Domain name for API request: csip.intl.tencentcloudapi.com.
This API is used to obtain EDR alarm quantity statistics for the asset module. It queries the EDR alarm table based on the passed-in MemberId and InstanceIDs and returns the number of alarm records. If InstanceIDs is empty, summarized statistics are returned. Otherwise, statistics are returned by InstanceID granularity.
A maximum of 20 requests can be initiated per second for this API.
The following request parameter list only provides API request parameters and some common parameters. For the complete common parameter list, see Common Request Parameters.
| Parameter Name | Required | Type | Description |
|---|---|---|---|
| Action | Yes | String | Common Params. The value used for this API: DescribeEdrAlertCountForAsset. |
| Version | Yes | String | Common Params. The value used for this API: 2022-11-21. |
| Region | No | String | Common Params. This parameter is not required. |
| MemberId.N | No | Array of String | Group account member id |
| InstanceIds.N | No | Array of String | List of host instance_id. If empty, return summarize for the appid corresponding to MemberId within range. If not empty, return statistics by each instance_id granularity. |
| Filters.N | No | Array of EDRFilters | Filter criteria list, consistent with DescribeEdrAlertList. Supported Name Values and corresponding Values enumeration: Status - string - Required: No - Alarm Status. Values: PENDING, WHITELISTED, PROCESSED, IGNORED. Level - string - Required: No - Alarm Level. Values: CRITICAL, HIGH, MEDIUM, LOW, INFO. DetectMode - string - Required: No - Detection mode. Values: PRECISE, BALANCED, DEEP. AlertCategory - string - Required: No - Major category of alarm. Values: VIRUS_TROJAN, ABNORMAL_LOGIN, HOST_BEHAVIOR, NETWORK_BEHAVIOR, AI_LINK_ENGINE. AlertSubType - string - Required: No - Alarm sub-type. Values: MALWARE_FILE, MALWARE_PROCESS, RISK_LOGIN, BRUTE_FORCE, DNS, BASH, PRIV_ESCALATION, REVERSE_SHELL, NET_ATTACK, VUL_DEFENCE, MEMORY_SHELL_INJECT, MEMORY_SHELL_SCAN, MULTI_BEHAVIOR_ATTACK. AttackStage - string - Required: No - ATT&CK ATTACK stage. Values: TA0001-TA0011, TA0040, TA0042, TA0043. Empty string means unclassified. AlertSource - string - Required: No - Alarm source. Values: HOST. StartTime - string - Required: No - Start time in YYYY-MM-DD HH:MM:SS format. Defaults to the last 180 days if not passed. EndTime - string - Required: No - End time in YYYY-MM-DD HH:MM:SS format. Defaults to the current time if not passed. |
| Parameter Name | Type | Description |
|---|---|---|
| GlobalCount | EdrAlertCountItem | Global summary statistics (returned when Quuids is empty) |
| Items | Array of EdrAlertCountItem | Statistics list by quuid granularity (returned when Quuids is not empty) |
| RequestId | String | The unique request ID, generated by the server, will be returned for every request (if the request fails to reach the server for other reasons, the request will not obtain a RequestId). RequestId is required for locating a problem. |
POST / HTTP/1.1
Host: cwp.tencentcloudapi.com
Content-Type: application/json
X-TC-Action: DescribeEdrAlertCountForAsset
<Common request parameters>
{}{
"Response": {
"GlobalCount": {
"AbnormalLoginCount": 2659,
"HostBehaviorCount": 406,
"InstanceId": "",
"InstancesCount": 7,
"NetworkBehaviorCount": 56,
"TotalCount": 3461,
"VirusTrojanCount": 244
},
"RequestId": "954af95c-8abc-4e3b-b1aa-7ee55f4a8de2"
}
}TencentCloud API 3.0 integrates SDKs that support various programming languages to make it easier for you to call APIs.
The following only lists the error codes related to the API business logic. For other error codes, see Common Error Codes.
| Error Code | Description |
|---|---|
| FailedOperation | Operation failed. |
| InternalError | Internal error. |
| InvalidParameter | Parameter error. |
文档反馈