info: adds the alert to the whitelist.
• ignore: ignores the alert.
• manual_handled: marks the alert as manually handled.
• kill_process: terminates the malicious process.
• cleanup: performs in-depth virus detection and removal.
• kill_and_quara: terminates the malicious process and quarantines the source file.
• disable_malicious_defense: disables the malicious behavior defense feature.
• client_problem_check: performs troubleshooting.
• quara: quarantines the source file of the malicious process.
• defense_mark_mis_info: enables the precise defense feature but disables the notification feature.
• rm_defense_mark_mis_info: enables the notification feature.
• rm_mark_mis_info: removes the alert from the whitelist.
• cancle_manual: cancels marking the alert as manually handled.

example:

advance_mark_mis_info

operationParams

public DescribeSecurityEventOperationsResponseBody.SecurityEventOperationsResponse.Builder operationParams(String operationParams)

The configuration of the operation that is performed to handle the alert.

If the value of the OperationCode parameter is kill_and_quara or block_ip, the OperationParams parameter is required. If the value of the OperationCode parameter is a different value, the OperationParams parameter can be left empty.

example:

{"expireTime":1641566807783}

userCanOperate

public DescribeSecurityEventOperationsResponseBody.SecurityEventOperationsResponse.Builder userCanOperate(Boolean userCanOperate)

Indicates whether you can handle the alert in the current edition of Security Center. Valid values:

• true
• false

example:

false

build

public DescribeSecurityEventOperationsResponseBody.SecurityEventOperationsResponse build()