OpenAPI Specification
openapi: 3.0.3
info:
title: APISec Management account ueba API
version: '26.05'
description: Generated from APISec skyview APIView classes.
tags:
- name: ueba
description: UEBA 分析
paths:
/ueba:
post:
summary: UEBA添加事件策略
deprecated: false
description: ''
tags:
- ueba
parameters:
- name: X-CS-Header-App
in: header
description: 应用id
required: true
example: '{{app}}'
schema:
type: string
- name: X-CS-Header-Company
in: header
description: 公司id
required: true
example: '{{company_id}}'
schema:
type: string
- name: X-CS-Header-Crypt
in: header
description: 加密算法，请参考：https://servaltech.feishu.cn/docs/doccnQCZ2cw32uazgNSO0DFwceb
required: true
example: ''
schema:
type: string
- name: If-None-Match
in: header
description: 对于支持「ETAG」的接口，将上一次请求的响应header的Etag，填入到下一次请求。若匹配，则返回304（无变更），否则会返回新版本的数据 + 新Etag
required: true
example: string
schema:
type: string
- name: X-CS-Header-Debug
in: header
description: ''
required: true
example: '{{debug}}'
schema:
type: string
- name: Accept-Language
in: header
description: ''
required: true
example: zh
schema:
type: string
- name: X-Cs-Header-Timezone
in: header
description: ''
required: true
example: Asia/Shanghai
schema:
type: string
- name: Content-Type
in: header
description: ''
required: true
example: application/json
schema:
type: string
- name: Accept
in: header
description: ''
required: true
example: application/json
schema:
type: string
requestBody:
content:
application/json:
schema:
type: object
properties:
name:
type: string
category:
type: string
description:
type: string
source:
type: string
queries:
type: array
items:
type: object
properties:
field:
type: string
operator:
type: string
value:
type: string
expression:
type: string
windows_s:
type: integer
score:
type: integer
notification_config:
type: array
items:
type: object
properties:
is_remind:
type: boolean
notification_bot_id:
type: string
notification_content_template_id:
type: string
email_to_list:
type: array
items: {}
threshold:
type: integer
required:
- name
- category
- description
- source
- queries
- expression
- windows_s
- score
- notification_config
- threshold
example:
name: test
category: outgoing
description: ''
source: policy_channel_log
queries:
- field: staff_name
operator: is
value: 吴贝宁
expression: ''
windows_s: 30000000
score: 60
notification_config:
- is_remind: true
notification_bot_id: cebe9d6d-5fba-4082-8780-48913d3ebfab
notification_content_template_id: 6497f9e0-6ea7-455c-9e34-02b1ec73d3f4
email_to_list: []
threshold: 1
responses:
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
code:
type: integer
msg:
type: string
data:
type: object
properties:
threshold:
type: integer
source:
type: string
uid:
type: string
description:
type: string
expression:
type: string
windows_s:
type: integer
score:
type: integer
code:
type: string
create_time:
type: string
expression_fields:
type: object
properties:
body:
type: object
properties:
query:
type: object
properties:
bool:
type: object
properties:
must:
type: array
items:
type: object
properties:
term:
type: object
properties:
staff_name:
type: string
company_id:
type: string
required:
- company_id
required:
- term
required:
- must
required:
- bool
aggs:
type: object
properties:
count:
type: object
properties:
cardinality:
type: object
properties:
field:
type: string
precision_threshold:
type: integer
required:
- field
- precision_threshold
required:
- cardinality
required:
- count
track_total_hits:
type: boolean
collapse:
type: object
properties:
field:
type: string
inner_hits:
type: object
properties:
name:
type: string
size:
type: integer
required:
- name
- size
required:
- field
- inner_hits
required:
- query
- aggs
- track_total_hits
- collapse
queries:
type: array
items:
type: object
properties:
field:
type: string
operator:
type: string
value:
type: string
required:
- body
- queries
create_by_id:
type: string
category:
type: string
expand:
type: object
properties: {}
id:
type: integer
name:
type: string
update_time:
type: string
status:
type: string
company_id:
type: string
update_by_id:
type: string
required:
- threshold
- source
- uid
- description
- expression
- windows_s
- score
- code
- create_time
- expression_fields
- create_by_id
- category
- expand
- id
- name
- update_time
- status
- company_id
- update_by_id
required:
- code
- msg
- data
example:
code: 0
msg: success
data:
threshold: 1
source: policy_channel_log
uid: 2cc5f045-d7ac-4a5e-8d71-18459fafdaa7
description: ''
expression: SELF
windows_s: 30000000
score: 60
code: 19291cce525c4904
create_time: '2023-12-27T06:01:56.499421Z'
expression_fields:
body:
query:
bool:
must:
- term:
staff_name: 吴贝宁
- term:
company_id: eeff7c64-5070-4582-8b93-fbcc57db7771
aggs:
count:
cardinality:
field: device_id
precision_threshold: 40000
track_total_hits: true
collapse:
field: device_id
inner_hits:
name: device_id
size: 100
queries:
- field: staff_name
operator: is
value: 吴贝宁
create_by_id: 2834ded5-b1c5-49ff-9655-3d4cc842e2b7
category: outgoing
expand: {}
id: 1
name: test
update_time: '2023-12-27T06:01:56.499462Z'
status: activated
company_id: eeff7c64-5070-4582-8b93-fbcc57db7771
update_by_id: 2834ded5-b1c5-49ff-9655-3d4cc842e2b7
security: []