tencent cloud

APIs

ドキュメントAPIsCloud Security CenterData Types

Data Types

ダウンロード
フォーカスモード
フォントサイズ
最終更新日: 2026-09-01 11:32:53

AIAgentAsset

Ai Agent asset information list item

Used by actions: DescribeAIAgentAssetList.

Name Type Description
ID String

ID identifier
AgentName String

agent name
AgentModel Array of String

Model name used by the agent
InstanceID String

Instance ID
InstanceName String

Instance name.
MetadataRiskList Array of String

metadata risk list. It has the following enumeration values: 1. AK_TMP 2. USER_DATA
IdentityTimeFirst Timestamp ISO8601

First detection time
IdentityTimeLast Timestamp ISO8601

Latest detected time
IdentityMethod String

Detection method. It has the following enumeration values: 1. FINGER: detected by asset fingerprinting. 2. NETWORK: detected by network access mode
ExposureStatus String

Exposure status. It has the following enumeration values: 1. EXPOSED; 2. UNEXPOSED;

  1. UNKNOWN;
MetadataRiskURL String

Corresponding path when metadata is at risk
SkillState SkillState

Credential Skill installation status
TrafficPluginState TrafficPluginState

Traffic sandbox plug-in status
TrafficRuleState Array of TrafficRuleState

Traffic sandbox rule status
CommandPluginState CommandPluginState

Command sandbox plug-in status

AIAgentCredential

AIAgent asset credential details

Used by actions: DescribeAIAgentCredentialList.

Name Type Description
ID Integer

Credential ID
CredName String

Credential name
CredType String

Credential type

Enumeration values:

  • OAUTH: OAUTH credential
  • API_TOKEN: TOKEN credential
  • CLOUD_AK: AK/SK credential
Locations Array of AIAgentCredentialLocation

Credential location identification
DetectTime Timestamp ISO8601

Latest scan discovery time
HitCount Integer

Total count of leakage locations of this credential

AIAgentCredentialLocation

AIAgent asset credential position

Used by actions: DescribeAIAgentCredentialList, DescribeAIAgentCredentialLocationList.

Name Type Description
InstanceID String

Instance ID
ContainerID String

Container ID
Path String

Credential path
Line Integer

Row number where the credential resides
Content String

Credential masking fragment
Status Integer

Whether the credential is managed

Enumeration values:

  • 1: Managed
  • 0: Unhosted
DelegateID Integer

Hosted credential ID

AIAgentSkillInfo

skill details of an AI Agent

Used by actions: DescribeAIAgentSkillList.

Name Type Required Description
Name String No skill name
Path String No skill path
Version String No Skill version.
Description String No skill description

AIAnalysisSession

AI security assistant session information

Used by actions: DescribeAIAnalysisHistory.

Name Type Description
Title String Title.
SessionID String Session ID
ModifyTime Integer Last modification timestamp.
IsPinned Boolean Pin to top

AIRecommendAction

Recommended operation items for AI QA in AI assistant.

Used by actions: DescribeAIAnalysisRecommendQuestions.

Name Type Required Description
Action String No

Recommended operation type
Question String No

Recommended operations

AIScheduleUserIdentity

User identity information of the AI assistant

Used by actions: DescribeAIScheduleList.

Name Type Description
AppId Integer

appid
Uin String

Account Uin
SubUin String

Sub-account uin
UserId String

uid
BotId String

Robot ID
ChatId String

Chat ID.
Channel String

Channel identifier, for example, wecom / qq / wx / feishu / dingtalk / cloud

AKInfo

AK brief information

Used by actions: DescribeAccessKeyRisk, DescribeAccessKeyRiskDetail, DescribeSourceIPAsset, DescribeSourceIPDetail.

Name Type Description
ID Integer id of the ak
Name String ak specific value. This field returns the temporary key when the temporary key is used.
User String Associated account
Remark String Remarks

AbTestUserItem

Grayscale user configuration

Used by actions: DescribeAbTestUser.

Name Type Description
AppId Integer appId
IsAbTestUser Boolean Whether it is a grayscale user

AccessCredentialOutput

General key credential (dedicated output parameter), used for the response of the details query API. The Value field returns the masked value without exposing the plaintext.

Used by actions: DescribeKeySandboxCredential.

Name Type Description
Key String Credential key name (original text), for example, SecretId, SecretKey, and Token.
Value String Credential key-value (masked)
Supplemental description: Reserve the first 3 and last 4 digits, replace the middle with *; if the length is less than 7 digits, replace all with *.

AccessKeyAlarm

Access key alarm records

Used by actions: DescribeAccessKeyAlarm, DescribeAccessKeyAlarmDetail.

Name Type Description
Name String

Alarm name
Level Integer

Alarm level
0 - Invalid, 1 - Notification, 2 - Low risk, 3 - Medium risk, 4 - High risk, 5 - Critical
ID Integer

Alarm record ID
AlarmRuleID Integer

Alarm rule ID
AlarmType Integer

Alarm type
0 Abnormal calls
1 Leak monitoring
AccessKey String

Access key
AccessKeyID Integer

Access Key ID
AccessKeyRemark String

Access key remark
LastAlarmTime String

Last alarm time
Status Integer

Alarm status
0 - Unprocessed, 1 - Processed, 2 - Ignored
Date String

Aggregation date
Tag Array of String

Alarm tag
Uin String

Uin of the main account
Nickname String

Nickname of the main account
SubUin String

Sub-account Uin
SubNickname String

Belonging sub-account nickname
Type Integer

Account type
0: root account AK; 1: sub-account AK; 2: temporary key
AppID Integer

App ID
LeakEvidence Array of String

Leakage evidence
IsSupportEditWhiteAccount Boolean

Whether editing trusted accounts is supported
Evidence String

Alert evidence
RuleKey String

Alarm rule identifier
CloudType Integer

Cloud vendor type. 0: Tencent Cloud. 1: Amazon Web Services. 2: Microsoft Azure. 3: Google Cloud. 4: Alibaba Cloud. 5: Huawei Cloud
AIStatus Integer

Alarm AI analysis status
-1: Analysis failed
0: Not analyzed
1: Under analysis
2: Analysis successful, real alarm
3: Analysis successful, suspicious alarm
FirstAlarmTimestamp Integer

Initial alarm timestamp (in seconds)
LastAlarmTimestamp Integer

Last alarm timestamp (in seconds)
AIFailedReason String

AI analysis failure description, an empty string if no failure

AccessKeyAlarmCount

Access key alarm count

Used by actions: DescribeAccessKeyRiskDetail.

Name Type Description
ID Integer Access key ID
AccessKey String Access key
AlarmCount Integer Alarm count
AccessKeyStatus Integer Access key status: 0: disabled, 1: enabled, 2: deleted
AccessKeyCreateTime String AK creation time
LastAccessTime String Last AK usage time. If it has never been used, "-" is returned.

AccessKeyAlarmInfo

Access key asset alarm information

Used by actions: DescribeAccessKeyAsset, DescribeAccessKeyUserDetail, DescribeAccessKeyUserList, DescribeSourceIPAsset, DescribeSourceIPDetail.

Name Type Description
Type Integer Alarm type/Risk type
Alarm type:
0Abnormal calls
1. Leakage detection
Custom parameter 2.

Risk type:
0: Configuration risk
1: Custom risk
Count Integer Alarm count / risk quantity

AccessKeyAsset

Access key asset information

Used by actions: DescribeAccessKeyAsset.

Name Type Description
ID Integer id of the AK
Name String AK name
Remark String Remarks
AppID Integer APPID of the account
Uin String Uin of the main account
Nickname String Account nickname
SubUin String Sub-account Uin it belongs to
SubNickname String Sub-account nickname
Type Integer 0 root account AK
1 Sub-account AK
2 Temporary key
Advice Integer Security advice Enumerate
0 Normal
1 Process now
2. Hardening is recommended.
AccessKeyAlarmList Array of AccessKeyAlarmInfo Alarm information list.
AccessKeyRiskList Array of AccessKeyAlarmInfo Risk information list.
IPCount Integer Source IP quantity
CreateTime String Creation time.
LastAccessTime String Last access Time
Status Integer AK status
0: Disable
1: Enabled
2: Deleted (already deleted on the cam side, and the security center still retains earlier records)
CheckStatus Integer 0 indicates detected
1: Indicates detection in progress
CloudType Integer Cloud vendor type. 0: Tencent Cloud. 1: Amazon Web Services. 2: Microsoft Azure. 3: Google Cloud. 4: Alibaba Cloud. 5: Huawei Cloud

AccessKeyRisk

Access key risk record

Used by actions: DescribeAccessKeyRisk, DescribeAccessKeyRiskDetail.

Name Type Description
Name String Risk name
Level Integer Risk level
0 - Invalid, 1 - Notification, 2 - Low risk, 3 - Medium risk, 4 - High risk, 5 - Critical
ID Integer Risk record ID
RiskRuleID Integer Risk rule ID
RiskType Integer Risk type
0 - Configuration risk
AccessKey String Access key
AccessKeyID Integer Access Key ID
AccessKeyRemark String Access key remark
RiskTime String Risk detection time
Status Integer Risk status
0: unprocessed; 2: ignored; 3: converged
Tag Array of String Risk tag
Evidence String Risk evidence
Description String Risk description.
Uin String Uin of the main account
Nickname String Nickname of the main account
SubUin String Uin of the associated sub-account
SubNickname String Sub-account nickname
Type Integer Account type
0-Root Account AK, 1-Sub-account AK
2 Temporary key
CheckStatus Integer Detection status.
0 means detected
1: Indicates detection in progress
AppID Integer App ID
QueryParam String Query parameter corresponding to the risk
CloudType Integer Cloud type. 0: Tencent Cloud; 4: Alibaba Cloud
RelatedAK Array of AKInfo List of related AKs, including AK names and remarks

AccessKeyUser

Access key account information

Used by actions: DescribeAccessKeyUserDetail, DescribeAccessKeyUserList.

Name Type Description
ID Integer Account ID
Name String Account name
Type Integer 0 Root account 1 Sub-account
AccessType Integer Access method
0 API
1 Console and API
Advice Integer Security advice. Enumerated values: 0: Normal. 1: Process now. 2: Hardening recommended.
AccessKeyAlarmList Array of AccessKeyAlarmInfo Alarm information list.
AccessKeyRiskList Array of AccessKeyAlarmInfo Risk information list.
AppID Integer APPID of the account
Nickname String Main account nickname
SubNickname String Sub-account nickname
Uin String Uin of the main account to which the account belongs
SubUin String Account's own uin. For a root account, it is the same as the root account uin.
LoginIP String Login IP
LoginLocation String Login address.
LoginTime String Log-in time
ISP String ISP name
ActionFlag Integer Whether operation protection is enabled
0: not enabled
1: On.
LoginFlag Integer Whether login protection is enabled
0: not enabled
1: On.
CheckStatus Integer 0 indicates detected, and 1 indicates in-progress detection.
CloudType Integer Cloud vendor type. 0: Tencent Cloud. 1: Amazon Web Services. 2: Microsoft Azure. 3: Google Cloud. 4: Alibaba Cloud. 5: Huawei Cloud

AccessKeyWhiteList

Access key alarm rule allowlist

Used by actions: DescribeAccessKeyWhiteList.

Name Type Description
ID Integer Allowlist ID
Name String Allowlist policy name
AKList Array of String ak allowlist
IPList Array of String ip allowlist
IPTypeList Array of Integer ip type list IP type. 0: within the account (no remark). 1: outside the account (no remark). 2: within the account (remarked). 3: outside the account (remarked). 4: LAN (no remark). 5: LAN (remarked)
ActionList Array of String API allowlist
CallType Integer Add the call method to the allowlist
0: all calling methods
1 Console
2 API
-1 Nonexistent
ErrorCodeList Array of Integer Error code allowlist (other error codes to be supplemented)
0: successful.
Remark String Policy content/description
CreateTime String Creation time.
UpdateTime String Update time
AkImportType Integer Input type of ak
0: Select from existing
1: Manually enter
2: Temporary key
3: Persistent key
4: All keys
-1: None
AppID Integer Main account AppID
Uin String uin of the main account
Nickname String Main account Nickname
NeedDealPastAlarm Boolean Whether to process past alarms
DealStatus Integer Processing status
0: Processing completed
1 Currently processing
ActionType Integer Select an API
0: Custom input
1: Select product+api format interaction
2: All interfaces
AlarmPolicyID Array of Integer List of binding policy IDs. If this parameter is empty, the policy takes effect globally.

AccountBriefInfo

Brief account information

Used by actions: DescribeBaselineUserOtherConf, DescribeHostKBRiskList, DescribeHostVulRiskList, DescribeVulComponentRelateHost, DescribeVulHostRelateComponent, DescribeVulRiskRelateHost, DescribeVulScanPeriodic.

Name Type Required Description
AppID Integer No

Account AppID
Nick String No

Account nickname
Uin String No

Account Uin

AgentRunModePolicy

Agent running mode policy (CPU/Memory/NetworkPps)

Used by actions: DescribeAgentRunPolicy.

Name Type Description
Memory Integer

Memory limit (MB). Options: 0/200/300/500
Cpu Integer

CPU limit (%), selectable: 10/20/30/40/50/60
NetworkPps Integer

Network PPS limit

AiScheduleInfo

AI scheduled task information

Used by actions: DescribeAIScheduleList.

Name Type Description
ScheduleId String

ID of the AI scheduled task.
Name String

Task name. Maximum 128 characters.
Prompts String

Execute the prompt content. Maximum 2048 characters.
Status Integer

Status. Parameter Value: 1 (enabled), 2 (disabled).
Triggers Array of AiScheduleTriggerInfo

Trigger
MaxFireCount Integer

Maximum trigger count. 0 indicates unlimited.
CurrentFireCount Integer

Trigger count.
StartTime Integer

Start of effective time, Unix millisecond timestamp. 0 means effective immediately.
EndTime Integer

Expiration time, Unix millisecond timestamp. 0 means never expires.
CreateTime Integer

Creation time, Unix millisecond timestamp.
UpdateTime Integer

Update time, Unix millisecond timestamp.
Identity AIScheduleUserIdentity

Identity information

AiSchedulePlanInfo

Future trigger plan entry

Used by actions: DescribeAISchedulePlanList.

Name Type Description
TriggerId String Trigger ID.
FireTime Integer Expected trigger time, Unix millisecond timestamp.
TriggerType Integer Trigger type. Parameter Value: 1 (Cron expression), 2 (fixed time).

AiScheduleTaskInfo

Task execution log

Used by actions: DescribeAIScheduleTaskList.

Name Type Description
TaskId String

Task ID.
ScheduleId String

ID of the AI scheduled task it belongs to.
TriggerId String

ID of the trigger that triggers the task.
SessionId String

Unique conversation ID of the Agent call.
Status Integer

Execution status.
Result String

Agent output result or error detail.
ScheduledTime Integer

Planned trigger time, Unix millisecond timestamp.
StartTime Integer

Actual start execution time, Unix millisecond timestamp.
EndTime Integer

Execution completion time, Unix millisecond timestamp.
CreateTime Integer

Creation time, Unix millisecond timestamp.
UpdateTime Integer

Update time, Unix millisecond timestamp.
TaskName String

Scheduled task name
Prompts String

Scheduled task prompt

AiScheduleTriggerInfo

Trigger configuration

Used by actions: CreateAISchedule, DescribeAIScheduleList, ModifyAISchedule.

Name Type Required Description
TriggerId String No

Trigger ID.
TriggerType Integer No

Trigger type. Value: 1 (Cron expression), 2 (fixed time).

AlertExtraInfo

Alarm Dropdown Fields

Used by actions: DescribeAlertList.

Name Type Required Description
RelateEvent RelatedEvent No Related attack events
LeakContent String No Leaked content
LeakAPI String No Leak APIs
SecretID String No secretID
Rule String No Matched rule
RuleDesc String No Rule description
ProtocolPort String No Protocol port
AttackContent String No Attack content
AttackIPProfile String No Attack IP profiling.
AttackIPTags String No Attack IP tag
RequestMethod String No Request method
HttpLog String No HTTP log
AttackDomain String No Attacked domain name
FilePath String No File path
UserAgent String No user_agent
RequestHeaders String No Request headers
LoginUserName String No Login username
VulnerabilityName String No Vulnerability name
CVE String No Public vulnerability and exposure
ServiceProcess String No Service process
FileName String No File name
FileSize String No File size
FileMD5 String No File MD5
FileLastAccessTime String No Last access time of the file
FileModifyTime String No File modification time
RecentAccessTime String No Last access Time
RecentModifyTime String No Last modification time
VirusName String No Virus name
VirusFileTags String No Virus file tag
BehavioralCharacteristics String No Behavioral characteristics
ProcessNamePID String No Process name (PID)
ProcessPath String No Process path
ProcessCommandLine String No Process command line
ProcessPermissions String No Process permission
ExecutedCommand String No Execute commands
AffectedFileName String No Affected file name
DecoyPath String No Bait path
MaliciousProcessFileSize String No Malicious process file size
MaliciousProcessFileMD5 String No MD5 of the malicious process file
MaliciousProcessNamePID String No Malicious process name (PID)
MaliciousProcessPath String No Malicious process path
MaliciousProcessStartTime String No Malicious process startup time
CommandContent String No Command
StartupUser String No Startup user
UserGroup String No User group
NewPermissions String No Added permission
ParentProcess String No Parent process
ClassName String No Class name
ClassLoader String No Class loader to which it belongs
ClassFileSize String No Individual file size
ClassFileMD5 String No Class file MD5
ParentClassName String No Parent class name
InheritedInterface String No Inherit interfaces
Comment String No Annotation
PayloadContent String No Payload content
CallbackAddressPortrait String No Callback address profile
CallbackAddressTag String No Callback address tag
ProcessMD5 String No Process MD5
FilePermission String No File permission
FromLogAnalysisData Array of KeyValue No Information fields that come from log analysis
HitProbe String No Cache hit probe
HitHoneyPot String No Hit a honeypot
CommandList String No Command list
AttackEventDesc String No Description of the attack event
ProcessInfo String No Process information.
UserNameAndPwd String No Use username and password
StrategyID String No Host protection policy ID
StrategyName String No Host protection policy name
HitStrategy String No Host protection hit policy, which is a combination of the policy ID and policy name.
ProcessName String No Process name
PID String No PID
PodName String No Pod name of the container
PodID String No Pod ID of the container
Response String No Http response
SystemCall String No System call
Verb String No Operation type.
LogID String No Log ID.
Different String No Change content
EventType String No Event type
Description String No Event description
TargetAddress String No Target address (container reverse shell)
MaliciousRequestDomain String No Malicious request domain name (malicious outbound connection of a container)
RuleType String No Rule type (exceptional request of the K8s API in the container)
RequestURI String No Requested resource (exceptional request for K8s API of a container)
RequestUser String No Request initiating user (container K8s API abnormal request)
RequestObject String No Request object (exceptional K8s API request in a container)
ResponseObject String No object (for exceptional requests from the K8s API in a container)
FileType String No File type (container file tampering)
TIType String No Tag feature (container malicious outbound connection)
SourceIP String No Source IP address (exceptional request to the K8s API of a container)

AlertInfo

Full Alarm List Data from Alarm Center

Used by actions: DescribeAlertList.

Name Type Required Description
ID String No Alarm ID
Name String No Alarm name
Source String No Alarm source
CFW: Cloud firewall
WAF: Web application firewall
CWP: Host Security
CSIP: Cloud Security Center
Level Integer No Alarm level
1: Prompt
2: Low-risk
3: Medium risk
4: High risk
5: Critical
Attacker RoleInfo No Attacker
Victim RoleInfo No Victim.
EvidenceData String No Evidence data (for example, attack content, base64 encoded)
EvidenceLocation String No Evidence location (such as protocol port)
EvidencePath String No Evidence Path
CreateTime String No First alarm time
UpdateTime String No Latest Alarm Time
Count Integer No Alarm count
UrgentSuggestion String No Emergency Mitigation Suggestions
RemediationSuggestion String No Radical Treatment Suggestion
Status Integer No Processing status
0: Unprocessed; 1: Ignored; 2: Processed.
ProcessType String No Alarm Handling Type
Type String No Major Category of Alarm
SubType String No Alarm Subcategory
ExtraInfo AlertExtraInfo No Dropdown Field
Key String No Aggregate Fields
Date String No Alarm Date
AppID String No appid
NickName String No Account name
Uin String No Account ID
Action Integer No Action
RiskInvestigation String No Risk detection
RiskTreatment String No Risk handling
LogType String No Log type
LogSearch String No Statement retrieval

AssetBaseInfoResponse

Host asset details

Used by actions: DescribeCVMAssetInfo.

Name Type Description
VpcId String vpc-id
VpcName String vpc-name
AssetName String Asset name
Os String Operating system.
PublicIp String Public IP address
PrivateIp String Private IP address
Region String Region.
AssetType String Asset type
AssetId String Asset ID
AccountNum Integer Number of accounts
PortNum Integer Number of Ports
ProcessNum Integer Process quantity
SoftApplicationNum Integer Number of Software Applications
DatabaseNum Integer Database Count
WebApplicationNum Integer Number of Web Applications
ServiceNum Integer Number of services
WebFrameworkNum Integer Web Framework Count
WebSiteNum Integer Website Count
JarPackageNum Integer Jar Package Count
StartServiceNum Integer Started Service Count
ScheduledTaskNum Integer Number of Scheduled Tasks
EnvironmentVariableNum Integer Number of Environment Variables
KernelModuleNum Integer Number of Kernel Modules
SystemInstallationPackageNum Integer System Installation Package Count
SurplusProtectDay Integer Remaining protection duration
CWPStatus Integer Whether client is installed. 1 for Installed, 0 for Not Installed.
Tag Array of Tag Tag.
ProtectLevel String Protection level
ProtectedDay Integer Protection duration

AssetCluster

This example shows you how to obtain the cluster list.

Cluster protection status. Enumerations on the left and displays on the right.
Cluster protection status
0: Not connected
1: No protection
2: Partial protection
3: Under protection
4: Access exception
5: Accessing
6: Uninstalling
7: Uninstallation exception

Used by actions: DescribeClusterAssets.

Name Type Description
AppId Integer Tenant ID
Uin String Tenant uin
Nick String Tenant Nickname
Region String Region.
AssetId String Cluster ID.
AssetName String Cluster name.
AssetType String Cluster type.
InstanceCreateTime String Cluster Creation Time
Status String Status.
ProtectStatus Integer Cluster protection status. Enumerations on the left and displays on the right.
Cluster protection status
0: Not connected
1: No protection
2: Partial protection
3: Under protection
4: Access exception
5: Accessing
6: Uninstalling
7: Uninstallation exception
ProtectInfo String Access information. Being not empty indicates an access exception message.
VpcId String VPC id
VpcName String VPC name
KubernetesVersion String kubernetes version
Component String Runtime component
ComponentVersion String Runtime component version
ComponentStatus String Component status
CheckTime String Health Checkup Time
MachineCount Integer Number of associated hosts
PodCount Integer Associated Pod Count
ServiceCount Integer Associated Service Count
VulRisk Integer Vulnerability risk
CFGRisk Integer Configuration risk
CheckCount Integer Health Checkup Count
IsCore Integer Whether it is core. 1: Core; 2: Non-core.
IsNewAsset Integer New Asset or Not. 1: New
CloudType Integer Cloud asset type: 0: Tencent Cloud, 1: aws, 2: azure

AssetClusterPod

Cluster Pod List

Used by actions: DescribeClusterPodAssets.

Name Type Description
AppId Integer Tenant ID
Uin String Tenant uin
Nick String Tenant Nickname
Region String Region.
AssetId String pod id
AssetName String Pod name
InstanceCreateTime String Pod Creation Time
Namespace String Namespace
Status String Status.
ClusterId String Cluster ID.
ClusterName String Cluster name.
MachineId String Host ID
MachineName String MachineName
PodIp String pod ip
ServiceCount Integer Associated Service Count
ContainerCount Integer Number of associated containers
PublicIp String Public IP address
PrivateIp String Private IP address
IsCore Integer Whether it is core. 1: Core; 2: Non-core.
IsNewAsset Integer New Asset or Not. 1: New

AssetComponent

Component information in an asset

Used by actions: DescribeAssetComponentList.

Name Type Required Description
Name String No

Component name.
Version String No

Component version
Type String No

Component type
FirstFoundTime String No

First discovery time

Parameter format: YYYY-MM-DD hh:mm:ss
LatestFoundTime String No

Last discovery time

Parameter format: YYYY-MM-DD hh:mm:ss
Id String No

Component id
OwnerAccountName String No

Component associated account name
OwnerAppId Integer No

appid of the account associated with the component
OwnerUin String No

Account uin associated with the component
AffectedImageCount Integer No

Numbers of affected images

AssetDetailItem

Asset detail information

Used by actions: DescribeAssetDetail.

Name Type Description
AppID Integer

Tenant ID
CloudAccountName String

Cloud account name
AssetID String

Asset ID.
AssetType String

Asset type
Tags Array of AssetTag

Cloud API return tag
SecurityGroupIDs Array of String

Security group ID collection
PublicIP String

Public IP address
PrivateIP String

Private IP address.
PublicDomain String

Public network domain
PrivateDomain String

Private domain
RiskCount Integer

Total number of risks
AlarmCount Integer

Total number of alarms
AssetName String

Asset name
CustomTags Array of CustomTag

Cloud security center tag
Provider String

Cloud service provider
AssetTypeName String

Asset type name
AssetTypeIconURL String

Asset type icon
AssetRID String

Asset unique identifier

AssetFilterConfig

Asset filter configurator

Used by actions: DescribeDynamicAssets.

Name Type Description
Attr String

Query attributes
Label String

Show
Style String

Style
Value String

Value.
LabelEn String

Show in English
Options Array of AssetFilterOptions

Asset private field filter

AssetFilterOptions

Asset filter options

Used by actions: DescribeDynamicAssets.

Name Type Description
Text String

Display value.
Value String

Actual value.
Style String

Style

AssetFilters

Container security
Description key-value pair filter, which is used for conditional filtering queries. For example, filter by ID, name, and status.
If there are multiple Filters, the logical relationship between them is AND.
If there are multiple Values in the same Filter, the logical relationship between the Values under the same Filter is OR.

Used by actions: DescribeLoginWhiteHostList.

Name Type Required Description
Name String Yes

Name of filter key
Values Array of String Yes

One or more filter values.
ExactMatch Boolean No

Whether to enable fuzzy search

AssetHeaderItem

Asset dynamic table header

Used by actions: DescribeDynamicAssets.

Name Type Description
ItemType String

Type.
Label String

Show
Copy Integer

Support copying
Values Array of String

Value corresponding to the field key
LinkURL String

Redirect URL
Filters Array of AssetFilterConfig

Filter
Sort Integer

Support sorting
ValueStyle String

Field display style

AssetInfoDetail

Asset Scan Structure Details

Used by actions: DescribeSearchBugInfo.

Name Type Description
AppID String User appid.
CVEId String CVE ID
IsScan Integer Scan Status. 0-Not Scanned by Default; 1-Scanning; 2-Scan Completed; 3-Scan Error.
InfluenceAsset Integer Number of Affected Assets
NotRepairAsset Integer Number of Unfixed Assets
NotProtectAsset Integer Unprotected Asset Count
TaskId String Task ID.
TaskPercent Integer Task Percentage
TaskTime Integer Task time
ScanTime String Scan time

AssetInstanceTypeMap

Mapping between asset types and instance types

Used by actions: DescribeCVMAssets.

Name Type Description
Text String Asset type
Value String Asset type
InstanceTypeList Array of FilterDataObject Asset type and instance type mapping relationship

AssetItem

Asset information

Used by actions: DescribeCloudAssets.

Name Type Description
AppID Integer

Tenant ID
Provider String

Cloud service provider
ProviderName String

Cloud vendor name
CloudAccountID String

Cloud Account ID
CloudAccountName String

Cloud account name
AssetID String

Asset ID.
AssetName String

Asset name
AssetType String

Asset type
AssetTypeName String

Asset type name
AssetStatus String

Asset running state.
PublicExpose Integer

Whether it is exposed to the public network
Tags Array of AssetTag

Asset tag
PublicIP String

Public ip address
PrivateIP String

Private ip
PublicDomain String

Public network domain
PrivateDomain String

Private domain
ProtectStatus Integer

Protection status
RiskCount Integer

Number of risks
AlarmCount Integer

Number of alarms.
CreatedAt String

Instance creation time
FirstSyncTime String

First sync time
UpdateTime String

Update time.
OsName String

Operating system name
CriticalRiskCount Integer

Total number of severe risks
HighRiskCount Integer

Total number of high risks
MediumRiskCount Integer

Total number of medium risks
LowRiskCount Integer

Total number of low risks
Region String

Region.
RegionName String

Region name.
AssetRID String

Asset unique ID.
CustomTags Array of CustomTag

CSC tag
AssetTypeIconURL String

Asset type icon

AssetProcessItem

Host process content

Used by actions: DescribeAssetProcessList.

Name Type Description
CloudAccountID String Cloud Account ID
InstanceName String Instance name.
AppID Integer Tenant ID
CloudAccountName String Cloud account name
InstanceID String Instance ID.
PublicIp String Public IP address
PrivateIp String Private IP address
ProcessID String Process ID
ProcessName String Process name
CmdLine String Command line
Port String Listening port list

AssetProviderDistributeInfo

Number of assets of the cloud service provider

Used by actions: DescribeAssetOverview.

Name Type Description
TencentAssetCount Integer

Total number of Tencent Cloud assets
AliAssetCount Integer

Total number of Alibaba Cloud assets
AwsAssetCount Integer

Total number of Amazon Web Services assets
OtherAssetCount Integer

Total number of assets in other cloud environments
AzureAssetCount Integer

Number of Microsoft cloud assets

AssetRiskContent

Risk information grouped by risk engine

Used by actions: DescribeAssetRiskDetail.

Name Type Description
EngineType String

Risk engine
Risks Array of AssetRiskInfo

Risk distribution of a specific risk under the risk engine
AssetRID String

Asset ID.

AssetRiskInfo

Asset correlation risk information

Used by actions: DescribeAssetRiskDetail.

Name Type Description
ResultType String

Risk type
RiskCount Integer

Total number of risks
RiskCritical Integer

Number of severe risks
RiskHigh Integer

High risk count
RiskMedium Integer

Number of medium risks
RiskLow Integer

Number of low-risk assets

AssetRiskItem

Risk information from the asset perspective

Used by actions: DescribeAssetRiskList.

Name Type Description
AppId Integer

Tenant ID
Provider String

Cloud service provider.
ProviderName String

Cloud vendor name
CloudAccountName String

Cloud account name
CloudAccountId String

Cloud Account ID
InstanceName String

Instance name.
InstanceId String

Instance ID.
CreateTime String

First discovery time
UpdateTime String

Update time.
RiskStatus Integer

Risk status
RiskTitle String

Risk name
CheckType String

Check type
Severity String

Risk level.
RiskRuleId String

Risk rule ID
Classify String

Handling category
StandardTerms Array of StandardTerm

Cybersecurity classified protection compliance
AssetType String

Asset type
AssetTypeIconURL String

Asset type icon
AssetTypeName String

Asset type

AssetStatisticsInfo

Asset Overview statistical information

Used by actions: DescribeAssetOverview.

Name Type Description
AssetTotalCount Integer

Total number of assets
AssetAddCount Integer

New asset count in the last 7 days
RiskAssetCount Integer

Number of risky assets
AlarmAssetCount Integer

Number of assets with alarms.
PublicAssetCount Integer

Number of public network assets
ExposeAssetCount Integer

Number of exposed assets
CloudHostAssetCount Integer

Host asset quantity

AssetTag

Security Center Asset Tag

Used by actions: CreateDomainAndIp, CreateRiskCenterScanTask, DeleteDomainAndIp, DescribeAssetDetail, DescribeAssetViewVulRiskList, DescribeCloudAssets, DescribeClusterAssetList, DescribeClusterDetail, DescribeClusterNamespaceList, DescribeClusterPodDetail, DescribeClusterServiceList, DescribeDomainAssets, DescribePublicCloudAssets, DescribePublicIpAssets, DescribeRiskCenterAssetViewCFGRiskList, DescribeRiskCenterAssetViewPortRiskList, DescribeRiskCenterAssetViewVULRiskList, DescribeRiskCenterAssetViewWeakPasswordRiskList, DescribeRiskCenterPortViewPortRiskList, DescribeRiskCenterServerRiskList, DescribeRiskCenterVULViewVULRiskList, DescribeRiskCenterWebsiteRiskList, DescribeVulViewVulRiskList.

Name Type Required Description
TagKey String No Tag Key, can be letters, digits, and underscores.
TagValue String No Tag Value, can be letters, digits, and underscores.

AssetTagItem

Asset tag element

Used by actions: DescribeAssetTags.

Name Type Required Description
ID Integer No

Tag ID
AppID Integer No

appid
TagKey String No

Tag key
TagValue String No

Tag value
Description String No

Description.
TaggingRule String No

Automatic tagging policy
Color String No

Tag color
AssetCount Integer No

Number of assets bound to a tag
CreateTime String No

Creation time.
UpdateTime String No

Update time.

AssetTagModifyAssetItem

Operate asset tags and asset information

Used by actions: DescribeCWPMachineDetail, DescribeCWPMachines, ModifyAssetTagsByAssetInfo.

Name Type Required Description
AppID Integer Yes

appid
AssetType String Yes

Asset type
InstanceID String Yes

Instance ID.
Provider String Yes

Cloud service provider

AssetTagPreviewAssetItem

Asset tag preview asset

Used by actions: DescribeTagRuleAssets.

Name Type Required Description
AssetID String No

Asset ID.
AssetName String No

Asset name
PublicIP String No

Public IP address
PrivateIP String No

Private IP address.
PublicDomain String No

Public network domain
PrivateDomain String No

Private domain
AssetType String No

Asset type
AssetTypeName String No

Asset type name
AssetTypeIconURL String No

Asset type icon

AssetTagTreeNode

Asset tag tree node

Used by actions: DescribeAssetTagAttributes, DescribeAssetTagTree.

Name Type Required Description
Key String No Tag key.
Value String No Tag value.
Children Array of AssetTagTreeNode No Child node.
Color String No Color

AssetTypeCount

Distribution of the number of related assets

Used by actions: DescribeAssetDetail.

Name Type Description
AssetType String

Associated asset type
Count Integer

Quantity.
AssetTypeName String

Asset type display name
Filter String

Filter field

AssetTypeNode

Asset tree - Asset type node

Used by actions: DescribeAssetTree.

Name Type Description
AssetType String

Asset type
AssetTypeName String

Asset type name
AssetCount Integer

Asset type count
AssetTypeID Integer

Asset type ID

AssetTypeStatisticsInfo

Asset type and number of asset types with existing risks

Used by actions: DescribeAssetOverview.

Name Type Description
AssetTypeCount Integer

Asset type count
RiskAssetTypeCount Integer

Number of asset types with existing risks

AssetViewCFGRisk

Configuration Risk from Asset's Perspective

Used by actions: DescribeRiskCenterAssetViewCFGRiskList.

Name Type Description
Id String Unique ID
CFGName String Configuration name
CheckType String Check type
InstanceId String Instance ID.
InstanceName String Instance name.
InstanceType String Instance type
AffectAsset String Affect assets
Level String Risk level. low: low risk. high: high risk. middle: medium risk. info: notification. extreme: critical.
FirstTime String First Recognition Time
RecentTime String Latest Recognition Time
From String Source.
Status Integer Status.
CFGSTD String Relevant standards
CFGDescribe String Configuration detail
CFGFix String Fixing suggestion
CFGHelpURL String Help Document Link
Index String Front-end Usage Index
AppId String User appid.
Nick String User Nickname
Uin String User UIN
ClbId String This field is displayed when the asset type is LBL, to help locate the specific LB.

AssetViewFilter

Asset search view

Used by actions: DescribeAssetFilterViews.

Name Type Description
ViewID Integer

View ID.
ViewName String

View name
Filters Array of Filters

View filter items

AssetViewPortRisk

Port Risk Objects from Asset's Perspective

Used by actions: DescribeRiskCenterAssetViewPortRiskList.

Name Type Description
Port Integer Port.
AffectAsset String Affect assets
Level String Risk level. low: low risk. high: high risk. middle: medium risk. info: notification. extreme: critical.
InstanceType String Asset type
Protocol String Protocol
Component String Component
Service String Service.
RecentTime String Latest Recognition Time
FirstTime String First Recognition Time
Suggestion Integer Disposal Suggestions. 0: Maintain Status Quo; 1: Restrict Access; 2: Block Port.
Status Integer Status. 0-Unprocessed; 1-Disposed; 2-Ignored; 3-Defended by Cloud Firewall.
Id String Risk ID
Index String Front-end Index
InstanceId String Instance ID.
InstanceName String Instance name.
AppId String User appid.
Nick String User Nickname
Uin String User UIN
From String Recognition Source. See Enumeration Return for details.
ServiceJudge String Service judgment. high_risk_service: high-risk service. web_service: web service. other_service: other service.
XspmStatus Integer Status. 0: unprocessed; 1: processed; 2: ignored; 3: defended by Cloud Firewall; 4: no action is required.

AssetViewVULRisk

Vulnerability Risk Objects from Asset's Perspective

Used by actions: DescribeRiskCenterAssetViewVULRiskList.

Name Type Description
AffectAsset String Affected assets
Level String Risk level. low: low risk. high: high risk. middle: medium risk. info: notification. extreme: critical.
InstanceType String Asset type
Component String Component
Service String Service.
RecentTime String Latest Recognition Time
FirstTime String First Recognition Time
Status Integer Status. 0-Unprocessed; 1-Disposed; 2-Ignored.
Id String Risk ID
Index String Front-end Index
InstanceId String Instance ID.
InstanceName String Instance name.
AppId String User appid.
Nick String User Nickname
Uin String User UIN
VULType String Vulnerability type
Port String Port.
Describe String Vulnerability description
AppName String Affected component of the vulnerability
References String Technical reference
AppVersion String Vulnerability Impact version
VULURL String Risk point
VULName String Vulnerability name
CVE String cve
Fix String Fixing solution
POCId String pocid
From String Scan Source
CWPVersion Integer Host version.
IsSupportRepair Boolean Whether repair is supported
IsSupportDetect Boolean Whether scanning is supported.
InstanceUUID String Instance UUID
Payload String Payload
EMGCVulType Integer Emergency Vulnerability Type. 1-Emergency Vulnerability; 0-Non-emergency Vulnerability.

AssetViewVULRiskData

Vulnerability Risk Objects from Asset's Perspective

Used by actions: DescribeAssetViewVulRiskList.

Name Type Description
AffectAsset String Affect assets
Level String Risk level. low: low risk. high: high risk. middle: medium risk. info: notification. extreme: critical.
InstanceType String Asset type
Component String Component
RecentTime String Latest Recognition Time
FirstTime String First Recognition Time
Status Integer Status. 0: unprocessed, 1: tagged processed, 2: ignored, 3: processed, 4: under disposal, 5: in-progress detection, 6: partially processed
RiskId String Risk ID
InstanceId String Instance ID.
InstanceName String Instance name.
AppId String User appid.
Nick String User Nickname
Uin String User UIN
VULType String Vulnerability type
Port String Port.
AppName String Vulnerability Impact component
AppVersion String Vulnerability Impact version
VULURL String Risk point
VULName String Vulnerability name
CVE String cve
POCId String pocid
From String Scan Source
CWPVersion Integer Host version.
InstanceUUID String Instance UUID
Payload String Payload
EMGCVulType Integer Emergency Vulnerability Type. 1-Emergency Vulnerability; 0-Non-emergency Vulnerability.
CVSS Float CVSS score
Index String Frontend index id
PCMGRId String pcmgrId
LogId String Report ID
TaskId String Task ID.
VulTag Array of String Vulnerability tag
DisclosureTime String Vulnerability disclosure time
AttackHeat Integer Attack level
IsSuggest Integer Whether vulnerability 1 is mandatory. 0 indicates false.
HandleTaskId String Disposal task ID.
EngineSource String Engine source
VulRiskId String New vulnerability risk id (same as RiskId in the network-wide vulnerability table)
TvdID String Vulnerability id of the new version
IsOneClick Integer Whether to perform one-click physical examination. 1: yes, 0: no.
IsPOC Integer Whether it is a POC scan. 0: non-POC; 1: POC

AssetViewWeakPassRisk

Weak Password Risk from Asset's Perspective

Used by actions: DescribeRiskCenterAssetViewWeakPasswordRiskList.

Name Type Description
AffectAsset String Affect assets
Level String Risk level. low: low risk, high: high risk, middle: medium risk, info: notification, extreme: critical.
InstanceType String Asset type
Component String Component
Service String Service.
RecentTime String Latest Recognition Time
FirstTime String First Recognition Time
Status Integer Status. 0-Unprocessed; 1-Disposed; 2-Ignored.
Id String ID, fix risks
Index String Front-end Index
InstanceId String Instance ID.
InstanceName String Instance name.
AppId String User appid.
Nick String User Nickname
Uin String User UIN
PasswordType String Weak password type
From String Source.
VULType String Vulnerability type
VULURL String Vulnerability URL
Fix String Fixing suggestion
Payload String Proof
Port Integer Port.

AttackStageCount

Number of policies corresponding to the EDR attack phase.

Used by actions: DescribeEDRRuleList, DescribeEdrAlertList.

Name Type Description
AttackStage String

Attack phase
Count Integer

Policy count

AttributeOptionSet

Common dropdown box list

Used by actions: DescribeAssetRiskList, DescribeAssetTags, DescribeCheckViewRisks, DescribeCloudAssets, DescribeCloudFunctionList, DescribeComplianceRiskList, DescribeConfigCheckRules, DescribeCustomRiskRules, DescribeDynamicAssets, DescribeExposureAutoTagAttribute, DescribePublicCloudAssets, DescribeRiskRules, DescribeTagRuleAssets.

Name Type Description
Text String cvm instance type
Value String CVM instance name.

AuditLogInfo

Audit log list information.

Used by actions: DescribeDspmLogList.

Name Type Description
AiScore Float AI score.
AppUser String Application user.
BackPacket String Backup data package.
ClientIp String Client IP
ClientMac String Client Mac.
ClientName String Terminal name. When the value is Proxy, it indicates CASB proxy traffic. Otherwise, it indicates agent traffic.
ClientUser String Client user.
ClientPort Integer Client port
DangerLevel Integer Risk level
DbIp String Database IP.
DbName String Database name.
DbPort Integer Database port.
DbUser String Database user
EffectRow Integer Number of affected rows
ExecTime Integer Execution time, unit: ms
HitRule String Matched rule
Id Integer Log ID
InstanceId Integer Data asset name
InstanceName String Audit unit name.
OpSql String Operational statement (SQL statement).
OpTime Integer Operation time (time).
RetMsg String message
RetNo Integer code
SessionId String Session ID
SqlType String Operation type.
TableName String Table name
AssetName String Data asset name
HitRules Array of HitRules Rule set.
SourceType String Traffic source
ReqId String Single audit log ID.
SqlMainType String Main SQL types: DML, DDL, DCL, and TCL.
TableNames Array of String Table name collection.
FieldNames Array of String Field name collection
FieldName String Field name
DbType String Database type
ClientDriverName String Client tool.
Location Location Location information
FieldDetails Array of TableField Field information (contains sensitive information).
AppId Integer app id of the account that owns the asset
NickName String Account nickname
Uin String Account uin of the asset owner

AutoTagRuleItem

Cloud boundary analysis automatic tagging item

Used by actions: DescribeExposureAutoTagRules.

Name Type Description
RuleID Integer

Rule ID.
RuleName String

rule name
Tag String

Tag.
Description String

Description.
Enable Boolean

Switch status
AssetTypes Array of String

Asset type
Ports Array of String

Port
OpenStatuses Array of String

Open status
Priority Integer

Rule priority
CreateTime String

Creation time.
UpdateTime String

Update time.

BackupLog

Log backup

Used by actions: DescribeDspmBackupLogList.

Name Type Required Description
Id Integer Yes Index.
IndexStartTime Integer Yes Index start time.
IndexEndTime Integer Yes Index end time.
BackupSize Integer Yes Compressed size after backup, in MB.
Status Integer Yes Log status. 0: backup incomplete; 1: backup file; 2: restoration in progress; 3: restored; 4: deleted.
RestoreProcessRemindTime Integer No Remaining restore time in minutes. Minutes must be converted by the frontend.
RestoreRemindTime Integer No Time until which restored logs are retained.
RestoreIndexSize Integer No Restoration index size.
RestoreEndTime Integer No End time of the recovery log execution.
AppId Integer No appId to which the backup belongs
AssetId Integer No Asset ID to which the backup belongs
NickName String No Account nickname
Uin String No uin of the account to which the asset belongs

BaselineAggregatedCategory

Aggregation results of the baseline subcategory dimension, carrying the pass/fail statistics of detection items under this subcategory.

Used by actions: DescribeBaselineAggregatedPolicyList.

Name Type Description
Category BaselineCategory

Basic information of the baseline subcategory (including category ID, name, and description).
NotPassItemRiskLevelStatistic Array of BaselineRiskLevelStatistic

Distribution statistics of detection-failed items in this subcategory by risk level.
PassItemCount Integer

Number of detection items with a PASS result in this subcategory.
NotPassItemCount Integer

Number of detection items with NOT_PASS result in this subcategory.
PassRate Float

Pass rate of detection items under this subcategory, unit: percentage (0-100), rounded to two decimal places.
Scanned Boolean

Whether the baseline category has been scanned

BaselineAggregatedItem

Aggregation results of the detection item dimension, carrying the pass/fail statistics of this detection item on assets.

Used by actions: DescribeBaselineAggregatedItemList.

Name Type Description
Item BaselineItem

Basic detection item information (including ID, name, risk level, category, etc.).
PassAssetCount Integer

Number of assets with a PASS result in the last scan for this detection item.
NotPassAssetCount Integer

Number of assets with result NOT_PASS in the last scan of this detection item.
TotalAssetCount Integer

Number of assets with the last scan result of PASS, NOT_PASS, and CHECKING for this detection item.
PassRate Float

Pass rate of assets in the last scan of this detection item, unit: percentage (0–100).
LatestCheckTime Timestamp ISO8601

The last time the scan for this detection item was completed.
ResultStatus String

Status of the last scan result. Parameter Value:

  • CHECKING: in-progress detection
  • PASS: passed
  • NOT_PASS: failed
  • CHECK_FAILED: detection failed
  • NOT_INVOLVED: not involved
Appid Array of Integer

Tenant Appid list involved in the aggregation result.
JobID Array of String

List of scan JobIDs involved in this aggregation result.

BaselineAggregatedPolicy

Baseline policy aggregation results, for summary display of the current scan pass/fail status by policy dimension.

Used by actions: DescribeBaselineAggregatedPolicyList.

Name Type Description
ParentCategoryID Integer

Parent category ID of the system policy (only for aggregation when PolicyType=SYSTEM; 0 for custom policy).
PolicyID Array of Integer

List of baseline policy IDs involved in this aggregation.
Name String

Policy Name (custom policy is user input, and system policy is a built-in classification name).
Description String

Policy description.
ConfItemCount Integer

Number of detection items configured in the policy.
PassItemCount Integer

Number of detection items with a result of PASS under this policy.
NotPassItemCount Integer

Number of detection items with result NOT_PASS under this policy.
NotPassItemRiskLevelStatistic Array of BaselineRiskLevelStatistic

Distribution statistics of detection failed items by risk level (LOW/MEDIUM/HIGH/CRITICAL).
PassRate Float

Passing rate of the last scan of this policy, unit: percentage (0-100), rounded to two decimal places.
CategoryStatistic Array of BaselineAggregatedCategory

Scanning result statistics details of each subcategory under this policy.
PolicyType String

Baseline policy type. Values:

  • SYSTEM: system policy (CSIP built-in)
  • SELF: user-defined policy
CheckAssetType String

Detect asset major category, case-sensitive host baseline and container cluster baseline. Parameter values:

  • HOST: Host
  • CLUSTER: Container cluster
Scanned Boolean

Whether the baseline category has been scanned

BaselineCategory

Baseline classification basic information, covering both parent and subcategory layers.

Used by actions: DescribeBaselineAggregatedPolicyList, DescribeBaselineCategoryItemList, DescribeBaselineMainTaskItemList, DescribeBaselinePolicyCategoryList, DescribeBaselinePolicyItemList, DescribeBaselineSystemCategoryList.

Name Type Description
ID Integer

Baseline classification ID.
Name String

Baseline classification name (Chinese).
Description String

Baseline category description (Chinese).
CheckAssetType String

Detect the asset major category and distinguish between host baseline and container cluster baseline. Parameter Value:

  • HOST: Host
  • CLUSTER: Container cluster

BaselineClusterAsset

Baseline cluster asset.

Used by actions: DescribeBaselineFixRecordList, DescribeBaselineItemRiskList, DescribeBaselineSubTaskList.

Name Type Description
ClusterID String

Cluster ID.
ClusterName String

Cluster name.
ClusterType String

Cluster type.
NodeCount Integer

Total nodes in the cluster.
OnlineNodeCount Integer

Number of online nodes in the cluster.
Appid Integer

Appid of the tenant associated with the cluster.
AssetName String

Cluster sub-asset name (Pod name/Node name/Container name/Namespace name; cluster name for CLUSTER type).

BaselineCustomItemConf

Configuration item for overriding the built-in detection item with a custom value in a policy.

Used by actions: BatchModifyBaselinePolicy, DescribeBaselinePolicyList, ModifyBaselinePolicy.

Name Type Required Description
RuleID Integer Yes

Built-in detection item rule ID. Either this or CustomItemID needs to be imported.
CustomValueList Array of String Yes

User-defined judgment value list, which must comply with the value constraints defined by the detection item WebEditParam.
CustomItemID Integer Yes

Existing custom configuration ID. It can be omitted when projects are added and is filled in when editing.

BaselineFixRecord

Baseline risk repair history

Used by actions: DescribeBaselineFixRecordList.

Name Type Description
ID Integer

Primary key ID of the correction record.
AppID Integer

Tenant AppID.
ItemInfo BaselineItem

Basic information of the repaired detection item.
HostInfo BaselineHostAsset

Host asset information involved in this fix. null when no data is available.
ClusterInfo BaselineClusterAsset

Cluster asset information. The value is null if no data is available.
AssetType String

Asset type: HOST (host), CLUSTER (container cluster).
FixTime Timestamp ISO8601

Repair completion time.
DiscoveryTime Timestamp ISO8601

The time when the risk was first detected.

BaselineHostAsset

Baseline host asset, which hosts the host details associated with subtasks and risk records.

Used by actions: DescribeBaselineFixRecordList, DescribeBaselineItemRiskList, DescribeBaselineSubTaskList.

Name Type Description
InstanceID String

Cloud host instance ID, e.g. ins-instanceid.
QUUID String

Host unique identifier QUUID.
UUID String

UUID submitted by the Host Agent.
PublicIP String

Public IP address of the host.
PrivateIP String

Private IP of the host.
AgentStatus String

CWP Agent status. Valid values:

  • ONLINE: ONLINE
  • OFFLINE: OFFLINE
  • UNINSTALLED: not installed
InstanceStatus String

Cloud virtual machine instance running status. Parameter values:

  • RUNNING: running
  • STOPPED: stopped
  • UNKNOWN: unknown
Name String

Host name.
Appid Integer

Appid of the tenant associated with the host.
TagItem Array of MiniTagItem

CSIP internal asset tag list.
CloudTag Array of Tag

Cloud natively asset Tag list.
RegionInfo RegionInfo

Region information of the host.
OsInfo String

Host operating system information (including distro and version number).
ProtectVersion String

Host protection version. Value: NONE (no protection), BASIC (basic version), PRO (pro edition), ULTIMATE (flagship edition), PRO_LH (lite edition).

BaselineItem

Baseline detection item.

Used by actions: DescribeBaselineAggregatedItemList, DescribeBaselineCategoryItemList, DescribeBaselineFixRecordList, DescribeBaselineMainTaskItemList, DescribeBaselinePolicyItemList.

Name Type Description
ID Integer

Baseline detection item ID.
RuleID Integer

Built-in rule ID.
CheckObject Array of String

Detection object description, such as configuration file path, kernel parameter, and Kubernetes Resources.
RiskLevel String

Risk level. Value:

  • LOW: Low risk
  • MEDIUM: Medium risk
  • HIGH: High risk
  • CRITICAL: Critical
Name String

Detection item name (Chinese).
Description String

Detection item description (Chinese, explaining the detection background and determination logic).
FixSuggestion String

Detection item repair advice (Chinese, including recommended configuration reference values or hardening commands).
ReferenceLink String

Reference link list of detection items.
SystemCategory BaselineCategory

Classification information of the parent category in the associated system.
Category BaselineCategory

Classification information of the subcategory it belongs to.
SupportFix Boolean

Whether one-click repair is supported. true: supported, false: unsupported.
SupportCustomValue Boolean

Whether user-defined judgment values are supported. true: supported; false: not supported.
AffectedVersionList Array of String

Operating system/component version list applicable to this detection item.
WebEditParam String

Parameter definition when editing a custom judgment value (for example, permissible range, control type).
DefaultValueList Array of String

Default detection item judgment value list.
IsCustomConf Boolean

Whether customized by the user. true: customized; false: use default values.
CustomItemID Integer

User-customized configuration record ID. The value is 0 if not customized.

BaselineItemRiskRecord

Risk result history of a detection item on an asset.

Used by actions: DescribeBaselineItemRiskList.

Name Type Description
ID Integer

Risk record primary key ID.
HostInfo BaselineHostAsset

Risk-hit host asset information. If no data is available, this field is null.
ClusterInfo BaselineClusterAsset

Cluster asset information. The value is null if no data is available.
AssetType String

Asset type of the hit asset. Value:

  • HOST: host
  • CLUSTER: cluster
  • POD: Pod
  • CONTAINER: container
  • IMAGE: mirror
ResultStatus String

Risk detection result status. Parameter values:

  • CHECKING: in-progress detection
  • PASS: passed
  • NOT_PASS: failed
  • CHECK_FAILED: detection failed
  • NOT_INVOLVED: not involved
  • IGNORED: ignored
LatestCheckTime Timestamp ISO8601

Latest check time.
ItemID Integer

Baseline detection item ID.
RiskID String

Risk event ID, used for uniquely identifying this risk record.
JobID String

Global JobID of this scan.

BaselineMainTask

Baseline scanning main task, corresponding to a "one-click scan/period scanning/disperse scan" action.

Used by actions: DescribeBaselineMainTaskList.

Name Type Description
JobID String

Global task ID corresponding to the main task.
ID Integer

Main task ID.
Status String

Main task status. Values:

  • INIT: initialization
  • SUBTASK_CREATING: creating subtasks
  • SCANNING: scanning
  • TIMEOUT: timeout
  • USER_CANCELED: canceled by the user
  • ALL_FAILED: all failed
  • SUCCESS: success
Appid Integer

Appid of the associated tenant of the main task.
TaskType String

Main task type. Value:

  • ONE_SHOT: one-click policy scan (manual triggering)
  • PERIODIC: period scanning (auto-trigger by CycleScanConf)
  • OTHER: other disperse scans (triggered by asset dimension, etc.)
StartTime Timestamp ISO8601

Main task start time.
FinishTime Timestamp ISO8601

End time of the main task. Empty if not ended.
CheckAssetType String

Detect asset major category, case-sensitive host baseline and container cluster baseline. Parameter values:

  • HOST: Host
  • CLUSTER: Container cluster
ErrCode String

Failure error code. Empty if the request is successful.
ErrMessage String

Failure reason, empty if successful.
Solution String

Solution (mapped according to ErrCode; empty on success)
ScanSuccessCount Integer

Number of assets scanned successfully.
ScanFailedCount Integer

Number of assets with scan failure.
ScanTotalCount Integer

Total number of subtasks

BaselineOverviewStatistic

Statistical metrics in the header of the baseline overview page.

Used by actions: DescribeBaselineOverview.

Name Type Required Description
NotPassItemCount Integer No

Current total count of failed check items (including hosts and container clusters).
NotPassItemStatistic Array of NotPassItemStatistic No

Statistics list of detection failed items by policy group.
LastYearFixCount Integer No

Total baseline risks fixed in the past one year.

BaselinePolicy

Baseline policy

Used by actions: DescribeBaselinePolicyList, ModifyBaselinePolicy.

Name Type Required Description
CycleScanConf CycleScanConf Yes

Periodic scan configuration (switch, interval type, scanning period, etc.).
CheckAssetType String Yes

Detect asset major category, case-sensitive host baseline and container cluster baseline. Parameter values:

  • HOST: Host
  • CLUSTER: Container cluster
AutoSyncItem Boolean Yes

Whether to automatically join this policy when new built-in detection items are added to the system. true: automatically join, false: do not join.
Type String Yes

Baseline policy type. Values:

  • SYSTEM: system policy (CSIP built-in)
  • SELF: user-defined policy
Name String Yes

Policy Name (custom policy is user input, and system policy is a built-in classification name).
Description String Yes

Policy description.
ConfHostType String Yes

Host effective scope. Value:

  • ALL: all hosts (can be used in conjunction with ConfHostExcludeList for removal)
  • TAG_MATCH: tag matching, in conjunction with ConfHostTagValue
  • PICK: takes effect only on hosts specified in ConfHostIncludeList
  • NONE: no configuration
ConfHostIncludeList Array of String Yes

Host InstanceID allowlist, used when ConfHostType=PICK / TAG_MATCH.
ConfHostExcludeList Array of String Yes

Host InstanceID removal list, used when ConfHostType=ALL.
Enable Boolean Yes

Policy activation status. 0 disabled, 1 enabled; once disabled, the policy will not participate in scans and statistics.
ConfClusterType String Yes

Cluster effective scope. Value:

  • ALL: all clusters (can be used in conjunction with ConfClusterExcludeList for removal)
  • PICK: takes effect only on the clusters specified by ConfClusterIncludeList
  • NONE: no configuration
ConfClusterIncludeList Array of String Yes

Cluster ID allowlist, used when ConfClusterType=PICK.
ConfClusterExcludeList Array of String Yes

Cluster ID removal list, used when ConfClusterType=ALL.
CategoryConf Array of BaselinePolicySystemCategoryConf Yes

Hit configuration of system classification / subcategory / detection item (only system policies take effect).
CustomItemConf Array of BaselineCustomItemConf Yes

Custom detection item parameter value configuration list (overwrites the judgment value based on the system check item).
Appid Integer Yes

Appid of the associated tenant of the policy.
ID Integer No

Baseline policy ID.
ConfItemCount Integer No

Number of detection items configured in the current policy.
ConfHostCount Integer No

Number of hosts hit by the current policy.
ConfClusterCount Integer No

Number of clusters hit by the current policy.
ScanningTaskID Integer No

ID of the scan main task currently in progress for the policy; 0 if not in a scan.
LatestScanTime Timestamp ISO8601 No

Last scan completion time (including manual/periodic).
LatestCycleScanTime Timestamp ISO8601 No

Last periodic scan completion time.
TagIDList Array of Integer No

Security Center tag ID list
CloudTagList Array of String No

Cloud tag list

BaselinePolicySubCategoryConf

Hit configuration of detection items under the sub-classification dimension.

Used by actions: BatchModifyBaselinePolicy, DescribeBaselinePolicyList, ModifyBaselinePolicy.

Name Type Required Description
CategoryID Integer Yes

Baseline subcategory ID.
AllSelect Boolean Yes

Whether to select all detection items under this subcategory. true: select all; false: take effect based on the ItemIDList details.
ItemIDList Array of Integer Yes

List of selected testing item IDs, which take effect by this detail when AllSelect=false.

BaselinePolicySystemCategoryConf

Hit configuration of detection items under the parent classification dimension in a system policy.

Used by actions: BatchModifyBaselinePolicy, DescribeBaselinePolicyList, ModifyBaselinePolicy.

Name Type Required Description
CategoryID Integer Yes

System parent category ID.
AllSelect Boolean Yes

Whether to select all subcategories under this parent category. true: select all; false: take effect based on SubCategoryConfList details.
SubCategoryConfList Array of BaselinePolicySubCategoryConf Yes

Sub-category configuration list. When AllSelect=false, this detail takes effect.

BaselineRiskLevelStatistic

Statistics of detection failures aggregated by risk level.

Used by actions: DescribeBaselineAggregatedPolicyList.

Name Type Description
RiskLevel String

Risk level. Parameter value: LOW, MEDIUM, HIGH, CRITICAL.
NotPassCount Integer

Number of detection items with a NOT_PASS result at this risk level.

BaselineSubCategory

Baseline system subcategory (including all its built-in detection item ID list).

Used by actions: DescribeBaselinePolicyCategoryList, DescribeBaselineSystemCategoryList.

Name Type Description
Category BaselineCategory

Basic information of the subcategory.

BaselineSubTask

Subtasks of a baseline scan are split by detection asset dimension (one host or cluster corresponds to one subtask).

Used by actions: DescribeBaselineSubTaskList.

Name Type Description
ID Integer

Subtask ID.
TaskID Integer

ID of the main task it belongs to (corresponds to BaselineMainTask.ID).
Status String

Execution result of the subtask. Value:

  • SUCCESS: successful
  • FAILED: failed
  • USER_CANCELED: canceled by the user
  • CHECKING: detecting
  • UNKNOWN: unknown status
Appid Integer

Appid of the tenant associated with the subtask.
StartTime Timestamp ISO8601

Subtask start execution time.
FinishTime Timestamp ISO8601

Subtask end time. If not ended, it is empty
CheckAssetType String

Detect asset major category, case-sensitive between host baseline and container cluster baseline. Parameter Value:

  • HOST: host
  • CLUSTER: container cluster
HostAsset BaselineHostAsset

Host asset information returned when CheckAssetType=HOST. Empty when CheckAssetType=CLUSTER.
ErrCode String

Status code: In case of failure, a failure code is returned (for example, AGENT_OFFLINE, SCAN_TIMEOUT, CLIENT_SCAN_FAILED). During detection, the detection status is returned. It is empty for success or user cancellation.
ErrMessage String

Detailed description of the reason for failure. Empty on success, canceled by the user, or during detection.
Solution String

Solution recommendation in case of failure. Empty for success, canceled by the user, or in-progress detection.
ClusterAsset BaselineClusterAsset

Cluster asset information returned when CheckAssetType=CLUSTER. Empty when CheckAssetType=HOST.

BaselineSyncConf

Baseline synchronization configuration for Group Administrator.

Used by actions: DescribeBaselineSyncConf, ModifyBaselineSyncConf.

Name Type Required Description
AutoSync Boolean Yes

Whether to automatically sync the baseline configuration to member accounts. true indicates enabled, false indicates disabled.
TargetAppidList Array of Integer Yes

List of Appids of target member accounts for automatic synchronization. This parameter is valid only when AutoSync=true.
UserConfList Array of UserConfSyncStatus No

User Configuration List

BaselineSystemCategory

Baseline system main category (including all its subcategories and detection item ID list).

Used by actions: DescribeBaselinePolicyCategoryList, DescribeBaselineSystemCategoryList.

Name Type Description
SubCategoryList Array of BaselineSubCategory

List of subcategories under the parent category (each subcategory includes its built-in detection item ID list).
Category BaselineCategory

System parent category basic information (ID, name, description, CheckAssetType).
ItemCount Integer

Detection item count

BaselineUserOtherConf

Other user-level baseline configuration (synchronize authorization, clear risks offline, Agent scan timeout, etc.).

Used by actions: DescribeBaselineUserOtherConf, ModifyBaselineUserOtherConf.

Name Type Required Description
AllowSync Boolean Yes

Whether to allow the Group Administrator to sync the baseline configuration to this account. true means allowed, and false means not allowed.
CleanRiskWhenOffline Boolean Yes

Whether to automatically clear the historical risk results of an asset when it goes offline. true: clear; false: retain.
AgentScanTimeout Integer Yes

Timeout period for a single scan by the Agent, in seconds. Value ranges from 60 to 86400. Default: 1800.

BehaviorInfo

User behavior - abnormal behavior detailed information

Used by actions: DescribeUebaBehaviorSummary.

Name Type Description
Date String Date
NodeInfo Array of NodeInfo Specific data for rendering a curve

BehaviorSummary

User behavior overview

Used by actions: DescribeUebaBehaviorSummary.

Name Type Description
BehaviorInfo Array of BehaviorInfo Specific user behavior data for rendering a line chart
AbnormalCount Integer Number of abnormal behaviors
IsAccess Boolean Whether to access

BruteAttackRule

Standard blocking mode rule

Used by actions: ModifyBruteAttackRules.

Name Type Required Description
TimeRange Integer Yes

Time range of the brute force cracking event (unit: second)
LoginFailTimes Integer Yes

Number of failed blasting incidents

BruteAttackRuleList

List of rules for determining brute force cracking

Used by actions: DescribeBruteAttackRules.

Name Type Description
TimeRange Integer

Time range of the brute force cracking event (unit: second)
LoginFailTimes Integer

Number of failed blasting incidents
Enable Boolean

Whether the rule is empty. If yes, fill in the default rule.
TimeRangeDefault Integer

Occurrence time range of brute force cracking events, in seconds (default rule)
LoginFailTimesDefault Integer

Number of failed blasting incidents (default rule)

BugInfoDetail

Vulnerability details

Used by actions: DescribeSearchBugInfo.

Name Type Description
Id Integer Vulnerability ID
PatchId String PocId Corresponding to Vulnerability
VULName String Vulnerability name
Level String Vulnerability Severity: High, Middle, Low, Info.
CVSSScore String CVSS Score
CVEId String CVE ID
Tag String Vulnerability tag
VULCategory Integer Vulnerability Type. 1: Web Application; 2: System Component Vulnerabilities; 3: Configuration Risk.
ImpactOs String Vulnerability Affected System
ImpactCOMPENT String Components affected by the vulnerability
ImpactVersion String Vulnerability affected version
Reference String Link
VULDescribe String Vulnerability description
Fix String Fixing suggestion
ProSupport Integer Product Support Status, returned in real time.
IsPublish Integer Published or Not. 0 for No, 1 for Yes.
ReleaseTime String Release time.
CreateTime String Creation time.
UpdateTime String Update time
SubCategory String Vulnerability Subcategory

CFGRiskStatisticsItem

Cloud resource configuration risk statistical information

Used by actions: DescribeCFGRiskStatistics.

Name Type Description
TotalRiskCount Integer

Total number of risks
RiskAddCount Integer

Number of newly-added risks in the past 7 days
CheckViewCount Integer

All cloud resource configuration risk items to be fixed
HighPriorityRiskCount Integer

High priority risk to be fixed
CheckViewAddCount Integer

Newly-added pending repair items in the last 7 days
HighPriorityCheckViewCount Integer

All cloud resource configuration risk items to be fixed, with high priority first
AssetViewCount Integer

Display quantity from the asset perspective
AssetViewAddCount Integer

Number of newly-added assets to be fixed in the last 7 days
HighPriorityAssetViewCount Integer

Display quantity from asset perspective, number of high-priority fixes

CFGViewCFGRisk

Configuration Risk Objects from Configuration's Perspective

Used by actions: DescribeRiskCenterCFGViewCFGRiskList.

Name Type Description
NoHandleCount Integer Affect assets
Level String Risk level. low: low risk. high: high risk. middle: medium risk. info: notification. extreme: critical.
RecentTime String Latest Recognition Time
FirstTime String First Recognition Time
AffectAssetCount Integer Status. 0-Unprocessed; 1-Disposed; 2-Ignored.
Id String Unique ID of Asset
From String Asset Subtype
Index String Front-end Index
AppId String User appid.
Nick String User Nickname
Uin String User UIN
CFGName String Configuration name
CheckType String Check type
CFGSTD String -
CFGDescribe String Description
CFGFix String Fixing suggestion
CFGHelpURL String Help documentation

CICDToken

CI/CD access token.

Used by actions: DescribeIaCTokenList.

Name Type Required Description
Id Integer No

ID
AppId Integer No

appid
Name String No

CI/CD name
Token String No

Token for integration
Period Integer No

Result storage duration of scan
FileCnt Integer No

Scanned file.
LastScanStatus String No

Latest scan status
LastScanTime String No

Last scan time.

CSIPMachineExtraInfo

Additional asset information of the host in the CSIP scan task

Used by actions: DescribeCSIPMalwareScanTaskDetail.

Name Type Required Description
WanIP String No

Public IP address
PrivateIP String No

Private IP address.
InstanceID String No

Instance ID (unique ID of CVM/BM/ECM)

CSIPMalwareScanUuidDetailItem

Specific details of a manual malicious file scan

Used by actions: DescribeCSIPMalwareScanTaskDetail.

Name Type Required Description
Uuid String No

UUID
Quuid String No

QUUID
MachineAppId Integer No

Machine APPID.
MachineName String No

Machine name
MachineIP String No

Machine IP
OsType String No

Type.
MachineExtraInfo CSIPMachineExtraInfo No

Additional host information (public IP address, private IP address, instance ID)
Status Integer No

Status.
RiskCount Integer No

Number of risks
UsedTimeS Integer No

Scanning time (seconds).
Exception Integer No

Exception code
ExceptionMessage String No

Exception information.
CreateTime String No

Creation time.
ModifyTime String No

Modification time.

CSIPTag

Security center tag

Used by actions: DescribeEdrAlertInfo, DescribeEdrAlertThreatTags.

Name Type Required Description
TagColor String No

Tag color
TagID Integer No

Tag ID
TagKey String No

Tag key (returned in Chinese or English according to the language environment)
TagValue String No

Tag value (returned in Chinese or English based on the language environment).

CVMAssetVO

Host Asset Information

Enumeration of host protection status. The left side is a constant, and the right side is the display.
0: not installed
1: In basic edition protection
2: In inclusive edition protection
3: Protection by pro edition
4: Flagship edition protection
5: offline
6: Shutdown

Used by actions: DescribeCVMAssets.

Name Type Required Description
AssetId String No Asset ID
AssetName String No Asset name
AssetType String No Asset type
Region String No Region.
CWPStatus Integer No Protection status
AssetCreateTime String No Asset creation time
PublicIp String No Public IP address
PrivateIp String No Private IP
VpcId String No vpc id
VpcName String No VPC Name
AppId Integer No App ID information
Uin String No User UIN
NickName String No Nickname.
AvailableArea String No Availability zone
IsCore Integer No Core or Not
SubnetId String No Subnet ID
SubnetName String No Subnet Name
InstanceUuid String No Host security Agent UUID
InstanceQUuid String No CVM UUID
OsName String No OS Name
PartitionCount Integer No Partition
CPUInfo String No CPU Information
CPUSize Integer No CPU Size
CPULoad String No CPU Load
MemorySize String No Memory size.
MemoryLoad String No Memory Load
DiskSize String No Hard disk size.
DiskLoad String No Hard Disk Load
AccountCount String No Number of Accounts
ProcessCount String No Number of Processes
AppCount String No Software application
PortCount Integer No Listening port
Attack Integer No Network attack
Access Integer No Network access
Intercept Integer No Network Interception
InBandwidth String No Inbound peak bandwidth
OutBandwidth String No Outbound peak bandwidth
InFlow String No Total inbound traffic
OutFlow String No Outbound cumulative traffic
LastScanTime String No Last scan time
NetWorkOut Integer No Malicious outgoing request
PortRisk Integer No Port risk
VulnerabilityRisk Integer No Vulnerability risk
ConfigurationRisk Integer No Configuration risk
ScanTask Integer No Scan Task Count
Tag Array of Tag No Tag.
MemberId String No memberId
Os String No Full OS Name
RiskExposure Integer No Risk service exposure
BASAgentStatus Integer No Simulated Attack Tool Status. 0 indicates not installed. 1 indicates installed. 2 indicates offline.
IsNewAsset Integer No 1-New Asset; 0-Not a New Asset
CVMAgentStatus Integer No 0: not installed; 1: installed; 2: installing
CVMStatus Integer No 1: Enable; 0: Not enabled
DefenseModel Integer No 1: Installed on the client 0: Not installed 2: Agentless
TatStatus Integer No 1: installed; 0: not installed
CpuTrend Array of Element No cpu trend chart
MemoryTrend Array of Element No Memory trend chart
AgentStatus Integer No 1: agent online 0: agent offline 2: Host offline
CloseDefenseCount Integer No Number of protection shutdowns this month
InstanceState String No Running status.
SecurityGroupIds Array of String No Security group data
AgentMemRss Integer No Physical memory usage in KB
AgentCpuPer Float No CPU utilization percentage
RealAppid Integer No appid that the cvm actually belongs to
CloudType Integer No Cloud asset type: 0: Tencent Cloud, 1: aws, 2: azure
ProtectStatus Integer No Host Protection Status Enumeration
0: not installed
1: In basic edition protection
2: In inclusive edition protection
3: Protection by pro edition
4: Flagship edition protection
5: offline
6: Shutdown
OfflineTime String No Last offline time

CWPOrderExtraParam

Additional parameters for orders.

Used by actions: DescribeCWPOrderList.

Name Type Description
Mode String PrePay: monthly subscription.
PostPay indicates pay-as-you-go mode.
One-time delivery
DisposableStatus Boolean One-time service delivery status. This value is available for one-time resource orders only.
false: Not accepted
true accepted

CWPOrderList

Order list object members.

Used by actions: DescribeCWPOrderList.

Name Type Description
ProductCode String

Associated product p_
SubProductCode String

Subproduct sp_
InquireKey String

Billing item Layer-4 sv_
InquireNum Integer

Resource purchase quantity
UsedNum Integer

Resource usage
TagList Array of Tags

Cloud tag
Status Integer

Order status: 1 normal, 2 isolated, 3 terminated
BeginTime String

Order start time
EndTime String

Order end time
ProjectID Integer

Project ID.
Alias String

Resource alias
ResourceId String

Resource ID
AutoRenewFlag Integer

Auto-renewal label 0: no automatic renewal by default (key accounts renew automatically). 1: auto-renewal. 2: manually set not to automatically renew (key accounts do not renew automatically).
SourceType Integer

Resource type.
PayMode Integer

Billing mode. 0: postpaid. 1: prepaid (annual/monthly subscription)
RegionID Integer

Region ID.
ZoneID Integer

AZ ID.
DealName String

Current sub-order number
ExtraParam CWPOrderExtraParam

Additional parameters for orders

CallRecord

Call log details

Used by actions: DescribeAbnormalCallRecord, DescribeCallRecord.

Name Type Description
CallID String Call record ID
AccessKey String Access key
AccessKeyRemark String Access key remark
AccessKeyID Integer Access Key ID
SourceIP String Source IP for calls
SourceIPRemark String Source IP remark of a call
Region String Region of the source IP
IPType Integer IP type. 0: within the account (no remark). 1: outside the account (no remark). 2: within the account (remarked). 3: outside the account (remarked)
EventName String Name of the called API
ProductName String API call product name
EventType Integer Invocation type
0: Console invocation
1:API
UserType String Type of user. Valid values: CAMUser, root, AssumedRole.
UserName String User/role name
PolicySet Array of String Policy List
CallCount Integer Call count
Code Integer Call error code
0: Successful
FirstCallTime String First call time
LastCallTime String Last call time
InstanceID String ID of the associated asset for the IP. If it is an empty string, the IP is not associated with any asset.
InstanceName String IP associated asset name
Date String Aggregation date
AppID Integer appid
ShowStatus Boolean Display status.
ISP String Internet service provider.
VpcInfo Array of SourceIPVpcInfo List of vpc information outside the account
ReqClient Array of String List of call request clients

CategoryItem

Point deduction and to-do information for sub-items.

Used by actions: DescribeSecurityScoreOverview.

Name Type Description
CategoryId String

Sub-item ID
Enumeration values:
vulnerability: Vulnerability governance
cloud_config: Cloud product configuration governance
system_baseline: System baseline risk
intrusion_alert: Intrusion threat alarm
cloud_api_alert: Cloud API alarm
ai_agent_alert: AI Agent security alarm
object_storage_alert: Object storage exception alarm
database_alert: Database security alarm
protection_config: Recommended protection configuration not enabled
edition_coverage: Insufficient Pro/Ultimate edition coverage
product_expiry: Product expires within 7 days
CategoryName String

Sub-item name
CategoryDesc String

Subclass description
MaxDeductScore Integer

Sub-item deduction limit
DeductScore Integer

Actual point deduction for sub-items
RiskCount Integer

Total number of risks
SeverityItems Array of SeverityItem

Level details, sub-items of risk/threat type have values
DeductReason String

Reason for deduction description
ActionText String

Handling suggestion copywriting
ProtectionDetail ProtectionDetail

Protection configuration detail, returned only for protection configuration dimension sub-items

CategoryNode

Asset tree - Asset category node

Used by actions: DescribeAssetTree.

Name Type Description
Category String

Asset category name
DisplayOrder Integer

Display order
AssetTypes Array of AssetTypeNode

Subordinate asset type node

CheckConnectivityHostInfo

Host information for connectivity detection

Used by actions: DescribeCheckConnectivityHostList.

Name Type Required Description
HostId String No

Host ID.
HostIp String No

Host ip address
HostName String No

host name
DockerVersion String No

docker version
DockerFileSystemDriver String No

docker file system type
Status String No

Status.
IsContainerd Boolean No

Whether it is a container.
MachineType String No

Specific host types.
PublicIp String No

Public ip address
Uuid String No

Host UUID
InstanceId String No

Instance id
HostRegionId Integer No

id of the region where the host is located
HostRegion String No

Host region
Project ProjectInfo No

Cluster belonging project
Tags Array of Tags No

Cluster tag
ClusterId String No

Cluster ID.
ClusterName String No

Cluster name.

CheckViewRiskItem

Check item viewing angle risk

Used by actions: DescribeCheckViewRisks, DescribeComplianceRiskList.

Name Type Description
RiskRuleId String

check item rule ID
RiskTitle String

Risk name
CheckType String

Check type
Severity String

Risk level.
RiskDesc String

There is 1 risk item
CreateTime String

First discovery time
UpdateTime String

Risk update time
Provider String

Cloud service provider.
RiskStatus Integer

Risk status
AssetCount Integer

Number of affected assets
RiskCount Integer

Number of risks
AssetType String

Asset type
EventType String

Event type
Classify String

Handling category
StandardTerms Array of StandardTerm

cspm specification clause
AssetTypeIconURL String

Asset type icon

CkafkaInstance

Tenant CKafka information.

Used by actions: DescribeDspmUserCkafkaInstanceList.

Name Type Description
InstanceId String Instance ID.
InstanceName String Instance name.
RegionId String Instance region

ClbListenerItem

CLB listener

Used by actions: DescribeClbListenerList.

Name Type Description
ListenerID String

Listener ID.
ListenerName String

Listener name
Protocol String

Protocol
Port Integer

Port
CreateTime String

Creation time.

ClbListenerListInfo

CLB Instance and Listener Information

Used by actions: DescribeListenerList.

Name Type Description
ListenerId String Listener ID
ListenerName String Listener name
LoadBalancerId String CLB Id
LoadBalancerName String CLB name
Protocol String Protocol
Region String Region.
Vip String Load balancing ip
VPort Integer Port.
Zone String Region.
NumericalVpcId Integer VPC id
LoadBalancerType String CLB Type
Domain String Listener Domain Name
LoadBalancerDomain String CLB domain name

ClbListenerRuleItem

CLB Layer 7 forwarding rule

Used by actions: DescribeClbListenerRules.

Name Type Description
ListenerID String

Listener ID.
LocationID String

Rule ID.
Domain String

Domain name.
Url String

URL
CreateTime String

Creation time.

ClbTargetItem

CLB backend service

Used by actions: DescribeClbTargets.

Name Type Description
InstanceID String

Instance ID.
InstanceName String

Instance name.
PrivateIpAddresses String

Private IP address.
EniID String

ENI ID.
Port Integer

Port

ClientSettingHost

Host structure for client-side settings.

Used by actions: DescribeLoginTypeHost, DescribeNFSScanHost, DescribePreventUninstallHost, DescribeProcessDaemonHost.

Name Type Description
Id Integer

Database record ID corresponding to the host.
Name String

Host name.
InstanceId String

Instance ID.
PublicIp String

Public IP address
PrivateIp String

Private IP address.
Quuid String

Host Quuid
Status String

Host status
OFFLINE: offline
ONLINE: online
SHUTDOWN: is shut down
UNINSTALLED: no protection
VpcId String

ins-sad143
RegionInfo RegionInfo

Region information.
MachineExtraInfo MachineExtraInfo

Additional information.
FunctionStatus Integer

0: Disabled
1: Enabled
2: Enabling
3: Disabling
9: Not set
Message String

The following fixed values require special handling on the frontend, while other failure reasons can be shown directly:

  1. UNINSTALLED -- not installed
  2. NEED_UPGRADE -- Upgrade required
  3. NOT_RUNNING -- is shut down
  4. NO_PASSWORD -- Password login is not enabled, so QR code login cannot be enabled
MessageDesc String

Failure reason
InstanceStatus String

Instance status
RUNNING: Running
STOPED: Shut down
EXPIRED: To be recycled

CloudAssetInfo

Number of assets by cloud service provider

Used by actions: DescribeMultiCloudAssetCount.

Name Type Description
CloudType String Cloud vendor type
Enumeration values:
tencent: tencent Cloud
aliyun: Alibaba Cloud
aws:AWS
huawei: Huawei Cloud
azure:Azure
Count Integer Number of assets of the cloud service provider
Valid values: [0, +∞)

CloudCountDesc

Multi-Cloud Account Statistics

Used by actions: DescribeOrganizationInfo.

Name Type Description
CloudType Integer 0 indicates Tencent Cloud
1 indicates AWS
CloudCount Integer Account Quantity
CloudDesc String Description of The Cloud Account Type

CloudFromCnt

Number of hosts of the CVM instance type.

Used by actions: DescribeMachineGeneral.

Name Type Description
CloudFrom Integer

Server type
MachineCnt Integer

Number of machines

CloudFunctionItem

Cloud function

Used by actions: DescribeCloudFunctionList.

Name Type Description
InstanceName String Cloud function name
InstanceStatus String Function status
FunctionType String Cloud function type
InstanceTag String Resource tag
Namespace String Namespace
Region String Region.
Domain String Custom domain name
InstanceID String Instance ID.
InstanceType String Instance type
AppID Integer Tenant ID
InstanceStatusDisplay String Displayed content of function status
CoreAssetFlag String Core asset tag
PublicURL String Public network access URL
PrivateURL String VPC access URL
AccountInfo String Account

ClusterContainerListItem

Cluster container list item

Used by actions: DescribeClusterContainerList, DescribeClusterPodList, DescribePodContainerList.

Name Type Description
AppID Integer

appid
ContainerId String

Container id
ContainerName String

Container name
RunStatus String

Running state
NodeId String

Node ID.
NodeType String

Node type
PodUid String

Unique pod id
PodName String

Pod name.
ImageId String

Image ID.
ImageName String

Image name.
IsolateStatus String

Isolation status
CreateTime String

Creation time.
AlarmCount Integer

Number of associated alarms

ClusterCustomParameters

Cluster Custom Parameters

Used by actions: DescribeClusterInstallCommand.

Name Type Required Description
Name String No Placeholder name
Input parameter limit: length 1-256
Applicable branch: Tencent Cloud branch (IsCloud=true)
Values Array of String No One or more values (multiple values are concatenated with commas to replace the placeholder)
Input parameter limit: each element length 1-256
Applicable branch: Tencent Cloud branch (IsCloud=true)
ExactMatch Boolean No Whether to match exactly.
Default value: false.

ClusterIDWithAppIdItem

Cluster location information

Used by actions: DescribeMalwareTimingScanSetting, ModifyEDRRule, ModifyMalwareTimingScanSettings, ModifyNetAttackSetting, ModifyReverseShellSystemPolicyConfig.

Name Type Required Description
ClusterID String Yes Cluster ID
AppId Integer Yes AppId of the cluster

ClusterListItem

Cluster list item

Used by actions: DescribeClusterAssetList, DescribeClusterDetail.

Name Type Description
AppID Integer

appid
ClusterId String

Cluster ID.
ClusterName String

Cluster name.
ClusterType String

Cluster type
MANAGED_CLUSTER: managed cluster
NodeCount Integer

Total nodes
OfflineNodeCount Integer

Total number of offline nodes
UninstallNodeCount Integer

Total number of nodes not installed
TotalCoresCount Integer

Total cores.
AuditLogSwitchStatus Integer

Audit log switch
(0: off; 1: on; 2: activation fail; 3: failed to close)
DefendStatus String

Protection status
Defended: Defended
RunStatus String

Cluster status
Region String

Region.
Version String

K8s version.
LastAssetSyncTime Timestamp ISO8601

Most recent asset synchronization time
LastRiskCheckTime Timestamp ISO8601

Last risk check time
RiskStatus String

Risk status
Tags Array of AssetTag

Tag list.
OwnerName String

Owner name
FailMessage String

Failure reason
RunSubStatus String

Operating sub-status
AccessedStatus String

Cluster access status

Enumeration values:

  • AccessedNone: not connected
  • AccessedInstalling: connecting
  • AccessedInstalled: connected - unprotected
  • AccessedUninstalling: uninstalling
  • AccessedUninstallException: uninstallation exception
  • AccessedDefended: connected - defended
  • AccessedPartialDefence: connected - partially defended
  • AccessedException: access exception
AccessedSubStatus String

Integration sub-status
ClusterCaMD5 String

Cluster ca certificate md5 value, unique cluster id
AssetSyncStatus String

Asset synchronization status

Enumeration values:

  • AssetCheckNone: initial state
  • AssetCheckSync: synchronizing
  • AssetCheckFinished: synchronization complete
  • AssetCheckFailed: synchronization failed
RegionName String

Region Chinese Name
RegionNameEn String

Region English name
UnboundUltimateNodeCount Integer

Number of nodes not bound to the Ultimate Edition

ClusterNamespaceListItem

Cluster Namespace item

Used by actions: DescribeClusterNamespaceList.

Name Type Description
AppID Integer

appid
Name String

Name.
Label Array of AssetTag

Tag.
CreateTime Timestamp ISO8601

Creation time.
UniqueID String

Namespace unique ID

ClusterNodeListItem

Cluster node list item

Used by actions: DescribeClusterNodeList.

Name Type Description
AppID Integer

appid
NodeId String

Node ID.
NodeName String

Node name.
PublicIP String

Public ip address
InternalIP String

Private ip
NodeType String

Node type
CoresCount Integer

Number of cores.
Tags Array of String

Tag.
RunStatus String

Running state
IsNew Boolean

Whether it is a new asset
UniqueID String

Unique ID of the node
ClientStatus String

Client status

Enumeration values:

  • ONLINE: online
  • OFFLINE: offline
  • UNINSTALL: not installed
InstanceId String

Node instance ID

ClusterPodListItem

Cluster pod list item

Used by actions: DescribeClusterPodList.

Name Type Description
AppID Integer

appid
PodUid String

Unique pod id
PodName String

Pod name.
PodIPs Array of String

Pod IP array
RunStatus String

pod status
NodeId String

Node ID.
NodeType String

Node type
WorkloadName String

Load Name
WorkloadType String

Workload type
Namespace String

Namespace.
CreateTime Timestamp ISO8601

Creation time.
UniqueID String

Unique Pod identifier ID
ContainerList Array of ClusterContainerListItem

Associated container list
AlarmCount Integer

Number of associated alarms
CoresCount Integer

Number of cores.

Unit: millicore.

ClusterServiceListItem

Cluster service list items

Used by actions: DescribeClusterServiceList.

Name Type Description
AppID Integer

appid
Name String

Name.
SelectorLabel Array of AssetTag

selector tag.
Namespace String

Namespace.
CreateTime Timestamp ISO8601

Creation time.
ServiceUniqueID String

Unique service ID
ServiceType String

service type
ClusterIP String

Cluster IP
ExternalIP Array of String

Public network IP.
Ports Array of String

Port

ClusterWithAppIdItem

Cluster location information

Used by actions: CreateEDRManualScan.

Name Type Required Description
ClusterID String Yes Cluster ID
AppId Integer Yes AppId of the tenant associated with the cluster.

CommandPluginState

AI Agent command sandbox plug-in status

Used by actions: DescribeAIAgentAssetList.

Name Type Description
InstallStatus String

Plug-in installation status (upper-layer aggregation)
Enumeration values:
NONE: not installed
INSTALLING: installing
INSTALLED: installed
INSTALL_FAIL: installation failure

CommandSandboxFileRule

Command sandbox file access rule basic information

Used by actions: DescribeSandboxFileRuleList.

Name Type Description
RuleID Integer

Rule ID.
RuleType String

Rule source type

Enumeration values:

  • SYSTEM: system preset rule
  • CUSTOM: custom rule
UpdateTime Timestamp ISO8601

Rule update time
RuleContent CommandSandboxFileRuleBase

Rule content

CommandSandboxFileRuleBase

Command sandbox file access rule basic information

Used by actions: CreateSandboxFileRule, DescribeSandboxFileRuleList, ModifySandboxFileRule.

Name Type Required Description
RuleName String No

rule name
BelongAssetType String No

Rule asset scope type

Enumeration values:

  • HOST: Host
  • CONTAINER: Container
EffectScope TrafficSandboxEffectScope No

Rule effective scope
Action String No

Rule behavior type

Enumeration values:

  • RO: read-only
  • RW: read-write
PathWhitelist Array of String No

Allowlist path
Status String No

Rule status

Enumeration values:

  • ON: Enablement
  • OFF: Disablement

ComplianceChapterItem

Cloud resource configuration detection chapter items

Used by actions: DescribeComplianceStandardTermTree.

Name Type Description
MenuID String

Menu ID
Name String

Clause category name
Terms Array of ComplianceTermItem

Clause corresponding chapter

ComplianceCheckItemsOverview

Statistics of all check items for cloud resource configuration detection

Used by actions: DescribeComplianceOverview.

Name Type Description
TotalCount Integer

Number of check items
PassRate Integer

Check item pass rate
CheckTypes Array of ComplianceCheckTypeItem

Check type and check item distribution

ComplianceCheckTypeItem

Cloud resource configuration detection check type statistics

Used by actions: DescribeComplianceOverview.

Name Type Description
CheckType String

Check type
Count Integer

Number of associated check items

ComplianceStandardOverview

Cloud resource configuration detection compliance standard overview

Used by actions: DescribeComplianceOverview.

Name Type Description
ID Integer

Standard ID
Name String

Specification name
TotalCount Integer

Number of associated check items
PassRate Integer

Check item pass rate

ComplianceStandardRuleCount

Cloud resource configuration detection standard associated check items

Used by actions: DescribeComplianceStatistics.

Name Type Description
ID Integer

Standard ID
Name String

Specification name
Count Integer

Number of associated check items

ComplianceTermItem

Cloud resource configuration detection clause fund

Used by actions: DescribeComplianceStandardTermTree.

Name Type Description
TermID Integer

Clause ID
Description String

Clause description.
Name String

Term name
RuleCount Integer

Number of association rules
Rationale String

Clause principle
Sn String

No.

ComponentDetailItem

Associated component & path description

Used by actions: DescribeVulFixedHostDetail.

Name Type Description
Name String Component name
Version String cache hit version
Path String Association path
FixCommand String Fix Command

ConditionMatch

Advanced mirror conditional matching (one and only one of the three match strings is non-empty)

Used by actions: DescribeEDRRuleList, ModifyEDRRule.

Name Type Required Description
ImageIDMatchString String No

Image ID match string (select one of the three, one and only one can be non-empty)
ImageNameMatchString String No

Image name match string (choose one of three, one and only one is non-empty)
ImageAddressMatchString String No

Image address match string (Select one of the three. One and only one is non-empty)
MatchType String No

Match condition. Value: EQUALS-equal to/NOT_EQUALS-not equal to/STARTS_WITH-starting with/NOT_STARTS_WITH-not starting with/ENDS_WITH-ending with/NOT_ENDS_WITH-not ending with/CONTAINS-containing/NOT_CONTAINS-excluding

ConnectivityDetectConfig

Connectivity check configuration

Used by actions: AddImageRegistry, ModifyImageRegistry.

Name Type Required Description
Quuid String No

Host quuid
Uuid String No

Host UUID.

ContainerAppItem

Container application information.

Used by actions: DescribeClusterContainerAppList.

Name Type Required Description
MainType String No Application comprehensive type, for example, web, app, or db
Type String No Specific application types, such as nginx or redis
Version String No Application version number
RunAs String No Running username.
ExePath String No Executable file path
ConfigPath String No Configuration file path
ProcessCnt Integer No Number of associated processes

ContainerComponentItem

Container component information

Used by actions: DescribeClusterContainerComponentList.

Name Type Required Description
Name String No Component name
Version String No Component version number

ContainerEnvInfo

Container environment info

Used by actions: DescribeCWPMachineDetail.

Name Type Description
NodeType String

Node type
DockerVersion String

docker version
ContainerdVersion String

containerd version
FileSystemType String

File System Type

ContainerMountItem

Container mount information.

Used by actions: DescribeClusterContainerDetail.

Name Type Required Description
Type String No

Mount type
Source String No

Host path
Destination String No

Path within container
Mode String No

Mount mode
RW Boolean No

Whether it is readable and writable
Propagation String No

Spread method
Name String No

Mount name
Driver String No

Driver name

ContainerPortItem

Container Port Information

Used by actions: DescribeClusterContainerPortList.

Name Type Required Description
ProcessName String No Name of the listening process
ContainerPort Integer No Listening port in container
RunAs String No Process running user
ContainerPID Integer No Containerized process ID
HostInnerIP String No Host private IP address
HostPublicIP String No Public network IP address of the host machine.
PublicPort Integer No Host machine mapping port
ProtocolType String No Network protocol type.

ContainerProcessItem

Container process information.

Used by actions: DescribeClusterContainerProcessList.

Name Type Required Description
ProcessName String No Process name
PID Integer No Host process ID
ContainerPID Integer No Containerized process ID
ProcessPath String No Executable file path of the process
RunAs String No Process running user
StartTime Timestamp ISO8601 No Process startup time

ContainerWebServiceItem

Container Web service information.

Used by actions: DescribeClusterContainerWebServiceList.

Name Type Required Description
Type String No Web service type
Version String No Service version No.
RunAs String No Service startup user
ExePath String No Executable file path
ConfigPath String No Configuration file path

CreatedTaskItem

Task creation return item

Used by actions: CreateEDRManualScan.

Name Type Description
TaskId Integer

Task ID.
TaskType String

Task type: HOST-host scan/CONTAINER-container scan
AppId Integer

AppId of the account associated with the task

CredentialEffectScope

Scope of effective machines, used to specify which machines a credential takes effect on

Used by actions: DescribeKeySandboxCredential, DescribeKeySandboxCredentialList.

Name Type Required Description
Exclude Integer No Whether to exclude mode
Enumeration values:
0: Inclusion mode (only for the Real Server in Instances). At this point, Instances is required.
1: Exclusion mode (machines in Instances do not take effect, remaining machines take effect). At this point, Instances is selectable. An empty list means all machines take effect.
Instances Array of String No List of machine instance IDs. Required when Exclude is 0, means only these machines can access the credential. Optional when Exclude is 1, means these machines cannot access the credential (Empty list means all machines take effect)

CsipRiskCenterStatistics

Risk center risk overview statistics

Used by actions: DescribeCSIPRiskStatistics.

Name Type Description
PortTotal Integer Total Number of Port Risks
PortHighLevel Integer High Port Risk Count
WeakPasswordTotal Integer Total number of weak password risks
WeakPasswordHighLevel Integer High Weak Password Risk Count
WebsiteTotal Integer Website Risk Count
WebsiteHighLevel Integer Number of High Risks on Websites
LastScanTime String Time of the Latest Scan
VULTotal Integer Number of Vulnerability Risks
VULHighLevel Integer Number of High-Risk Vulnerability Risks
CFGTotal Integer Number of Configuration Item Risks
CFGHighLevel Integer Number of High-Risk Configuration Item Risks
ServerTotal Integer Mapping Service Risk Count
ServerHighLevel Integer High Mapping Service Risk Count
HostBaseLineRiskTotal Integer Number of host baseline risks
HostBaseLineRiskHighLevel Integer Number of high-risk risks in the host baseline
PodBaseLineRiskTotal Integer Number of baseline risks in the container
PodBaseLineRiskHighLevel Integer Number of high-risk risks in the container baseline

CustomAgentRunModePolicy

Custom Agent running policy

Used by actions: DescribeAgentRunMode, ModifyAgentRunMode, ModifyAgentRunPolicy.

Name Type Required Description
Memory Integer No

Run Memory
Cpu Integer No

Running cpu.
NetworkPps Integer No

Packet capture limit

CustomRiskRuleDetailItem

Configuration of the specified policy details

Used by actions: DescribeCustomRiskRuleDetail.

Name Type Description
Status String Rule status
AppID Integer Tenant ID.

CustomRiskRuleItem

Description of the custom policy

Used by actions: DescribeCustomRiskRules.

Name Type Description
RuleID String

Risk rule ID
Provider String

Tencent Cloud
RiskTitle String

Risk title
Classify String

Risk classification
Severity String

Risk level.
Status String

Risk rule opening status
RelatedUinCount Integer

Number of associated accounts
PolicyEnableCount Integer

Number of accounts with policy activation
AssetType String

Asset type
IsFree Integer

Whether the rule is free
CheckType String

Check type
StandardTerms Array of StandardTerm

Security clause specification
AssetTypeIconURL String

Asset type icon
EnableDefault Integer

Rule enabled by default

CustomTag

CSC tag

Used by actions: DescribeAssetDetail, DescribeCloudAssets, DescribePublicCloudAssets.

Name Type Description
TagID Integer

Tag ID
TagKey String

Tag key
TagValue String

Tag value.
TagColor String

Tag color

CycleScanConf

Period scanning configuration of the policy (interval type + interval value + scanning time window).

Used by actions: BatchModifyBaselinePolicy, DescribeBaselinePolicyList, ModifyBaselinePolicy.

Name Type Required Description
Enable Integer Yes

Period scanning switch. 0: off, 1: on.
IntervalType String Yes

Interval type for period scanning. Values:

  • DAY: Every several days. For IntervalValueList, take the number of interval days (for example, ["1"] means every day)
  • WEEK: Specified weekdays. For IntervalValueList, take 1–7 (Monday–Sunday)
  • MONTH: Specified date per month. For IntervalValueList, take 1–31
IntervalValueList Array of String Yes

Period value list. The meaning varies with IntervalType:

  • IntervalType=DAY: every how many days. For example, ["1"] means every day
  • IntervalType=WEEK: day of the week, with values from 1 to 7 (Monday to Sunday)
  • IntervalType=MONTH: day of the month, with values from 1 to 31
ScanStart String Yes

Scan period start time. Format: HH:mm. Example: 02:00.
ScanEnd String Yes

Scan period end time. Format: HH:mm. For example, 06:00.

DBAssetVO

DB Asset Output Fields

Used by actions: DescribeDbAssets, DescribeOtherCloudAssets.

Name Type Description
AssetId String Asset ID
AssetName String Asset name
AssetType String Asset type
VpcId String vpcid
VpcName String vpc tag
Region String Region.
Domain String Domain
AssetCreateTime String Asset creation time.
LastScanTime String Last scan time
ConfigurationRisk Integer Configuration risk
Attack Integer Network attack
Access Integer Network access
ScanTask Integer Scan Task
AppId Integer User appid.
Uin String User UIN
NickName String Nickname Alias
Port Integer Port.
Tag Array of Tag Tag.
PrivateIp String Private IP address
PublicIp String Public IP address
Status Integer Status.
IsCore Integer Core or Not
IsNewAsset Integer New Asset or Not. 1: New

DataSearchBug

Vulnerability and Asset Information

Used by actions: DescribeSearchBugInfo.

Name Type Description
StateCode String Return to Query Status
DataBug Array of BugInfoDetail Vulnerability details
DataAsset Array of AssetInfoDetail Vulnerability impact asset details
VSSScan Boolean True supports scanning. False does not support scanning.
CWPScan String 0-Not Supported; 1-Supported
CFWPatch String 1 indicates virtual patches supported, 0 or null indicates not supported.
WafPatch Integer 0-Not Supported; 1-Supported
CWPFix Integer 0-Not Supported; 1-Supported
DataSupport Array of ProductSupport Product support status
CveId String cveId

DbAssetInfo

DB Asset Details

Used by actions: DescribeDbAssetInfo.

Name Type Description
CFWStatus Integer Cloud Defense Status
AssetId String Asset ID
VpcName String VPC information
AssetType String Asset type
PublicIp String Public IP address
PrivateIp String VPC IP
Region String Region.
VpcId String VPC information
AssetName String Asset name
CFWProtectLevel Integer Cloud Defense Protection Edition
Tag Array of Tag Tag Information

DescribeDspmAuditFilterStrategy

Filter rule

Used by actions: DescribeDspmAuditFilterStrategy.

Name Type Required Description
AuditFilterStrategyId Integer No

Policy ID.
Name String No

Policy name.
Description String No

Policy description.
Rule String No

Rule content
IsEnabled Integer No

Whether to enable

Enumeration values:

  • 0: Disable
  • 1: Enable
Remark String No

Remarks.
CreateTime String No

Creation time

Parameter format: 2026-07-16T11:44:45+08
ModifyTime String No

Last update time

Parameter format: 2026-07-16T11:44:45+08
AppId Integer No

Cloud Account ID
Uin String No

User identity
NickName String No

Account nickname

DescribeExposureStatisticsItem

Pending risk information to be governed for cloud boundaries

Used by actions: DescribeExposeRiskStatistics.

Name Type Description
Title String Risk title
Severity String Risk level
RuleType String Risk type
RiskCount Integer Number of associated risks

DetectTypeCount

Number of policies corresponding to the EDR detection method.

Used by actions: DescribeEDRRuleList.

Name Type Description
DetectType Integer

Detection mode. 0: host detection. 1: network detection
Count Integer

Policy count

DimensionItem

Dimension deduction items

Used by actions: DescribeSecurityScoreOverview.

Name Type Description
DimensionId String Dimension ID
Enumeration value:
risk_governance: Risk Governance
threat_detection: threat detection
protection configuration
DimensionName String Dimension Name
MaxDeductScore Integer Dimension deduction limit
DeductScore Integer Actual dimension deduction
Categories Array of CategoryItem List of subitems

DimensionTrendData

Dimensional trend data

Used by actions: DescribeSecurityRiskTrend.

Name Type Description
DimensionId String Dimension ID
Enumeration values:
risk_governance: Risk Governance
threat_detection: threat detection
DataPoints Array of TrendDataPoint Daily data point

DiskPartitionInfo

Disk partition information

Used by actions: DescribeCWPMachineDetail.

Name Type Description
Name String

Partition name
Path String

Mount path
Percent Float

Usage percentage
Size Integer

Partition size (MB)
Type String

Partition type
Used Integer

Used (MB)

DomainAssetVO

Domain assets

Used by actions: DescribeDomainAssets.

Name Type Description
AssetId Array of String Asset ID
AssetName Array of String Asset name
AssetType Array of String Asset type
Region Array of String Region.
WAFStatus Integer WAF Status
AssetCreateTime String Asset creation time
AppId Integer Appid
Uin String Account ID
NickName String Account name
IsCore Integer Core or Not
IsCloud Integer Whether it is on-cloud asset.
Attack Integer Network attack
Access Integer Network access
Intercept Integer Network Interception
InBandwidth String Inbound peak bandwidth
OutBandwidth String Outbound peak bandwidth
InFlow String Cumulative Inbound Traffic
OutFlow String Cumulative Outbound Traffic
LastScanTime String Last scan time
PortRisk Integer Port risk
VulnerabilityRisk Integer Vulnerability risk
ConfigurationRisk Integer Configuration risk
ScanTask Integer Scan Task
SubDomain String Domain
SeverIp Array of String Resolve IP
BotCount Integer Number of Bot Attacks
WeakPassword Integer Weak password risk
WebContentRisk Integer Content risk
Tag Array of Tag tag
SourceType String Type of the associated instance
MemberId String memberId information
CCAttack Integer CC Attack
WebAttack Integer Web Attack
ServiceRisk Integer Number of Risk Service Exposures
IsNewAsset Integer New Asset or Not. 1: New
VerifyDomain String Random Layer-3 Domain of Assets to Be Recognized
VerifyTXTRecord String TXT Record Content of Pending Confirmation Assets
VerifyStatus Integer Authentication Status of Assets Pending Recognition. 0: Pending Authentication; 1: Authentication Succeeded; 2: Authentication in Progress; 3: TXT Authentication Failed; 4: Manual Authentication Failed.
BotAccessCount Integer Bot Access Count

DomainInfo

Reverse-check domain information

Used by actions: DescribeEdrAlertInfo, DescribeEdrAlertThreatTags.

Name Type Required Description
Domain String No

Domain name
AnalysisTime String No

Analysis time
Tags Array of String No

Tag.

DspmAccessRecord

Dspm access record

Used by actions: DescribeDspmAccessRecord.

Name Type Description
Asset DspmDbAsset Asset information
Accounts Array of DspmAssetAccount Account
SourceIpList Array of DspmIp Source ip information
RecordTime String Recording time
LoginSuccessCount Integer Number of successful logins
LoginFailedCount Integer Login failure count

DspmAccessRecordId

Dspm access management record Id

Used by actions: ModifyDspmAccessRecord.

Name Type Required Description
SourceIp String No Source IP
AssetId String No Asset list
Region String No Region of the asset
Account String No Asset account
Host String No Host address
RecordTime String No Recording time

DspmAccountCount

Dspm account statistics

Used by actions: DescribeDspmStatistics.

Name Type Description
UinAccountCount Integer Number of cloud accounts
PersonCount Integer Guest account count
UncontrolledAccountCount Integer Number of unmanaged accounts
TotalAccountCount Integer Total number of accounts

DspmAddIdentifyLevelItem

dspm data identification level info

Used by actions: CreateDspmIdentifyLevelGroup.

Name Type Required Description
LevelName String Yes

Level name
LevelScore Integer Yes

Level sensitivity

Unit: points

DspmApplyOrder

Application form information

Used by actions: DescribeDspmApplyHistory, DescribeDspmApplyOrderList, DescribeDspmApproveHistory.

Name Type Description
OrderId String Application ID
IdentifyId String Identity id.
ApplicantUin DspmUinUser Applicant account uin
AssetId String Asset ID
AssetName String Asset name
Region String Region of the asset
ApplyType Integer Application type. 0: associate an identity. 1: edit an identity. 2: create a temporary identity.
Privilege DspmDbAccountPrivilege Permission request.
ValidatePeriod Integer Access privilege expiration time calculated from when approval is complete. Temporary account validity. Milliseconds.
Reason String Application reason.
ApproverSteps Array of DspmApproverStep Approval procedure
ManagerType Integer Management type. 0: ordinary member; 1: administrator.
Person DspmPersonUser Personal user information
SubjectUser DspmUinUser Cloud account user information
Status Integer Approval status. 0: Pending approval; 1: Approved; 2: Rejected
CreateTime String Application creation time.

DspmApproverOrder

Approval order information

Used by actions: DescribeDspmApproveOrderList.

Name Type Description
OrderId String Corresponding Application id
IdentifyId String Identity id.
ApplicantUin DspmUinUser Applicant account uin
AssetId String Asset ID
AssetName String Asset name
ApplyType Integer Application type. 0: associate an identity. 1: edit an identity. 2: create a temporary identity.
Privilege DspmDbAccountPrivilege Permission request
ValidatePeriod Integer Access privilege expiration time calculated from when approval is complete. Temporary account validity. Milliseconds.
Reason String Reason for request
ManagerType Integer Management type. 0: ordinary member; 1: admin.
Person DspmPersonUser Personal user information
SubjectUser DspmUinUser Cloud account user information
CreateTime String Correspond to the application creation time.

DspmApproverStep

Approval procedure

Used by actions: DescribeDspmApplyHistory, DescribeDspmApplyOrderList, DescribeDspmApproveHistory.

Name Type Description
ApproverUinSet Array of DspmUinUser List of approvers
ApproverUin String Approver
Status Integer Approval status. 0: Pending approval; 1: Approved; 2: Rejected
Comment String Approval comments
ApproveTime String Approval time.

DspmArea

Dspm regional information

Used by actions: DescribeDspmAccessRecord.

Name Type Description
Country String national
Province String Province
City String City

DspmAssetAccessTopologyItem

Dspm asset access topology

Used by actions: DescribeDspmAssetAccessTopology.

Name Type Description
AssetId String Asset ID
AssetType String Asset type
AssetName String Asset name
AssetAccount String Asset account
Host String Host address
AccountType Integer Account type.
AssetIp String Asset address
SourceIp String Origin ip address
SourceIpType String Origin ip type
AccessFrequency DspmFrequency Access frequency (times/day)
ExecSQLFrequency DspmFrequency SQL execution frequency. Queries/hr.
AccessBeginTime String Access start time.
AccessEndTime String Access end time
AccountRisk Integer Number of account risks
AssetRisk Integer Number of asset risks
Region String Region
IdentifyType Integer Identity type. null for non-identity accounts. 0: Undefined; 2: Long-term identity; 3: Temporary identity
OwnerUin DspmUinUser uin of the user belonging to the cloud account.
Person DspmPersonUser User information to which it belongs.
AccountAlarm Integer Alarm count of the account
AssetAlarm Integer Number of asset alarms

DspmAssetAccount

Asset account information

Used by actions: DescribeDspmAccessRecord, DescribeDspmAssetAccounts.

Name Type Description
Account String Account name.
Host String Host address
AccountType Integer Account type. 0-Undefined 1-Service account 2-Personal account 3-Temporary account
Subject String Associated object. uin or personal id.
Privilege DspmDbAccountPrivilege Permission information
Status Integer Status. 0: inactive, 1: active, 2: deleted
CreateTime String Account creation time.
ValidateFrom String Access permission effective time.
ValidateTo String Access privilege expiration time.
Remark String Remarks
AssetId String Asset ID
IsNewAccount Integer Whether it is a new account
IdentifyType Integer Identity type. null for non-identity accounts. 0-Undefined 2-Long-term identity 3-Temporary identity
OwnerUin DspmUinUser The user that the cloud account uin belongs to.
Person DspmPersonUser Information about the personal user it belongs to.
RiskCount DspmRiskCount Risk statistical information
PresetPrivilege DspmDbAccountPrivilege Preset permission.

DspmAssetAccountIdentify

Asset account identity information

Used by actions: DescribeDspmAssetAccountIdentify.

Name Type Description
AssetId String Asset ID
OwnerUin DspmUinUser The user that the cloud account uin belongs to.
IsManager Integer Administrator or Not
Host String Host address
AccountType Integer Account type. 0-Undefined 1-Service account 2-Personal account 3-Temporary account
Privilege DspmDbAccountPrivilege Permission information
Status Integer Active status. 0: inactive, 1: active.
CreateTime String Account creation time.
ValidateFrom String Access permission effective time.
ValidateTo String Access privilege expiration time.
Remark String Remarks
PersonApplyCount Integer Number of visitor permission applications
AssetName String Asset name
AssetType String Asset type
Region String Region
RiskCount DspmRiskCount Risk statistical information
IdentifyType Integer Identity type. null for non-identity accounts. 0-Undefined 2-Long-term identity 3-Temporary identity
Person DspmPersonUser Information about the personal user it belongs to.
CreatorUin DspmUinUser The user that the creator account uin belongs to.
PresetPrivilege DspmDbAccountPrivilege Preset permission.
PrivateIp String Intranet access address. If there are multiple, separate them with ';'.
IdentifyId String Identity ID
AppId Integer app id of the account associated with the asset
NickName String Account nickname
Uin String Asset account uin

DspmAssetCount

Dspm asset statistics

Used by actions: DescribeDspmStatistics.

Name Type Description
AssetCount Integer Number of assets
DangerRiskCount Integer Number of assets with dangerous risks
LowRiskCount Integer Number of assets with low risk
RiskAssetCount Integer Number of instances with pending risks
AlarmAssetCount Integer Number of instances with pending alarms

DspmAssetDataScanDetail

dspm asset data identification details

Used by actions: DescribeDspmAssets.

Name Type Description
Status Integer

Recognition task status. 0: unrecognized; 1: in process; 2: terminated; 3: successful; 4: failed.
StatusInfo String

Identification task status. 0: unrecognized; 1: in process; 2: terminated; 3: successful; 4: failed.
Progress Float

Recognition progress
LatestScanTime String

Last scan time.
ErrorInfo String

Recognition failure message
DbCount Integer

Number of databases
CategoryIds Array of Integer

Category id set
CategoryNames Array of String

Category name collection.
TaskConfig DspmSensitiveScanTaskConfig

Scan task configuration
CategoryDetails Array of DspmIdentifyCategoryDetail

Categorization details of recognition results
TaskId Integer

Task ID.

DspmAssetDatabaseInfo

dspm asset database information

Used by actions: DescribeDspmAssetDatabaseList.

Name Type Description
AssetId String

Asset instance id
DbName String

Database name
TableCount Integer

Total number of tables
SensitiveTableCount Integer

Sensitive table count
RuleIds Array of Integer

Data item id collection
RuleNames Array of String

Data item name collection.
CategoryIds Array of Integer

Category id set
CategoryNames Array of String

Category name collection
CategoryDetails Array of DspmIdentifyCategoryDetail

Category details

DspmAssetFieldInfo

dspm asset field information

Used by actions: DescribeDspmAssetFieldList.

Name Type Description
AssetId String

Asset instance id
DbName String

Database name
SchemaName String

schema name.
TableName String

Table name
FieldName String

field name
RuleIds Array of Integer

Data item id collection
RuleNames Array of String

Data item name collection.
CategoryIds Array of Integer

Category id set
CategoryNames Array of String

Category name collection
CategoryDetails Array of DspmIdentifyCategoryDetail

Category details
FieldComment String

Field comment

DspmAssetIdentifyInfo

dspm Asset Data identification statistical information

Used by actions: DescribeDspmAssetIdentifyInfoList.

Name Type Description
AssetId String

Asset instance id
AssetName String

Asset name
AssetType String

Asset type

Enumeration values:

  • cdb: MySQL
  • mariadb: MariaDB
  • mongodb: MongoDB
DetectedDbCount Integer

Number of detected databases
DetectedTableCount Integer

Number of detected tables
RuleIds Array of Integer

Data item id set
RuleNames Array of String

Collection of data item names.
CategoryIds Array of Integer

Category id set
CategoryNames Array of String

Collection of category names
LevelId Integer

Highest level ID
LevelName String

Highest level name
LevelScore Integer

Sensitivity level
DetectedTime String

Detection time
CategoryDetails Array of DspmIdentifyCategoryDetail

Category details
AppId Integer

APPID
NickName String

Account name
Uin String

Account ID

DspmAssetIdentifyTaskStatus

Status of the dspm data identification task

Used by actions: ModifyDspmAssetDataScanTaskStatus.

Name Type Description
TaskId Integer

Task ID.
Status Integer

Task status.

Enumeration values:

  • 0: Unrecognized
  • 1: Recognizing
  • 2: Recognition terminated
  • 3: Recognition successful
  • 4: Recognition failed
  • 5: Suspended

DspmAssetInstance

Dspm asset instance

Used by actions: ModifyDspmAssetSecurityAnalysisSwitch.

Name Type Required Description
AssetId String Yes Asset instance ID.
AssetType String Yes Asset type
Region String Yes Region.
AppId Integer No app id of the asset owner account

DspmAssetSecurityAnalyseStatus

Dspm asset security analysis status

Used by actions: DescribeDspmAssetSecurityAnalyseStatus.

Name Type Description
AppId Integer app id of the asset owner account
AssetId String Asset instance ID.
AssetType String Asset type
Region String Region.
IdentifyScanSupported Integer Whether sensitive data identification is supported. 0: no support; 1: support
LogDeliverySupported Integer Whether log shipping is supported. 0: unsupported; 1: supported
SecurityAnalyseStatus Integer Security analysis status (0: Off, 1: On, 2: Activating, 3: Disabling)
LogDeliveryStatus Integer Log delivery status.
0: shipping disabled; 1: shipping enabled; 2: shipping activating; 3: shipping disabling
LogDeliveryDisableReason String The causes for the log audit being forbidden to enable. Available values: VersionNotSupportLogSubscription, InstanceIsUpgrading, CdbRuleAuditEnabled
TotalAuditLogs Integer Total number of logs for the current instance.
DataScanDetailRuleCount Integer Number of recognized sensitive data items
OperationErrorMsg String Operation error information

DspmAssetTableInfo

dspm asset table information

Used by actions: DescribeDspmAssetTableList.

Name Type Description
AssetId String

Asset instance id
DbName String

Database name
SchemaName String

schema name.
TableName String

Table name
FieldCount Integer

number of fields
SensitiveFieldCount Integer

Number of sensitive fields
RuleIds Array of Integer

Data item id set
RuleNames Array of String

Set of data item names
CategoryIds Array of Integer

Categorization id set
CategoryNames Array of String

Category name collection
CategoryDetails Array of DspmIdentifyCategoryDetail

Category details
TableId Integer

Data table id
TableComment String

Table annotation

DspmAssetTypeCount

Dspm asset statistics by type

Used by actions: DescribeDspmStatistics.

Name Type Description
AssetType String Asset type
OpenCount Integer Number of activations enabled for asset security analysis
OpeningCount Integer Number of activations being enabled for asset security analysis
ClosingCount Integer Number of assets whose security analysis is being disabled
CloseCount Integer Number of activations not enabled for asset security analysis

DspmAuditSessionInfo

Audit session list information.

Used by actions: DescribeDspmSessionList.

Name Type Description
SqlCount Integer

Audit log count.
LogoutTime Integer

Logout time.
ClientIp String

Client IP
ClientPort Integer

Client port
DbIp String

Database IP
DbName String

Database name
DbPort Integer

Database port
DbUser String

Database users.
InstanceId Integer

Audit unit ID
OpTime Integer

Operation time.
RetNo Integer

Status code
SessionId String

Session Id
LoginTime Integer

Login time.
InstanceName String

Data asset name.
AssetName String

Data asset name.
SourceType String

Traffic source.
SourceTypeEn String

Traffic source in English
AppId Integer

app id of the account associated with the asset
SourceTypeEnDisplayName String

Traffic source.
NickName String

Nickname
Uin String

uid
DbType String

Database type

Enumeration values:

  • MongoDB: mongodb
AssetType String

Asset type

Enumeration values:

  • cdb: mysql
  • mongodb: mongodb

DspmColumnPrivilege

List column permission information

Used by actions: CreateDspmApplyOrder, DescribeDspmAssetAccountPresetPrivileges, DescribeDspmAssetAccountRecycledPrivileges, ModifyDspmAssetAccountPrivileges.

Name Type Required Description
Database String No Database name
Table String No Table name
Column String No Database column name
Privileges Array of String No Permission information

DspmDatabasePrivilege

Database permission

Used by actions: CreateDspmApplyOrder, DescribeDspmAssetAccountPresetPrivileges, DescribeDspmAssetAccountRecycledPrivileges, ModifyDspmAssetAccountPrivileges.

Name Type Required Description
Privileges Array of String No Permission information
Database String No Database name

DspmDbAccountPrivilege

Database account permission information

Used by actions: CreateDspmApplyOrder, DescribeDspmApplyHistory, DescribeDspmApplyOrderList, DescribeDspmApproveHistory, DescribeDspmApproveOrderList, DescribeDspmAssetAccountIdentify, DescribeDspmAssetAccountPresetPrivileges, DescribeDspmAssetAccountRecycledPrivileges, DescribeDspmAssetAccounts, DescribeDspmPersonApplyHistory, ModifyDspmAssetAccountPrivileges.

Name Type Required Description
UseDefaultPrivilege Integer No Use the default permission. 0: inactive; 1: read-only permission, that is, SELECT permission; 2: all permissions, that is, all permissions at the global level.
GlobalPrivileges Array of String No Global permission array.
DatabasePrivilegesList Array of DspmDatabasePrivilege No Database permission array.
TablePrivileges Array of DspmTablePrivilege No Array of table permissions in the database.
ColumnPrivileges Array of DspmColumnPrivilege No Column permission array in the database table.

DspmDbAsset

Database assets

Used by actions: DescribeDspmAccessRecord, DescribeDspmAssets.

Name Type Description
AssetId String

Asset instance Id
AssetType String

Asset type
Name String

Asset name
AccountCount Integer

Account number
PublicIp String

Public network access address. If there are multiple, separate them with ';'.
PrivateIp String

Intranet access address. If there are multiple, separate them with ';'
WanDomain String

WAN domain address. If there are multiple, separate them with ';'
Region String

Region.
VpcId String

vpc ID of the vpc where the asset is located
VpcName String

Name of the vpc where the asset is located
SubnetId String

Subnet ID of the vpc subnet where the asset is located
SubnetName String

Subnet name of the vpc where the asset is located
Status Integer

Instance status
CreateTime String

Creation time.
Manager Array of DspmUinUser

Admin info.
BindIdentify Integer

Is the identity bound. 0: not bound; 1: bound
IsManager Integer

Admin or not
RiskCount DspmRiskCount

Risk statistics
SafetyAdvice String

Security recommendation.
Resolve immediate problem-solving
Reinforcement
None no abnormality detected
LogDeliveryStatus Integer

Log delivery status.
0 - Delivery off. 1 - Delivery on. 2 - Delivery activating. 3 - Delivery closing.
LogDeliverySupported Integer

Whether log shipping is supported. 0: no support; 1: support
DataScanInfo DspmAssetDataScanDetail

Data scanning info
AppId Integer

app id of the account to which the asset belongs
NickName String

Account nickname
Uin String

Account uin of asset ownership
SecurityAnalyseStatus Integer

Security analysis status (0-off, 1-on, 2-activating, 3-disabling)
TotalAuditLogs Integer

Total number of logs for the current instance.
LogDeliveryDisableReason String

Reasons why log audit is forbidden. Available values: VersionNotSupportLogSubscription, InstanceIsUpgrading, CdbRuleAuditEnabled, AssetNotExists
OldestOnlineLogTimestamp Integer

Start timestamp of online log, accurate to second
NewestOnlineLogTimestamp Integer

Latest timestamp of the online log, accurate to the second
OperationErrorMsg String

Operation error information
AccountOptSupported Integer

Whether account operations are supported. 0: not supported; 1: supported
InstanceType Integer

Instance type
ClusterType Integer

Cluster type (MongoDB), consistent with ClusterType in the cloud API DescribeDBInstances: 0-replica set, 1-sharding; fixed as 0 for non-MongoDB assets
IdentifyScanSupported Integer

Whether sensitive data identification is supported. 0: not supported; 1: supported
ClusterId String

Cluster ID.
ClusterName String

Cluster name.

DspmDbAssetId

Database asset Id information

Used by actions: DescribeDspmAssetIds.

Name Type Description
AssetId String Asset instance ID.
AssetType String Asset type
Name String Asset name
Id Integer Asset record id
AppId Integer app id of the account that owns the asset
NickName String Account nickname
Uin String Account uin of the asset owner

DspmDictionary

dspm dictionary information

Used by actions: DescribeDspmDictionaryList.

Name Type Description
DictId Integer Dictionary id
DictName String Dictionary name

DspmFrequency

Dspm frequency

Used by actions: DescribeDspmAssetAccessTopology.

Name Type Description
Count Integer Quantity.
Unit String Unit.

DspmIdentifyAssetStatistic

Dspm identity associated asset statistics

Used by actions: DescribeDspmIdentifyInfoList.

Name Type Description
ManagerCount Integer Number of asset administrators associated.
MemberCount Integer Number of ordinary members of associated assets.

DspmIdentifyCategoryDetail

dspm data identification result category details

Used by actions: DescribeDspmAssetDatabaseList, DescribeDspmAssetFieldList, DescribeDspmAssetIdentifyInfoList, DescribeDspmAssetTableList, DescribeDspmAssets.

Name Type Description
CategoryId Integer Category id
CategoryName String Category name
RuleSet Array of DspmIdentifyRuleDetail Data item collection

DspmIdentifyCategoryItem

dspm data identification classification list item

Used by actions: DescribeDspmIdentifyCategoryList.

Name Type Description
Id Integer

Category ID
Name String

Category name
Type Integer

Type

Enumeration values:

  • 0: Built-in
  • 1: Custom
UpdateTime String

Update time.
ComplianceRelations Array of DspmIdentifyRefComplianceInfo

Associated identification template information

DspmIdentifyCategoryRuleRelateDetailItem

Associated details of dspm data identification classification data items

Used by actions: DescribeDspmIdentifyComplianceCategoryRuleList.

Name Type Description
ComplianceId Integer

Identification template ID
CategoryId Integer

Category ID
RuleId Integer

Data item ID
RuleName String

Data item name.
LevelId Integer

Level ID
LevelName String

Level name

DspmIdentifyCategoryRuleRelateItem

dspm data identification category and data item association

Used by actions: CreateDspmIdentifyComplianceRuleRelation.

Name Type Required Description
RuleId Integer Yes

Data item ID
LevelId Integer Yes

Level ID

DspmIdentifyComplianceCategoryRelation

dspm data identification template classification association

Used by actions: DescribeDspmIdentifyComplianceGroupDetail.

Name Type Description
CategoryId Integer

Category ID
CategoryName String

Category name
CategoryParentId String

Parent category ID
IsLeaf Boolean

is leaf node
CategoryType Integer

Classification type

Enumeration values:

  • 0: Built-in
  • 1: Custom
CategoryGrade Integer

Classification levels

Unit: level
RuleRelations Array of DspmIdentifyComplianceRuleRelation

Associated data item information
Children Array of DspmIdentifyComplianceCategoryRelation

Sub-node information

DspmIdentifyComplianceItem

dspm classification and grading template information list

Used by actions: DescribeDspmIdentifyComplianceGroupList.

Name Type Description
Id Integer

Recognition template ID.
Name String

Recognition template name.
Description String

Description.
Status Integer

Enablement status

Enumeration values:

  • 0: Disabled
  • 1: Enabled
Type Integer

Template type

Enumeration values:

  • 0: Built-in
  • 1: Custom
UpdateTime String

Update time.
ApplyStatus Integer

Application status

Enumeration values:

  • 0: Not applied
  • 1: In application

DspmIdentifyComplianceRuleRelation

Association relationships of data items in the dspm data identification template

Used by actions: DescribeDspmIdentifyComplianceGroupDetail.

Name Type Description
RuleId Integer

Data item ID
RuleName String

Data item name.
LevelId Integer

Level ID
LevelName String

Level name
LevelScore Integer

Level

Unit: score
StructuredStatus Integer

Structured rule status

Enumeration values:

  • 0: Unconfigured
  • 1: Configured
UnStructuredStatus Integer

Unstructured rule status

Enumeration values:

  • 0: no configuration
  • 1: configured
Status Integer

Data item status

Enumeration values:

  • 0: Not enabled
  • 1: Enabled

DspmIdentifyCount

Dspm identity statistical information

Used by actions: DescribeDspmIdentifyInfo.

Name Type Description
IdentifyType Integer Identity type. 0: undefined; 2: long-term identity; 3: temporary identity
Count Integer Count.

DspmIdentifyIdItem

Dspm identity id information

Used by actions: DescribeDspmIdentifyIdList.

Name Type Description
IdentifyId String Identity id.
Remark String Remarks.
IdentifyType Integer Identity type. 0: undefined; 2: long-term identity; 3: temporary identity
OwnerUin DspmUinUser User belonging to the cloud account uin.
CreatorUin DspmUinUser Creator account uin user.
CreateTime String Creation time.
Status Integer Status. 0: inactive; 1: active
Person DspmPersonUser Information of the personal user it belongs to

DspmIdentifyInfoItem

Dspm identity information

Used by actions: DescribeDspmIdentifyInfoList.

Name Type Description
IdentifyId String Identity id.
Remark String Remarks.
IdentifyType Integer Identity type. 0: undefined; 2: long-term identity; 3: temporary identity
OwnerUin DspmUinUser User associated with the cloud account uin.
CreatorUin DspmUinUser Creator account uin user.
AssetCount Integer Associated assets.
CreateTime String Creation time.
Status Integer Status. 0: inactive; 1: active
Person DspmPersonUser User information to which it belongs
AssetStatistic DspmIdentifyAssetStatistic Associate statistical information of data assets.
RiskCount DspmRiskCount Risk statistics
SafetyAdvice String Security recommendation. Resolve immediate problem-solving Reinforcement None no abnormality detected
AppId Integer app id of the account to which the asset belongs
NickName String Account nickname
Uin String Account uin of the asset owner

DspmIdentifyLevelGroupItem

dspm data identification classification group list item

Used by actions: DescribeDspmIdentifyLevelGroupList.

Name Type Description
Id Integer

Level group id
Name String

Level group name
Description String

Level group description
Type Integer

Level group type

Enumeration values:

  • 0: Built-in
  • 1: Custom
LevelItems Array of DspmIdentifyLevelItem

Level information
UpdateTime String

Update time

Parameter format: YYYY-MM-DD hh:mm:ss
ComplianceRelations Array of DspmIdentifyRefComplianceInfo

Associated identification template information

DspmIdentifyLevelItem

dspm data identification level info

Used by actions: DescribeDspmIdentifyLevelGroupList, ModifyDspmIdentifyLevelGroup.

Name Type Required Description
LevelName String Yes

Level name
LevelScore Integer Yes

Risk level (ranging from low to high)

Value range: [1, 10]

Measurement unit: level
LevelId Integer No

Level id

DspmIdentifyRefComplianceInfo

dspm associated identification template info

Used by actions: DescribeDspmIdentifyCategoryList, DescribeDspmIdentifyLevelGroupList, DescribeDspmIdentifyRuleList.

Name Type Description
ComplianceId Integer

Identification template ID
ComplianceName String

Recognition template name.
ComplianceType Integer

Identification template type

Enumeration values:

  • 0: Built-in
  • 1: Custom

DspmIdentifyRuleDetail

dspm data item details

Used by actions: DescribeDspmAssetDatabaseList, DescribeDspmAssetFieldList, DescribeDspmAssetIdentifyInfoList, DescribeDspmAssetTableList.

Name Type Description
RuleId Integer

Data item id
RuleName String

Data item name.
LevelId Integer

Sensitivity level id
LevelName String

Sensitivity level name
LevelScore Integer

Sensitivity

DspmIdentifyRuleItem

dspm categorized and classified data item list item

Used by actions: DescribeDspmIdentifyRuleList.

Name Type Description
Id Integer

Data item id
Name String

Data item name.
Description String

Data item description.
Status Integer

Whether to enable the data item

Enumeration values:

  • 0: No
  • 1: Yes
Type Integer

Data item type

Enumeration values:

  • 0: Built-in
  • 1: Custom
UpdateTime String

Update time.
StructuredStatus Boolean

Structure rule configuration status
UnStructuredStatus Boolean

Unstructured rule configuration status
ComplianceRelations Array of DspmIdentifyRefComplianceInfo

Associated identification template information

DspmIdentifyRuleStructuredTestItem

dspm structured data item test

Used by actions: DescribeDspmIdentifyRuleTestResult.

Name Type Required Description
Name String Yes

Parameter name
Value String No

Parameter type

DspmIp

Dspm Ip information

Used by actions: DescribeDspmAccessRecord.

Name Type Description
Ip String IP address
IpType String ip type. public: public network; private: private network
Remark String ip tag information
IsRemarked Integer Whether it has been tagged with information
ResourceInstanceId String ip belongs to the instance id
ResourceType String ip-associated product
Area DspmArea ip region
IsNewIp Integer Whether it is a new ip address

DspmIpCount

Dspm ip statistics

Used by actions: DescribeDspmStatistics.

Name Type Description
IpCount Integer Number of accessed IPs
UnmarkedPublicIpCount Integer Number of untagged public IPs
PrivateIpCount Integer Number of private network IPs

DspmPersonApplyHistoryItem

Visitor application records

Used by actions: DescribeDspmPersonApplyHistory.

Name Type Description
AssetId String Asset ID
PersonName String Name
Phone String Mobile number.
ValidateFrom String Access permission effective time.
ValidateTo String Access privilege expiration time.
ValidatePeriod Integer Access permission validity period. In milliseconds.
Privilege DspmDbAccountPrivilege Permission information.
ValidStatus Integer Whether it is valid. 0: invalid; 1: valid.

DspmPersonIdentifyItem

Dspm personal identification information

Used by actions: DescribeDspmPersonalIdentifyList.

Name Type Description
PersonId String Identity id.
Name String Name
Phone String Mobile number.
Remark String Remarks.
CreateTime String Creation time.

DspmPersonUser

Personal user information

Used by actions: DescribeDspmApplyHistory, DescribeDspmApplyOrderList, DescribeDspmApproveHistory, DescribeDspmApproveOrderList, DescribeDspmAssetAccessTopology, DescribeDspmAssetAccountIdentify, DescribeDspmAssetAccounts, DescribeDspmIdentifyIdList, DescribeDspmIdentifyInfoList, DescribeDspmRisk, DescribeDspmRiskDetail.

Name Type Description
PersonId String Personal id
PersonName String Name
Phone String Mobile number.

DspmRisk

Dspm risk

Used by actions: DescribeDspmRisk.

Name Type Description
RiskId String

Risk id
RiskName String

Risk name
RiskNameEn String

Risk English name
StrategyType String

Policy type
StrategyCategory String

Policy category
RiskLevel String

Risk level.
AssetId String

Asset instance Id
AssetType String

Asset type
AssetName String

Asset name
AssetRegion String

Region.
Account String

Asset account
Host String

Host address
AccountType Integer

Account type
DetectTime String

Risk detection time
Status Integer

Processing status. 0: unprocessed; 1: processed; 2: ignored
IdentifyId String

Identity id
OwnerUin DspmUinUser

User belonging to cloud account uin
Person DspmPersonUser

Belongs to individual user information
RiskData String

Risk data.
IsAssetManager Integer

Whether the user is an asset administrator
DataBeginTime String

Data start time
DataEndTime String

Data end time
RiskType String

Risk type. risk: Risk; alarm: Alarm.
AppId Integer

app id of the asset ownership account
NickName String

Account nickname
Uin String

uin of the account to which the asset belongs
ClusterType Integer

Cluster type of MongoDb. For non-MongoDb assets, fixed to 0.

Enumeration values:

  • 0: replica set
  • 1: sharding

Default value: 0
ClusterId String

Cluster ID.
ClusterName String

Cluster name.

DspmRiskCount

Dspm risk statistics count

Used by actions: DescribeDspmAssetAccountIdentify, DescribeDspmAssetAccounts, DescribeDspmAssets, DescribeDspmIdentifyInfoList, DescribeDspmStatistics.

Name Type Description
UnprocessedRisk Integer Number of Pending Risks
SQLBehaviorAnomaly Integer Number of SQL abnormal behavior risks
PermissionAnomaly Integer Number of permission exception risks
LoginBehaviorAnomaly Integer Number of login behavior anomaly risks
AttackSurfaceRisk Integer Number of attack surface risks
AccountSensitiveOperation Integer Number of sensitive operations on the account
UnprocessedAlarm Integer Pending alarm count
NumOfNewAlarmEvent Integer Newly-added event alarm
NumOfNewConfigRisk Integer Newly-added configuration risk

DspmRiskStrategy

Dspm risk policy

Used by actions: DescribeDspmRiskStrategy, DescribeDspmRiskStrategyGroup.

Name Type Description
StrategyType String

Policy type
Name String

Policy name.
StrategyCategory String

Policy type
IsEnabled Integer

Whether to enable. 0-Disable 1-Enable
RiskLevel String

Risk level.
Rule String

Policy rule
Remark String

Remarks.
Description String

Policy content.
HitCount Integer

Number of hits
RiskType String

Risk type. risk: Risk; alarm: Alarm.
AppId Integer

app id of the asset ownership account
NickName String

Account nickname
Uin String

uin of the account to which the asset belongs
StrategyId Integer

Policy ID.
RuleSource String

Rule source
AssetTypes Array of String

Supported asset types
RiskDescription String

Risk description

DspmRiskStrategyGroup

Dspm risk group policy

Used by actions: DescribeDspmRiskStrategyGroup.

Name Type Description
StrategyType String

Policy type
Name String

Policy name.
StrategyCategory String

Policy type
IsEnabled Integer

Whether to enable. 0 - disable, 1 - enable
HitCount Integer

Number of hits
RiskType String

Risk type. risk: risk; alarm: alarm.
StrategyList Array of DspmRiskStrategy

Policy list.
RuleSource String

Rule source.

DspmRiskTendency

Dspm risk trend.

Used by actions: DescribeDspmRiskTendency.

Name Type Description
Date String Date
UncontrolledAccount Integer Number of unmanaged accounts
SQLBehaviorAnomaly Integer Number of SQL behavior anomaly risks
PermissionAnomaly Integer Number of permission abnormal risks
LoginBehaviorAnomaly Integer Number of login behavior anomaly risks
AttackSurfaceRisk Integer Number of attack surface risks
AccountSensitiveOperation Integer Number of sensitive operations for the account

DspmScheduleConfig

Schedule task execution configuration

Used by actions: DescribeDspmAssets, ModifyDspmAssetDataScanTask.

Name Type Required Description
ScheduleType String No Scheduling type: daily, weekly, monthly
Day Integer No If not passed, the day is used for daily scheduling. For weekly scheduling configuration (day of the week (1=Monday, ..., 7=Sunday)), for monthly scheduling configuration (day of the month (1-31)).
Time String No Scheduling time configuration
TimeZone String No Time zone. Default: UTC+8 (Asia/Shanghai)

DspmSecurityAnalyseStatusCount

Dspm asset security analysis status statistics

Used by actions: DescribeDspmStatistics.

Name Type Description
OpenCount Integer Number of activations enabled for asset security analysis
OpeningCount Integer Number of activations being enabled for asset security analysis
ClosingCount Integer Number of assets whose security analysis is being disabled
CloseCount Integer Number of activations not enabled for asset security analysis
AssetTypeCountSet Array of DspmAssetTypeCount Asset security analysis status statistics grouped by asset type

DspmSensitiveScanTaskConfig

dspm sensitive data scan task configuration

Used by actions: DescribeDspmAssets.

Name Type Description
IsScheduled Boolean Whether it is a scheduled task
ScheduleConfig DspmScheduleConfig Scheduling cycle configuration
IsRunAtOnce Boolean Whether to scan now

DspmStatisticsItem

dspm statistical item

Used by actions: DescribeDspmIdentifyDistributionStatistics.

Name Type Description
Name String

Statistic item name.
Value Integer

Statistical value
Desc String

Description.

DspmSupportedAssetType

dspm-supported product information

Used by actions: DescribeDspmSupportedAssetType.

Name Type Description
Product String

Product name (used for querying)
Regions Array of RegionConfig

Region list.
ProductDisplayName String

Product name-for display
ProductGroup String

Product group name
AssetTotal Integer

Total number of asset instances for a given asset type

DspmTablePrivilege

Table permission

Used by actions: CreateDspmApplyOrder, DescribeDspmAssetAccountPresetPrivileges, DescribeDspmAssetAccountRecycledPrivileges, ModifyDspmAssetAccountPrivileges.

Name Type Required Description
Database String No Database name
Table String No Table name
Privileges Array of String No Permission information

DspmUinUser

Cloud account user information

Used by actions: DescribeDspmApplyHistory, DescribeDspmApplyOrderList, DescribeDspmApproveHistory, DescribeDspmApproveOrderList, DescribeDspmAssetAccessTopology, DescribeDspmAssetAccountIdentify, DescribeDspmAssetAccounts, DescribeDspmAssets, DescribeDspmIdentifyIdList, DescribeDspmIdentifyInfoList, DescribeDspmRisk, DescribeDspmRiskDetail.

Name Type Description
Uin String Account UIN
Name String Name
UserType Integer Type of user. 1: root account, 2: sub-user

DspmWhitelistStrategy

Dspm allowlist policy

Used by actions: DescribeDspmWhitelistStrategy.

Name Type Description
WhitelistStrategyId String

Allowlist policy id
StrategyType String

Policy type
Name String

Allowlist policy name
StrategyCategory String

Policy type
Rule String

Policy rule
Remark String

Remarks.
ModifyTime String

Modification time.
AssetId String

Asset id
Account String

Account
Host String

Host
Description String

Policy rule content description
RiskType String

Allowlist type. risk - risk allowlist; alarm - alarm allowlist.
AppId Integer

app id of the asset's associated account
NickName String

Account nickname
Uin String

uin of the associated account of the asset
WhitelistType String

Type of allowlist

DuplicateHosts

Batch add to allowlists

Used by actions: AddLoginWhiteLists.

Name Type Description
Quuid String

Quuid parameter
Uuid String

Uuid parameter
Id Integer

Id parameter

DynamicTab

Asset detail dynamic tab configuration

Used by actions: DescribeAssetDetail.

Name Type Description
TabKey String

key
Count Integer

Quantity.
AssetType Array of AssetTypeCount

Associated asset configuration

EDRExportJobItem

EDR task list

Used by actions: DescribeEdrExportJobList.

Name Type Description
JobId String

Task ID.
JobName String

Task name
Source String

Data source
ExportStatus String

Export status.
ExportProgress Integer

Export progress
FailureMsg String

Description of failure
Timeout String

Timeout period.
InsertTime String

Insertion time.

EDRFilter

Description key-value pair filter, which is used for conditional filtering queries. For example, filter by ID, name, and status.

If there are multiple Filters, the logical relationship between them is AND.
If there are multiple Values in the same Filter, the logical relationship between the Values under the same Filter is OR.

  • A maximum of 5 Filters are allowed.
  • If multiple Values exist for the same Filter, the number of Values cannot exceed 5.

Used by actions: CreateEdrAlertExportJob, CreateEdrLessAlertExportJob, DescribeCSIPMalwareScanTaskDetail, DescribeEDRRuleList, DescribeEdrAlertCountForContainer, DescribeEdrAlertList, DescribeEdrExportJobList, DescribeLoginTypeHost, DescribeLoginWhiteCombinedList, DescribeNFSScanHost, DescribePreventUninstallHost, DescribeProcessDaemonHost, ExportCSIPMalwareScanTaskDetail, ExportEDRRules.

Name Type Required Description
Name String Yes

Name of filter key
Values Array of String Yes

One or more filter values.
ExactMatch Boolean No

Fuzzy search

EDRFilters

Description key-value pair filter, which is used for conditional filtering queries. For example, filter by ID, name, and status.

If there are multiple Filters, the logical relationship between them is AND.
If there are multiple Values in the same Filter, the logical relationship between the Values under the same Filter is OR.

Used by actions: DescribeEdrAlertCountForAsset, DescribeMachineClearHistory, ExportClientSettingHostList.

Name Type Required Description
Name String Yes

Name of filter key.
Values Array of String Yes

One or more filter values.
ExactMatch Boolean No

Whether to use fuzzy match. It will be handled by the front-end and can be ignored.

EDRRule

EDR policy content.

Used by actions: DescribeEDRRuleList.

Name Type Description
RuleID String

Policy ID.
RuleType Integer

Policy type. 0: System policy; 1: Custom policy
Name String

Policy name.
Description String

Policy description
ContentType String

Content Type: md5-File MD5, cmdline-Command Line, dns-DNS, ip_inbound-Inbound IP, ip_outbound-Outbound IP, custom_file-Custom File, process_network-Process Network
Action Integer

Executed Action: 0-Alert, 1-Allow, 2-Alert and Block
Level Integer

Alarm Level: 0-None, 1-High, 2-Medium, 3-Low, 4-Reminder
DetectMode Integer

Detection Mode: 0-Precise, 1-Balanced, 2-Deep
DetectType Integer

Detection mode / Detect Type: 0-Host Detection, 1-Network Detection
AttackStage String

Attack phase
CWPScope Integer

Effective asset scope of host / Effective Scope: 0-Specified Hosts, 1-All Hosts, 2-Professional, 3-Flagship, 4-Professional+Flagship
QUUIDS Array of String

Selected host at host runtime
Status Integer

Status: 0-Enabled, 1-Disabled
CreateTime String

Creation time.
ModifyTime String

Modification time.
SupportBlock Integer

Whether interception is supported / Support Block: 0-Not Supported, 1-Supported
Md5List Array of String

MD5 list. This field is filled when ContentType is md5.
FileName Array of String

File name list, filled when ContentType=custom_file
FileDirectory Array of String

File directory list, fill when ContentType=custom_file
Domains Array of String

Domain name list. Fill in when ContentType=dns
OutboundIP Array of String

Outbound IP list, populated when ContentType=ip_outbound
InboundIP Array of String

Inbound IP list, filled when ContentType=ip_inbound
CmdLineRules RuleContentCmdLine

Command line rule, filled when ContentType=cmdline
TCSSScope Integer

Container Image Scope: 0-Specified Images, 1-All Images
ImageIDs Array of String

Image ID list that takes effect / Image IDs (when TCSSScope=0)
ImageNamesRegex String

Image name regular expression / Image Names Regex
Confidence Integer

Confidence: 0-Low, 1-Medium, 2-High
ExcludeQUUIDS Array of String

Excluded host list / Excluded Host QUUIDS
ExcludeImageIDs Array of String

Excluded image id list / Excluded Image IDs
ProcessNetworkRules RuleContentProcessNetwork

Process network rules
AppID Integer

APPID corresponding to the policy.
InstanceIDs Array of String

Selected instance ID range
ExcludeInstanceIDs Array of String

Excluded instance ID
ClusterIDs Array of String

Cluster ID list that takes effect (with a value when TCSSScope=0; empty returns [])
ExcludeClusterIDs Array of String

Cluster ID list for exclusion (empty returns [])
ConditionMatches Array of ConditionMatch

Container condition matching.
TagItems Array of EDRRuleTagItem

Security center tag

EDRRuleTagItem

Security center tag

Used by actions: DescribeEDRRuleList.

Name Type Required Description
ID Integer No

Security center tag ID
TagKey String No

Tag Key in Chinese
TagKeyEn String No

Tag English key
TagValue String No

Tag Chinese value
TagValueEn String No

Tag value in English.
Description String No

Tag description
Color String No

Tag color

EDRScanRecordItem

Scan task record item

Used by actions: DescribeEDRScanRecordList.

Name Type Description
TaskId Integer

Task primary key ID
TaskName String

Task name, for example, Malware_20260702_030000
TriggerType String

Scan type

Enumeration values:

  • MANNAL: Manual scan
  • CYCLE: Scheduled scan
ScheduleDesc String

Scheduled scheduling description (has a value when ScanType=1), for example, "Every day at 03:00:00"
TaskType String

Task asset type: 0=host scan, 1=container scan
TargetAppIDs Array of Integer

AppId list of accounts involved in scanning target
AccountName String

Task creator account name
CloudType Integer

Cloud type: 0=Tencent Cloud, 1=AWS, 2=Azure, 4=Alibaba Cloud
AssetSelectionType String

Asset selection method: all=all assets, tag=select by tag, direct=direct selection
TotalAssetCount Integer

Total number of assets scanned
CreateAppID Integer

Creator account AppId (the frontend judges operation permission based on this)
Creator String

Creator account uin
CreatorName String

Creator account name
CreatorCloudType Integer

Creator cloud type: 0=Tencent Cloud, 1=AWS, 2=Azure, 4=Alibaba Cloud
StartTime String

Task start time. Format: 2006-01-02 15:04:05
EndTime String

Task end time. If not ended, it is an empty string
Status String

WAIT: pending scan, SCANNING: scan in progress, FINISHED: completed, FAILED: failure, CANCELED: stopped

Enumeration values:

  • WAIT: pending scan
  • SCANNING: scan in progress
  • FINISHED: completed
  • FAILED: failure
  • CANCELED: stopped

EDRScanTaskContainerItem

Container asset scan details item

Used by actions: DescribeEDRScanTaskDetail.

Name Type Description
ContainerID String

Container ID
ContainerName String

Container name
PodName String

Pod Name
ClusterID String

Cluster ID.
ClusterName String

Cluster name.
ClusterType String

Cluster type.
AccountName String

Account name of asset ownership (enriched from the backend)
AppId Integer

AppId of the associated account
CloudType Integer

Cloud type
Status String

Scan status: WAIT/SCANNING/FINISHED/FAILED
RiskCount Integer

Alarm count
FailReason String

Failure reason
FixSuggestion String

Solution.

EDRScanTaskHostItem

Host asset scan details item

Used by actions: DescribeEDRScanTaskDetail.

Name Type Description
Quuid String

Host unique identifier
HostName String

Host name.
InstanceId String

Instance ID.
PublicIp String

Public IP address
PrivateIp String

Private IP address.
OsType String

Operating system.
AccountName String

Account name of asset ownership (enriched from the backend)
AppId Integer

AppId of the account associated with the asset
CloudType Integer

Cloud type
Status String

Scan status: WAIT/SCANNING/FINISHED/FAILED
RiskCount Integer

Risk count
FailReason String

Failure reason
FixSuggestion String

Solution.

EdrAlertCategoryCount

Number of alarms corresponding to the major category of EDR alarms

Used by actions: DescribeEdrAlertList.

Name Type Required Description
AlertCategory String No

Major category of alarm
Count Integer No

Number of alarms.

EdrAlertCountItem

EDR alarm quantity statistics item

Used by actions: DescribeEdrAlertCountForAsset.

Name Type Required Description
InstanceId String No

Query instance ID
TotalCount Integer No

Total number of alarms
VirusTrojanCount Integer No

Number of viruses and trojans (VIRUS_TROJAN)
AbnormalLoginCount Integer No

Number of abnormal logins (ABNORMAL_LOGIN)
HostBehaviorCount Integer No

Number of server behaviors (HOST_BEHAVIOR)
NetworkBehaviorCount Integer No

Number of network behaviors (NETWORK_BEHAVIOR)
InstancesCount Integer No

Number of hosts with alarms (only available in GlobalCount mode)

EdrAlertDetail

EDR alert details (including content JSON and asset/intelligence enrichment fields)

Used by actions: DescribeEdrAlertInfo.

Name Type Required Description
Id Integer No

Primary key ID
AppId Integer No

Tenant ID
AlertId String No

Alarm unique ID
AlertCategory String No

Major category of alarm (English enumeration: VIRUS_TROJAN/ABNORMAL_LOGIN/HOST_BEHAVIOR/NETWORK_BEHAVIOR/LINK_ENGINE)
AlertSubType String No

Alarm sub-type (enum: MALWARE_FILE/MALWARE_PROCESS/RISK_LOGIN/BRUTE_FORCE/DNS/BASH/PRIV_ESCALATION/REVERSE_SHELL/NET_ATTACK/VUL_DEFENCE/MEMORY_SHELL_INJECT/MEMORY_SHELL_SCAN/MULTI_BEHAVIOR_ATTACK)
RuleId String No

Associated rule ID
RuleType Integer No

Rule type: 0 - system rule; 1 - user-customized
Level String No

Alarm level (English enumeration: CRITICAL/HIGH/MEDIUM/LOW/INFO)
Status String No

Processing status (English enumeration: PENDING/PROCESSED/WHITELISTED/ISOLATED/CLEANED/IGNORED/ISOLATING/RESTORING/BLOCKED/DELETED)
AttackStage String No

ATT&CK attack stages
DetectMode String No

Detection Mode (Enum: PRECISE/BALANCED/DEEP)
InstanceId String No

Instance ID.
Quuid String No

Host UUID
EventCount Integer No

Number of aggregations
IsProVersion Integer No

Whether it is a paid edition
AlertSource String No

Alarm source (English enumeration: HOST/CONTAINER/K8S/CSIP)
ImageId String No

Container image ID (reserved field, always an empty string).
ContainerId String No

Container ID (reserved field, always an empty string)
ClusterId String No

Cluster ID (reserved field, always an empty string)
FirstDetectTime String No

First discovery time
LatestDetectTime String No

Most recent discovery time
RuleName String No

Rule name (rule enrichment)
ContentType String No

Content type: md5/cmdline/dns/ip_inbound/ip_outbound/custom_file/process_network
InstanceName String No

Instance name (asset enrichment)
PublicIp String No

Public IP address (asset enrichment)
PrivateIp String No

Private IP address (asset enrichment)
Content String No

Alert details json string (parsed by the frontend via JSON.parse; empty value is "{}")
AlertName String No

Alarm name (Chinese and English name of the sub-type)
CSIPTags Array of CSIPTag No

Security center tag
HarmDesc String No

Severity description (unified field, merged from original independent fields of sub-types)
SuggestScheme String No

Repair advice (unified field)
HarmDescSource String No

Data source: vuldb/vdc/intel/default
ThreatTags Array of String No

Unified threat intelligence tag (routes to different intelligence sources by sub-type)
BashCmdDecoded String No

Base64-decoded command (unique to high-risk command sub-type)
NetVulName String No

Vulnerability name (unique to network attack sub-type)
NetCVEId String No

CVE ID (unique to network attack sub-type)
NetAbnormalAction String No

Exception behavior (unique to network attack sub-type)
IPIntel IPIntelInfo No

IP intelligence information (do not return if empty)
MultiBehaviorDetectionMode String No

Multi-act attack rule type categorization: sequence/threshold/command
SourceDesc String No

Alarm source description (derived by sub-type, describing which engine/rule detects it)
ModifyTime String No

Time parameter format to process: 2026-05-26 19:45:48
IntelSource String No

Source of intelligence enrichment result (flag indicating whether external intelligence is hit successfully this time). Parameter Value: "VDC" / "IPAnalysis" / "BreakingTI" / empty string
Verdict String No

Comprehensive analysis: Chinese and English are translated. Chinese: Malicious/Safe/Unknown; English: Malicious/Safe/Unknown
VerdictBasis String No

Analysis basis
VirusName String No

Virus name
VirusFamily String No

Virus family
NetResponsePayload String No

NetResponsePayload response packet (base64 encoded string)
NetSvcPs String No

Service process information (JSON string after base64 encoding)
ContainerName String No

Container name
ImageName String No

Container image name
ClusterName String No

Cluster name.
RunStatus String No

Container running status (raw enumeration: RUNNING/PAUSED/STOPPED...; frontend performs mapping itself)

Enumeration values:

  • RUNNING: running
  • PAUSED: suspended
  • STOPPED: stopped
  • CREATED: created
  • DESTROYED: terminated
  • RESTARTING: restarting
  • REMOVING: migrating
  • DEAD: DEAD
  • UNKNOWN: unknown
PodName String No

POD Name
PodIp String No

POD IP
Namespace String No

Namespace.
PodWorkloadType String No

POD workload type
ClusterCaMD5 String No

Cluster ca cert md5
PodUniqueId String No

POD Unique id

EdrAlertItem

EDR alarm list information

Used by actions: DescribeEdrAlertList.

Name Type Required Description
Id Integer No

Alarm table id
AppId Integer No

APPID
AlertId String No

Alarm ID
AlertCategory String No

Major category of alarm
AlertSubType String No

Alarm subcategory
RuleId String No

Policy ID.
RuleType Integer No

Policy type
Level String No

Alarm level.
Status String No

Alarm status
AttackStage String No

Attack phase
DetectMode String No

Detection mode
InstanceId String No

Instance ID.
Quuid String No

QUUID
IsProVersion Integer No

Whether to pay
AlertSource String No

Alarm source
MachineType String No

Machine type (specific to the list API; not limited to container alerts, and the same is returned for host alerts). Enriched from machines.machine_type by Quuid. The original enumeration value is passed through as-is without i18n translation, and the frontend performs row mapping for display. Parameter values include CVM / LH / Other / EKS-NATIVE. If no corresponding machine information is found, it is downgraded to an empty string "" (consistent with the downgrade action for asset enrichment fields such as InstanceName / PublicIp / PrivateIp). This field will not be returned by the alert details API (DescribeEdrAlertInfo)
ImageId String No

Image ID.
ContainerId String No

Container id
ClusterId String No

Cluster ID.
EventCount Integer No

Number of alarms.
FirstDetectTime String No

Initial discovery time
LatestDetectTime String No

Most recent discovery time
RuleName String No

Rule name.
ContentType String No

Policy type
InstanceName String No

Instance name
PublicIp String No

Public IP
PrivateIp String No

Private IP address.
RaspOpen Boolean No

Whether application protection is enabled for this machine
ContainerName String No

Container name
ImageName String No

Container image name
ClusterName String No

Cluster name.

EdrAlertTagItem

Tag query result item

Used by actions: DescribeEdrAlertThreatTags.

Name Type Required Description
AlertId String No

Alarm ID
CloudTags Array of TagItem No

Tencent Cloud tag
CSIPTags Array of CSIPTag No

Security Center tag
ThreatTags Array of String No

Intelligence tag.
IPIntel IPIntelInfo No

IP intelligence information

EdrAlertTarget

EDR alert location information (ID + AlertID + AppID triplet)

Used by actions: DescribeEdrAlertInfo, DescribeEdrAlertMultiAttackStages, DescribeEdrAlertThreatTags, ModifyEDRRule, ModifyEdrAlertIsolation, ModifyEdrAlertStatus.

Name Type Required Description
Id Integer Yes

Alarm primary key ID
AppId Integer Yes

Alarm account ID (across different accounts, required by frontend)
AlertId String No

Alarm unique ID
Quuid String No

Host UUID (Optional, returned from the list and passed through)
InstanceId String No

Instance ID (optional, passed through from the list, used for tag enrichment in security center)
AlertSubType String No

Alarm sub-type

EdrAlertTargetForIgnore

Location information of EDR alerts for permanent ignore or unignore

Used by actions: CancelEdrAlertIgnore, ModifyEdrAlertPermanentIgnore.

Name Type Required Description
Id Integer Yes Alarm primary key ID
AppId Integer Yes Alarm Account ID (across different accounts, required for frontend)
AlertId String No Alarm unique ID
Quuid String No Host UUID (optional)
InstanceId String No Instance ID (selectable, used for allowlist deletion)

EdrContainerAlertCountItem

Group statistics item for container alarms (only TotalCount is returned, without splitting by major category of alarm)

Used by actions: DescribeEdrAlertCountForContainer.

Name Type Required Description
ClusterId String No

Cluster ID (has a value when grouping by cluster, otherwise empty string)
ContainerId String No

Container ID (has a value when grouped by container; otherwise, empty string)
TotalCount Integer No

Total number of alarms for the cluster/container

EdrContainerGlobalCount

Global statistics of container alarms

Used by actions: DescribeEdrAlertCountForContainer.

Name Type Required Description
TotalCount Integer No

Total number of alarms
ClustersCount Integer No

Number of clusters with alarms (COUNT(DISTINCT cluster_id), excluding empty cluster_id)

Element

Statistics Entries

Used by actions: DescribeCVMAssets.

Name Type Required Description
Key String No Statistics type.
Value String No Statistics Object

ExpiringProduct

Products about to expire

Used by actions: DescribeSecurityScoreOverview.

Name Type Description
ProductId String

Product ID
ProductName String

Product name.
DaysToExpire Integer

Days until expiration
Unit: day
ExpireTime String

Expiration time

ExportJobItem

Export task info

Used by actions: DescribeExportJobManageList.

Name Type Description
JobID String Task ID.
JobName String Task name.
Source String Task source.
ExportJobStatus String Task status.
ExportProgress Integer Task progress
FailureMsg String Error message
Timeout String Task Timeout Duration
InsertTime String Task creation time

ExportTask

Exports the task list

Used by actions: DescribeDspmExportTask.

Name Type Required Description
Id Integer No Task ID
AppId Integer No User AppId
Percentage Integer No Progress percentage
TaskStatus Integer No Task status: 0: not started; 1: executing; 2: executed successfully; 3: timed out; 4: execution failed.
CreateTime Integer No Task creation time
ModifyTime Integer No Task update time
FileName String No File name
FileSize Integer No File size in bytes.
RemainingTime Integer No Remaining time (in seconds).

ExposeAssetTypeItem

Exposed asset category

Used by actions: DescribeExposeAssetCategory, DescribeExposureAutoTagAttribute.

Name Type Description
Provider String Cloud service provider
ProviderName String Cloud vendor name
AssetType String Asset type
AssetTypeName String Asset type name

ExposeRiskItem

Pending risk information for cloud boundaries

Used by actions: DescribeExposeRisks.

Name Type Description
RuleType String Rule type
Severity String Risk level
Title String Rule name

ExposeRuleItem

Cloud boundary rule information

Used by actions: DescribeExposeRules.

Name Type Description
RuleType String Rule type
Severity String Risk level
Title String Rule name
FixAdvice String Fixing suggestion

ExposeTrendItem

Quantity trend periodic statistical information of exposure

Used by actions: DescribeExposureTrend.

Name Type Description
OpenCount Integer Number of fully open ports
AclCount Integer Number of restricted accesses
CloseCount Integer Number of inaccessible instances
Date String Date

ExposesItem

Exposed assets

Used by actions: DescribeCWPExposures, DescribeExposures.

Name Type Description
Provider String

Cloud service provider.
CloudAccountName String

Cloud account name
CloudAccountId String

Cloud account
Domain String

Domain Name.
Ip String

IP
Port String

Port or port range
Status String

Open
RiskType String

Risk type
AclType String

acl type
AclList String

acl list
AssetId String

Asset ID.
InstanceName String

Instance name.
AssetType String

Asset type
PortServiceCount Integer

Number of port services
HighRiskPortServiceCount Integer

Number of high-risk ports
WebAppCount Integer

Number of web applications
RiskWebAppCount Integer

Number of web applications at risk
WeakPasswordCount Integer

Number of weak passwords
VulCount Integer

Number of vulnerabilities
CreateTime String

First discovery time
UpdateTime String

Latest update time.
AssetTypeName String

Instance Type Name
DisplayStatus String

Open status
DisplayRiskType String

Port status
ScanTaskStatus String

Scan task status
Uuid String

uuid
HasScan String

Whether a security check has been performed
AppId Integer

Tenant ID
AppIdStr String

Tenant ID string
ExposureID Integer

Record ID
PortDetectCount Integer

Number of open ports
PortDetectResult String

Port exposure result
Tag String

Tag.
Comment String

Remarks.
ToGovernedRiskCount Integer

Number of risks pending governance
ToGovernedRiskContent String

Risk content pending governance
AssetTypeIconURL String

Asset type icon
AssetTypeIconSolidURL String

3D icon of asset type

FieldConfig

Asset detail field configuration

Used by actions: DescribeAssetInfo.

Name Type Description
Label String

Field display
Value String

Field value
Style FieldStyle

Field style configuration
ValueCount Integer

Field content quantity.

FieldStyle

Field style configuration

Used by actions: DescribeAssetInfo.

Name Type Description
Type String

Type.
Copy Boolean

Whether copying is supported
Color String

Color
URL String

Redirect url

Filter

The list query API adopts the new filter API, which is directly passed to the backend for query filtering.

Used by actions: CreateAssetComponentListExportJob, CreateAssetComponentRelatedImageListExportJob, CreateClusterContainerListExportJob, CreateClusterListExportJob, CreateClusterNamespaceListExportJob, CreateClusterNodeListExportJob, CreateDspmAccessExportJob, CreateDspmApproveHistoryExportJob, CreateDspmAssetAccessTopologyExportJob, CreateDspmAssetIdentifyInfoExportJob, CreateDspmAssetsExportJob, CreateDspmIdentifyInfoListExportJob, CreateDspmRiskExportJob, CreateHostImageListExportJob, CreateIaCFileExportJob, CreateImageAssetListExportJob, CreateImageAssociatedContainerListExportJob, CreateImageAssociatedHostListExportJob, CreateImageComponentListExportJob, CreateImageLayerVulListExportJob, CreateImageRegistryListExportJob, CreateImageSensitiveInfoListExportJob, CreateImageVirusListExportJob, CreateImageVulListExportJob, CreateImageVulSummaryListExportJob, CreatePodContainerListExportJob, CreatePodServiceListExportJob, CreateScanStatisticExportJob, DescribeAIAgentAssetList, DescribeAIAgentCredentialList, DescribeAIAnalysisHistory, DescribeAbnormalCallRecord, DescribeAccessKeyAlarm, DescribeAccessKeyAsset, DescribeAccessKeyRisk, DescribeAccessKeyUserList, DescribeAccessKeyWhiteList, DescribeAlertList, DescribeAssetComponentList, DescribeAssetComponentRelatedImageList, DescribeAssetViewVulRiskList, DescribeCSIPRiskStatistics, DescribeCVMAssets, DescribeCWPMachines, DescribeCallRecord, DescribeCheckConnectivityHostList, DescribeClusterAssetList, DescribeClusterAssets, DescribeClusterContainerList, DescribeClusterNamespaceList, DescribeClusterNodeList, DescribeClusterPodAssets, DescribeClusterPodList, DescribeClusterServiceList, DescribeDbAssets, DescribeDomainAssets, DescribeDspmAccessRecord, DescribeDspmAccessTopologyAccounts, DescribeDspmAccessTopologyAssets, DescribeDspmAccessTopologyIps, DescribeDspmApplyHistory, DescribeDspmApplyOrderList, DescribeDspmApproveHistory, DescribeDspmApproveOrderList, DescribeDspmAssetAccessTopology, DescribeDspmAssetAccountIdentify, DescribeDspmAssetAccountPresetPrivileges, DescribeDspmAssetAccounts, DescribeDspmAssetDatabaseList, DescribeDspmAssetFieldList, DescribeDspmAssetIdentifyInfoList, DescribeDspmAssetIds, DescribeDspmAssetSecurityAnalyseStatus, DescribeDspmAssetTableList, DescribeDspmAssets, DescribeDspmAuditFilterStrategy, DescribeDspmIdentifyCategoryList, DescribeDspmIdentifyComplianceCategoryRuleList, DescribeDspmIdentifyComplianceGroupList, DescribeDspmIdentifyIdList, DescribeDspmIdentifyInfoList, DescribeDspmIdentifyLevelGroupList, DescribeDspmIdentifyRuleList, DescribeDspmPersonApplyHistory, DescribeDspmPersonalIdentifyList, DescribeDspmRisk, DescribeDspmRiskDetail, DescribeDspmRiskStrategy, DescribeDspmRiskStrategyGroup, DescribeDspmWhitelistStrategy, DescribeEDRScanRecordList, DescribeEDRScanTaskDetail, DescribeGatewayAssets, DescribeIaCFileList, DescribeIaCTokenList, DescribeImageAssetList, DescribeImageAssociatedContainerList, DescribeImageAssociatedHostList, DescribeImageComponentList, DescribeImageExportJobList, DescribeImageLayerList, DescribeImageLayerVulList, DescribeImageRegistryList, DescribeImageRegistryNamespaceList, DescribeImageRegistryScanSubTaskList, DescribeImageRegistryScanTaskList, DescribeImageRegistryTimedScanTaskConfig, DescribeImageRegistryTimedScanTaskPreview, DescribeImageSensitiveInfoList, DescribeImageSensitiveWhitelist, DescribeImageVirusList, DescribeImageVirusWhitelist, DescribeImageVulList, DescribeImageVulSummaryList, DescribeImageVulWhitelist, DescribeKeySandboxCredentialList, DescribeListenerList, DescribeNICAssets, DescribeOrganizationUserInfo, DescribeOtherCloudAssets, DescribePodContainerList, DescribePublicIpAssets, DescribeRepositoryImageAssets, DescribeRiskCallRecord, DescribeRiskCenterAssetViewCFGRiskList, DescribeRiskCenterAssetViewPortRiskList, DescribeRiskCenterAssetViewVULRiskList, DescribeRiskCenterAssetViewWeakPasswordRiskList, DescribeRiskCenterCFGViewCFGRiskList, DescribeRiskCenterPortViewPortRiskList, DescribeRiskCenterRiskTrendAnalysis, DescribeRiskCenterServerRiskList, DescribeRiskCenterVULViewVULRiskList, DescribeRiskCenterWebsiteRiskList, DescribeSandboxFileRuleList, DescribeScanReportList, DescribeScanTaskList, DescribeSourceIPAsset, DescribeSubUserInfo, DescribeSubnetAssets, DescribeTCRInstanceList, DescribeTaskLogList, DescribeUebaRule, DescribeUserAKInfoList, DescribeUserCallRecord, DescribeUserDspmInfoList, DescribeVULList, DescribeVULRiskAdvanceCFGList, DescribeVpcAssets, DescribeVulViewVulRiskList.

Name Type Required Description
Limit Integer No Query Quantity Limit
Offset Integer No Query Offset Position
Order String No Sort by Ascending or Descending Order. Ascending: asc, Descending: desc.
By String No Fields to Sort
Filters Array of WhereFilter No Filtered Columns and Content
StartTime String No Can be left blank. Log usage query time.
EndTime String No Can be left blank. Log usage query time.

FilterDataObject

Filter Data Objects

Used by actions: DescribeAssetTagAttributes, DescribeAssetViewVulRiskList, DescribeCVMAssets, DescribeClusterAssets, DescribeClusterPodAssets, DescribeDbAssets, DescribeDomainAssets, DescribeGatewayAssets, DescribeNICAssets, DescribeOrganizationUserInfo, DescribeOtherCloudAssets, DescribePublicIpAssets, DescribeRepositoryImageAssets, DescribeRiskCenterAssetViewCFGRiskList, DescribeRiskCenterAssetViewPortRiskList, DescribeRiskCenterAssetViewVULRiskList, DescribeRiskCenterAssetViewWeakPasswordRiskList, DescribeRiskCenterCFGViewCFGRiskList, DescribeRiskCenterPortViewPortRiskList, DescribeRiskCenterRiskTrendAnalysis, DescribeRiskCenterServerRiskList, DescribeRiskCenterVULViewVULRiskList, DescribeRiskCenterWebsiteRiskList, DescribeScanTaskList, DescribeSubUserInfo, DescribeSubnetAssets, DescribeUebaRule, DescribeVULList, DescribeVULRiskAdvanceCFGList, DescribeVpcAssets, DescribeVulViewVulRiskList.

Name Type Description
Value String English Translation
Text String Chinese Translation

Filters

Filter criteria. Multiple Values under the same Name are OR-related, while different Names are AND-related. Supported Name: Status (execution result, Values: SUCCESS/FAILED/USER_CANCELED/CHECKING)

Used by actions: CreateAllAssetsExportJob, CreateAssetFilterView, CreateAssetProcessExportJob, CreateAssetViewRisksExportJob, CreateBaselineAggregatedItemExportJob, CreateBaselineFixRecordExportJob, CreateBaselineMainTaskExportJob, CreateCFGRiskPDFReportExportJob, CreateCFGRisksExportJob, CreateCheckViewRisksExportJob, CreateCloudFunctionExportJob, CreateComplianceRiskExportJob, CreateDynamicAssetsExportJob, CreateExposuresExportJob, CreateHighBaseLineRisksExportJob, CreateHostVulExportJob, CreatePublicAssetsExportJob, CreateRiskDetailExportJob, CreateVulFixedExportJob, CreateVulRisksExportJob, DescribeAssetFilterViews, DescribeAssetProcessList, DescribeAssetRiskList, DescribeAssetTags, DescribeBaselineAggregatedItemList, DescribeBaselineCategoryItemList, DescribeBaselineFixRecordList, DescribeBaselineItemRiskList, DescribeBaselineMainTaskList, DescribeBaselinePolicyItemList, DescribeBaselinePolicyList, DescribeBaselineSubTaskList, DescribeCWPExposures, DescribeCWPLicenseBindSchedule, DescribeCWPOrderList, DescribeCheckViewRisks, DescribeClbListenerList, DescribeClbListenerRules, DescribeCloudAssets, DescribeCloudFunctionList, DescribeComplianceRiskList, DescribeConfigCheckRules, DescribeCustomRiskRules, DescribeDynamicAssets, DescribeExportJobManageList, DescribeExposeRisks, DescribeExposeRules, DescribeExposureAutoTagRules, DescribeExposures, DescribeHighBaseLineRiskList, DescribeHostKBRiskList, DescribeHostVulRiskList, DescribeKBUpdatableMachineList, DescribePublicCloudAssets, DescribeRaspLicenseList, DescribeRiskDetailList, DescribeRiskRules, DescribeSandboxACLAlertList, DescribeSandboxACLRuleList, DescribeSandboxACLSystemRuleList, DescribeSandboxDLPAlertList, DescribeSandboxDLPRuleList, DescribeSandboxDLPSystemRuleList, DescribeSandboxLLMAuditAlertList, DescribeSandboxLLMAuditRuleList, DescribeScanTaskRecordList, DescribeSkillScanAlertList, DescribeVulComponentRelateHost, DescribeVulFixTaskDetail, DescribeVulFixTaskList, DescribeVulFixableMachineList, DescribeVulFixedList, DescribeVulIgnoreRuleList, DescribeVulItemList, DescribeVulRiskList, DescribeVulRiskRelateComponent, DescribeVulRiskRelateHost, DescribeVulScanTaskDetail, DescribeVulScanTaskList, DescribeWebhookPolicyList, DescribeWebhookReceiverList, ModifyAssetFilterView, ModifyProtectionSetting, ModifyRaspLicenseBinds.

Name Type Required Description
Name String No Filter criterion name. Parameter value: Status (Execution result. Values: SUCCESS/FAILED/USER_CANCELED/CHECKING)
Values Array of String No List of filter condition values
ExactMatch String No Exact match: 1 for exact match; fuzzy match by default

GateWayAsset

Gateway asset

Used by actions: DescribeGatewayAssets.

Name Type Description
AppId String appid
Uin String uin
AssetId String Asset ID
AssetName String Asset name
AssetType String Asset type
PrivateIp String VPC IP
PublicIp String Public IP address
Region String Region.
VpcId String VPC id
VpcName String VPC Name
Tag Array of Tag Tag.
OutboundPeakBandwidth String Outbound peak bandwidth
InboundPeakBandwidth String Inbound peak bandwidth
OutboundCumulativeFlow String Cumulative Outbound Traffic
InboundCumulativeFlow String Cumulative Inbound Traffic
NetworkAttack Integer Network attack
ExposedPort Integer Exposed port
ExposedVUL Integer Exposed vulnerability
ConfigureRisk Integer Configuration risk
CreateTime String Creation time.
ScanTask Integer Number of tasks
LastScanTime String Last scan time
Nick String Nickname
AddressIPV6 String IPv6 address
IsCore Integer Core or Not
RiskExposure Integer Risk service exposure
IsNewAsset Integer New Asset or Not. 1: New
Status String Gateway Status
EngineRegion String TSE's Actual Gateway Region
WeakPasswordRisk Integer Weak password risk

HighBaseLineRiskItem

Risk content of high-risk baseline

Used by actions: DescribeHighBaseLineRiskList.

Name Type Description
CloudAccountID String Cloud Account ID
AssetID String Instance ID.
InstanceStatus String Instance status
InstanceName String Instance name.
RiskName String Risk name
RiskCategory String Risk classification
RiskLevel String Risk level
RiskDesc String Risk description
RiskResult String Risk result
FixAdvice String Fixing suggestion
RiskCategoryName String Linux vulnerability
RiskLevelName String Risk level name
InstanceStatusName String Instance status
CreateTime String First detection time
UpdateTime String Last discovery time
AppID Integer Tenant ID

HitRules

Rule set.

Used by actions: DescribeDspmLogList.

Name Type Required Description
RuleId Integer Yes Rule ID
RuleName String Yes Rule

HostAutoScaleConfig

Auto-scaling configuration for the CWP module

Used by actions: ModifyPayConfig.

Name Type Required Description
Switch String No Host auto-scaling switch
Enumeration values:
ON: enable
OFF: disabled.
Supplemental description: If not passed, no modification is made. Map the underlying auto-purchase switch auto_repurchase_switch.
ProtectType String No Scale-out version
Enumeration values:
PRO: Professional Edition
ULTIMATE: Flagship edition
Supplementary description: No modification will be made if this parameter is not passed in.

HostBriefInfo

Host brief information

Used by actions: DescribeVulComponentRelateHost, DescribeVulHostRelateComponent.

Name Type Description
InstanceID String Cloud host instance ID
Parameter format: such as ins-instance
QUUID String Host QUUID (CWP internal unique identifier)
UUID String Host UUID
PublicIP String Public network IP address
PrivateIP String Private IP address
AgentStatus String CWP Agent status
Enumeration value:
ONLINE: Online
OFFLINE: Offline
UNINSTALLED: Not installed
InstanceStatus String CVM instance status
Enumeration value:
RUNNING: running.
STOPPED: Stopped
UNKNOWN: unknown
Name String Host name
Account AccountBriefInfo Account information belonging to
TagItem Array of MiniTagItem Asset tag list (CSIP internal assets)
CloudTag Array of Tag Tag list on cloud (Tag on cloud asset)

HostDesc

Host information entity of the log-in audit allowlist

Used by actions: DescribeLoginWhiteHostList.

Name Type Description
Quuid String

Machine uuid
Uuid String

Host security UID
MachineName String

Machine name
MachineIp String

Machine IP address. This parameter is left blank for terminated servers.
MachineWanIp String

Public IP address. This parameter is left blank for terminated servers.
Tags Array of MachineTag

Tag information array

HostInfo

Add the host information entity of the log-in audit allowlist.

Used by actions: AddLoginWhiteLists, ModifyLoginWhiteRecord.

Name Type Required Description
Quuid String Yes

Host Quuid
Uuid String Yes

Uuid host

HostKBRisk

Host vulnerability risk

Used by actions: DescribeHostKBRiskList.

Name Type Description
RiskID Integer

Risk record ID (kb_risk.id)
KBDetail KBDetail

Windows KB patch detailed information
EffectHostCount Integer

Number of affected hosts.
LatestScanTime Timestamp ISO8601

Latest scan time
Parameter format: YYYY-MM-DDTHH:mm:ssZ
Account Array of AccountBriefInfo

Associated account list
RiskStatus String

Remediation status
Enumeration values:
PENDING: To be fixed
SCANNING: Scan in progress
FIXED: Fixed
IGNORED: Allowlisted
FIXING: In remediation
FIX_FAILED: Fix failure

HostLoginWhiteObj

Add log-in audit allowlist entity

Used by actions: AddLoginWhiteLists.

Name Type Required Description
Places Array of Place Yes

Add a region to the allowlist
SrcIp String Yes

Allowlisted source IP address. IP ranges are supported. Multiple IPs are separated by commas.
UserName String Yes

Allowlisted username separated by commas
IsGlobal Integer Yes

Whether it is effective globally. 1: all hosts; 0: only a single host'
HostInfos Array of HostInfo Yes

Machine information list with allowlist effective
Remark String No

Remarks.
StartTime String No

Start time.
EndTime String No

End time.

HostVulComponent

Host vulnerability component

Used by actions: DescribeVulComponentRelateHost, DescribeVulHostRelateComponent.

Name Type Description
HostInfo HostBriefInfo

Host brief information
EffectVersion String

Affected component version
Path String

Installation path of the component on the host
ProcessID String

Associated process ID.
FixCommand String

Fix Command (only display)
Name String

Component name.

HostVulOverview

Host Vulnerability Overview

Used by actions: DescribeHostVulOverview.

Name Type Description
UrgentRepairCount Integer

Number of vulnerabilities that require immediate fix (number of vulnerabilities with VPR rating of URGENT)
DefendHostCount Integer

Hosts with vulnerability protection enabled
TotalHostCount Integer

Total hosts
FixedVulCount Integer

Total number of times vulnerabilities have been fixed
LinuxVulCount Integer

Linux software vulnerability count
WindowVulCount Integer

Number of Windows system patches
WebCMSVulCount Integer

Number of Web-CMS vulnerabilities
AppVulCount Integer

Number of application vulnerabilities
EmergencyCount Integer

Number of emergency vulnerabilities
VulItemCount Integer

Total number of vulnerability knowledge base
LatestScanTime Timestamp ISO8601

Latest scan time.

Parameter format: YYYY-MM-DDTHH:mm:ssZ
EnableTimingScan Integer

Whether period scanning is enabled

Enumeration value:

  • 1: Enabled
  • 0: Not enabled
CriticalRepairCount Integer

Number of critical fixes
CriticalRepairLinuxVulCount Integer

Critical Linux vulnerability fix count
CriticalRepairAppVulCount Integer

Severe application vulnerability fix count
CriticalRepairWebCMSVulCount Integer

Critical fix for Web-CMS vulnerabilities
CriticalRepairEmergencyCount Integer

Critical fix emergency vulnerability count

HostVulRisk

Host vulnerability risk

Used by actions: DescribeHostVulRiskList.

Name Type Description
RiskID Integer

Risk record ID (host_vul_risk.id)
EffectHostCount Integer

Number of affected hosts
LatestScanTime Timestamp ISO8601

Latest scan time
Parameter format: YYYY-MM-DD HH:mm:ss
Account Array of AccountBriefInfo

Account list it belongs to
DefendStatus String

Vulnerability defense status
Enumeration value:
ENABLED: Enabled
NOT_SUPPORTED: Unsupported
NOT_ENABLED: Not enabled
RiskStatus String

Remediation status
Enumeration values:
PENDING: to be fixed
SCANNING: scan in progress
FIXED: fixed
IGNORED: whitelisted
FIXING: fix
FIX_FAILED: FIX_FAILURE
NOTSCAN: unscanned
WITHOUT_RISK: no risk
NEED_REBOOT: pending restart
VulDetail VulDetailInfo

Vulnerability details

IPIntelInfo

IP threat intelligence information (obtained through the TIX IPAnalysis API)

Used by actions: DescribeEdrAlertInfo, DescribeEdrAlertThreatTags.

Name Type Required Description
Tags Array of String No

Intelligence tag (such as Common Trojan, vulnerability software, Stealer Trojan)
Basis String No

Analysis basis
ISP String No

Associated operator
Location String No

Location
Characteristic String No

Family gang
Purpose String No

IP profiling
Referer Array of DomainInfo No

Reverse-check domain name list

IaCFile

IaC detection file

Used by actions: DescribeIaCFileList.

Name Type Required Description
Id Integer No

ID
AppId Integer No

appid
FileId String No

File ID
FileName String No

File name.
CICDName String No

CI/CD name
FilePath String No

File path
FileType Integer No

File type (1: Dockerfile, 2: Terraform, 3: KubernetesYaml)
RiskTotalCnt Integer No

Total number of risks
RiskLevelCnt Array of KeyValueInt No

Number of risk levels (0: low risk, 1: medium risk, 2: high risk, 3: critical)
ScanTime String No

Scan time.
Status Integer No

Detection status (0: Pending scan, 1: Detecting, 2: Completed, 3: Detection exception)
FailType Integer No

Scan failure type (0: no failure, 1: detection timeout, 2: file format parsing failed, 3: detection failed)

IaCFileRisk

Risk of IaC detection files

Used by actions: DescribeIaCFileReport.

Name Type Required Description
Level Integer No

Risk level (0: low risk, 1: medium risk, 2: high risk, 3: critical)
Line Integer No

Line count where the risk resides
RuleName String No

rule name
Description String No

Issue description
Suggestion String No

Fixing suggestion

ImageAssetDetail

Mirror asset detail

Used by actions: DescribeImageAssetDetail.

Name Type Required Description
ImageDigest String No

Image digests.
ImageRepoAddress String No

Repository address
RegistryType String No

Repository type
ImageName String No

Image name.
ImageTag String No

Image tag
LatestScanTime String No

Last scan time

Parameter format: YYYY-MM-DD hh:mm:ss
ScanStatus Integer No

Scan status

Enumeration values:

  • 0: Initial state
  • 1: Issued
  • 2: Scanning
  • 3: Scan complete
  • 4: Scan timeout
  • 5: Scan failure
VulCnt Integer No

Number of vulnerabilities
VirusCnt Integer No

Number of Trojans
SensitiveCnt Integer No

Number of sensitive information entries.
InstanceId String No

Repository instance id.
InstanceName String No

Image repository name
Namespace String No

Namespace.
IsAuthorized Integer No

Whether to authorize.
ImageSize Integer No

Image size.
ImageId String No

Image ID.
RegistryRegion String No

Repository region
ImageCreateTime String No

Image creation time

Parameter format: YYYY-MM-DD hh:mm:ss
Id String No

id
OwnerAccountName String No

Account name associated with the mirror
OwnerUin String No

uin of the associated account of the mirror
OwnerAppId Integer No

appid of the account associated with the mirror
LowLevelVulCnt Integer No

Number of low-risk vulnerabilities
MediumLevelVulCnt Integer No

Medium-risk vulnerability count
HighLevelVulCnt Integer No

Number of high-risk vulnerabilities
CriticalLevelVulCnt Integer No

Number of critical risk vulnerabilities
LowLevelVirusCnt Integer No

Number of low-risk trojans
MediumLevelVirusCnt Integer No

Number of medium-risk trojans
HighLevelVirusCnt Integer No

Number of high-risk trojans
CriticalLevelVirusCnt Integer No

Number of severe trojans
EmergencyVulCnt Integer No

Number of emergency vulnerabilities
LowLevelSensitiveCnt Integer No

Number of low-risk sensitive data items
MediumLevelSensitiveCnt Integer No

Number of medium-risk sensitive data items
HighLevelSensitiveCnt Integer No

Number of high-risk sensitive data items
CriticalLevelSensitiveCnt Integer No

Number of critical sensitive data items

ImageAssetInfo

Image asset information

Used by actions: DescribeAssetComponentRelatedImageList, DescribeImageAssetList.

Name Type Description
ImageRepoAddress String

Image repository address
ImageDigest String

Image digests.
RegistryType String

Image repository type
ImageName String

Image name.
ImageTag String

Image tag
ImageSize Integer

Image size.
LatestScanTime String

Last scan time

Parameter format: YYYY-MM-DD hh:mm:ss
ScanStatus String

Scan status

Enumeration values:

  • INIT: Unscanned
  • SCANNING: Scanning
  • FINISH: Scan successful
  • TIMEOUT: Scan timeout
  • FAILED: Scan failure
  • STOPPING: Terminating
  • CANCELLED: Scan canceled
  • CREATING: Scan task under creation
  • LICENSE_NOT_ENOUGH: Insufficient license
VulCnt Integer

Number of vulnerabilities
VirusCnt Integer

Number of Trojans
SensitiveCnt Integer

Number of sensitive information entries.
OsName String

Image operating system
InstanceId String

id of the associated repository instance
InstanceName String

Name of the associated mirror repository instance
Namespace String

Namespace.
IsAuthorized Integer

Whether to authorize
RegistryRegion String

region where the image repository is located
Id String

id
ImageId String

Image ID.
ImageCreateTime String

Image creation time

Parameter format: YYYY-MM-DD hh:mm:ss
IsLatestImage Boolean

Is it the latest image?
LowLevelVulCnt Integer

Number of low-risk vulnerabilities
MediumLevelVulCnt Integer

Medium-risk vulnerability count
HighLevelVulCnt Integer

Number of high-risk vulnerabilities
CriticalLevelVulCnt Integer

Number of critical risk vulnerabilities
OwnerAccountName String

Associated account name
OwnerAppId Integer

appid of the associated account
OwnerUin String

Associated account uin
LowLevelVirusCnt Integer

Number of low-risk trojans
MediumLevelVirusCnt Integer

Number of medium-risk trojans
HighLevelVirusCnt Integer

Number of high-risk trojans
CriticalLevelVirusCnt Integer

Number of severe trojans
EmergencyVulCnt Integer

Number of emergency vulnerabilities
LowLevelSensitiveCnt Integer

Number of low-risk sensitive data items
MediumLevelSensitiveCnt Integer

Number of medium-risk sensitive data items
HighLevelSensitiveCnt Integer

Number of high-risk sensitive data items
CriticalLevelSensitiveCnt Integer

Number of severe sensitive data items
RiskCnt Integer

Risk count
ScanFailReason String

Scan failure reason
ScanSolution String

Solution to scan failure
RegionInfo RegionInfo

Region information.
ScanTaskId Integer

Most recent scan task Id.

ImageAssociatedAssetCount

Number of related assets of an image

Used by actions: DescribeImageAssociatedAssetCount.

Name Type Required Description
Id Integer No

Image ID.
HostCount Integer No

Number of servers associated with the image
ContainerCount Integer No

Number of containers associated with the image
OwnerAccountName String No

Mirror associated account name
OwnerAppId Integer No

appid of the account associated with the mirror
OwnerUin String No

Account uin of the mirror

ImageAssociatedContainer

Asset of the host associated with the mirror

Used by actions: DescribeImageAssociatedContainerList.

Name Type Required Description
ContainerId String No

Container id
ContainerName String No

Container name.
PodName String No

pod name.
PodIp String No

pod ip
OwnerAccountName String No

Account name to which the pod belongs
OwnerAppId Integer No

appid of the account associated with the pod
OwnerUin String No

uin of the account to which the pod belongs
ClusterId String No

Cluster ID.
ClusterName String No

Cluster name.
ClusterStatus String No

Cluster status.

Enumeration values:

  • Running: Running,
  • Exception: Exception,
  • Unknown: Unknown,
  • Creating: Creating.
Cmd String No

Image cmd
PodId String No

Pod unique id
ClusterCaMd5 String No

Unique cluster Id.

ImageAssociatedHostAsset

Asset of the host associated with the mirror

Used by actions: DescribeImageAssociatedHostList.

Name Type Required Description
Uuid String No

Host UUID.
QUuid String No

Host quuid
HostName String No

host name
OwnerAccountName String No

Account name associated with the host
OwnerAppId Integer No

appid of the account associated with the host
OwnerUin String No

uin of the account associated with the host
InnerIp String No

Host private network address
PublicIp String No

Host public network address
AgentStatus String No

agent status on the host

Enumeration value:

  • ONLINE: ONLINE
  • OFFLINE: OFFLINE
  • UNINSTALL: uninstalled
InstanceID String No

Host instance ID.
InstanceState String No

Host status

ImageComponent

Image component information

Used by actions: DescribeImageComponentList.

Name Type Description
Name String

Component name.
Version String

Component version
Path String

Component path
Type String

Component type

Enumeration value:

  • SYSTEM_COMPONENT: System component
  • APP_COMPONENT: Application component
ImageID String

Image ID.
VulCount Integer

Number of vulnerabilities
Id String

Image component Id
ComponentId Integer

Component Id

ImageIDWithAppIdItem

Image ID and corresponding appid account information

Used by actions: ModifyEDRRule.

Name Type Required Description
AppId Integer No

Account ID
ImageID String No

Container image ID

ImageLayer

Image Layer Information

Used by actions: DescribeImageLayerList.

Name Type Required Description
LayerIndex Integer No

Image layer serial number
LayerId String No

Image layer id
LayerCmd String No

Image layer command line
Size Integer No

Mirror layer size
CriticalLevelVulCnt Integer No

Critical vulnerability count
HighLevelVulCnt Integer No

High-risk vulnerability count
MediumLevelVulCnt Integer No

medium-risk vulnerability count
LowLevelVulCnt Integer No

Number of low-risk vulnerabilities
VirusCnt Integer No

Number of Trojans
SensitiveCnt Integer No

Number of sensitive information entries.
LayerCreateTime String No

Image layer creation time

Parameter format: YYYY-MM-DD hh:mm:ss

ImageLayerVul

Vulnerability information of the mirror

Used by actions: DescribeImageLayerVulList.

Name Type Description
OwnerAccountName String

Owner account name
OwnerUin String

Owner account uin
OwnerAppId Integer

Owner account appid
ID Integer

Vulnerability record id
LayerId String

Image layer id
FirstFoundTime String

First detected time

Parameter format: YYYY-MM-DD hh:mm:ss
LatestFoundTime String

Last discovery time

Parameter format: YYYY-MM-DD hh:mm:ss
VulInfo ImageVulBaseInfo

Vulnerability information
ImageId String

Image ID.

ImageRegistryConnectivityTaskResult

Connectivity task result of an image repository.

Used by actions: DescribeImageRegistryConnectivityTaskResult.

Name Type Required Description
ConnDetectMessage String No

Check result
ConnDetectStatus String No

Check status
FailReason String No

Failure reason
Quuid String No

Host Quuid
Solution String No

Troubleshoot solution
Uuid String No

Host Uuid

ImageRegistryDetectionHostParam

Probe host parameters in the mirror repository

Used by actions: CreateImageRegistryConnectivityTask.

Name Type Required Description
InstanceUuid String No

Host UUID.
Region String No

Region.
Quuid String No

Host quuid

ImageRegistryExportJobInfo

Subtask information of image repository scanning

Used by actions: DescribeImageExportJobList.

Name Type Required Description
JobID String No

Export task id
Status String No

Task status.

Enumeration values:

  • SUCCESS: Task successful
OwnerAppId Integer No

appid of the account to which the task belongs
ExportType String No

Export type
Name String No

Task name
ExportCreateTime String No

Export time

Parameter format: YYYY-MM-DD hh:mm:ss

ImageRegistryInfo

Image repository information.

Used by actions: DescribeImageRegistryList.

Name Type Description
RegistryId Integer

Repository id
Name String

Repository name.
RegistryType String

Repository type
Url String

Warehouse url
NetType String

Network connection type
RegistryRegion String

Repository region
RegistryVersion String

Warehouse version
InstanceID String

Repository instance id.
LatestSyncTime String

Last sync time

Parameter format: YYYY-MM-DD hh:mm:ss
SyncSolution String

Solution to synchronization failure
SyncMode Integer

Synchronization method
ConnDetectDetail Array of RegistryConnDetectResult

Connection check description
ConnDetectType String

Connection type
OwnerAccountName String

Account name of the repository
OwnerAppId Integer

appid of the account associated with the repository
OwnerUin String

Account uin associated with the repository
SyncStatus String

Synchronization status

Enumeration values:

  • doing: Syncing
  • success: Synchronization successful
  • failed: Synchronization failed
SyncFailReason String

Reason for synchronization failure.
RegionInfo RegionInfo

Region information.
UserName String

Mirror warehouse username

ImageRegistryNamespaceInfo

Mirror repository namespace information

Used by actions: DescribeImageRegistryNamespaceList.

Name Type Required Description
Namespace String Yes

Namespace.

ImageRegistryScanSubTaskInfo

Subtask information of image repository scanning

Used by actions: DescribeImageRegistryScanSubTaskList.

Name Type Required Description
SubTaskId Integer No

Task sub-id
ImageId String No

Image ID.
ImageName String No

Image name.
ImageTag String No

Image tag
ScanStatus String No

Task status

Enumeration values:

  • FINISHED: Scan complete
  • SCANNING: Scanning
  • CANCELLED: Canceled
  • SCAN_EXCEPTION: Scan exception
FailedReason String No

Failure reason
Solution String No

Solution.
OwnerAccountName String No

Account name of the scheduled task
OwnerUin String No

uin of the account associated with the scheduled task
OwnerAppId Integer No

appid of the account associated with the scheduled task
IsLatestImage Boolean No

Whether it is the newest image
ImageRepoAddress String No

Image address
RegistryType String No

Image repository type

ImageRegistryScanTaskInfo

Image repository scan task information

Used by actions: DescribeImageRegistryScanTaskList.

Name Type Required Description
Id Integer No

Task ID.
TimedScanConfigId Integer No

Scheduled scan task id.
AutoMatchMode Array of String No

Automatic matching mode

Enumeration values:

  • BY_CLUSTER: Select by cluster
  • LATEST_VERSION: Scan the latest version image only
  • LOCAL_IMAGE: Local image
ScopeMode String No

Scan asset mode

Enumeration values:

  • ALL: All
  • MANUAL: Manual selection
  • AUTO_MATCH: Automatic matching
TriggerType String No

Task trigger type

Enumeration values:

  • TIMED: scheduled task
  • MANUAL: manual triggering
ScanType Array of String No

Scan category

Enumeration values:

  • CVE: vulnerability
  • RISK: risk
  • VIRUS: Trojan
ImageIds Array of Integer No

Image id scanned
Status String No

Task status

Enumeration values:

  • RUNNING: Executing
  • SUCCESS: Task successful
  • TIMEOUT: Task timeout
  • FAILED: Task failure
  • CANCELLED: Canceled
OwnerAccountName String No

Scheduled task associated account name
OwnerAppId Integer No

appid of the account associated with the scheduled task
OwnerUin String No

uin of the associated account for the scheduled task
ScanImageCount Integer No

Scan image count
SuccessImageCount Integer No

Image count scanned successfully
FailureImageCount Integer No

Image count of scan failure
IgnoredImageCount Integer No

Number of images ignored by the task
CancelledImageCount Integer No

Task cancelled image count
ScanStartTime String No

Scan start time

Parameter format: hh:mm
ScanEndTime String No

Scan stop time

Parameter format: hh:mm
Timeout Integer No

Timeout period, in seconds
CancelReason String No

Task cancellation reason
Name String No

Task name
Schedule ImageScanScheduleConfig No

Scan task scheduling configuration
Target ImageScanAssetTarget No

Scan task target
Filter ImageScanRegistryFilter No

Scan task filtering configuration

ImageRegistryTimedScanTaskInfo

Image repository periodic scan task information

Used by actions: DescribeImageRegistryTimedScanTaskConfig.

Name Type Required Description
Id Integer No

Task ID.
Name String No

Task name
Enable Boolean No

Whether to enable
ScanType Array of String No

Scan category

Enumeration values:

  • CVE: vulnerability
  • RISK: risk
  • VIRUS: Trojan
Schedule ImageScanScheduleConfig No

Scheduled task scheduling configuration
Target ImageScanAssetTarget No

Scan target image filtering configuration
Filter ImageScanRegistryFilter No

Mirror filter configuration
Timeout Integer No

Timeout period, in seconds
LastScanTime String No

Last scan time

Parameter format: YYYY-MM-DD hh:mm:ss
OwnerAccountName String No

Scheduled task associated account name
OwnerAppId Integer No

appid of the account associated with the scheduled task
OwnerUin String No

uin of the associated account for the scheduled task
CreateTime String No

Configuration creation time

Parameter format: YYYY-MM-DD hh:mm:ss
UpdateTime String No

Configuration update time

Parameter format: YYYY-MM-DD hh:mm:ss

ImageRegistryTypeCountItem

Image repository type statistics

Used by actions: DescribeRegistryOverview.

Name Type Description
RegistryType String

Repository type
Count Integer

Number of warehouses

ImageScanAssetTarget

Image scanning mirror matching configuration

Used by actions: CreateImageRegistryScanTask, CreateImageRegistryTimedScanTaskConfig, DescribeImageRegistryScanTaskList, DescribeImageRegistryTimedScanTaskConfig, ModifyImageRegistryTimedScanTaskConfig.

Name Type Required Description
Mode String No

Target image match mode

Enumeration values:

  • ALL: all images
  • MANUAL: select
  • AUTO_MATCH: auto-match
ExcludeImages Array of String No

Image id excluded from scan in mirror mode for all
Images Array of String No

id of the mirror that needs to be scanned in manual selection mode
AutoMatch ImageScanAutoMatchConfig No

Matching configuration in auto-match mode

ImageScanAutoMatchConfig

Image scanning auto-match configuration

Used by actions: CreateImageRegistryScanTask, CreateImageRegistryTimedScanTaskConfig, ModifyImageRegistryTimedScanTaskConfig.

Name Type Required Description
Modes Array of String No

Match mode

Enumeration values:

  • BY_CLUSTER: select by cluster
  • RUNNING_CONTAINER: images running on the container cluster
  • LATEST_VERSION: latest version image
  • LOCAL_HOST: images running on the host node
Clusters Array of String No

Cluster ID.

ImageScanRegistryFilter

Image repository scanning filter

Used by actions: CreateImageRegistryScanTask, CreateImageRegistryTimedScanTaskConfig, DescribeImageRegistryScanTaskList, DescribeImageRegistryTimedScanTaskConfig, ModifyImageRegistryTimedScanTaskConfig.

Name Type Required Description
RegistryType Array of String No

Repository type
Namespace Array of String No

Repository namespace

ImageScanScheduleConfig

Image scanning cycle configuration

Used by actions: BatchModifyImageRegistryTimedScanTaskConfig, CreateImageRegistryTimedScanTaskConfig, DescribeImageRegistryScanTaskList, DescribeImageRegistryTimedScanTaskConfig, ModifyImageRegistryTimedScanTaskConfig.

Name Type Required Description
CycleType String No

Cycle type

Enumeration values:

  • DAILY: Daily
  • WEEKLY: Weekly
  • MONTHLY: Monthly
CycleDays Array of Integer No

Specific date. For weekly type: 1-7 (Monday to Sunday); for monthly type: 1-31; disabled for daily type.
StartTime String No

Scan start time

Parameter format: hh:mm
Timezone String No

Time zone

ImageSensitiveInfo

Sensitive information in the mirror

Used by actions: DescribeImageSensitiveInfoList.

Name Type Required Description
Behavior Integer No

Sensitive information behavior types

Enumeration values:

  • 1: start up with root account
  • 2: code leakage
  • 3: credential leakage
Type Integer No

Rule type.
Level String No

Risk level

Enumeration values:

  • 1: Low risk
  • 2: Medium risk
  • 3: High-risk
  • 4: Severe risk
Describe String No

Risk description
InstructionContent String No

Risk content
ImageId String No

Image ID.
OwnerAccountName String No

Associated account name
OwnerUin String No

Associated account uin
OwnerAppId Integer No

appid of the associated account
AffectImageCount Integer No

Numbers of affected images
LayerId String No

Image layer Id
Id Integer No

Image Id
FirstFoundTime String No

First discovery time

Parameter format: YYYY-MM-DD hh:mm:ss
LatestFoundTime String No

Most recent discovery time

Parameter format: YYYY-MM-DD hh:mm:ss
LayerIndex Integer No

Image layer serial number

ImageSensitiveWhitelist

Sensitive information allowlist for container images

Used by actions: DescribeImageSensitiveWhitelist.

Name Type Required Description
RuleId Integer No

Sensitive information allowlist id
OwnerAccountName String No

Allowlist associated account name
OwnerUin String No

Account uin of the allowlist
OwnerAppId Integer No

appid of the account associated with the allowlist
Behavior Integer No

Allowlisted sensitive information types

Enumeration values:

  • 1: root startup
  • 2: code leakage
  • 3: credential leakage
Scope Integer No

Whitelist scope

Enumeration values:

  • 0: Selected image
  • 1: All images
ImageIds Array of Integer No

Allowlist effective mirror id
Remark String No

Remarks.
Status Integer No

Effective status

Enumeration values:

  • 0: allowlist ineffective
  • 1: allowlist effective
Name String No

Sensitive information allowlist name
UpdateTime String No

Update time

Parameter format: YYYY-MM-DD hh:mm:ss

ImageVirus

Virus info of an image

Used by actions: DescribeImageVirusList.

Name Type Required Description
Path String No

Trojan path
RiskLevel String No

Risk level
Category String No

Category
VirusName String No

Trojan name
Tags String No

Trojan Tag
FileType String No

File type
FileName String No

File name.
FileMd5 String No

File md5
FileSize Integer No

File size
FirstDetectedTime String No

First detection time

Parameter format: YYYY-MM-DD hh:mm:ss
LatestDetectedTime String No

Last detection time

Parameter format: YYYY-MM-DD hh:mm:ss
ImageId String No

Image ID.
OwnerAccountName String No

Associated account name
OwnerUin String No

Associated account uin
OwnerAppId Integer No

appid of the associated account
CheckPlatform String No

Detection platform
AffectImageCount Integer No

Numbers of affected images
LayerId String No

Image layer id
Id Integer No

Trojan record id
Suggestion String No

Trojan handling suggestions
Description String No

Trojan description
VirusType String No

Trojan horse type

ImageVirusWhitelist

Trojan whitelist for container images

Used by actions: DescribeImageVirusWhitelist.

Name Type Required Description
RuleId Integer No

Allowlist ID.
OwnerAccountName String No

Allowlist associated account name
OwnerUin String No

Account uin of the allowlist
OwnerAppId Integer No

appid of the account associated with the allowlist
Scope Integer No

Whitelist scope

Enumeration values:

  • 0: Selected image
  • 1: All images
ImageIds Integer No

Allowlist effective mirror id
Remark String No

Remarks.
Status Integer No

Whitelist status

Enumeration values:

  • 0: Invalid
  • 1: Valid
UpdateTime String No

Update time

Parameter format: YYYY-MM-DD hh:mm:ss
Name String No

Trojan whitelist name

ImageVirusWhitelistDetail

Trojan allowlist for container images

Used by actions: DescribeImageVirusWhitelistDetail.

Name Type Required Description
RuleId Integer No

Whitelist rule id
OwnerAccountName String No

Allowlist associated account name
OwnerUin String No

Allowlist associated account uin
OwnerAppId Integer No

appid of the account that the allowlist belongs to
Scope Integer No

Whitelist effective range

Enumeration values:

  • 1: All images
  • 0: Specified images
ImageIds Array of Integer No

Image ID.
Remark String No

Remarks.
Md5List Array of String No

Trojan whitelist md5 list

ImageVul

Image vulnerability information

Used by actions: DescribeImageVulList.

Name Type Description
OwnerAccountName String

Owner account name
OwnerUin String

Owner account uin
OwnerAppId Integer

Owner account appid
ID Integer

Record id
FirstFoundTime String

First discovery time

Parameter format: YYYY-MM-DD hh:mm:ss
LatestFoundTime String

Last discovery time

Parameter format: YYYY-MM-DD hh:mm:ss
VulInfo ImageVulBaseInfo

Vulnerability details
ImageId String

Image ID.

ImageVulBaseInfo

Image vulnerability information

Used by actions: DescribeImageLayerVulList, DescribeImageVulList, DescribeImageVulSummaryList.

Name Type Description
AffectedComponents Array of VulAffectedComponent

Affected component information
Name String

Vulnerability name
CVEID String

Vulnerability CVEID
Category String

Vulnerability category
PublishTime String

Vulnerability release time
CheckMethod String

Vulnerability detection method
DefendStatus String

Whether the defense is supported

Enumeration value:

  • ENABLED: support defense
  • NOT_ENABLED: defense not supported
SupportFix Boolean

Whether repair is supported
CvssScore String

CVSS score
Remark String

Vulnerability severity description
Summary String

Vulnerability description
CVSSLevel String

Severity level
VulAffect String

Primary impact type
KVERecord Boolean

Existence of exploitation in the wild
EPSSScore Float

EPSS probability score
AffectVendor String

Impacted manufacturer
AffectProduct String

Impact on the target product
Mechanism String

Vulnerability principle
Precondition String

Prerequisites for an attack
FixSolution String

Vulnerability remediation suggestions
RefLink String

Vulnerability-related link
Label Array of String

Vulnerability tag
PocId String

Vulnerability Id

ImageVulSummary

Vulnerability information of the mirror

Used by actions: DescribeImageVulSummaryList.

Name Type Description
OwnerAccountName String

Owner account name
OwnerUin String

Owner account uin
OwnerAppId Integer

Owner account appid
FirstFoundTime String

First detected time

Parameter format: YYYY-MM-DD hh:mm:ss
LatestFoundTime String

Last discovery time

Parameter format: YYYY-MM-DD hh:mm:ss
AffectImageCount Integer

Numbers of affected images
VulInfo ImageVulBaseInfo

Vulnerability information
ID Integer

Record id

ImageVulWhitelist

Vulnerability allowlist for container images

Used by actions: DescribeImageVulWhitelist.

Name Type Required Description
RuleId Integer No

Vulnerability allowlist id
OwnerAccountName String No

Account name of the allowlist
OwnerUin String No

uin of the account to which the allowlist belongs
OwnerAppId Integer No

appid of the associated account with the allowlist
Scope Integer No

Whitelist scope

Enumeration values:

  • 0: Selected images
  • 1: All images
ImageIds Array of Integer No

Allowlist effective mirror id
Remark String No

Remarks.
PocId String No

Vulnerability id
VulName String No

Vulnerability allowlist name
Status Integer No

Whitelist status

Enumeration values:

  • 0: Inactive
  • 1: Active
UpdateTime String No

Update time

Parameter format: YYYY-MM-DD hh:mm:ss

InquireInfo

Billing item information

Used by actions: DescribeDspmPayInfo.

Name Type Description
Name String Billing item name.
Value Integer Purchase quantity

InstanceIDWithAppIdItem

Host instance location information

Used by actions: CreateCSIPManualMalwareScan, CreateEDRManualScan, DescribeMalwareTimingScanSetting, ModifyEDRRule, ModifyMalwareTimingScanSettings, ModifyNetAttackSetting, ModifyReverseShellSystemPolicyConfig.

Name Type Required Description
AppId Integer Yes AppId of the machine ownership
InstanceID String Yes Machine instance ID.

IpAssetListVO

IP List

Used by actions: DescribePublicIpAssets.

Name Type Description
AssetId String Asset ID
AssetName String Asset Name
AssetType String Asset type
Region String Region.
CFWStatus Integer Cloud Defense Status
AssetCreateTime String Asset creation time.
PublicIp String Public IP address
PublicIpType Integer Public IP Type
VpcId String vpc
VpcName String VPC Name
AppId Integer appid
Uin String User UIN
NickName String Name
IsCore Integer Core
IsCloud Integer On-Cloud
Attack Integer Network attack
Access Integer Network access
Intercept Integer Network Interception
InBandwidth String Inbound bandwidth
OutBandwidth String Outbound bandwidth
InFlow String Inbound traffic
OutFlow String Outbound traffic
LastScanTime String Last scan time
PortRisk Integer Port risk
VulnerabilityRisk Integer Vulnerability risk
ConfigurationRisk Integer Configuration risk
ScanTask Integer Scan Task
WeakPassword Integer Weak password
WebContentRisk Integer Content risk
Tag Array of Tag Tag.
AddressId String EIP Primary Key
MemberId String MemberId information
RiskExposure Integer Risk service exposure
IsNewAsset Integer New Asset or Not. 1: New
VerifyStatus Integer Asset Authentication Status. 0-Pending Authentication; 1-Authentication Succeeded; 2-Authentication in Progress; 3+-Authentication Failed.

KBDetail

Windows KB detailed information

Used by actions: DescribeHostKBRiskList, DescribeKBDetail.

Name Type Description
ID Integer

KB patch internal ID (kb_info.id)
Number String

KB No.
Parameter format: e.g. KB5001234
Name String

KB patch name
ReferUrl String

Reference link (Microsoft Official Documentation address)
PublishTime String

Release time
Parameter format: YYYY-MM-DD HH:mm:ss
NeedRestart Boolean

Whether restart is required after installing this KB
Enumeration values:
true: required
false: not required
RelateVulList Array of VulBriefInfo

Associated vulnerability list
RelateVulCount Integer

Total number of associated vulnerabilities
RelateProduct String

Associated os version

KBFixSummaryItem

Summary of KB patch repair

Used by actions: DescribeKBUpdatableMachineList.

Name Type Description
KBId Integer KB patch ID
KBName String KB patch name
KBNo String KB No. (for example, KB5001234)
RelatedVulCount Integer Number of related vulnerabilities
AffectedCount Integer Number of affected hosts
NeedReboot Boolean Whether a system restart is required after the repair
KBPreCondition String Prerequisite dependency patches (comma-separated list of KB numbers)

KBUpdateMachineItem

Host information for update patches

Used by actions: DescribeKBUpdatableMachineList.

Name Type Description
KBId Integer

KB patch ID
InstanceId String

Host instance ID.
MachineName String

Host name.
MachineIp String

Host IP address.
PublicIp String

Public IP address
OsName String

OS name
MachineStatus String

Host online status
Enumeration values:
ONLINE: online
OFFLINE: offline
SupportAutoFix Integer

Whether auto-update patch is supported
Enumeration values:
0: unsupported
1: supported
FixStatus Integer

Current remediation status
Enumeration values:
0: Unfixed
1: In remediation
2: Fix failed
3: Repair successful
4: Remediation timeout
LatestFixTime String

Last repair time
Parameter format: YYYY-MM-DDTHH:mm:ssZ (ISO8601 format)
NotFixableReason String

Non-repairable reason. Returned when SupportAutoFix is 0.
TagItems Array of MiniTagItem

Asset tag list
AppId Integer

Account AppId
PayVersion String

Payment version information
Enumeration values:
BASIC: basic version
PRO: pro edition
ULTIMATE: flagship edition

KeySandboxCredential

Credential data structure, used for list query and details query response

Used by actions: DescribeKeySandboxCredentialList.

Name Type Description
CredentialId String Credential ID
CredentialName String Credential name
CredentialType String Credential type
Enumeration value:
access: standard Key (Key-Value pair)
sts: STS temporary key credential
CredentialEffectScope CredentialEffectScope Scope of effective machines
CreateTime String Creation time.
Parameter format: YYYY-MM-DDTHH:mm:ssZ (ISO8601 format)
UpdateTime String Update time
Parameter format: YYYY-MM-DDTHH:mm:ssZ (ISO8601 format)

KeyValue

KeyValue Pair

Used by actions: DescribeAlertList, DescribeBaselineAggregatedItemList.

Name Type Required Description
Key String No Field
Value String No Value.

KeyValueInt

Key-value pair (integer)

Used by actions: DescribeIaCFileList, DescribeIaCFileOverview.

Name Type Required Description
Key Integer No

Key.
Value Integer No

Value.

LevelOption

Custom alarm/Risk level

Used by actions: DescribeNotifySettingAk, ModifyNotifySettingAk.

Name Type Required Description
Type String No Alarm/risk type
Level Array of Integer No Alarm severity (1: notification, 2: low risk, 3: medium risk, 4: high risk, 5: critical)

LicenseBindFailedItem

Bind failure detail

Used by actions: DescribeCSIPLicenseBindSchedule.

Name Type Description
InstanceId String Instance ID.
ExceptionMessage String Reason for failure
FixMessage String Fixing suggestion
MachineExtraInfo MachineExtraInfo Additional Information on Machine

LicenseBindFilter

Filter criteria

Used by actions: DescribeCSIPLicenseBindSchedule.

Name Type Required Description
Name String No Filter field name. Currently, only Status is supported.
Values Array of String No Filter value list

LicenseBindScheduleItem

Binding status details of a single machine

Used by actions: DescribeCSIPLicenseBindSchedule.

Name Type Description
Quuid String Instance ID.
Status Integer Binding status. 0: initialization; 1: successful; 2: failed; 3: skipped.
ErrMsg String Error message
FixMessage String Fixing suggestion

LicenseBindTaskDetail

Authorization binding task details

Used by actions: DescribeCWPLicenseBindSchedule.

Name Type Description
Quuid String

UUID of the CVM instance
ErrMsg String

Error information.
Status Integer

0 in execution, 1 successful, 2 failed
FixMessage String

Repair advice
MachineExtraInfo MachineExtraInfo

Additional information of machine

LicenseStatusItem

Authorization status summary of each billing item

Used by actions: DescribeLicenseStatus.

Name Type Description
ResourceId String

Resource ID
LicenseType String

Authorization type (ENTERPRISE_HP=flagship edition/ADVANCED_HP=pro edition/RASP)
Name String

Authorization name (flagship edition/pro edition/RASP)
Category Integer

Authorization type. 0: host authorization. 1: RASP authorization.
TotalNum Integer

Total.
UsedNum Integer

Used
RemainNum Integer

Remaining
BeginTime String

Earliest start time (format: 2006-01-02 15:04:05)
EndTime String

Latest expiration time (format: 2006-01-02 15:04:05)

LicenseUnbindFailedItem

Unbind failure detail

Used by actions: ModifyCSIPLicenseUnBinds, ModifyCSIPRaspLicenseUnBinds.

Name Type Description
InstanceId String

Instance ID.
ExceptionMessage String

Failure reason

LighthouseFirewallRule

Firewall rules of a lightweight application server

Used by actions: DescribeLighthouseFirewallRules.

Name Type Description
AppType String

Application type.
Protocol String

Protocol
Port String

Port
CidrBlock String

Address
Ipv6CidrBlock String

ipv6 address
Action String

Status.
FirewallRuleDescription String

Description.

Location

Location information

Used by actions: DescribeDspmLogList.

Name Type Description
Country String nation
Region String Region.
City String city

LogAppCollectPath

Collection path of application logs.

Used by actions: DescribeEdrLogCollectPaths, ModifyEdrLogCollectPath.

Name Type Required Description
Id Integer No

Configuration ID.
Path String No

Collection path.
LogTag String No

Log tag.
CreateTime String No

Creation time.
ModifyTime String No

Modification time.

LogCLSFilter

Log filter

Used by actions: DescribeCLSLogIndexV3.

Name Type Required Description
Key String No

Key
Values Array of String No

Value.

LogColumn

Log column information

Used by actions: DescribeCLSLogListV3.

Name Type Description
Name String

Name.
Type String

Type.

LogContextInfo

Context information of log retrieval

Used by actions: DescribeCLSLogListV3.

Name Type Required Description
TopicId String No

Topic id
Context String No

context

LogDeliveryCkafkaConfig

Log shipping information configuration.

Used by actions: DescribeDspmLogTypeConfigList.

Name Type Description
VipType Integer

Access type
InstanceId String

Instance id
InstanceName String

Instance name.
Vip String

Virtual IP VipType is 7, valid
Vport String

The virtual port VipType is 7 valid
Domain String

The domain name is valid when VipType is 1.
DomainPort String

Domain port VipType is 1 and valid
RegionId String

Region
VpcId String

Instance vpc
SubnetId String

Instance subnet
Healthy Integer

Instance health status. 1: healthy, 2: warning, 3: abnormal, 4: instance does not exist
LogType Integer

Log type.
TopicId String

Delivered Topic ID
TopicName String

Delivered topicname
Status Integer

Delivery status
StatusMessages String

Status information
IsOpen Integer

Enable or disable. Delivery status: 1 for enabled and 0 for disabled. It is enabled by default, but disabled if there is no topic.

LogDeliveryInfo

Topic configuration for log type shipping.

Used by actions: ModifyDspmCkafkaSave, ModifyDspmCkafkaStart, ModifyDspmCkafkaStop.

Name Type Required Description
LogType Integer Yes Log type
TopicId String Yes Shipping topicid.
TopicName String Yes Shipped topicname.

LogDeliveryType

Log type for log shipping.

Used by actions: DescribeDspmLogDeliveryType.

Name Type Description
LogType Integer Log shipping type.
LogTypeName String Name of the shipped log type.
LogTypeDesc String Description of the shipped log type.

LogDynamicIndex

Log dynamic indexing information

Used by actions: DescribeCLSLogIndexV3.

Name Type Description
Status Boolean

Status.

LogFullTextInfo

Index information of full text of the log

Used by actions: DescribeCLSLogIndexV3.

Name Type Description
CaseSensitive Boolean

Case-sensitive
Tokenizer String

token
ContainZH Boolean

contain Chinese

LogHighLightItem

Log highlight information

Used by actions: DescribeCLSLogListV3.

Name Type Description
Key String

Key
Values Array of String

Value.

LogIndexRuleInfo

Log indexing rule information

Used by actions: DescribeCLSLogIndexV3.

Name Type Description
FullText LogFullTextInfo

Full-text index
KeyValue LogRuleKeyValueInfo

Key-value index
Tag LogRuleKeyValueInfo

Tag.
DynamicIndex LogDynamicIndex

Dynamic indexing

LogItem

Log entry

Used by actions: DescribeCLSLogListV3.

Name Type Description
Key String

Key
Value String

Value.

LogItems

Log entry list

Used by actions: DescribeCLSLogListV3.

Name Type Description
Data Array of LogItem

Value.

LogKeyValueInfo

Log key-value index details

Used by actions: DescribeCLSLogIndexV3.

Name Type Description
Key String

Key
Value LogValueInfo

Value.

LogRuleKeyValueInfo

Log key-value indexing rule information

Used by actions: DescribeCLSLogIndexV3.

Name Type Description
CaseSensitive Boolean

Case-sensitive
KeyValues Array of LogKeyValueInfo

Key-value index information

LogSearchErrors

Log retrieval error message

Used by actions: DescribeCLSLogListV3.

Name Type Description
TopicId String

Topic
ErrorMsg String

Error information.
ErrorCodeStr String

Error information.

LogSearchInfos

Log retrieval information

Used by actions: DescribeCLSLogListV3.

Name Type Description
TopicId String

Topic
Period Integer

Time interval
Context String

context

LogSearchResult

Log retrieval results

Used by actions: DescribeCLSLogListV3.

Name Type Description
Time Integer

Time
TopicId String

Topic
TopicName String

Topic name.
Source String

Source.
FileName String

File name
PkgId String

pkgid
PkgLogId String

pkglogid
LogJson String

json data
HostName String

host name
RawLog String

log message
IndexStatus String

Index status.
HighLights Array of LogHighLightItem

Highlighted Information

LogSearchTopics

Topic information of log retrieval

Used by actions: DescribeCLSLogListV3.

Name Type Description
Errors Array of LogSearchErrors

Error information.
Infos Array of LogSearchInfos

Normal information

LogTopicIndexInfo

Log topic search information

Used by actions: DescribeCLSLogIndexV3.

Name Type Description
TopicId String

Topic
Status Boolean

Status.
Rule LogIndexRuleInfo

Rule
ModifyTime String

Modification time.
IncludeInternalFields Boolean

Whether it contains
MetadataFlag Integer

Metadata tag

LogValueInfo

Log index value description

Used by actions: DescribeCLSLogIndexV3.

Name Type Description
Type String

Type.
Tokenizer String

Tag.
SqlFlag Boolean

sql tag
ContainZH Boolean

contain Chinese
Alias String

Alias

LoginWhiteCombinedInfo

Merge cross-region log-in allowlists

Used by actions: DescribeLoginWhiteCombinedList.

Name Type Description
Places Array of Place

Allowlist region
UserName String

allowlisted users (multiple users separated by commas)
SrcIp String

Allowlisted IPs (multiple IPs separated by commas)
Locale String

Region string
Remark String

Remarks.
StartTime String

Start time.
EndTime String

End time.
IsGlobal Integer

Whether the settings take effect globally. 1: take effect globally; 0: take effect on the specified host list'
Name String

Allowlist name. If IsLocal is set to 1, the name is fixed as All servers. If the allowlist applies to only a single server, the name is the server's private IP Address. If the allowlist applies to multiple servers, the name is the number of servers, such as 11.
Desc String

Return the server name when the allowlist applies to only one server.
Id Integer

Allowlist ID
CreateTime String

Creation time.
ModifyTime String

Last modification time
Uuid String

Server Uuid
Locations String

Login location

Machine

Host list

Used by actions: DescribeCWPMachines.

Name Type Description
AgentStatus String

Agent status. Valid values: ONLINE: online; OFFLINE: offline; UNINSTALL: not installed
AgentVersion String

Agent version
AppId Integer

Account AppId
CloudFromEnum String

Cloud service provider
CloudTags Array of Tag

Cloud tag list
CsipProtectType String

CSIP protection type. Value: BASIC: basic version; PRO: pro edition; ULTIMATE: flagship edition
ExposedStatus String

Exposure status
InstanceID String

Instance ID.
InstanceStatus String

Instance status. Value: RUNNING-running, STOPPED-shut down, EXPIRED-pending recycling
IpList Array of String

Network Card IP List
IsNew Boolean

Whether it is a new host (added within 15 days)
KernelVersion String

Kernel version
LatestOfflineTime Integer

Last offline time (Unix timestamp).
MachineIp String

Private IP address.
MachineName String

Host name.
MachineOs String

Operating system.
MachineWanIp String

Public IP address.
PayMode String

Payment mode. Valid values: PREPAID: prepaid; POSTPAID: postpaid
ProjectId Integer

Project ID
ProtectType String

Protection type. Value: NONE: no protection; BASIC: basic version; PRO: pro edition; ULTIMATE: flagship edition; PRO_LH: lightweight edition
Quuid String

Host unique identifier
RegionInfo RegionInfo

Region information.
Remark String

Remarks.
TagItems Array of MiniTagItem

Asset tag list
TagModifyInfo AssetTagModifyAssetItem

Tag change information
TatStatus String

TAT status. Valid values: ONLINE: online; OFFLINE: offline
Uuid String

Agent unique ID
VpcId String

VPC ID
NodeType String

Host node type

Enumeration values:

  • NONE: Host node
  • CLUSTER: Cluster node
  • CONTAINER: Container node
ContainerDefendStatus String

Container protection status

Enumeration values:

  • Enabled: Enable protection
  • Disabled: Disable protection
  • Unknown: Unknown
ContainerCount Integer

Container count
CpuCoreCount Integer

Number of cores.
MigrationRequired Boolean

Whether migration is supported
IsSupportXSPM Boolean

Whether exposed surface scan is supported
CanUnbind Boolean

Whether it can be unbound

MachineClearHistory

Machine Cleanup Record Object

Used by actions: DescribeMachineClearHistory.

Name Type Description
Id Integer

ID value
InstanceId String

Instance ID.
InstanceName String

Instance name.
PublicIp String

Public IP address
PrivateIp String

Private IP address.
AgentLastOfflineTime String

Client's last offline time
CreateTime String

Creation time.

MachineDetail

Host list

Used by actions: DescribeCWPMachineDetail.

Name Type Description
AgentStatus String

Agent status
AgentVersion String

Agent version
AppId Integer

Account AppId
AssetTypeName String

Asset type name
BootTime Integer

System boot time (Unix timestamp).
BuyTime Integer

Purchase time (Unix timestamp).
CloudFromEnum String

Cloud service provider
CloudTags Array of Tags

Cloud tag list
CoreVersion String

Kernel version
Cpu String

CPU info
CpuLoad String

CPU load
CpuSize Integer

CPU cores.
DeviceVersion String

Device model
Disks Array of DiskPartitionInfo

Disk partition information
EndTime Integer

Expiration time (Unix timestamp).
ExposedStatus String

Exposure status
InstallTime Integer

Installation time (Unix timestamp).
InstanceID String

Instance ID.
InstanceStatus String

Instance status
KernelVersion String

Kernel version
LatestLiveTime Integer

Last online time (Unix timestamp).
LatestOfflineTime Integer

Last offline time (Unix timestamp).
MachineIp String

Private IP address.
MachineName String

Host name.
MachineOs String

Operating system (cloud collection)
MachineStatus String

Host status
MachineWanIp String

Public IP address.
MemSize Integer

Memory size (MB)
MemoryLoad String

Memory usage rate
NetCards Array of NetworkCardInfo

ENI information.
OsByAgent String

Operating system (client collection)
PayMode String

Payment mode
ProjectId Integer

Project ID
ProtectDays Integer

Days protected
ProtectType String

Protection type
Quuid String

Host unique identifier
RegionInfo RegionInfo

Region information.
Remark String

Remarks.
SerialNumber String

Serial number
TagItems Array of MiniTagItem

Asset tag list
TagModifyInfo AssetTagModifyAssetItem

Tag change information
Uuid String

Agent unique ID
VpcCidrBlock String

VPC CIDR
VpcId String

VPC ID
VpcName String

VPC name.
NodeType String

Host node type

Enumeration values:

  • NONE: Host node
  • CLUSTER: Cluster node
  • CONTAINER: Container node
ContainerDefendStatus String

Container protection status

Enumeration values:

  • Enabled: Enable protection
  • Disabled: Disable protection
  • Unknown: Unknown
ClusterCaMd5 String

Cluster visa md5
ContainerEnvInfo ContainerEnvInfo

Container environment info
ClusterId String

Cluster ID.
ClusterName String

Cluster name.

MachineExtraInfo

Additional Information on Machine

Used by actions: DescribeCSIPLicenseBindSchedule, DescribeCWPLicenseBindSchedule, DescribeLoginTypeHost, DescribeNFSScanHost, DescribePreventUninstallHost, DescribeProcessDaemonHost.

Name Type Description
WanIP String Public IP address
PrivateIP String Private IP address
NetworkType Integer Network type: 1-vpc network 2-basic network 3-Non-Tencent Cloud Network
NetworkName String VPC ID
InstanceID String CVM instance ID
HostName String Host name.

MachineLoginType

CVM login method

Used by actions: DescribeMachineLoginType.

Name Type Required Description
InstanceId String No

Instance ID.
Quuid String No

Host Quuid
LoginType Integer No

Login method: 0-original login method, 1-scan code for password-free log-in, 2-enable scan code, 3-disable scan code

MachineTag

Server tag information

Used by actions: DescribeLoginWhiteHostList.

Name Type Description
Rid Integer

Associated tag ID
Name String

Tag name
TagId Integer

Tag ID

MiniTagItem

Brief asset tag element for internal CSIP use.

Used by actions: DescribeBaselineFixRecordList, DescribeBaselineItemRiskList, DescribeBaselineSubTaskList, DescribeCWPMachineDetail, DescribeCWPMachines, DescribeKBUpdatableMachineList, DescribeVulComponentRelateHost, DescribeVulFixableMachineList, DescribeVulHostRelateComponent, DescribeVulRiskRelateHost.

Name Type Required Description
Color String No Tag display color.
Description String No Tag description.
ID Integer No Tag ID.
TagKey String No Tag key (Chinese).
TagValue String No Tag value (Chinese).
TagKeyEn String No Tag key (English).
TagValueEn String No Tag value (English).

ModifyLoginTypeFailInfo

Details of failed host login method modifications.

Used by actions: DescribeModifyMachinesLoginTypeTasks, StartOrModifyPreventUninstall.

Name Type Required Description
MachineName String No

Host name.
InstanceId String No

Host instance ID.
MachineIp String No

Host private IP address
MachineWanIp String No

Public IP of the server
Region String No

Host availability zone
MachineType String No

Specific host types
Message String No

The following fixed values require special handling on the frontend. Other failure reasons can be displayed directly:

  1. UNINSTALLED -- not installed
  2. NEED_UPGRADE -- requires upgrading
  3. NOT_RUNNING -- is shut down
  4. NO_PASSWORD -- password login is not enabled, so QR code login cannot be enabled
MessageDesc String No

Failure reason

ModifyMachinesLoginTypeTask

Batch task for modifying the host login method.

Used by actions: DescribeModifyMachinesLoginTypeTasks.

Name Type Description
Id Integer

Task ID.
Status Integer

1-In progress, 2 completed
SuccessCount Integer

Successfully executed count.
FailList Array of ModifyLoginTypeFailInfo

Host list of failed execution
SuccessInstances Array of String

List of instance IDs with successful modification.
ProgressingInstances Array of String

List of instance IDs being modified
FailedHostCount Integer

Number of failed hosts

ModifyProtectionSetting

Protection settings object.

Used by actions: ModifyProtectionSetting.

Name Type Required Description
QUUID String Yes Unique asset ID.
Enable Integer No Master switch. Valid values: 0 (disabled) and 1 (enabled).
VulDefEnable Integer No Vulnerability defense switch. Valid values: 0 (disabled) and 1 (enabled).
VulDefMode Integer No Vulnerability defense mode. Valid values: 0 (standard) and 1 (major event protection).
VulDefAction Integer No Vulnerability defense action. Valid values: 0 (detection only) and 1 (detection and prevention).
MemShellDefEnable Integer No In-memory webshell defense switch. Valid values: 0 (disabled) and 1 (enabled).
PerformanceLimit Integer No Performance limit switch. Valid values: 0 (disabled) and 1 (enabled).
PerformanceLimitCpu Integer No CPU threshold. Value range: 1–99.
PerformanceLimitMem Integer No Memory threshold. Value range: 1–99.
PerformanceLimitMemAmount Integer No Remaining memory threshold.
SafeInject Integer No Additional protection. Valid values: 0 (do not inject into processes that will restart) and 1 (inject into processes that will restart).

ModifyRuleItem

Modifies a rule item

Used by actions: ModifySecurityScoreRule.

Name Type Required Description
RuleType String No Rule type
Enumeration values:
Dimension: dimension-level rule
category: Subitem-level rule
Severity: severity-level rule
DimensionId String No Dimension ID
CategoryId String No Sub-item ID, category, and severity level are required.
Severity String No severity level. Required.
Enumeration values:
critical: severe
High: high risk
Medium: medium-risk
low: low-risk
MaxDeductScore Integer No Deduction limit
DeductPerItem Integer No Points deducted per time.

MultiAttackStageItem

Multiple attack stages corresponding to the alarm

Used by actions: DescribeEdrAlertMultiAttackStages.

Name Type Description
Id Integer

Table id.
AppId Integer

APPID
AlertId String

Alarm ID
AttackStages Array of String

Attack stage list

NICAsset

Network interface card asset

Used by actions: DescribeNICAssets.

Name Type Description
AppId String appid
Uin String uin
AssetId String Asset ID
AssetName String Asset name
AssetType String Asset type
PrivateIp String VPC IP
PublicIp String Public IP address
Region String Region.
VpcId String VPC id
VpcName String VPC Name
Tag Array of Tag Tag.
OutboundPeakBandwidth String Outbound peak bandwidth
InboundPeakBandwidth String Inbound peak bandwidth
OutboundCumulativeFlow String Cumulative Outbound Traffic
InboundCumulativeFlow String Cumulative Inbound Traffic
NetworkAttack Integer Network attack
ExposedPort Integer Exposed port
ExposedVUL Integer Exposed vulnerability
ConfigureRisk Integer Configuration risk
CreateTime String Creation time.
ScanTask Integer Number of Tasks
LastScanTime String Last scan time
Nick String Nickname
IsCore Integer Core or Not
IsNewAsset Integer New Asset or Not. 1: New

NatDnatRuleItem

DNAT rule

Used by actions: DescribeNatRules.

Name Type Description
IpProtocol String

IP protocol
PublicIpAddress String

Public IP address.
PublicPort Integer

Public network port
PrivateIpAddress String

Private IP address.
PrivatePort Integer

Private network port
Description String

Description.

NatSnatRuleItem

SNAT rule

Used by actions: DescribeNatRules.

Name Type Description
NatGatewaySnatId String

Gateway SNat ID
ResourceId String

Resource ID
ResourceType String

Resource type.
PrivateIpAddress String

Private IP address.
PublicIpAddresses String

Public IP address.
Description String

Description.
CreatedTime String

Creation time.

NetworkCardInfo

Nic information

Used by actions: DescribeCWPMachineDetail.

Name Type Description
DnsServer String

DNS server
Gateway String

Gateway
Ip String

IP address
Ipv6 String

IPv6 address
Mac String

MAC address
Name String

ENI name.

NetworkSegment

Network segment

Used by actions: DescribeEdrExcludeNetworkSegments.

Name Type Description
Segment String

Network segment
Desc String

Description.

NewAlertKey

The structure is used to input the key of the alarm to update the alarm status.

Used by actions: UpdateAlertStatusList.

Name Type Required Description
AppId String Yes User AppID to Be Changed
Type String Yes Alarm category
SubType String Yes Alarm Subcategory
Source String Yes Alarm source
Name String Yes Alarm name
Key String Yes Alarm Key
Date String Yes Time
Status Integer No Status.

NodeInfo

Node information

Used by actions: DescribeUebaBehaviorSummary.

Name Type Required Description
Key String Yes English name
Value String Yes Value.
Name String Yes Chinese Name

NotPassItemStatistic

Statistics of detection failed items by policy group.

Used by actions: DescribeBaselineOverview.

Name Type Required Description
PolicyType String No Policy type. Valid values: SYSTEM (system policy), SELF (custom policy).
PolicyID Integer No Policy ID. 0 for a SYSTEM policy.
ParentCategoryID Integer No Parent category ID. 0 for SELF policies.
NotPassCount Integer No Number of failed check items under this policy.
Name String No Policy or category name. SYSTEM takes the parent category name, and SELF takes the policy name.

NotifyAssetConfigItem

Notification asset scope configuration item

Used by actions: DescribeNotifyAssetConfig, ModifyNotifyAssetConfig.

Name Type Required Description
Module String Yes

Module name
SubModule String Yes

Submodule
AssetRange Integer Yes

Asset scope

Enumeration values:

  • 0: meaningless
  • 1: all
  • 2: selected
  • 3: by tag
InstanceIds Array of String No

ID of selected instances
ExcludedInstanceIds Array of String No

Removed instance ID
TagIds Array of Integer No

Tag ID
CloudTags Array of String No

Cloud tag
TotalCount Integer No

Total.

NotifySetting

Notification settings

Used by actions: DescribeNotifySetting, DescribeNotifySettingAlert, ModifyNotifySettingAlert.

Name Type Required Description
Module String Yes

Notification module

Enumeration values:

  • AkSk: Cloud API Risk Governance
  • Alert: Alert Center
  • Agent: Client
Mode Integer Yes

Notification settings mode

Enumeration values:

  • 0: Standard mode
  • 1: Advanced mode
Status Integer Yes

Notification status

Enumeration values:

  • 0: notification off
  • 1: notification on
BeginTime String Yes

Notification start time

Parameter format: hh:mm:ss
EndTime String Yes

Notification end time

Parameter format: hh:mm:ss
AssetRange Integer Yes

Asset scope

Enumeration values:

  • 1: All hosts
  • 2: Selected hosts
  • 3: Select by tag
Option Array of String No

Notification option

Enumeration values:

  • CRITICAL: Alarm level: critical
  • HIGH: Alarm level: high risk
  • MEDIUM: Alarm level: medium risk
  • LOW: Alarm level: low risk
  • INFO: Alarm level: reminder
  • AGENT_UNINSTALL: Client uninstallation
  • AGENT_OFFLINE: Client offline
SubModule String No

Notification module (secondary module)
Item Array of String No

Handling status

OrderDetail

Order detail

Used by actions: DescribeRaspLicenseList.

Name Type Description
ResourceID String

Resource ID
InquireKey String

Billing item
Status Integer

Order status

  • 1: normal
  • 2: isolation period
  • 3: terminated
SourceType Integer

Order type

OrderQuotaInfo

Order Quota Information

Used by actions: DescribeCSCPayInfo.

Name Type Description
QuotaKey String Quota Key
QuotaNum Integer Total Quota
QuotaUsed Integer Quota Usage

OrganizationInfo

Group Account Details

Used by actions: DescribeOrganizationInfo.

Name Type Description
NickName String Member account name
NodeName String Department Node Name, Account's Department
Role String Member/Admin/DelegatedAdmin/EntityAdmin, corresponding to Member/Administrator/Delegated Administrator/Entity Administrator
MemberId String Member Account ID
JoinType String Account Joining Method: Create/Invite.
GroupName String Group Name
AdminName String Admin account name
AdminUin String Administrator UIN
CreateTime String Creation time.
NodeCount Integer Number of departments
MemberCount Integer Number of members
SubAccountCount Integer Number of sub-accounts
AbnormalSubUserCount Integer Number of exceptional sub-accounts
GroupPermission Array of String Group Relationship Policy Permissions
MemberPermission Array of String Membership Policy Permissions
GroupPayMode Integer Group Payment Mode. 0: Self-payment; 1: Proxy Payment.
MemberPayMode Integer Personal Payment Mode. 0: Self-payment; 1: Proxy payment.
CFWProtect String Not enabled if empty. Otherwise, different strings correspond to different versions. Common for General, regardless of version.
WAFProtect String Not enabled if empty. Otherwise, different strings correspond to different versions. Common for General, regardless of version.
CWPProtect String Not enabled if empty. Otherwise, different strings correspond to different versions. Common for General, regardless of version.
Departments Array of String Array of Collections for All Departments
MemberCreateTime String Member Creation Time
CSIPProtect String Advanced/Enterprise/Ultimate
QuotaConsumer Integer 1 indicates the quota consumer.
EnableAdminCount Integer Number of enabled admins/delegated admins
CloudCountDesc Array of CloudCountDesc Account Multi-Cloud Information Statistics, in array format. Refer to the description of CloudCountDesc for details.
AdminCount Integer Total number of admins/delegated admins

OrganizationUserInfo

Group Account Member Details

Used by actions: DescribeOrganizationUserInfo.

Name Type Description
Uin String Member Account UIN
NickName String Member account name
NodeName String Department Node Name, Account's Department
AssetCount Integer Number of assets
RiskCount Integer Number of risks
AttackCount Integer Number of Attacks
Role String Member/Admin/; Member or Administrator
MemberId String Member Account ID
AppId String Member Account AppID
JoinType String Account Joining Method: Create/Invite.
CFWProtect String Not enabled if empty. Otherwise, different strings correspond to different versions. Common for General, regardless of version.
WAFProtect String Not enabled if empty. Otherwise, different strings correspond to different versions. Common for General, regardless of version.
CWPProtect String Not enabled if empty. Otherwise, different strings correspond to different versions. Common for General, regardless of version.
Enable Integer 1-Enabled; 0-Not Enabled.
CSIPProtect String Free // Free Edition Advanced //Advanced Edition Enterprise //Enterprise Edition Ultimate //Premium Edition
QuotaConsumer Integer 1 for quota consumer.
CloudType Integer Account Type. 0 for Tencent Cloud account; 1 for AWS account.
SyncFrequency Integer 0 for default value, 1 for 10 minutes, 2 for 1 hour, 3 for 24 hours.
IsExpired Boolean Whether the multi-cloud account is expired.
PermissionList Array of String Multi-Cloud Account Permission List
AuthType Integer 1
TcMemberType Integer 0 Tencent Cloud Group Account
1 Tencent Cloud access account
2. Non-Tencent Cloud
SubUserCount Integer Number of sub-accounts.
JoinTypeInfo String Joining method details

OsName

Operating System Information

Used by actions: DescribeCWPMachineOsList.

Name Type Description
MachineOSType Integer

OS type ID
Name String

OS name

Place

Log-in location information

Used by actions: AddLoginWhiteLists, DescribeLoginWhiteCombinedList, ModifyLoginWhiteRecord.

Name Type Required Description
CityId Integer Yes

City ID.
ProvinceId Integer Yes

Province ID.
CountryId Integer Yes

Country ID. Currently, only 1 is supported, indicating China.
Location String No

Location name.

PortDetectInfo

Port detection information

Used by actions: DescribePortDetectList.

Name Type Description
Host String Host address (ip or domain name)
Port Integer Port.
Protocol String Protocol
Status String Status.
UpdateTime String Last discovery time

PortRiskAdvanceCFGParamItem

Port Risk Advanced Configuration Item

Used by actions: CreateRiskCenterScanTask, ModifyRiskCenterScanTask.

Name Type Required Description
PortSets String Yes Port Collection, separated by commas.
CheckType Integer Yes Detection Item Type. 0-System-Defined; 1-User-Defined.
Detail String No Detection item description
Enable Integer No Enable/Disable. 1-Enable; 0-Disable.

PortViewPortRisk

Port Risk Objects from Port's Perspective

Used by actions: DescribeRiskCenterPortViewPortRiskList.

Name Type Description
NoHandleCount Integer Unprocessed quantity.
Level String Risk level. low: low risk, high: high risk, middle: medium risk, info: notification, extreme: severe.
Protocol String Protocol
Component String Component
Port Integer Port.
RecentTime String Latest Recognition Time
FirstTime String First Recognition Time
Suggestion Integer Disposal Suggestions. 0: Maintain Status Quo; 1: Restrict Access; 2: Block Port.
AffectAssetCount String Number of Affected Assets
Id String ID
From String Source recognition
Index String Front-end Index
AppId String User appid.
Nick String User Nickname
Uin String User UIN
Service String Service.

ProductSupport

Vulnerability information product support status

Used by actions: DescribeSearchBugInfo.

Name Type Description
VSSScan Boolean True supports scanning. False does not support scanning.
CWPScan String 0-Not Supported; 1-Supported
CFWPatch String 1 indicates virtual patches supported, 0 or null indicates not supported.
WafPatch Integer 0-Not Supported; 1-Supported
CWPFix Integer 0-Not Supported; 1-Supported
CveId String cveid

ProjectInfo

Host Project Ownership

Used by actions: DescribeCheckConnectivityHostList.

Name Type Required Description
ProjectName String No

Project name
ProjectId Integer No

Project ID.

ProtectionConfigItem

Recommended protection configuration item

Used by actions: DescribeSecurityScoreOverview.

Name Type Description
ConfigId String Configuration item ID
ConfigName String Configuration item name.
ConfigDescription String Configuration item description
ConfigGroup String Configuration group
Enumeration value:
auto_risk_discovery: auto risk discovery
auto-defense
client_hardening: Client hardening
Enabled Boolean Whether enabled

ProtectionDetail

Protection configuration details

Used by actions: DescribeSecurityScoreOverview.

Name Type Description
ConfigItems Array of ProtectionConfigItem Enablement status of each configuration item
EligibleAssetCount Integer Number of assets to protect
ProtectedAssetCount Integer Number of protected assets
CoveragePercent Integer Coverage percentage.
Value range: [0, 100].
ExpiringProducts Array of ExpiringProduct List of products about to expire

ProviderNode

Asset tree - Cloud service provider node

Used by actions: DescribeAssetTree.

Name Type Description
Provider String

Cloud service provider
ProviderName String

Cloud vendor name
Categories Array of CategoryNode

Subordinate asset category node

PublicAssetInfo

Asset information

Used by actions: DescribePublicCloudAssets.

Name Type Description
AppID Integer

Tenant ID
Provider String

Cloud service provider
ProviderName String

Cloud vendor name.
CloudAccountID String

Cloud Account ID
CloudAccountName String

Cloud account name
AssetID String

Asset ID.
AssetName String

Asset name
AssetType String

Asset type
AssetTypeName String

Asset type name
Tags Array of AssetTag

Asset tag.
Address String

Public network address
AddressType String

Public address type
ResolvedAddress Array of String

Resolution address
Region String

Region.
ProtectStatus Integer

Protection status
RiskCount Integer

Number of risks
AlarmCount Integer

Number of alarms.
CreatedAt String

Instance creation time
FirstSyncTime String

First sync time
UpdateTime String

Update time.
CriticalRiskCount Integer

Total number of severe risks
HighRiskCount Integer

Total number of high risks
MediumRiskCount Integer

Total number of medium risks
LowRiskCount Integer

Total number of low risks
AssetRID String

Unique asset ID
CustomTags Array of CustomTag

CSC tag
AssetTypeIconURL String

Asset type icon

PublicIpDomainListKey

Public IP and Domain Asset List Key

Used by actions: DeleteDomainAndIp.

Name Type Required Description
Asset String Yes Asset Value

RaspLicenseList

List of authorization packages for major event protection.

Used by actions: DescribeRaspLicenseList.

Name Type Description
QUUID String

Unique machine ID
InstanceName String

Instance name.
InstanceId String

Instance ID.
PublicIP String

Public IP Address
PrivateIP String

Private IP address.
Tags Array of Tags

Cloud tag information
ProtectionVersion Array of String

Protection edition information

  • CriticalProtection Prioritized Protection package
  • Pro Container security-Pro Edition
  • Ultimate CWP-Flagship Edition
ConfigurationSetting Integer

Protection setting

  • 0 No configuration
  • 1 Configured
Enable Integer

Master switch

  • 0 Not enabled
  • 1 Enabled
VulDefEnable Integer

Vulnerability defense switch

  • 0 Not enabled
  • 1 Enable
VulDefMode Integer

Vulnerability defense mode

  • 0: standard
  • 1: major event protection
VulDefAction Integer

Vulnerability defense action

  • 0: Detection only
  • 1: Detection and prevention
MemShellDefEnable Integer

Java Webshell Defense switch

  • 0 Not enabled
  • 1 Enable
SafeInject Integer

More protection

  • 0: Do not inject into processes that will restart
  • 1: Inject into processes that will restart
PerformanceLimit Integer

Performance threshold configuration switch

  • 0 Not enabled
  • 1 Enabled
PerformanceLimitCpu Integer

CPU threshold. Value range: 1–99.
PerformanceLimitMem Integer

Memory threshold. Value range: 1–99
PerformanceLimitMemAmount Integer

Remaining memory threshold
RaspException Integer

Plug-in status

  • 0 Used normally
  • 1 Anomaly exists
  • 2 Inactive
LatestUpdateTime String

Latest update time.
ClusterName String

Cluster ID, available only for container assets
ClusterId String

Cluster name, only available for container assets
OrderDetail OrderDetail

Order information
IsUnBind Boolean

Whether unbinding is allowed. false: not allowed; true: permission
UUID String

uuid: unique ID of a machine. It has a value only when AssetType is CWP.
Reason String

No injection/failure reason

Default value: empty

Values are available only if injection fails

RegionConfig

Region configuration

Used by actions: DescribeDspmSupportedAssetType.

Name Type Description
Region String

Region.
RegionName String

Region in Chinese
Foreign Integer

Outside Chinese Mainland or not
Code Integer

Region code
IsAutoDriveCloud Integer

Whether self-driving cloud
IsSupportNat Integer

nat support
RegionArea String

Region information
RegionNameEN String

Region in English

RegionInfo

Region information of cloud assets.

Used by actions: DescribeAssetComponentRelatedImageList, DescribeBackendScanEngineRegionList, DescribeBaselineFixRecordList, DescribeBaselineItemRiskList, DescribeBaselineSubTaskList, DescribeCWPMachineDetail, DescribeCWPMachines, DescribeImageAssetList, DescribeImageRegistryList, DescribeLoginTypeHost, DescribeNFSScanHost, DescribePreventUninstallHost, DescribeProcessDaemonHost, DescribeRegistryRegionList.

Name Type Description
Region String Region identifier, for example ap-guangzhou, ap-shanghai, ap-beijing.
RegionName String Chinese name of region, such as South China (Guangzhou), East China (Shanghai), and North China (Beijing).
RegionId Integer Region digital ID.
RegionCode String Region short code, such as gz, sh, and bj.
RegionNameEn String English name of the region.

RegistryConnDetectResult

Image Repository Connectivity Test Results

Used by actions: DescribeImageRegistryList.

Name Type Required Description
ConnDetectMessage String No

Link information
ConnDetectStatus String No

Link status
FailReason String No

Reason for failure
Quuid String No

Host quuid
Solution String No

Failure solution
Uuid String No

Host UUID.

RelatedEvent

Related Attack Event Structure

Used by actions: DescribeAlertList.

Name Type Required Description
EventID String No Event ID
Description String No Event description
RelatedCount Integer No Number of Alarms Associated with Event

ReportItemKey

Report Item Key

Used by actions: DescribeTaskLogURL.

Name Type Required Description
TaskLogList Array of String Yes Log ID List

ReportTaskIdList

Task_id List in the Report

Used by actions: DescribeTaskLogURL.

Name Type Required Description
TaskIdList Array of String Yes Task ID List
AppId String No Tenant ID

RepositoryImageVO

Repository Image List

Used by actions: DescribeRepositoryImageAssets.

Name Type Required Description
AppId Integer No User appid.
Uin String No User UIN
NickName String No Nickname
InstanceId String No Image id
InstanceName String No Image Name
InstanceCreateTime String No Image creation time.
InstanceSize String No Image Size with Unit
BuildCount Integer No Build Times
InstanceType String No Image type.
AuthStatus Integer No Authorization status
InstanceVersion String No Mirror version
Region String No Region.
RepositoryUrl String No Repository address
RepositoryName String No Repository name
IsCore Integer No Core or Not
VulRisk Integer No Vulnerability risk
CheckCount Integer No Check task
CheckTime String No Health Checkup Time
IsNewAsset Integer No New Asset or Not. 1: New

RiskCallRecord

Risk call record details

Used by actions: DescribeRiskCallRecord.

Name Type Description
EventName String API name
EventDescCN String Chinese description of the api
EventDescEN String Interface description
ProductName String Product name
ProductNameCN String Product Chinese Name
CallCount Integer Number of calls.

RiskCenterOverviewTrendAnalysis

Risk trend

Used by actions: DescribeRiskCenterRiskTrendAnalysis.

Name Type Description
Date String Date
Port Integer Number of ports
VUL Integer Number of vulnerabilities
WeakPassword Integer Weak Password Count
Website Integer Number of Websites
CFG Integer Number of Configurations
Server Integer Mapping Risk Count
HostCFG Integer Number of host risk configurations
PodCFG Integer Number of risk configurations in the container baseline

RiskCenterStatusKey

Risk Center Status Handling Key

Used by actions: ModifyRiskCenterRiskStatus.

Name Type Required Description
Id String Yes Risk ID
PublicIPDomain String No Public IP/domain name
InstanceId String No Instance ID.
AppId String No APP ID

RiskCronConfig

Cloud resource configuration risk periodic scan configuration

Used by actions: DescribeRiskScanCronConfig.

Name Type Description
CreateAppID Integer

appid of the periodic task creator.
PlanContent String

Periodic schedule
CronStatus Integer

Period scanning enabled status
AddRuleEnableStatus Boolean

Whether to automatically join the scan for new rules
ScanPlanTimezone String

Time zone
IncrementAssetScanRisk Boolean

Enable risk scan for incremental assets

RiskDetailItem

Risk details

Used by actions: DescribeRiskDetailList.

Name Type Description
CreateTime String

First discovery time
UpdateTime String

Update time.
RiskStatus Integer

Risk status
RiskContent String

Risk content
Provider String

Cloud service provider.
ProviderName String

Vendor name
CloudAccountId String

Cloud account
CloudAccountName String

Cloud account name
InstanceId String

Instance ID.
InstanceName String

Instance name.
RiskId Integer

Risk ID
RiskRuleId String

Risk rule ID
CheckStatus String

Risk verification status
AppID Integer

User AppID.
AssetType String

Asset type
Reason String

Risk ignore reason

RiskRuleInfo

Risk rule

Used by actions: DescribeConfigCheckRules.

Name Type Description
RuleID String Risk check item ID
Provider String Vendor name
InstanceType String Instance type
RiskTitle String Risk name
CheckType String Check type
RiskLevel String Risk level
RiskInfluence String Risk damage
RiskFixAdvance String Risk remediation guide report link
DispositionType String Boundary management and control

RiskRuleItem

Risk rule

Used by actions: DescribeRiskRules.

Name Type Description
ItemId String Risk check item ID
Provider String Vendor name
InstanceType String Instance type
InstanceName String Instance Type Name
RiskTitle String Risk name
CheckType String Check type
Severity String Risk level
RiskInfluence String Risk damage

RiskTrendItem

Last day risk summary item

Used by actions: DescribeSecurityRiskTrend.

Name Type Description
Key String Risk item type: intrusion_alert / vulnerability
Name String Display name, returned in the language of the request. Vulnerability items use different copywriting based on whether payment is required.
Count Integer Number of risks

RoleInfo

Alarm Data Attacker or Victim Information

Used by actions: DescribeAlertList.

Name Type Required Description
IP String No IP
HostIP String No HostIP
OriginIP String No Original IP
Port Integer No Port.
InstanceID String No Asset ID
City String No City
Province String No Province
Country String No national
Address String No Address.
Latitude String No Latitude
Longitude String No Longitude
Info String No Information.
Domain String No Domain
Name String No Enterprise name
Account String No Account
Family String No Family Group
VirusName String No Virus name
MD5 String No MD5 Value
FileName String No Malicious process file name
AssetType Integer No 1-Host Assets; 2-Domain Assets; 3-Network Assets
FromLogAnalysisData Array of KeyValue No Information Fields of Source Log Analysis
ContainerName String No Container name
ContainerID String No Container ID

RouteInfo

Routing information

Used by actions: DescribeDspmCkafkaRouteList, ModifyDspmCkafkaSave.

Name Type Required Description
Vip String Yes Access IP.
Vport String Yes Access Port
Domain String Yes Domain name
DomainPort String Yes Access domain name port.

RuleContentCmdLine

EDR command-line rule.

Used by actions: DescribeEDRRuleList, ModifyEDRRule.

Name Type Required Description
Process RuleContentProcessInfo No

Process command line information
ParentProcess RuleContentProcessInfo No

Command line information of the parent process
AncestorProcess RuleContentProcessInfo No

Command line information of the ancestor process

RuleContentProcessInfo

Single rule of EDR command-line rules.

Used by actions: DescribeEDRRuleList, ModifyEDRRule.

Name Type Required Description
Exe String Yes

Process file path
CmdLine String Yes

Process command line

RuleContentProcessNetwork

Content structure of process network rules for reverse shell allowlist scenarios. Filtering is supported by process matching combined with IP address or port.

Used by actions: DescribeEDRRuleList, ModifyEDRRule.

Name Type Required Description
Process RuleContentProcessInfo Yes

Current process
DstIP String Yes

Destination IP (required): enable individually IP/IP range/CIDR. Both IPv4 and IPv6 are supported.
ParentProcess RuleContentProcessInfo No

Parent process
DstPorts Array of Integer No

Destination port list (optional): supports 1-65535, being empty indicates no port limit

RuleStatisticsItem

Statistical information of rules

Used by actions: DescribeCustomRiskRules.

Name Type Description
Text String

Name.
Value String

Value.
Count String

Statistical information

SCFAliasInfo

Streamlined SCF function alias info

Used by actions: DescribeSCFAliasList.

Name Type Description
Name String Alias name
FunctionVersion String Major version number that the alias points to

SCFFunctionInfo

Streamlined SCF function info

Used by actions: DescribeSCFFunctionList.

Name Type Description
FunctionId String Function ID
Parameter format: such as lam-xxxxxxxx
FunctionName String Function name
Namespace String Namespace
Status String Function status
Enumeration value:
Active: available
Creating
Updating
CreateFailed: creation failed
Deleting: deleting.
Type String Function type
Enumeration value:
Event: Event function (the current API only returns this type)

SCFFunctionVersionInfo

Streamlined SCF function version info

Used by actions: DescribeSCFFunctionVersionList.

Name Type Description
Version String Function version name
Parameter format: $LATEST or a digital version number, such as 1, 2, 3
Status String Version status. The current implementation returns the same value as the Version field.

SCFNamespaceInfo

SCF namespace simplified info

Used by actions: DescribeSCFNamespaceList.

Name Type Description
Name String Namespace name
Type String Namespace type
Enumeration values:
Default: default namespace
Custom: custom namespace

STSCredentialOutput

STS temporary key credential (dedicated for output parameters), used for the response of the query details API. The SecretID and SecretKey fields return masked values, and System returns the original text.

Used by actions: DescribeKeySandboxCredential.

Name Type Description
System String Credential provider identifier (original), for example tencentCam, aws, aliyun
SecretID String SecretID (masked)
Supplemental description: Reserve the first 3 and last 4 digits, replace the middle with *. If the length is less than 7, use * as a complete replacement.
SecretKey String SecretKey (masked)
Supplemental description: Reserve the first 3 and last 4 digits, replace the middle with *. If the length is less than 7, use * as a complete replacement.

ScanTaskInfo

Scan Task Details

Used by actions: DescribeScanReportList.

Name Type Description
TaskId String Task ID
TaskName String Task name.
Status Integer Task Status Code: 1-Awaiting Start, 2-Scanning, 3-Scan Error, 4-Scan Completed.
Progress Integer Task progress
TaskTime String Task completion time
ReportId String Report ID
ReportName String Report name
ScanPlan Integer Scanning Schedule. 0-Periodic Task; 1-Scan Now; 2-Scheduled Scan; 3-Custom.
AssetCount Integer Number of Associated Assets
AppId String APP ID
UIN String User Host Account ID
UserName String User name

ScanTaskInfoList

Scan Task List Display Information

Used by actions: DescribeScanTaskList.

Name Type Description
TaskName String Task name.
StartTime String Task start time
EndTime String Task end time
ScanPlanContent String Cron Format
TaskType Integer 0-Periodic Task; 1-Scan Now; 2-Scheduled Scan; 3-Custom.
InsertTime String Creation time.
TaskId String Task ID.
SelfDefiningAssets Array of String Custom Specified Scan Asset Information
PredictTime Integer Estimated Time
PredictEndTime String Estimated Completion Time
ReportNumber Integer Report Count
AssetNumber Integer Number of assets
ScanStatus Integer Scan Status. 0-Initial Value; 1-Scanning; 2-Scan Completed; 3-Scan Error; 4-Scan Stopped.
Percent Float Task progress
ScanItem String port/poc/weakpass/webcontent/configrisk
ScanAssetType Integer 0-Full Scan; 1-Specified Asset Scan; 2-Excluded Asset Scan; 3-Custom Specified Asset Scan.
VSSTaskId String VSS Subtask ID
CSPMTaskId String CSPM Subtask ID
CWPPOCId String Host Vulnerability Scan Subtask ID
CWPBlId String Host Baseline Subtask ID
VSSTaskProcess Integer VSS Subtask Progress
CSPMTaskProcess Integer CSPM Subtask Progress
CWPPOCProcess Integer Host Vulnerability Scan Subtask Progress
CWPBlProcess Integer Host Baseline Subtask Progress
ErrorCode Integer Exception status code
ErrorInfo String Exception message
StartDay Integer Number of Days for Periodic Task to Start
Frequency Integer Scanning Frequency, in Days. 1-Daily; 7-Weekly; 30-Monthly; 0-Scan Once.
CompleteNumber Integer Completion Count
CompleteAssetNumber Integer Completed Asset Count
RiskCount Integer Risk count
Assets Array of TaskAssetObject Asset
AppId String User Appid
UIN String User Host Account ID
UserName String User name
TaskMode Integer Checkup Mode. 0-Standard Mode; 1-Quick Mode; 2-Advanced Mode.
ScanFrom String Scan Source
IsFree Integer Whether health checkup is limited or exempted. 0-No; 1-Yes.
IsDelete Integer Whether it can be deleted. 1-Yes; 0-No. For use with multi-account management.
SourceType Integer Task Source Type. 0: Default; 1: Assistant; 2: Health Checkup Items.

ScanTaskRecordItem

Scan task record details

Used by actions: DescribeScanTaskRecordList.

Name Type Description
TaskID String

Task ID.
Status String

Task status.
Progress Integer

Task progress
CostQuota Integer

Consumed quota.
CreateTime String

Task creation time
EndTime String

Task end time.
TaskSource String

Task source

ScfCustomDomainEndpointItem

SCF custom domain name endpoint

Used by actions: DescribeScfCustomDomainEndpoints.

Name Type Description
PathMatch String

Matching path
Namespace String

Namespace.
FunctionName String

Function name
Qualifier String

Function version

ScoreRuleItem

Scoring rule item

Used by actions: DescribeDefaultSecurityScoreRule, DescribeSecurityScoreRule, ModifySecurityScoreRule.

Name Type Description
RuleType String

Rule type
Enumeration value:
dimension: dimensional rule
category: category-level rule
severity: severity-level rule
DimensionId String

Dimension ID
DimensionName String

Dimension name
CategoryId String

Sub-item ID.
CategoryDesc String

Sub-item point deduction rule description
CategoryName String

Sub-item name.
Severity String

Severity
Enumeration values:
critical: Critical
high: High risk
medium: Medium risk
low: Low risk
MaxDeductScore Integer

Deduction limit
DeductPerItem Integer

Points deducted per time.
DeductPerItemDisabled Boolean

Whether individual deduction is non-editable (true for sub-items under Protection Configuration Dimension)
SortOrder Integer

Sorting serial number

SecurityGroupPolicyItem

Security group policy

Used by actions: DescribeSecurityGroupPolicy.

Name Type Description
Port String

Port
Action String

Policy.
Protocol String

Protocol
CidrBlock String

Access source
Description String

Description.
CreateTime String

Creation time.
Priority Integer

Priority

Unit: 1

SensitiveDetail

Sensitive field categorization and level description.

Used by actions: DescribeDspmLogList.

Name Type Description
CategoryRule String Field classification
LevelRisk String Field classification
IsSensitive Integer 1: Sensitive information field.
0: Non-sensitive field

ServerRisk

Service Risk

Used by actions: DescribeRiskCenterServerRiskList.

Name Type Description
ServiceTag String Mapping Tag
Port Integer Port.
AffectAsset String Affect assets
InstanceId String Instance ID.
InstanceName String Instance name.
InstanceType String Asset type
Level String Risk level. low: low risk. high: high risk. middle: medium risk. info: notification. extreme: critical
Protocol String Protocol
Component String component
Service String Service.
RecentTime String Latest Recognition Time
FirstTime String First Recognition Time
RiskDetails String Risk details
Suggestion String Handling suggestion
Status Integer Status. 0-Unprocessed; 1-Disposed; 2-Ignored; 3-Defended by Cloud Firewall.
Id String Unique ID of Asset
AppId String User appid.
Nick String User Nickname
Uin String User UIN
ServiceSnapshot String Service Snapshot
Url String Service Access URL
Index String List Index Value
RiskList Array of ServerRiskSuggestion Risk list
SuggestionList Array of ServerRiskSuggestion Recommendation List
StatusCode String HTTP Response Status Code
NewLevel String New risk level. high_risk: high risk. suspect: suspected. Normal: no risk data yet.
XspmStatus Integer Status. 0: unprocessed; 1: processed; 2: ignored; 3: defended by Cloud Firewall; 4: no action is required.

ServerRiskSuggestion

Risk details

Used by actions: DescribeRiskCenterServerRiskList.

Name Type Description
Title String Title.
Body String Details.

ServiceSupport

Product support status

Used by actions: DescribeVULRiskAdvanceCFGList, DescribeVULRiskDetail.

Name Type Description
ServiceName String Product name:
"cfw_waf_virtual", "cwp_detect", "cwp_defense", "cwp_fix"
SupportHandledCount Integer Total number of fixed assets
SupportTotalCount Integer Total number of supported assets
IsSupport Boolean Whether the product is supported. 1: supported; 0: not supported

SeverityItem

Deduction detail by severity

Used by actions: DescribeSecurityScoreOverview.

Name Type Description
Severity String Risk level
Enumeration values:
critical: severe
high: high risk
Medium: medium risk
low: low-risk
SeverityName String Risk level name in Chinese
RiskCount Integer Number of risks at this level
DeductPerItem Integer Points deducted per time.
MaxDeductScore Integer Severity deduction limit
DeductScore Integer Actual point deduction

SkillCapabilityTag

Skill capacity tag

Used by actions: DescribeSkillScanAlertDetail, DescribeSkillScanResult.

Name Type Description
ID String Capacity tag identification
Name String Display name of the capability tag

SkillRuleCatalogItem

Fusion rule directory entry

Used by actions: DescribeSkillScanAlertDetail, DescribeSkillScanAlertList, DescribeSkillScanResult.

Name Type Description
RuleID String Fusion rule ID
Parameter format: such as 9xxxx
RuleName String Risk category name

SkillScanAlertItem

Single record in the Skill security detection alarm list

Used by actions: DescribeSkillScanAlertList.

Name Type Description
ID Integer

Alarm record ID
AppID Integer

Tenant AppID
UUID String

Host UUID
HostIP String

Host IP address
InstanceID String

Instance ID
Parameter format: such as ins-xxxxxxxx
InstanceName String

Instance name.
BelongAssetType String

Asset type affiliation
Enumeration values:
HOST: Host
CONTAINER: Container
SkillName String

Skill name
SkillPath String

Skill file path
Scope String

Skill application scope
Version String

Skill version number
ContentHash String

SHA256 hash of file content
Parameter format: sha256:<64-digit hex>
RiskLevel String

Risk level
Enumeration values:
malicious: Malicious
suspicious: Suspicious
SecurityScore Integer

Security score
Value range: [0, 100]
PrimaryRuleID String

Main matched rule ID
HitRules Array of String

List of hit rule IDs (9xxxx), deduplicated by RuleID
The display name is translated using the RuleCatalog dictionary in the outer layer of the response
If historical alarms do not persist this field, an empty array is returned
EngineVersion Integer

Detection engine version number
Status Integer

Processing status
Enumeration values:
0: unprocessed
1: processed
2: ignored
3: trusted
4: deleted (soft deletion)
Level String

Alarm level
Enumeration values:
high: High risk
medium: Medium risk
CreateTime Timestamp ISO8601

First detection time
Parameter format: YYYY-MM-DDTHH:mm:ssZ (ISO8601 format)
UpdateTime Timestamp ISO8601

Last update time
Parameter format: YYYY-MM-DDTHH:mm:ssZ (ISO8601 format)

SkillScanEngineResult

Scanning result of the sub-engine

Used by actions: DescribeSkillScanAlertDetail, DescribeSkillScanResult.

Name Type Description
ScanType String Sub-engine type.
Enumeration values:
AI: AI engine
STATIC: static analysis engine
RuleList Array of SkillScanRuleHit Hit rule list.

SkillScanItem

Skill security detection result details

Used by actions: DescribeSkillScanResult.

Name Type Description
SkillName String

Skill name
SkillDescription String

Skill description to help understand the primary purpose of the Skill
ContentHash String

SHA256 Hash of the ZIP file
Parameter format: sha256:<64-bit hex>
UploadFileCount Integer

Number of actual files after decompressing the original uploaded ZIP file, which is also the scope of billing. After a successful scan, 1 file is counted as 1 limit.
RiskLevel String

Comprehensive risk level
Enumeration values:
malicious: Malicious
suspicious: Suspicious
benign: Trustworthy
PrimaryRuleID String

Risk primary tag fusion rule ID (9xxxx), generated by the server from the hit fusion risk tags; empty when benign with no rule hits. The display name can be obtained through RuleCatalog
Mitigation String

Comprehensive handling suggestions to guide the caller in prioritizing actions such as decommission, isolation, repair, and recheck. It may be empty in historical results. Return in English when Language=en-US is passed.
RiskDescription String

Comprehensive description of risks, summarizing the risks detected this time. Return in English when Language=en-US is passed
SecurityScore Integer

Security score value range: [0, 100]. Supplemental description: The higher the score, the more secure.
EngineVersion Integer

Engine version number used for this scan
CapabilityTags Array of SkillCapabilityTag

Skill capability tag list, describing the capabilities, features, or application scenarios of a Skill. It is not equal to risk tags and does not participate in risk level judgment. When Language=en-US is passed, Name switches to English, and ID remains unchanged
RuleCatalog Array of SkillRuleCatalogItem

Complete set of fusion rule directories, including all fusion rule categories (9xxxx). Callers can show category tags based on this without the need to maintain a mapping table locally. Pass Language=en-US to return in English.
ScanItems Array of SkillScanEngineResult

Scan result details, grouped by sub-engine. Each element contains ScanType (engine type) and RuleList (hit rule list). The RuleID within the rules uses fusion coding (9xxxx) and can be cross-referenced with RuleCatalog. When Language=en-US is passed, Description returns English text.
ReportURL String

Comprehensive security audit report address (pre-signed URL). The valid period is controlled by the request parameter ReportURLExpireHours.
ScannedAt Timestamp ISO8601

Scan completion time. It has a value only when Status=SUCCESS.
Parameter format: YYYY-MM-DDTHH:mm:ssZ (ISO8601 format)
CreatedAt Timestamp ISO8601

Task creation time. It has a value only when Status=SCANNING
Parameter format: YYYY-MM-DDTHH:mm:ssZ (ISO8601 format)
FailedAt Timestamp ISO8601

Failure time. It has a value only when Status=FAILED
Parameter format: YYYY-MM-DDTHH:mm:ssZ (ISO8601 format)
Message String

Failure reason description. It only has a value when Status=FAILED.

SkillScanRuleHit

Matched rule items

Used by actions: DescribeSkillScanAlertDetail.

Name Type Description
RuleID String Fusion rule number
Parameter format: such as 9xxxx
Description String Risk discovery description

SkillState

SKILL installation status information

Used by actions: DescribeAIAgentAssetList.

Name Type Description
SkillInstallStatus Integer SKILL installation status
Enumeration value:
0: Not installed
1: Installing
2: Installed
3: Installation failure
4: Uninstalling
5: Uninstallation failed
SkillInstallTime String SKILL installation/uninstallation operation time
Parameter format: YYYY-MM-DDTHH:mm:ssZ (ISO8601 format)
SkillInstallResult String SKILL installation/uninstallation result description information

SourceIPAsset

Access key asset information (source IP perspective)

Used by actions: DescribeSourceIPAsset, DescribeSourceIPDetail.

Name Type Description
ID Integer Source IP id
SourceIP String Source IP
Remark String Remarks
AppID Integer APPID of the account
Region String IP region
EventType Integer Calling method
-1: Uncounted
0: Console invocation
1:API
IPType Integer IP type
0: within the account (no remark)
1: Outside the account (no remarks)
2: Within the account (remarked)
3: Outside the account (Remarks added)
AccessKeyAlarmList Array of AccessKeyAlarmInfo Alarm information list.
AKInfo Array of AKInfo ak information list
ActionCount Integer Number of API calls.
LastAccessTime String Last access Time
InstanceID String Associated instance ID of the IP. If it is an empty string, the asset is not within the account.
InstanceName String IP associated instance name
Uin String Uin of the account
Nickname String Nickname
ShowStatus Boolean Display status.
ISP String Carrier field
VpcInfo Array of SourceIPVpcInfo vpc information outside the account
CloudType Integer Cloud type
0: Tencent Cloud

SourceIPVpcInfo

Source IP of the call. External account info.

Used by actions: DescribeAbnormalCallRecord, DescribeCallRecord, DescribeSourceIPAsset, DescribeSourceIPDetail.

Name Type Description
Name String Account name
AppID Integer App ID of the VPC.
VpcID String vpc id
VpcName String VPC name.

StandardItem

CSPM specification

Used by actions: DescribeAssetRiskList, DescribeCheckViewRisks, DescribeCustomRiskRules.

Name Type Description
ID Integer Regulation ID
Name String Specification name

StandardModeConfig

Blocking configuration in the standard mode

Used by actions: DescribeBanMode.

Name Type Description
Ttl Integer

Blocking duration (unit: second)

StandardTerm

CSPM clause

Used by actions: DescribeAssetRiskList, DescribeCheckViewRisks, DescribeComplianceRiskList, DescribeCustomRiskRules.

Name Type Description
Tag String Tag.
Terms Array of String Clause

StatisticalFilter

User behavior analysis statistical conditions

Used by actions: DescribeUebaRule.

Name Type Required Description
OperatorType Integer Yes 0: Not based on statistical testing
1: Occurrence count higher than a fixed value
2: Occurrence count exceeds the cycle average by percent
3: Occurrences higher than the user average percent
Value Float Yes Statistical value

SubUserInfo

Sub-account details

Used by actions: DescribeSubUserInfo.

Name Type Description
ID Integer

Primary key ID, no business significance, used only as a unique key
AppID String

Sub-account Appid
Uin String

Sub-account UIn
NickName String

Sub-account name
OwnerAppID String

Root Account Appid
OwnerUin String

Root account Uin
OwnerNickName String

Root account name
OwnerMemberID String

memberId information belonging to main account
CloudType Integer

Account type. 0: Tencent Cloud account; 1: AWS account
ServiceCount Integer

Number of accessible services
InterfaceCount Integer

Number of accessible APIs
AssetCount Integer

Number of accessible resources
LogCount Integer

Number of access/behavior logs
ConfigRiskCount Integer

Permission configuration risk
ActionRiskCount Integer

Dangerous behavior alarm
IsAccessCloudAudit Boolean

Whether to access operation audit log
IsAccessCheck Boolean

Whether to configure a security check for risks
IsAccessUeba Boolean

Whether to configure a user behavior management policy
CreateTime Integer

Creation time (Unix timestamp).

SubnetAsset

Subnet Assets

Used by actions: DescribeSubnetAssets.

Name Type Description
AppId String appid
Uin String uin
AssetId String Asset ID
AssetName String Asset name
Region String Region.
VpcId String VPC id
VpcName String VPC Name
Tag Array of Tag Tag.
Nick String Nickname
CIDR String cidr
Zone String Availability zone
CVM Integer CVM Count
AvailableIp Integer Available IP Count
CreateTime String Creation time.
ConfigureRisk Integer Configuration risk
ScanTask Integer Number of tasks
LastScanTime String Last scan time
IsCore Integer Core or Not
IsNewAsset Integer New Asset or Not. 1: New

TableField

Database field description.

Used by actions: DescribeDspmLogList.

Name Type Description
DB String Database name
Schema String Database view name.
Table String Table name
Field String Database field name.
Sensitive SensitiveDetail Sensitive field information.

Tag

Native tag key-value pair in the cloud.

Used by actions: DescribeBaselineFixRecordList, DescribeBaselineItemRiskList, DescribeBaselineSubTaskList, DescribeCVMAssetInfo, DescribeCVMAssets, DescribeCWPMachines, DescribeDbAssetInfo, DescribeDbAssets, DescribeDomainAssets, DescribeGatewayAssets, DescribeNICAssets, DescribeOtherCloudAssets, DescribePublicIpAssets, DescribeSubnetAssets, DescribeVpcAssets, DescribeVulComponentRelateHost, DescribeVulHostRelateComponent, DescribeVulRiskRelateHost.

Name Type Required Description
Name String Yes Tag key.
Value String Yes Tag value.

TagCount

Product Log Entries

Used by actions: DescribeAlertList, DescribeTopAttackInfo.

Name Type Description
Name String Product name
Count Integer Number of logs.

TagItem

Tencent Cloud tags.

Used by actions: DescribeEdrAlertThreatTags.

Name Type Required Description
Key String No

Tag key
Value String No

Tag value.

Tags

Host Tag Information

Used by actions: DescribeCWPMachineDetail, DescribeCWPOrderList, DescribeCheckConnectivityHostList, DescribeRaspLicenseList, DescribeScanTaskList.

Name Type Required Description
TagKey String No Host tag key
TagValue String No Host tag value

TaskAdvanceCFG

Task Advanced Configuration

Used by actions: CreateRiskCenterScanTask, ModifyRiskCenterScanTask.

Name Type Required Description
PortRisk Array of PortRiskAdvanceCFGParamItem No Port Risk Advanced Configuration
VulRisk Array of TaskCenterVulRiskInputParam No Vulnerability Risk Advanced Configuration
WeakPwdRisk Array of TaskCenterWeakPwdRiskInputParam No Weak Password Risk Advanced Configuration
CFGRisk Array of TaskCenterCFGRiskInputParam No Advanced Configuration of Configuration Risk

TaskAssetObject

Task Asset Items

Used by actions: CreateRiskCenterScanTask, DescribeScanTaskList, ModifyRiskCenterScanTask.

Name Type Required Description
AssetName String No Asset name
InstanceType String No Asset type
AssetType String No Asset category
Asset String No IP/Domain/Asset ID, Database ID, etc.
Region String No Region.
Arn String No Unique ID of Multi-Cloud Assets

TaskCenterCFGRiskInputParam

Advanced Configuration of Configuration Risk

Used by actions: CreateRiskCenterScanTask, ModifyRiskCenterScanTask.

Name Type Required Description
ItemId String Yes Detection Item ID
Enable Integer Yes Whether to enable. 0-Not to Enable; 1-Enable.
ResourceType String Yes Resource type.

TaskCenterVulRiskInputParam

Vulnerability Risk Advanced Configuration

Used by actions: CreateRiskCenterScanTask, ModifyRiskCenterScanTask.

Name Type Required Description
RiskId String Yes Risk ID
Enable Integer Yes Whether to enable. 0-Not to Enable; 1-Enable.

TaskCenterWeakPwdRiskInputParam

Weak Password Risk Advanced Configuration

Used by actions: CreateRiskCenterScanTask, ModifyRiskCenterScanTask.

Name Type Required Description
CheckItemId Integer Yes Detection Item ID
Enable Integer Yes Whether to enable. 0-Not to Enable; 1-Enable.

TaskIdListKey

Task ID List Key

Used by actions: DeleteRiskScanTask, StopRiskCenterTask.

Name Type Required Description
TaskId String Yes Task ID.
TargetAppId String No APP ID

TaskInfo

Detection task information

Used by actions: DescribeLastScanTaskInfo.

Name Type Description
ScanTime String Scan time
TaskID String Task ID.
Status String Task status.
Progress Integer Task progress

TaskLogInfo

Task Report Information

Used by actions: DescribeTaskLogList.

Name Type Description
TaskLogName String Report Name
TaskLogId String Report ID
AssetsNumber Integer Associated Asset Count
RiskNumber Integer Security Risk Count
Time String Report generation time
Status Integer Task Status Code. 0-Initial Value; 1-Scanning; 2-Scan Completed; 3-Scan Error; 4-Stopped; 5-Halted; 6-Task Has Been Restarted.
TaskName String Associated Task Name
StartTime String Scan start time
TaskCenterTaskId String Task Center Scan Task ID
AppId String Tenant ID
UIN String Host Account ID
UserName String User name
ReportType Integer Report Type. 1: Security Checkup; 2: Daily Report; 3: Weekly Report; 4: Monthly Report.
TemplateId Integer Report Template ID

TaskLogURL

Temporary Link for Report PDF Download

Used by actions: DescribeTaskLogURL.

Name Type Description
URL String Temporary Link for Report Download
LogId String Task Report ID
TaskLogName String Task Report Name
AppId String APP ID

TcrRegistry

TCR repository instance.

Used by actions: DescribeTCRInstanceList.

Name Type Required Description
RegistryId String No

Repository instance id
RegistryName String No

Warehouse name
PublicDomain String No

Repository domain.
RegistryRegion String No

region where the repository is located
RegistryRegionId Integer No

Repository id

TimedScanTaskPreviewInfo

Preview of mirror information for scheduled tasks

Used by actions: DescribeImageRegistryTimedScanTaskPreview.

Name Type Required Description
Id Integer No

Preview data id
ImageId String No

Image ID.
ImageName String No

Image name.
ImageTag String No

Image tag
RegistryType String No

Image repository type
OwnerAccountName String No

Account name of the scheduled task
OwnerUin String No

uin of the account associated with the scheduled task
OwnerAppId Integer No

appid of the account associated with the scheduled task
IsLatestImage Boolean No

Whether it is the newest image
ImageRepoAddress String No

Image address

TopicInfo

CKafka instance topic information.

Used by actions: DescribeDspmCkafkaTopicList.

Name Type Description
TopicId String CKafka topic ID.
TopicName String CKafka topic name.

TrafficPluginState

AI Agent traffic sandbox plug-in status

Used by actions: DescribeAIAgentAssetList, DescribeSandboxACLRuleList, DescribeSandboxDLPRuleList, DescribeSandboxLLMAuditRuleList.

Name Type Description
InstallStatus String Plugin installation status (upper-level aggregation)
Enumeration value:
NONE: not installed
INSTALLING: installing
INSTALLED: installed
INSTALL_FAIL: installation failure
Status String Plug-in installation sub-status. The value corresponds to InstallStatus: empty string when not installed (InstallStatus=UNINSTALL); SUCCESS when installation is successful (InstallStatus=INSTALLED); specific failure reason when installation fails (InstallStatus=INSTALL_FAIL).
Enumeration value:
NOT_SUPPORT: The environment does not support it
CONTAINER_NOT_FOUND: container does not exist.
REQUIRE_RESTART: restart required
CA_FAILED: CA failed
EBPF_FAILED: eBPF failure
IPTABLE_FAILED: iptables failed.
REDIRECT_FAILED: Traffic redirection failed.
Message String Status copywriting (an internationalized description derived from Status based on the request language)
ActivityTime Timestamp ISO8601 Recent activity time of the plug-in
Parameter format: YYYY-MM-DDTHH:mm:ssZ (ISO8601 format)

TrafficRuleState

Traffic sandbox rule status

Used by actions: DescribeAIAgentAssetList.

Name Type Description
Module String

Sandbox plug-in module name
Status String

Sandbox rule status

Enumeration values:

  • ON: Enable
  • OFF: Disable

TrafficSandboxACLAlertInfo

Data structure of an ACL alert

Used by actions: DescribeSandboxACLAlertList.

Name Type Description
ID Integer

Alarm record ID
BelongAssetType String

Asset type affiliation
Enumeration values:
HOST: Host
CONTAINER: Container
RuleID Integer

Hit user rule ID.
RuleName String

Name of the hit user rule
UUID String

Agent UUID
InstanceId String

Instance ID
InstanceName String

Instance name.
Exe String

Process exe path
Param String

Process command line parameters
Input parameter limit: maximum 4096 bytes. May be truncated if overly long
Target String

Target address, such as GET http://xxxx or ip:port
Protocol String

Protocol type
Enumeration values:
http
https
Level String

Alarm level
Enumeration values:
INFO: notification
LOW: low risk
MEDIUM: medium risk
HIGH: high risk
CRITICAL: critical
Status String

Processing status
Enumeration values:
PENDING: Unprocessed
HANDLED: Processed
IGNORE: Ignored
PASS: Allowlisted
BLOCK: Blocked
Count Integer

Number of alarms
FirstAlertTime Timestamp ISO8601

Initial alarm time
Parameter format: YYYY-MM-DDTHH:mm:ssZ (ISO8601 format)
LastAlertTime Timestamp ISO8601

Last alarm time
Parameter format: YYYY-MM-DDTHH:mm:ssZ (ISO8601 format)
RuleAction String

Hit action
Enumeration values:
PASS: Allowlist
BLOCK: Block and alarm
MONITOR: Alarm

TrafficSandboxACLDstRule

ACL target (IP/port) match rule

Used by actions: CreateSandboxACLRule, ModifySandboxACLRule.

Name Type Required Description
DstIP Array of String No Target IP list
Input parameter limit: each item supports three formats: single IP address (for example, 10.0.0.1), CIDR block (for example, 10.0.0.1/24), and IP range (for example, 10.0.0.1-10.0.2.0).
DstIPExcept Array of String No List of excluded target IPs
Input parameter limitations: The format is the same as that of DstIP.
DstPort Array of String No Target port or port range
Input parameter limit: single port, for example, 80; port range, for example, 8000-9000.
DstPortExcept Array of String No Excluded target port list
Input parameter limitations: The format is the same as that of DstPort.

TrafficSandboxACLRuleContentItem

ACL rule content. The sub-rule ID is managed internally by the server and not exposed to the public.

Used by actions: CreateSandboxACLRule, DescribeSandboxACLRuleList, DescribeSandboxACLSystemRuleList, ModifySandboxACLRule.

Name Type Required Description
DstRule TrafficSandboxACLDstRule No Target (IP/port) match rule
URLRule TrafficSandboxACLURLRule No URL, protocol, and method match rules

TrafficSandboxACLRuleInfo

ACL user rule data structure

Used by actions: DescribeSandboxACLRuleList.

Name Type Description
ID Integer Rule ID
RuleName String Rule name
Level String Rule level
Enumeration values:
INFO: Notification.
LOW: low-risk
MEDIUM: Medium-risk
HIGH: high risk
CRITICAL: Critical
Status String Rule status
Enumeration values:
ON: enabled.
OFF: disabled.
BelongAssetType String Asset type to which it belongs
Enumeration values:
HOST: host
CONTAINER: Container
SystemRuleContent Array of TrafficSandboxACLRuleContentItem Snapshot of the referenced system rule content
UserRuleContent Array of TrafficSandboxACLRuleContentItem Content of the user-defined rule
EffectScope TrafficSandboxEffectScope Rule effective scope
InactiveAssets Array of TrafficSandboxInactiveAsset List of ineffective assets: AI Agent assets in the policy association targets' effective assets where the traffic sandbox plug-in is not installed (TrafficPluginState.InstallStatus is not INSTALLED). Return the InstanceId / ContainerId and TrafficPluginState of the machines. If there are no ineffective assets, return an empty array.
InsertTime Timestamp ISO8601 Creation time.
Parameter format: YYYY-MM-DDTHH:mm:ssZ (ISO8601 format)
UpdateTime Timestamp ISO8601 Update time
Parameter format: YYYY-MM-DDTHH:mm:ssZ (ISO8601 format)
RuleAction String Rule Action
Enumeration values:
PASS: allowlist
BLOCK: Block and alarm
MONITOR: Alarm records

TrafficSandboxACLSystemRuleItem

Data structure of the ACL system rule

Used by actions: DescribeSandboxACLSystemRuleList.

Name Type Description
ID Integer System rule ID
RuleName String Rule name
RuleContent Array of TrafficSandboxACLRuleContentItem System rule content

TrafficSandboxACLURLRule

ACL URL, protocol, and method match rules

Used by actions: CreateSandboxACLRule, ModifySandboxACLRule.

Name Type Required Description
URL Array of String No URL list
Input parameter limits: each item supports domain name wildcards, such as .example.com, api..example.com, example.com/api/*
URLExcept Array of String No Excluded URL list
Input parameter limits: same format as the URL.
Protocol Array of String No Protocol type list
Enumeration values:
http: HTTP protocol
https: HTTPS protocol
Method Array of String No List of HTTP methods
Enumeration values:
GET
POST
HEAD
PUT
DELETE
OPTIONS
PATCH

TrafficSandboxAssetScope

Traffic sandbox effective asset elements

Used by actions: CreateSandboxACLRule, CreateSandboxDLPRule, CreateSandboxLLMAuditRule, InstallSandboxPlugin, ModifySandboxACLRule, ModifySandboxDLPRule, ModifySandboxLLMAuditRule.

Name Type Required Description
InstanceId String No Instance ID. Only for host assets.
ContainerId String No Container ID. This parameter is required only when the asset type is container.

TrafficSandboxDLPAlertInfo

Data structure of a DLP alert

Used by actions: DescribeSandboxDLPAlertList.

Name Type Description
ID Integer

Alarm record ID
BelongAssetType String

Asset type affiliation
Enumeration values:
HOST: Host
CONTAINER: Container
RuleID Integer

Hit user rule ID.
RuleName String

Name of the hit user rule
UUID String

Agent UUID
InstanceId String

Instance ID
InstanceName String

Instance name.
ClusterId String

Cluster ID
Input parameter limitation: returned only for container alarms
ContainerId String

Container ID
Input limit: Returned only for container alarms
ContainerName String

Container name
Input parameter limit: returned only for container alarms
Exe String

Process exe path
Param String

Process command line parameters
Target String

Destination address.
MatchScope String

Matching scope
Enumeration values:
req_head: Request header
req_body: Request body
rsp_head: Response header
rsp_body: Response body
MatchContent String

Complete match_content submitted by the agent
Input limit: up to 256 bytes; the first half of characters are masked
MatchContentSample String

Actual matching fragment that triggers the rule
Input limit: the first half of characters is masked; when the rule is missing or not hit, it degenerates into the same as MatchContent
UpProto String

UGC upload protocol
FileName String

File name.
FileType String

File type
FileSize Integer

File size

Unit: Byte
Level String

Alarm level
Enumeration values:
INFO: notification
LOW: low risk
MEDIUM: medium risk
HIGH: high risk
CRITICAL: critical
Status String

Processing status
Enumeration values:
PENDING: Unprocessed
HANDLED: Processed
IGNORE: Ignored
PASS: Allowlisted
BLOCK: Blocked
Count Integer

Number of alarms
FirstAlertTime Timestamp ISO8601

First alarm time
Parameter format: YYYY-MM-DDTHH:mm:ssZ (ISO8601 format)
LastAlertTime Timestamp ISO8601

Last alarm time
Parameter format: YYYY-MM-DDTHH:mm:ssZ (ISO8601 format)
RuleAction String

Hit action
Enumeration values:
PASS: Allowlist
BLOCK: Block and alarm
MONITOR: Alarm

TrafficSandboxDLPFileSizeRange

File size limit interval, in bytes; if Min/Max is 0, it means no limit on that side.

Used by actions: CreateSandboxDLPRule, DescribeSandboxDLPRuleList, ModifySandboxDLPRule.

Name Type Required Description
Min Integer No Lower limit in bytes. 0 means no lower limit.
Max Integer No Capacity limit in bytes. 0 means unlimited.

TrafficSandboxDLPRuleContentItem

DLP rule content. The sub-rule ID is managed internally by the server and not exposed to the public. The application scope is applied to all scopes by the backend by default.

Used by actions: CreateSandboxDLPRule, DescribeSandboxDLPRuleList, ModifySandboxDLPRule.

Name Type Required Description
RuleName String No Sub-rule name
Input parameter limit: length 1–128
RuleContent String No Rule content
Input parameter limit: regex, maximum length: 2048

TrafficSandboxDLPRuleInfo

Data structure of the DLP user rule

Used by actions: DescribeSandboxDLPRuleList.

Name Type Description
ID Integer Rule ID
RuleName String Rule name
Level String Rule level
Enumeration values:
INFO: Notification
LOW: low-risk
MEDIUM: Medium risk
HIGH: high risk
CRITICAL: Critical
Status String Rule status
Enumeration values:
ON: enable
OFF: disabled.
BelongAssetType String Asset type to which it belongs
Enumeration values:
HOST: Host
CONTAINER: Container
SystemRuleContent Array of TrafficSandboxDLPRuleContentItem Snapshot of the referenced system rule content
UserRuleContent Array of TrafficSandboxDLPRuleContentItem Content of the user-defined rule
UserRuleInfo TrafficSandboxDLPUserRuleInfo Structured view of user rules, returning rule content by detection dimension, making it easy for the frontend to render partitions by file name, file size, file format, outbound domain name, and outbound content. Read-only output fields do not affect Create/Modify input parameters.
EffectScope TrafficSandboxEffectScope Rule effective scope
InactiveAssets Array of TrafficSandboxInactiveAsset List of ineffective assets: AI Agent assets in the traffic sandbox plug-in not installed (TrafficPluginState.InstallStatus not INSTALLED) among the policy association targets' effective assets. Returns the InstanceId/ContainerId and TrafficPluginState of the machines. Returns an empty array when there are no ineffective assets.
InsertTime Timestamp ISO8601 Creation time.
Parameter format: YYYY-MM-DDTHH:mm:ssZ (ISO8601 format)
UpdateTime Timestamp ISO8601 Update time
Parameter format: YYYY-MM-DDTHH:mm:ssZ (ISO8601 format)
RuleAction String Rule Action
Enumeration values:
PASS: allowlist
BLOCK: Block and alarm
MONITOR: alarm

TrafficSandboxDLPSystemRuleItem

Data structure of the DLP system rule

Used by actions: DescribeSandboxDLPSystemRuleList.

Name Type Description
ID Integer System rule ID
RuleName String Rule name
RuleContent String Rule content, a Hyperscan-compatible regular expression (display-only, not editable).

TrafficSandboxDLPTrafficRuleItem

Outbound content detection line (name + regular)

Used by actions: CreateSandboxDLPRule, DescribeSandboxDLPRuleList, ModifySandboxDLPRule.

Name Type Required Description
RuleName String No Sub-rule name
RuleContent String No Regular expression content (Hyperscan-compatible)

TrafficSandboxDLPURLRuleItem

Outbound domain name detection dimensions (URL/excluded URL)

Used by actions: CreateSandboxDLPRule, DescribeSandboxDLPRuleList, ModifySandboxDLPRule.

Name Type Required Description
URL Array of String No Outbound object list (domain name/URL)
URLExcept Array of String No exclusion object list

TrafficSandboxDLPUserRuleInfo

Structured view of DLP user rules, returned by 5 detection dimensions of the detection rule, making it easy for the frontend to render by dimension. Read-only output fields, does not affect Create/Modify input parameters.

Used by actions: CreateSandboxDLPRule, DescribeSandboxDLPRuleList, ModifySandboxDLPRule.

Name Type Required Description
FileName Array of String No File name match dimension: summarized and deduplicated file name/regular list
FileSize TrafficSandboxDLPFileSizeRange No File size limit dimension (interval)
FileType Array of String No File format limited dimensions: format/category list after aggregation and deduplication
URLRule TrafficSandboxDLPURLRuleItem No Outbound domain name detection dimension (single Value Object)
TrafficRule Array of TrafficSandboxDLPTrafficRuleItem No Outbound content detection dimension (multi-line, name + regular)

TrafficSandboxEffectScope

Effective scope of the traffic sandbox rule

Used by actions: CreateSandboxACLRule, CreateSandboxDLPRule, CreateSandboxFileRule, CreateSandboxLLMAuditRule, DescribeSandboxACLRuleList, DescribeSandboxDLPRuleList, DescribeSandboxLLMAuditRuleList, InstallSandboxPlugin, ModifySandboxACLRule, ModifySandboxDLPRule, ModifySandboxFileRule, ModifySandboxLLMAuditRule.

Name Type Required Description
EffectType String Yes Effective mode
Enumeration values:
INCLUDE: specified asset takes effect
EXCLUDE: Remove the specified asset (all take effect by default)
EffectAssets Array of TrafficSandboxAssetScope No List of effective assets
Input parameter limits: required and non-empty when EffectType=INCLUDE; an empty array can be passed when EffectType=EXCLUDE.

TrafficSandboxInactiveAsset

AI Agent assets in the traffic sandbox plug-in not installed among the policy association targets' effective assets (ineffective assets)

Used by actions: DescribeSandboxACLRuleList, DescribeSandboxDLPRuleList, DescribeSandboxLLMAuditRuleList.

Name Type Description
InstanceId String Instance ID. It is required only for host assets.
ContainerId String Container ID. Refill only for container assets.
TrafficPluginState TrafficPluginState Traffic sandbox plug-in status

TrafficSandboxLLMAuditAlertInfo

LLM audit alarm data structure

Used by actions: DescribeSandboxLLMAuditAlertList.

Name Type Description
ID Integer

Alarm record ID
BelongAssetType String

Affiliated asset type
Enumeration values:
HOST: Host
CONTAINER: Container
RuleID Integer

ID of the hit user rule
RuleName String

Name of the hit user rule
SystemRuleName String

Name of the hit LLM audit system rule
InstanceId String

Instance ID
InstanceName String

Instance name.
ClusterId String

Cluster ID.
ContainerId String

Container ID
ContainerName String

Container name
HitPayload String

Risk description of the hit
RuleAction String

Hit action
Enumeration values:
PASS: allowlist
BLOCK: block and alarm
MONITOR: alarm
Level String

Alarm level
Enumeration values:
INFO: notification
LOW: low risk
MEDIUM: medium risk
HIGH: high risk
CRITICAL: critical
Status String

Processing status
Enumeration values:
PENDING: unprocessed
HANDLED: processed
IGNORE: ignored
PASS: allowlisted
BLOCK: blocked
FirstAlertTime Timestamp ISO8601

First alarm time
LastAlertTime Timestamp ISO8601

Last alarm time

TrafficSandboxLLMAuditRuleInfo

LLM audit user rule data structure

Used by actions: DescribeSandboxLLMAuditRuleList.

Name Type Description
ID Integer Rule ID
RuleName String Rule name
Level String Rule level
Enumeration value:
INFO: Notification
LOW: low-risk
MEDIUM: Medium risk
HIGH: high risk
CRITICAL: Critical
Status String Rule status
Enumeration value:
ON: enabled.
OFF: disabled.
BelongAssetType String Asset type of the affiliation
Enumeration value:
HOST: host
CONTAINER: container
SystemRuleRefs Array of TrafficSandboxLLMAuditRuleRef List of referenced system rules (including system rule names)
EffectScope TrafficSandboxEffectScope Effective scope of the rule
InactiveAssets Array of TrafficSandboxInactiveAsset List of ineffective assets: AI Agent assets in the policy association targets' effective assets where the traffic sandbox plug-in is not installed (TrafficPluginState.InstallStatus is not INSTALLED). Returns the InstanceId / ContainerId and TrafficPluginState of the machines. Returns an empty array if there are no ineffective assets.
InsertTime Timestamp ISO8601 Creation time.
Parameter format: YYYY-MM-DDTHH:mm:ssZ (ISO 8601 format)
UpdateTime Timestamp ISO8601 Update time
Parameter format: YYYY-MM-DDTHH:mm:ssZ (ISO8601 format)
RuleAction String Rule Action
Enumeration value:
PASS: allowlist
BLOCK: Block and alarm
MONITOR: alarm

TrafficSandboxLLMAuditRuleRef

Reference item of the LLM audit system rule in the LLM audit rule

Used by actions: DescribeSandboxLLMAuditRuleList.

Name Type Description
SystemRuleID String LLM audit system rule ID (string)
SystemRuleName String LLM audit system rule name

TrafficSandboxLLMAuditSystemRuleItem

LLM audit system sub-rule (LLM audit system rule)

Used by actions: DescribeSandboxLLMAuditSystemRuleList.

Name Type Description
RuleID String LLM audit system rule ID (string)
RuleName String Rule name
Description String Rule description

TrendDataPoint

Trend data point

Used by actions: DescribeSecurityRiskTrend.

Name Type Description
Date String Date
Parameter format: YYYY-MM-DD
RiskCount Integer Number of risks. 0 indicates no data.

UebaCustomRule

User behavior analysis custom policy structure

Used by actions: DescribeUebaRule.

Name Type Required Description
RuleName String Yes Policy name.
UserType Integer Yes 1: Cloud account
2: Custom user
TimeInterval Integer Yes Occurrence time
1: 10 minutes
2: 1 hour
3: One day
4: One week
5: One month
EventContent UebaEventContent Yes Event that occurred
AlertName String Yes Alarm name
AlterLevel Integer Yes Alarm type
0: Notification
1: Low risk
2: Medium risk
3: High risk
4: Critical
Operator Array of String Yes Operator.
OperateObject Array of String Yes Operation object.
OperateMethod Array of String Yes Operation method.
LogType String No Log type
LogTypeStr String No Log Chinese name

UebaEventContent

Event structure of user behavior analysis

Used by actions: DescribeUebaRule.

Name Type Required Description
EventType Integer Yes Event type
1: Statement retrieval
2: Filter retrieval
Content String No Content for statement retrieval
Filters Array of WhereFilter No Retrieval criteria
StatisticalFilter StatisticalFilter No Statistical condition

UebaRule

User behavior analysis policy

Used by actions: DescribeUebaRule.

Name Type Description
RuleID String Policy ID
RuleName String Rule name
RuleType Integer Policy type.
0: System policy
1: Create custom policy
RuleLevel Integer Policy level
0: Prompt.
1: low
2: Medium risk
3: High risk
4: Critical
RuleContent String Policy content
RuleStatus Boolean Policy switch
HitCount Integer Number of hits
AppID String Appid of the associated account
MemberID String Multi-account, member ID
Uin String Uin
Nickname String Nickname
CustomRuleDetail UebaCustomRule Specific content of the custom rule
CloudType Integer Cloud type
Tencent Cloud: 0
aws:1

UebaUserSummary

User behavior analysis - user overview information

Used by actions: DescribeUebaUserSummary.

Name Type Description
AllUserCount Integer Quantity of all users
AbnormalUserCount Integer Number of abnormal users
UserCount Integer Number of users for the cloud account
SubUserCount Integer Number of sub-users
CustomUserCount Integer Number of custom users
Element Array of UebaUserSummaryElement Custom user sum building block

UebaUserSummaryElement

user behavior analysis user overview sum of elements

Used by actions: DescribeUebaUserSummary.

Name Type Description
MemberID String Attendee id
LogType String Log type
UserID String UID basis field
Count Integer Quantity.

UltimateAppItem

User flagship version information.

Used by actions: CheckCWPExposePathPermission.

Name Type Description
AppID Integer

User AppID.
IsUltimateVersion Boolean

Whether it is the flagship edition.

UserAKInfo

ak quantity information of the account

Used by actions: DescribeUserAKInfoList.

Name Type Description
AppID Integer APPID
Uin String UIN
NickName String Account nickname
AKNum Integer Number of AKs under the account
IsShared Integer Whether it is shared. 1: shared. 2: not shared.
IsSelfBuy Integer Whether to purchase separately. 1: separate purchase; 2: not purchased separately
ShareFromAppID Integer Source account of the quota
CloudType Integer Cloud vendor type
0: Tencent Cloud
1: Amazon Web Services
2: Microsoft Azure.
3: Google Cloud
4: Alibaba Cloud
5: Huawei Cloud

UserCSPMInfo

CSPM information of an account

Used by actions: DescribeUserCSPMInfoList.

Name Type Description
AppID Integer

APPID
Uin String

UIN
NickName String

Account nickname
CSPMNum Integer

CSPM scan quota
UsedCount Integer

Consumed CSPM scan quota
GrantedCSPMNum Integer

Complimentary CSPM scan quota
IsShared Integer

Whether it is shared. 1: shared, 2: not shared
IsSelfBuy Integer

Whether to purchase separately. 1: purchase separately, 2: not purchased separately
ShareFromAppID Integer

Quota source account
Role String

Role: member; admin; delegatedAdmin
Department String

Department

UserCallRecord

Details of call log records

Used by actions: DescribeUserCallRecord.

Name Type Description
SourceIP String Source IP of the api call
EventType Integer Invocation type
0: Console invocation
1:API
CallCount Integer Number of calls.
Code Integer Call error code
0: Successful
FirstCallTime String First call time
LastCallTime String Last call time
SourceIPRemark String Remark on source IP of the api call
Region String Region of the source IP of the api call
UserName String User/role name
Date String Aggregation date
AppID Integer appid
ISP String Internet service provider.

UserConfSyncStatus

User configuration synchronization status

Used by actions: DescribeBaselineSyncConf, ModifyBaselineSyncConf.

Name Type Required Description
AppID Integer No

User AppID.
AllowSync Boolean No

Whether administrator synchronization is allowed
InConf Boolean No

Whether it is being configured
ManagedByOther Boolean No

Whether synchronized by other administrators

UserDspmInfo

Account dspm information

Used by actions: DescribeUserDspmInfoList.

Name Type Description
AppID Integer APPID
Uin String UIN
NickName String Account nickname
AssetNum Integer Number of database assets under the account
UsedAssetNum Integer Number of security analysis database assets enabled under the account
IsShared Integer Whether it is shared. 1: shared; 2: not shared
IsSelfBuy Integer Whether to purchase separately. 1: separate purchase; 2: not purchased separately
ShareFromAppID Integer Quota source account
CloudType Integer Cloud type (0: Tencent Cloud; 1: Amazon Web Services; 2: Microsoft Azure; 3: Google Cloud; 4: Alibaba Cloud; 5: Huawei Cloud)
IsIsolating Boolean Whether the account is isolated
IsDataCleaning Boolean Whether data clearing is underway

UserItem

User information.

Used by actions: DescribeUserInfo.

Name Type Description
AppID Integer

Login user appid
AccountType Integer

Type of user
PayType Integer

User payment mode
TotalQuota Integer

Total quota count
CostQuota Integer

Consumed quota count
Providers Array of String

Cloud vendor information
QuotaFlushType String

refresh: update next time; expire: no longer update next time
QuotaFlushTime String

Next quota refresh time
QuotaSource Integer

Purchase type
ShareFromAppID Integer

The appid of the sharing party when shared, or 0 when purchased or out of quota
ShareFromUser String

Quota sharing party account

VPRLabel

Vulnerability VPR tag

Used by actions: DescribeHostKBRiskList, DescribeHostVulItemVPRInfo, DescribeKBDetail, DescribeVulItemList, DescribeVulLabelList.

Name Type Description
Name String

Tag name
Enumeration values:
IN_THE_WILD: exploitation in the wild
EXP: has EXP
POC: has POC
INTERNET_EXPOSED: public network exposure
NO_RESTART: no restart required
HIGH_VALUE_ASSET: important asset
MALWARE_WEAPONIZED: weaponized
Level String

Tag level
Enumeration values:
HIGH: High
MEDIUM: Medium
LOW: Low
Remark String

Tag description

VPRRatingInfo

VRP rating information

Used by actions: DescribeHostVulItemVPRInfo, DescribeVulFixedList, DescribeVulItemList, DescribeVulRiskRelateHost.

Name Type Description
Result String VPR rating result
Enumeration value:
URGENT: Immediate repair
SUGGESTED: Suggested repairs
DEFERRABLE: Deferrable repair
Remark String Rating description
Stage Array of VPRRatingStage List of stage rating details

VPRRatingStage

VRP rating stage

Used by actions: DescribeHostVulItemVPRInfo, DescribeVulItemList.

Name Type Required Description
Stage String No Stage name (for example: threat activity level, exploitability, vulnerability severity)
Result String No Rating result of this stage

VULBaseInfo

Basic data of urgent vulnerabilities

Used by actions: DescribeVULList.

Name Type Description
Level String Risk level
high risk / Medium risk / low risk / Notification
Component String Component
PublishTime String Vulnerability release time
LastScanTime String Last scan time
AffectAssetCount Integer Number of Affected Assets
RiskId String Risk ID
VULType String Vulnerability type
VULName String Vulnerability name
CVE String cve
Describe String Description
Payload String Vulnerability Payload
AppName String Vulnerability Impact component
References String Technical reference
AppVersion String Vulnerability Impact version
VULURL String Risk point
Nick String User Nickname
AppId String User appid.
Uin String User UIN
Fix String Fixing suggestion
EMGCVulType Integer Emergency Vulnerability Type. 1-Emergency Vulnerability; 0-Non-emergency Vulnerability.
CVSS Float CVSS score
AttackHeat Integer Attack heat
0/1/2/3
ScanStatus Integer Detection status. 0: unscanned; 1: scan in progress; 2: scan complete
IsSuggest Integer Whether 1/0 is required
VulTag Array of String Tag.
SupportProduct String Supported products, separate with commas: "cfw_waf_virtual", "cwp_detect", "cwp_defense", "cwp_fix"
TaskId String Vulnerability detection task id
Index String Primary key
PcmgrID String Vulnerability id (legacy version)
TvdID String Vulnerability id New version

VULRiskAdvanceCFGList

Vulnerability Risk Advanced Configuration List

Used by actions: DescribeVULRiskAdvanceCFGList.

Name Type Description
RiskId String Risk ID
VULName String Vulnerability name
RiskLevel String Risk level. low: low risk. high: high risk. middle: medium risk. info: notification. extreme: critical.
CheckFrom String Recognition source
Enable Integer Enable/Disable. 1-Enable; 0-Disable.
VULType String Risk type
ImpactVersion String Affected version
CVE String CVE
VULTag Array of String Vulnerability tag
FixMethod Array of String Repair method
ReleaseTime String Disclosure time
EMGCVulType Integer Emergency Vulnerability Type. 1-Emergency Vulnerability; 0-Non-emergency Vulnerability.
VULDescribe String Vulnerability description
ImpactComponent String Affected component
Payload String Vulnerability Payload
References String Technical reference
CVSS String CVSS Score
AttackHeat String Attack level
ServiceSupport Array of ServiceSupport Security product support status
RecentScanTime String Latest detection time

VULRiskInfo

Vulnerability risk information

Used by actions: DescribeVULRiskDetail.

Name Type Description
Fix String Fixing suggestion
References String Technical reference/Reference link
Describe String Vulnerability description
ImpactComponent Array of VulImpactComponentInfo Affected component

VULViewVULRisk

Vulnerability Risk Objects from Vulnerability's Perspective

Used by actions: DescribeRiskCenterVULViewVULRiskList.

Name Type Description
Port String Port.
NoHandleCount Integer Affect assets
Level String Risk level. low: low risk, high: high risk, middle: medium risk, info: notification, extreme: critical.
Component String Component
RecentTime String Latest Recognition Time
FirstTime String First Recognition Time
AffectAssetCount Integer Number of Affected Assets
Id String Risk ID
From String Scan Source. See API Return Enumeration Type for details.
Index String Front-end Index
VULType String Vulnerability type
VULName String Vulnerability name
CVE String cve
Describe String Description
Payload String Vulnerability Payload
AppName String Vulnerability Impact Component
References String Technical reference
AppVersion String Affected versions
VULURL String Risk Points
Nick String User Nickname
AppId String User appid.
Uin String User UIN
Fix String Fixing suggestion
EMGCVulType Integer Emergency Vulnerability Type. 1-Emergency Vulnerability; 0-Non-emergency Vulnerability.

VULViewVULRiskData

Vulnerability Risk Objects from Vulnerability's Perspective

Used by actions: DescribeVulViewVulRiskList.

Name Type Description
Port String Port.
NoHandleCount Integer Affect assets
Level String Risk level. low: low risk. high: high risk. middle: medium risk. info: notification. extreme: critical.
Component String Component
RecentTime String Latest Recognition Time
FirstTime String First Recognition Time
AffectAssetCount Integer Number of Affected Assets
RiskId String Risk ID
From String Scan Source. See API Return Enumeration Type for details.
Index String Front-end Index
VULType String Vulnerability type
VULName String Vulnerability name
CVE String cve
Payload String Vulnerability Payload
AppName String Vulnerability Impact component
AppVersion String Affected versions of the vulnerability
VULURL String Risk point
Nick String User Nickname
AppId String User appid.
Uin String User UIN
EMGCVulType Integer Emergency Vulnerability Type. 1-Emergency Vulnerability; 0-Non-emergency Vulnerability.
CVSS Float CVSS score
PCMGRId String PCMGRId
VulTag Array of String Vulnerability tag. During searching, you must pass in VulTag=SuggestRepair/EMGCVul for emergency and mandatory vulnerabilities.
DisclosureTime String Vulnerability disclosure time
AttackHeat Integer Attack heat
IsSuggest Integer Whether it is a mandatory vulnerability. 1: yes, 0: no
HandleTaskId String Disposal task id
EngineSource String Engine source
VulRiskId String New vulnerability risk id
TvdID String New version vulnerability id
IsOneClick Integer Is one-click physical examination possible? 1: allowed, 0: not allowed.

Vpc

VPC List Data

Used by actions: DescribeVpcAssets.

Name Type Description
Subnet Integer Subnet (supports only 32-bit)
ConnectedVpc Integer Interconnected VPC (supports only 32-bit)
AssetId String Asset ID
Region String region
CVM Integer CVM (supports only 32-bit)
Tag Array of Tag Tag.
DNS Array of String DNS Domain
AssetName String Asset name
CIDR String CIDR Network Segmentation
CreateTime String Asset creation time
AppId String appid
Uin String uin
Nick String Nickname
IsNewAsset Integer New Asset or Not. 1: New
IsCore Integer Whether it is a core asset. 1-Yes, 2-No.

VulAffectedComponent

Detailed list of components affected by vulnerabilities in the repository image

Used by actions: DescribeImageLayerVulList, DescribeImageVulList, DescribeImageVulSummaryList.

Name Type Description
ComponentId Integer

Component id
LayerId String

Image layer id
Name String

Component name
Version String

Component version number
FixedVersion String

Version number of the vulnerability fix

VulBriefInfo

Vulnerability brief information

Used by actions: DescribeHostKBRiskList, DescribeKBDetail.

Name Type Description
VulID Integer Vulnerability ID (vul_vuls.id)
VulName String Vulnerability name
CVEID String CVE No.
Parameter format: e.g. CVE-2018-5377
Label Array of VPRLabel List of VPR risk tags
CvssScore Float CVSS score
Valid values: [0.0, 10.0]
Level String Threat level
Enumeration value:
INVALID: invalid
INFO: Notification
LOW: low-risk
MEDIUM: Medium risk
HIGH: High risk
CRITICAL: Critical
PublishTime String Vulnerability disclosure time
Parameter format: YYYY-MM-DD HH:mm:ss

VulComponentSummary

Host Vulnerability Component Overview

Used by actions: DescribeVulRiskRelateComponent.

Name Type Required Description
Name String Yes

Component name.
RelateHostCount Integer No

Associated hosts.

VulDetailInfo

All vulnerability information

Used by actions: DescribeHostVulRiskList, DescribeVulItemList.

Name Type Description
ID Integer

Vulnerability ID
Name String

Vulnerability name
CVEID String

CveID
Category String Vulnerability category
Enumeration values:
LINUX: Linux software vulnerability
WINDOWS: Windows systems patch
WEB_CMS: Web-CMS vulnerabilities
APPLICATION: Application vulnerability
EMERGENCY: Urgent vulnerability
PublishTime String Vulnerability disclosure time
Parameter format: YYYY-MM-DD HH:mm:ss
CheckMethod String

Detection mode

Enumeration value:

  • VersionCompare: Version comparison
  • POC: POC detection
DefendStatus String Vulnerability defense status
Enumeration values:
ENABLED: On
NOT_SUPPORTED: Not supported
NOT_ENABLED: not enabled
SupportFix Boolean Whether one-click repair is supported
Enumeration values:
true: Support
false: Not supported
VRPRatingInfo VPRRatingInfo VPR rating information (including rating result, description, and phased score)
CvssScore Float CVSS score
Valid values: [0.0, 10.0]
Label Array of VPRLabel VPR risk tag list (such as exploitation in the wild, EXP available, POC available, public network exposure, no restart required)
Remark String Vulnerability remark
Summary String Vulnerability overview
DefendHostCount Integer Number of hosts with vulnerability protection enabled
NotDefendHostCount Integer Number of hosts with vulnerability defense disabled
LatestScanTime String Last scan time
Parameter format: YYYY-MM-DD HH:mm:ss
CVSSLevel String CVSS severity level
Enumeration values:
INVALID: Invalid
INFO: Notification
LOW: low-risk
MEDIUM: Medium risk
HIGH: High risk
CRITICAL
VulAffect Array of String Description list of affected software (each item such as openssl < 1.1.1k)
KVERecord Boolean Whether included in the KVE (Known Vulnerability Exploitation) library
Enumeration values:
true: Recorded
false: Not recorded
KVERecordTime String KVE collection time
Parameter format: YYYY-MM-DD HH:mm:ss
EPSSScore Float EPSS score (vulnerability type probability prediction)
Valid values: [0.0, 1.0]
AffectVendor Array of String Affected vendor list
AffectProduct Array of String List of affected products
Mechanism String Vulnerability type mechanism description
Precondition String Pre-deployment instructions for vulnerability type
LatestTrend Array of VulSpreadTrend Latest vulnerability spread trend data list (by date)
FixSolution String

Solution
RefLink String

Reference link
HarmDescription String

Vulnerability severity description
AffectVendorProduct Array of VulVendorProduct

Vulnerability Impact product

VulFixItem

Vulnerability repair item, specify a vulnerability/KB patch and its target host that needs to be repaired.

Used by actions: CreateVulFixTask.

Name Type Required Description
InstanceIds Array of String Yes

Instance ID list of hosts requiring fixing
Input parameter limitation: Up to 1,000 instance IDs per single item
VulId Integer No

Vulnerability ID. Choose either VulId or KBId.
KBId Integer No

Patch ID. Choose either VulId or KBId.

VulFixStatusItem

Vulnerability/KB patch dimensional remediation status

Used by actions: DescribeVulFixTaskDetail.

Name Type Description
VulId Integer Vulnerability ID (empty for KB patch fix tasks)
KBId Integer Patch ID (empty for vulnerability repair tasks)
VulName String Vulnerability name or KB patch name
FixStatus Integer Remediation status of the vulnerability
Enumeration value:
0: In remediation
1: All successful
2: partially failed
3: All failed
HostCount Integer Total hosts associated with the vulnerability/KB patch
SuccessHostCount Integer Number of hosts successfully fixed by the vulnerability/KB patch
FailHostCount Integer Number of hosts failed to be fixed for the vulnerability/KB patch

VulFixSummaryItem

Vulnerability repair summary

Used by actions: DescribeVulFixableMachineList.

Name Type Description
VulId Integer

Vulnerability ID
VulName String

Vulnerability name
CveId String

CVE id
AffectedCount Integer

Number of affected hosts
NeedReboot Boolean

Whether restart is required after repair
FixSwitch Boolean

Whether one-click repair is supported true-supported false-unsupported

VulFixTaskDetailItem

Vulnerability repair task details

Used by actions: DescribeVulFixTaskDetail.

Name Type Description
Id Integer

Detailed record ID
TaskId Integer

Associated repair task ID
VulId Integer

Vulnerability ID to be repaired
KBId Integer

Patch ID of the fixed KB
InstanceId String

Host instance ID.
MachineName String

Host name.
MachineIp String

Host private IP address.
VulName String

Vulnerability name
Status Integer

Execution status
Enumeration value:
0: Initial state
1: Task issued
11: Client confirmed
2: Repair completed
3: Client offline
4: Timeout
5: Failure
6: Unsupported
9: Waiting for snapshot creation
10: Snapshot creation failed
FixStatus Integer

Fix result

Enumeration values:

  • 0: initial state
  • 1: repair successful
  • 2: fix failure
  • 3: fix
SnapshotStatus Integer

Snapshot status
Enumeration value:
-1: No need to create a snapshot
0: Not started
1: In progress
2: Completed
3: Creation failed
ExceptionMessage String

Exception prompt message
StartTime Timestamp ISO8601

Repair startup time
Parameter format: YYYY-MM-DDTHH:mm:ssZ (ISO8601 format)
EndTime Timestamp ISO8601

Repair end time
Parameter format: YYYY-MM-DDTHH:mm:ssZ (ISO8601 format)
SnapshotCreateTime Timestamp ISO8601

Snapshot creation time
Parameter format: YYYY-MM-DDTHH:mm:ssZ (ISO8601 format)
SnapshotExpireTime Timestamp ISO8601

Snapshot expiration time
Parameter format: YYYY-MM-DDTHH:mm:ssZ (ISO8601 format)
SnapshotFailReason String

Snapshot creation failure reason (available when SnapshotStatus=3)

VulFixTaskInfo

Task summary of vulnerability repair

Used by actions: DescribeVulFixTaskDetail.

Name Type Description
Id Integer Primary key ID of the fix task
TaskId Integer Task ID.
FixStatus Integer Remediation status
Enumeration values:
0: initialization
1: In remediation
2: Repair successful
3: Partially fix failed
4: All fix failures
5: Stop repair
AssetCount Integer Repair total number of assets
SuccessCount Integer Number of successful fixes
FailCount Integer FIX_FAILURE count
FixingCount Integer Number of hosts in remediation
QueueCount Integer Number in queue (waiting for distribution or snapshot creation)
Progress Integer Progress percentage of the repair
Value range: [0, 100].
Supplemental description: Calculation method is (SuccessCount+FailCount)/AssetCount×100.
SuccessVulCount Integer Number of successfully fixed vulnerabilities
FailVulCount Integer Number of vulnerabilities that failed to fix
VulNames Array of String List of vulnerability names to be fixed
StartTime Timestamp ISO8601 Fix startup time
Parameter format: YYYY-MM-DDTHH:mm:ssZ (ISO8601 format).
EndTime Timestamp ISO8601 Fixing end time
Parameter format: YYYY-MM-DDTHH:mm:ssZ (ISO8601 format).
VulFixStatusList Array of VulFixStatusItem List of vulnerability dimensional remediation status, status details of each vulnerability

VulFixTaskItem

Vulnerability repair task list item

Used by actions: DescribeVulFixTaskList.

Name Type Description
Id Integer Primary key ID of the fix task
TaskId Integer Task ID, hash flag for interactive
JobId String JobId, corresponding to the Task ID of the task system.
VulIds Array of Integer List of vulnerability IDs to be fixed
KBIds Array of Integer List of fixed KB patch IDs
AssetCount Integer Repair the total number of assets
SuccessCount Integer Number of successfully fixed hosts
FailCount Integer Number of hosts failed to be fixed
Progress Integer Progress percentage of the repair
Valid values: [0, 100]
Supplemental description: Calculation method is (SuccessCount+FailCount)/AssetCount×100.
TargetAppIdsCount Integer Number of users in the fix task
FixStatus Integer Remediation status
Enumeration value:
0: initialization
1: In remediation
2: Repair successful
3: Partially fix failed
4: All fix failures
5: Stop repair
Timeout Integer Maximum repair time
Unit: seconds.
StartTime Timestamp ISO8601 Fix startup time
Parameter format: YYYY-MM-DDTHH:mm:ssZ (ISO8601 format).
EndTime Timestamp ISO8601 Fix end time
Parameter format: YYYY-MM-DDTHH:mm:ssZ (ISO8601 format).
CreateTime Timestamp ISO8601 Record creation time.
Parameter format: YYYY-MM-DDTHH:mm:ssZ (ISO8601 format).
VulNames Array of String List of vulnerability names to be fixed, making it easy to show directly on the list page
VulCategory Array of String Vulnerability Type List
Enumeration values:
LINUX: Linux software vulnerability
WINDOWS: Windows system patch vulnerability
WEB_CMS: Web-CMS vulnerabilities
APPLICATION: Application vulnerability
EMERGENCY: Urgent vulnerability
AppId Integer Creator AppId

VulFixableMachineItem

Fixable host information

Used by actions: DescribeVulFixableMachineList.

Name Type Description
VulIds Array of Integer

Vulnerability ID list, grouped by SupportAutoFix dimension: repairable vulnerability IDs when SupportAutoFix=1, non-repairable vulnerability IDs when SupportAutoFix=0
InstanceId String

Host instance ID.
MachineName String

Host name.
MachineIp String

Host IP address.
PublicIp String

public IP address
OsType String

OS type
Enumeration value:
linux: Linux operating system
windows: Windows operating system
OsName String

Operating system name.
MachineStatus String

Host online status
Enumeration value:
ONLINE: online
OFFLINE: offline
SupportAutoFix Integer

Is auto-repair supported
Enumeration value:
0: No support
1: Support
FixStatus Integer

Current remediation status
Enumeration value:
0: Unfixed
1: In remediation
2: Fix failure
3: Repair successful
4: Timeout
LatestFixTime Timestamp ISO8601

Last repair time
Parameter format: YYYY-MM-DDTHH:mm:ssZ (ISO8601 format)
NotFixableReason String

Non-repairable reason. Returned when SupportAutoFix is 0.
FixCommands Array of String

Fix command list, returned when SupportAutoFix is 1
Components Array of String

Associated component list
TagItems Array of MiniTagItem

Asset tag list
AppId Integer

Account AppId
PayVersion String

Paid edition info
Enumeration value:
BASIC: Basic version
PRO: Pro edition
ULTIMATE: Flagship edition

VulFixedItem

Fixed vulnerability information

Used by actions: DescribeVulFixedList.

Name Type Description
VulId Integer Vulnerability ID
VulName String Vulnerability name
Level String Vulnerability level
Enumeration values:
LOW: low-risk
MEDIUM: Medium risk
HIGH: High risk
CRITICAL
VRPRatingInfo VPRRatingInfo VPR rating information (including rating result, description, and phased score), consistent with DescribeHostVulRiskList
VulCategory String Vulnerability Type
Enumeration values:
LINUX: Linux software vulnerability
WINDOWS: Windows system patch vulnerability
WEB_CMS: Web-CMS vulnerabilities
APPLICATION: Application vulnerability
EMERGENCY: Urgent vulnerability
CveId String CVE id
MachineName String Repair the host name
InstanceId String Repair the host instance ID
ComponentCount Integer Associated component & number of paths
Components Array of String Associated component & path list
LatestFixTime String Last repair time
Parameter format: YYYY-MM-DDTHH:mm:ssZ (ISO8601 format).

VulHostBriefInfo

Host brief information

Used by actions: DescribeVulRiskRelateHost.

Name Type Description
InstanceID String

Cloud host instance ID
Parameter format: such as ins-xxxxxxxx
Name String

Host name.
PublicIP String

Public network IP address
PrivateIP String

Private IP address
DefendVersion String

Protection edition
Enumeration value:
NONE: No protection
BASIC: Basic version
PRO: Pro edition
ULTIMATE: Flagship edition
PRO_LH: Lightweight edition
DefendStatus String

Vulnerability defense status
Enumeration value:
ENABLED: Enabled
NOT_SUPPORTED: Unsupported
NOT_ENABLED: Not enabled
Account AccountBriefInfo

Associated account information
InstanceStatus String

Cloud host instance status
Enumeration value:
RUNNING: running
STOPPED: stopped
UNKNOWN: unknown
RiskStatus String

Remediation status enumeration values.

Enumeration values:

  • PENDING: To be fixed,
  • SCANNING: Scan in progress,
  • FIXED: Fixed,
  • IGNORED: Ignored,
  • FIXING: In remediation,
  • FIX_FAILED: Fix failure,
  • NEED_REBOOT: Pending restart.
VPRRating VPRRatingInfo

VPR rating information (including rating result and details in each dimension)
AgentStatus String

CWP Agent status
Enumeration value:
ONLINE: Online
OFFLINE: Offline
UNINSTALLED: Not installed
TagItem Array of MiniTagItem

Asset tag list (CSIP internal asset tag)
CloudTag Array of Tag

Cloud tag list (cloud asset side Tag)

VulImpactComponentInfo

Vulnerability Impact component information

Used by actions: DescribeVULRiskDetail.

Name Type Description
Component String Component name
Version String Version name

VulInfoListItem

Vulnerability intelligence data

Used by actions: DescribeMandatoryVulSet.

Name Type Description
Level String Risk level
high: high risk / middle: medium risk / low: low risk / info: notification
SubmitTime String Vulnerability disclosure time
VULName String Vulnerability name
VULID String cveID/tvdID/ssvid

VulRiskItem

Host vulnerability risk content

Used by actions: DescribeVulRiskList.

Name Type Description
CloudAccountID String Cloud Account ID
AssetID String Instance ID.
InstanceStatus String Instance status
InstanceName String Instance name.
CreateTime String Creation time.
UpdateTime String Update time
VulName String Vulnerability name
VulCategory String vulnerability type
VulLevel String Vulnerability level
CveID String CVE ID
Description String Vulnerability description
ContainerID String Container ID
Fix String Vulnerability risk remediation recommendations
VulCategoryName String Linux vulnerability
VulLevelName String Vulnerability level name
InstanceStatusName String Chinese information of instance status
AppID Integer Tenant ID

VulScanTask

Vulnerability scanning task history

Used by actions: DescribeVulScanTaskList.

Name Type Required Description
Id Integer No

Task ID.
JobId String No

Task ID.
AppId Integer No

Associated user appid of the task
TaskType Integer No

Task type

Enumeration value:

  • 0: One-click scan
  • 1: Period scanning
VulCategory Array of String No

Vulnerability type

Enumeration value:

  • LINUX: Linux software vulnerability
  • WINDOWS: Windows system patch
  • WEB_CMS: Web-CMS vulnerability
  • APPLICATION: Application vulnerability
  • EMERGENCY: Emergency vulnerability
VulName Array of String No

Vulnerability name
KbName Array of String No

kb name.
Emergency Integer No

Whether an emergency vulnerability

Enumeration value:

  • 0: No
  • 1: Yes
Account Integer No

Number of accounts to scan (0: all accounts, others: number of accounts)
StartTime Timestamp ISO8601 No

Scan start time
EndTime Timestamp ISO8601 No

Scan end time
Status String No

Scan status (INITIALIZING: Initialization, SCANNING: Scanning, SUCCESS: Scan successful, TOTAL_FAIL: Total scan failure)

Enumeration value:

  • STOPPED: Stopped
Level Array of String No

Vulnerability threat level

Enumeration value:

  • LOW: Low risk
  • MEDIUM: Medium risk
  • HIGH: High risk
  • CRITICAL: Critical
Method Array of String No

Scanning method

Enumeration value:

  • VersionCompare: version comparison
  • POC: POC detection
  • VersionComparePOC: version comparison+POC detection
AssetList Array of String No

Asset list
AssetRange Integer No

Asset scope

Enumeration value:

  • 0: All assets
  • 1: Custom assets
  • 2: Selected excluded assets

VulScanTaskDetail

Vulnerability scan task details

Used by actions: DescribeVulScanTaskDetail.

Name Type Required Description
Id String No

Task ID.
AppId Integer No

Creator AppId
InstanceId String No

Instance id
InstanceName String No

Instance name.
PublicIp String No

Public ip address
PrivateIp String No

Private ip
OS String No

os
Status String No

Scan status (SUCCESS: Scan complete/successful, OFFLINE: Client offline, TIMEOUT: Scan timeout, FAILED: Scan failed, UNSUPPORTED: Client version too low/Do not support scanning, TERMINATED: Terminated, TERMINATING: Terminating)

Enumeration value:

  • SCANNING: Scanning
StartTime Timestamp ISO8601 No

Scan start time
EndTime Timestamp ISO8601 No

Scan end time
Vuls Integer No

Vulnerability count
Description String No

Failure reason

VulSpreadTrend

Vulnerability propagation trend

Used by actions: DescribeVulItemList.

Name Type Description
Date String

Date
Parameter format: YYYY-MM-DD
Trend Float

Propagation trend numeric value of the date

VulTrend

Vulnerability trends - Attack trend, Users Affected, Affecting Assets

Used by actions: DescribeVULRiskDetail.

Name Type Description
AffectAssetCount Integer Number of affected assets
AffectUserCount Integer Number of impacted users
AttackCount Integer Number of attacks
Date String Time

VulVendorProduct

Vulnerability Impact Manufacturer and Product

Used by actions: DescribeVulItemList.

Name Type Description
Vendor String

supplier
Product String

Product name.
VersionRange Array of String

Affected version

VulWhitelist

Vulnerability allowlist

Used by actions: DescribeVulIgnoreRuleList.

Name Type Required Description
Id Integer No

id
Name String No

Vulnerability name
Remark String No

Remarks.
AppId Integer No

Account
AssetList Array of String No

Asset list
UpdateTime Timestamp ISO8601 No

Update time.
Switch Integer No

Policy switch (0-off, 1-on)
AssetRange Integer No

Asset scope

Enumeration value:

  • 0: All assets
  • 1: Self-selected Assets
  • 2: Select all excluded asset
KBId Integer No

Patch KB id
VulId Integer No

Vulnerability Id

WebhookAssetScope

Notification asset scope

Used by actions: DescribeWebhookPolicyList, ModifyWebhookPolicy.

Name Type Required Description
AssetRange Integer Yes Asset scope type (aligned with NotifyAssetRange)
Enumeration values:
1: All hosts (removable)
2: Specified hosts
3: Select by tag
InstanceIds Array of String No quuid list of selected hosts. It takes effect only when AssetRange=2.
ExcludedInstanceIds Array of String No Excluded host quuid list. This parameter takes effect only when AssetRange is 1.
TagIds Array of Integer No Security center tag ID list. It takes effect only when AssetRange is 3.
CloudTags Array of String No List of Tencent Cloud tags. It takes effect only when AssetRange is set to 3.
Input parameter limitation: when AssetRange=3, TagIds and CloudTags cannot be empty at the same time.

WebhookCustomField

Custom passthrough field

Used by actions: DescribeWebhookPolicyList, ModifyWebhookPolicy.

Name Type Required Description
Key String No Field name
Input parameter limit: length 1-64
Value String No field value
Input parameter limits: length 1-256

WebhookNotifyItem

A single notification item

Used by actions: DescribeWebhookPolicyList, ModifyWebhookPolicy.

Name Type Required Description
Module String No

Module code (shares enumeration with ModifyNotifySettingAlert)
Enumeration values:
Vul: vulnerability and cloud security posture
Alert: alarm center
AkSk: Cloud API Risk Governance
Agent: client/host asset
LogAnalysis: log analysis
SubModule String No

Submodule code
Enumeration values (partial):
MALWARE_FILE: MALICIOUS FILE
MALWARE_PROCESS: MALICIOUS PROCESS
RISK_LOGIN: abnormal LOGIN
BRUTE_FORCE: password cracking
MALICIOUS_REQUEST: MALICIOUS REQUEST
HIGH_RISK_COMMAND: HIGH-RISK COMMAND
PRIVILEGE_ESCALATION: local PRIVILEGE ESCALATION
REVERSE_SHELL: REVERSE SHELL
NETWORK_ATTACK: NETWORK ATTACK
MULTI_BEHAVIOR_ATTACK: MULTI-BEHAVIOR ATTACK
AGENT_OFFLINE: client OFFLINE
AGENT_UNINSTALL: client uninstallation
For the complete enumeration, see DescribeWebhookNotifyItemTree
Levels Array of String No

Risk level collection
Enumeration values:
CRITICAL: Critical
HIGH: High risk
MEDIUM: Medium risk
LOW: Low risk
INFO: Notification
Submodules with unsupported levels pass an empty array
Items Array of String No

Processing status

WebhookPolicy

Complete notification policy information

Used by actions: DescribeWebhookPolicyList.

Name Type Description
ID Integer

Policy ID
Name String

Policy name.
Status String

Enabled status
Enumeration values:
ON: enable
OFF: disable
NotifyItems Array of WebhookNotifyItem

Notification item list (module + submodule + severity + handling status)
MemberId Array of String

Account range of members to receive
AssetScope WebhookAssetScope

Notification asset scope
ReceiveFormat String

Accept format
Enumeration values:
TEXT: text format
JSON: JSON format
MsgLanguage String

Push language
Enumeration values:
zh: Chinese
en: English
CustomFields Array of WebhookCustomField

Custom passthrough field list. It is an empty array when turned off.
ReceiverIDList Array of Integer

Receiving robot ID list
ReceiverList Array of WebhookReceiverBrief

Simplify info for the receiving robot (for list row display)

WebhookReceiver

Receiving robot info

Used by actions: DescribeWebhookReceiverList.

Name Type Description
ID Integer

Robot ID
Name String

Bot name
Input limit: 1-20 characters in length
Type String

Robot type
Enumeration values:
WEBHOOK: webhook type
SCF: function type
WebhookAddr String

Webhook address, returned only if Type=WEBHOOK; otherwise empty
SCFRegion String

Function region. It is returned only when Type is SCF.
Namespace String

Function namespace, returned only when Type is SCF
FunctionName String

SCF function name. It is returned only when Type is SCF.
FunctionVersion String

Function version of the cloud function. It is returned only when Type is SCF.
Alias String

SCF function alias, returned only when Type is SCF

WebhookReceiverBrief

Streamlined info for receiving robot

Used by actions: DescribeWebhookPolicyList.

Name Type Description
ID Integer Bot ID.
Name String Bot name
Type String Robot type
Enumeration values:
WEBHOOK: webhook type
SCF: Cloud function type

WebsiteRisk

Website Risk Objects

Used by actions: DescribeRiskCenterWebsiteRiskList.

Name Type Description
AffectAsset String Affect assets
Level String Risk level. low: low risk. high: high risk. middle: medium risk. info: notification. extreme: critical.
RecentTime String Latest Recognition Time
FirstTime String First Recognition Time
Status Integer Status. 0-Unprocessed; 1-Disposed; 2-Ignored.
Id String ID, handle risks
Index String Front-end Index
InstanceId String Instance ID.
InstanceName String Instance name.
AppId String User appid.
Nick String User Nickname
Uin String User UIN
URL String Risky link
URLPath String Risk File Address
InstanceType String Instance type
DetectEngine String Type.
ResultDescribe String Result Description
SourceURL String Source Address URL
SourceURLPath String Source File Address

WhereFilter

Filter criteria

Used by actions: CreateAssetComponentListExportJob, CreateAssetComponentRelatedImageListExportJob, CreateClusterContainerListExportJob, CreateClusterListExportJob, CreateClusterNamespaceListExportJob, CreateClusterNodeListExportJob, CreateDspmAccessExportJob, CreateDspmApproveHistoryExportJob, CreateDspmAssetAccessTopologyExportJob, CreateDspmAssetIdentifyInfoExportJob, CreateDspmAssetsExportJob, CreateDspmIdentifyInfoListExportJob, CreateDspmRiskExportJob, CreateHostImageListExportJob, CreateIaCFileExportJob, CreateImageAssetListExportJob, CreateImageAssociatedContainerListExportJob, CreateImageAssociatedHostListExportJob, CreateImageComponentListExportJob, CreateImageLayerVulListExportJob, CreateImageRegistryListExportJob, CreateImageSensitiveInfoListExportJob, CreateImageVirusListExportJob, CreateImageVulListExportJob, CreateImageVulSummaryListExportJob, CreatePodContainerListExportJob, CreatePodServiceListExportJob, CreateScanStatisticExportJob, DescribeAIAgentAssetList, DescribeAIAgentCredentialList, DescribeAIAnalysisHistory, DescribeAbnormalCallRecord, DescribeAccessKeyAlarm, DescribeAccessKeyAsset, DescribeAccessKeyRisk, DescribeAccessKeyUserList, DescribeAccessKeyWhiteList, DescribeAlertList, DescribeAssetComponentList, DescribeAssetComponentRelatedImageList, DescribeAssetViewVulRiskList, DescribeCSIPRiskStatistics, DescribeCVMAssets, DescribeCWPMachines, DescribeCallRecord, DescribeCheckConnectivityHostList, DescribeClusterAssetList, DescribeClusterAssets, DescribeClusterContainerList, DescribeClusterNamespaceList, DescribeClusterNodeList, DescribeClusterPodAssets, DescribeClusterPodList, DescribeClusterServiceList, DescribeDbAssets, DescribeDomainAssets, DescribeDspmAccessRecord, DescribeDspmAccessTopologyAccounts, DescribeDspmAccessTopologyAssets, DescribeDspmAccessTopologyIps, DescribeDspmApplyHistory, DescribeDspmApplyOrderList, DescribeDspmApproveHistory, DescribeDspmApproveOrderList, DescribeDspmAssetAccessTopology, DescribeDspmAssetAccountIdentify, DescribeDspmAssetAccountPresetPrivileges, DescribeDspmAssetAccounts, DescribeDspmAssetDatabaseList, DescribeDspmAssetFieldList, DescribeDspmAssetIdentifyInfoList, DescribeDspmAssetIds, DescribeDspmAssetSecurityAnalyseStatus, DescribeDspmAssetTableList, DescribeDspmAssets, DescribeDspmAuditFilterStrategy, DescribeDspmDictionaryList, DescribeDspmIdentifyCategoryList, DescribeDspmIdentifyComplianceCategoryRuleList, DescribeDspmIdentifyComplianceGroupList, DescribeDspmIdentifyIdList, DescribeDspmIdentifyInfoList, DescribeDspmIdentifyLevelGroupList, DescribeDspmIdentifyRuleList, DescribeDspmPersonApplyHistory, DescribeDspmPersonalIdentifyList, DescribeDspmRisk, DescribeDspmRiskDetail, DescribeDspmRiskStrategy, DescribeDspmRiskStrategyGroup, DescribeDspmWhitelistStrategy, DescribeEDRScanRecordList, DescribeEDRScanTaskDetail, DescribeGatewayAssets, DescribeIaCFileList, DescribeIaCTokenList, DescribeImageAssetList, DescribeImageAssociatedContainerList, DescribeImageAssociatedHostList, DescribeImageComponentList, DescribeImageExportJobList, DescribeImageLayerList, DescribeImageLayerVulList, DescribeImageRegistryList, DescribeImageRegistryNamespaceList, DescribeImageRegistryScanSubTaskList, DescribeImageRegistryScanTaskList, DescribeImageRegistryTimedScanTaskConfig, DescribeImageRegistryTimedScanTaskPreview, DescribeImageSensitiveInfoList, DescribeImageSensitiveWhitelist, DescribeImageVirusList, DescribeImageVirusWhitelist, DescribeImageVulList, DescribeImageVulSummaryList, DescribeImageVulWhitelist, DescribeKeySandboxCredentialList, DescribeListenerList, DescribeNICAssets, DescribeOrganizationUserInfo, DescribeOtherCloudAssets, DescribePodContainerList, DescribePublicIpAssets, DescribeRepositoryImageAssets, DescribeRiskCallRecord, DescribeRiskCenterAssetViewCFGRiskList, DescribeRiskCenterAssetViewPortRiskList, DescribeRiskCenterAssetViewVULRiskList, DescribeRiskCenterAssetViewWeakPasswordRiskList, DescribeRiskCenterCFGViewCFGRiskList, DescribeRiskCenterPortViewPortRiskList, DescribeRiskCenterRiskTrendAnalysis, DescribeRiskCenterServerRiskList, DescribeRiskCenterVULViewVULRiskList, DescribeRiskCenterWebsiteRiskList, DescribeSandboxFileRuleList, DescribeScanReportList, DescribeScanTaskList, DescribeSourceIPAsset, DescribeSubUserInfo, DescribeSubnetAssets, DescribeTCRInstanceList, DescribeTaskLogList, DescribeUebaRule, DescribeUserAKInfoList, DescribeUserCallRecord, DescribeUserDspmInfoList, DescribeVULList, DescribeVULRiskAdvanceCFGList, DescribeVpcAssets, DescribeVulViewVulRiskList.

Name Type Required Description
Name String Yes Filtered Items
Values Array of String Yes Filtered Value
OperatorType Integer No Central platform definition:
1 equal 2 greater than 3 less than 4 greater than or equal to 5 less than or equal to 6 not equal to 9 fuzzy matching 13 exact matching 14 bitwise AND
Enter 7 for exact match and 9 for fuzzy matching.
前の記事へ: DescribeSearchBugInfo次の記事へ: Error Codes

ヘルプとサポート

この記事はお役に立ちましたか？

フィードバック

キーワードで検索
    Enter keywords to search documentation