Domain name for API request: csip.intl.tencentcloudapi.com.
Locate malicious file alarms by EDR alarm ID and return the download URL of the malicious sample. Only alarms with alert_sub_type=1 (malicious file) can be downloaded. Other sub-types are handled as resource not found. Public cloud returns a COS presigned URL (valid for 1 hour). Non-public cloud returns a base64 DataURL and FileName when the export switch is on. In cross-account scenarios, TargetAppId specifies the account that owns the alarm, and ownership verification is performed (fail-close, InvalidParameter is returned if no permission).
A maximum of 20 requests can be initiated per second for this API.
The following request parameter list only provides API request parameters and some common parameters. For the complete common parameter list, see Common Request Parameters.
| Parameter Name | Required | Type | Description |
|---|---|---|---|
| Action | Yes | String | Common Params. The value used for this API: DescribeEdrMalwareFile. |
| Version | Yes | String | Common Params. The value used for this API: 2022-11-21. |
| Region | No | String | Common Params. This parameter is not required. |
| AlertId | Yes | String | Unique ID of the EDR alert. Required. Up to 34 characters |
| MemberId.N | No | Array of String | Group account member id |
| TargetAppId | No | Integer | AppId of the account associated with the alarm (in cross-account scenarios, the member AppId is passed through by the frontend); if 0 or omitted, the login account AppId is used |
| Parameter Name | Type | Description |
|---|---|---|
| FileUrl | String | Sample download link. For public cloud, it is a COS presigned URL (expires in 1 hour); for non-public cloud with the export switch on, it is data:application/octet-stream;base64,<base64 of the zip> |
| FileName | String | Export file name, such as <name>.zip; only returned in the non-public cloud base64 branch, and this field is not returned in other scenarios |
| RequestId | String | The unique request ID, generated by the server, will be returned for every request (if the request fails to reach the server for other reasons, the request will not obtain a RequestId). RequestId is required for locating a problem. |
When it is not a public cloud and the export switch is on, return the base64 DataURL and file name.
POST / HTTP/1.1
Host: csip.intl.tencentcloudapi.com
Content-Type: application/json
X-TC-Action: DescribeEdrMalwareFile
<Common request parameters>
{
"AlertId": "edr-alert-8f3c1a2b"
}{
"Response": {
"FileUrl": "data:application/octet-stream;base64,UEsDBBQ...",
"FileName": "evil.bin.zip",
"RequestId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
}
}Download a malicious sample in a single account scenario (without passing TargetAppId).
POST / HTTP/1.1
Host: csip.intl.tencentcloudapi.com
Content-Type: application/json
X-TC-Action: DescribeEdrMalwareFile
<Common request parameters>
{
"AlertId": "edr-alert-8f3c1a2b"
}{
"Response": {
"FileUrl": "https://xxx.cos.ap-guangzhou.myqcloud.com/samples/6f1e9c...?q-sign-time=...",
"RequestId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
}
}Download malicious samples of member account alerts under the group account
POST / HTTP/1.1
Host: csip.intl.tencentcloudapi.com
Content-Type: application/json
X-TC-Action: DescribeEdrMalwareFile
<Common request parameters>
{
"TargetAppId": 1250000001,
"AlertId": "edr-alert-8f3c1a2b"
}{
"Response": {
"FileUrl": "https://xxx.cos.ap-guangzhou.myqcloud.com/samples/6f1e9c...?q-sign-time=...",
"RequestId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
}
}TencentCloud API 3.0 integrates SDKs that support various programming languages to make it easier for you to call APIs.
The following only lists the error codes related to the API business logic. For other error codes, see Common Error Codes.
| Error Code | Description |
|---|---|
| InternalError | Internal error. |
| InvalidParameter | Parameter error. |
| ResourceNotFound | The resource does not exist. |
文档反馈