Chaitin Tech ueba/list API

UEBA 分析/列表

OpenAPI Specification

chaitin-ueba-list-api-openapi.yml Raw ↑
openapi: 3.0.3
info:
  title: APISec Management account ueba/list API
  version: '26.05'
  description: Generated from APISec skyview APIView classes.
tags:
- name: ueba/list
  description: UEBA 分析/列表
paths:
  /ueba/list:
    post:
      summary: UEBA事件策略列表
      deprecated: false
      description: ''
      tags:
      - ueba/list
      parameters:
      - name: X-CS-Header-App
        in: header
        description: 应用id
        required: true
        example: '{{app}}'
        schema:
          type: string
      - name: X-CS-Header-Company
        in: header
        description: 公司id
        required: true
        example: '{{company_id}}'
        schema:
          type: string
      - name: X-CS-Header-Crypt
        in: header
        description: 加密算法,请参考:https://servaltech.feishu.cn/docs/doccnQCZ2cw32uazgNSO0DFwceb
        required: true
        example: ''
        schema:
          type: string
      - name: If-None-Match
        in: header
        description: 对于支持「ETAG」的接口,将上一次请求的响应header的Etag,填入到下一次请求。若匹配,则返回304(无变更),否则会返回新版本的数据 + 新Etag
        required: true
        example: string
        schema:
          type: string
      - name: X-CS-Header-Debug
        in: header
        description: ''
        required: true
        example: '{{debug}}'
        schema:
          type: string
      - name: Accept-Language
        in: header
        description: ''
        required: true
        example: zh
        schema:
          type: string
      - name: X-Cs-Header-Timezone
        in: header
        description: ''
        required: true
        example: Asia/Shanghai
        schema:
          type: string
      - name: Content-Type
        in: header
        description: ''
        required: true
        example: application/json
        schema:
          type: string
      - name: Accept
        in: header
        description: ''
        required: true
        example: application/json
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                status:
                  type: string
              required:
              - status
            example:
              status: deactivated
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  code:
                    type: integer
                  msg:
                    type: string
                  data:
                    type: object
                    properties:
                      total:
                        type: integer
                      results:
                        type: array
                        items:
                          type: object
                          properties:
                            company_id:
                              type: string
                            name:
                              type: string
                            notification_config:
                              type: array
                              items:
                                type: object
                                properties:
                                  notification_bot_template_id:
                                    type: string
                                  notification_bot:
                                    type: object
                                    properties:
                                      uid:
                                        type: string
                                      name:
                                        type: string
                                      category:
                                        type: string
                                      config:
                                        type: object
                                        properties:
                                          im_notification:
                                            type: object
                                            properties:
                                              webhook:
                                                type: string
                                            required:
                                            - webhook
                                        required:
                                        - im_notification
                                    required:
                                    - uid
                                    - name
                                    - category
                                    - config
                                  notification_content_template:
                                    type: object
                                    properties:
                                      uid:
                                        type: string
                                      name:
                                        type: string
                                      template_model:
                                        type: string
                                      template_value:
                                        type: string
                                    required:
                                    - uid
                                    - name
                                    - template_model
                                    - template_value
                                  is_remind:
                                    type: boolean
                                  email_to_list:
                                    type: array
                                    items: {}
                            code:
                              type: string
                            status:
                              type: string
                            windows_s:
                              type: integer
                            create_by_id:
                              type: string
                            uid:
                              type: string
                            score:
                              type: integer
                            category:
                              type: string
                            create_time:
                              type: string
                            update_time:
                              type: string
                            threshold:
                              type: integer
                            update_by_id:
                              type: string
                            id:
                              type: integer
                            expand:
                              type: object
                              properties: {}
                            description:
                              type: string
                            expression_fields:
                              type: object
                              properties:
                                aggs:
                                  type: object
                                  properties:
                                    layers:
                                      type: array
                                      items: {}
                                    threshold:
                                      type: integer
                                  required:
                                  - layers
                                  - threshold
                                queries:
                                  type: array
                                  items:
                                    type: object
                                    properties:
                                      field:
                                        type: string
                                      value:
                                        type: string
                                      operator:
                                        type: string
                              required:
                              - aggs
                              - queries
                            expression:
                              type: string
                            source:
                              type: string
                      page:
                        type: integer
                    required:
                    - total
                    - results
                    - page
                required:
                - code
                - msg
                - data
              example:
                code: 0
                msg: success
                data:
                  total: 1
                  results:
                  - company_id: eeff7c64-5070-4582-8b93-fbcc57db7771
                    name: test2
                    notification_config:
                    - notification_bot_template_id: a53b17da-ae3f-4d55-9bb7-708bc848af06
                      notification_bot:
                        uid: dda0e80b-e706-4da2-9470-7b1246593ecd
                        name: 大葱
                        category: feishu
                        config:
                          im_notification:
                            webhook: https://open.feishu.cn/open-apis/bot/v2/hook/711cc4f6-d8a4-4948-8d96-47245f796b96
                      notification_content_template:
                        uid: 461f0024-2474-4ff2-9718-1690f21db7ee
                        name: 示例-UEBA事件告警
                        template_model: ueba_event
                        template_value: UEBA事件告警:{{ueba_category_display}} - {{ueba_name}} - 用户:{{staff_name}}的终端:{{device_code}}在{{begin}}至{{end}}时间段内发生型异常行为,请及时关注。
                      is_remind: true
                      email_to_list: []
                    code: 7e5b4a593f1e8e04
                    status: activated
                    windows_s: 3000
                    create_by_id: 2834ded5-b1c5-49ff-9655-3d4cc842e2b7
                    uid: e99892a3-ed8e-46dc-9c7e-5e15f05a4d88
                    score: 60
                    category: outgoing
                    create_time: '2024-01-17T07:59:28.517254Z'
                    update_time: '2024-01-17T07:59:28.517329Z'
                    threshold: 1
                    update_by_id: 2834ded5-b1c5-49ff-9655-3d4cc842e2b7
                    id: 1
                    expand: {}
                    description: ''
                    expression_fields:
                      aggs:
                        layers: []
                        threshold: 1
                      queries:
                      - field: staff_name
                        value: 吴贝宁
                        operator: is
                    expression: SELF
                    source: policy_channel_log
                  page: 1
      security: []