Chaitin Tech ueba/test/{event_id} API
UEBA 分析/测试/event_id 参数
OpenAPI Specification
openapi: 3.0.3
info:
title: APISec Management account ueba/test/{event_id} API
version: '26.05'
description: Generated from APISec skyview APIView classes.
tags:
- name: ueba/test/{event_id}
description: UEBA 分析/测试/event_id 参数
paths:
/ueba/test/{event_id}:
post:
summary: 测试事件结果
deprecated: false
description: ''
tags:
- ueba/test/{event_id}
parameters:
- name: event_id
in: path
description: ''
required: true
example: string
schema:
type: string
- name: X-CS-Header-App
in: header
description: 应用id
required: true
example: '{{app}}'
schema:
type: string
- name: X-CS-Header-Company
in: header
description: 公司id
required: true
example: '{{company_id}}'
schema:
type: string
- name: X-CS-Header-Crypt
in: header
description: 加密算法，请参考：https://servaltech.feishu.cn/docs/doccnQCZ2cw32uazgNSO0DFwceb
required: true
example: ''
schema:
type: string
- name: If-None-Match
in: header
description: 对于支持「ETAG」的接口，将上一次请求的响应header的Etag，填入到下一次请求。若匹配，则返回304（无变更），否则会返回新版本的数据 + 新Etag
required: true
example: string
schema:
type: string
- name: X-CS-Header-Debug
in: header
description: ''
required: true
example: '{{debug}}'
schema:
type: string
- name: Accept-Language
in: header
description: ''
required: true
example: zh
schema:
type: string
- name: X-Cs-Header-Timezone
in: header
description: ''
required: true
example: Asia/Shanghai
schema:
type: string
- name: Accept
in: header
description: ''
required: true
example: application/json
schema:
type: string
responses:
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
code:
type: integer
msg:
type: string
data:
type: object
properties:
status:
type: string
data:
type: array
items:
type: object
properties:
status:
type: string
comment:
type: string
created_timestamp:
type: string
expand:
type: object
properties:
compressed_filenames:
type: array
items:
type: string
dest:
type: string
file_source:
type: string
rule_version:
type: object
properties:
cond_ticket:
type: string
cond_version:
type: integer
dc_ticket:
type: string
dc_version:
type: integer
filetype_version:
type: integer
im_version:
type: integer
policy_ticket:
type: string
policy_version:
type: integer
ms_version:
type: integer
required:
- cond_ticket
- cond_version
- dc_ticket
- dc_version
- filetype_version
- policy_ticket
- policy_version
screen_recording:
type: boolean
screenshot:
type: boolean
required:
- rule_version
category:
type: string
device_id:
type: string
device_code:
type: string
ip_address:
type: string
console_user:
type: string
os_name:
type: string
os_friendly_name:
type: string
staff_id:
type: string
staff_name:
type: string
staff_code:
type: string
staff_tag_ids:
type: array
items: {}
staff_tags:
type: array
items: {}
dept_ids:
type: array
items: {}
dept_names:
type: array
items: {}
dept_paths:
type: array
items: {}
time:
type: integer
'@timestamp':
type: integer
timestamp:
type: string
agent_version:
type: string
event_id:
type: string
company_id:
type: string
policy_id:
type: string
policy_name:
type: string
policy_group_id:
type: string
policy_group_name:
type: string
risk_name:
type: string
risk_level:
type: integer
action:
type: string
is_blocked:
type: boolean
is_password_protected:
type: boolean
channel:
type: string
channel_name:
type: string
operation:
type: string
filename:
type: string
filepath:
type: string
filesize:
type: integer
md5_hash:
type: string
is_hidden:
type: boolean
is_compressed:
type: boolean
sha256_hash:
type: string
file_type:
type: string
file_suffix:
type: string
file_created_time:
type: integer
file_created_timestamp:
type: string
file_updated_time:
type: integer
file_updated_timestamp:
type: string
file_type_categories:
type: array
items:
type: string
file_description:
type: string
simhash_value:
type: string
file_policies:
type: array
items:
type: object
properties:
action:
type: string
classifications:
type: array
items:
type: object
properties:
data_level:
type: integer
data_level_name:
type: string
name:
type: string
uid:
type: string
required:
- data_level
- data_level_name
- name
- uid
file_created_time:
type: integer
file_created_timestamp:
type: string
file_description:
type: string
file_suffix:
type: string
file_type:
type: string
file_type_categories:
type: array
items:
type: string
file_updated_time:
type: integer
file_updated_timestamp:
type: string
filename:
type: string
filepath:
type: string
filesize:
type: integer
is_compressed:
type: boolean
is_hidden:
type: boolean
is_password_protected:
type: boolean
md5_hash:
type: string
policy_group_id:
type: string
policy_group_name:
type: string
policy_id:
type: string
policy_name:
type: string
risk_level:
type: integer
risk_name:
type: string
sha256_hash:
type: string
required:
- file_created_timestamp
- file_updated_timestamp
- md5_hash
- policy_id
- is_hidden
- policy_name
- filesize
- policy_group_id
- policy_group_name
- risk_level
- classifications
- filename
- filepath
- is_compressed
- file_type
- file_suffix
- file_updated_time
- is_password_protected
- file_description
- action
- risk_name
- file_created_time
- sha256_hash
- file_type_categories
content_summary_list:
type: array
items: {}
extract_file:
type: boolean
cl_id:
type: string
cl_name:
type: string
data_level:
type: integer
data_level_name:
type: string
cl_ids:
type: array
items:
type: string
cl_names:
type: array
items:
type: string
data_levels:
type: array
items:
type: integer
data_level_names:
type: array
items:
type: string
has_cls:
type: boolean
metasource:
type: array
items:
type: object
properties:
original:
type: object
properties:
data:
type: string
url:
type: string
required:
- data
- url
source:
type: array
items:
type: object
properties:
name:
type: string
display_name:
type: string
category:
type: string
log_cnt:
type: integer
score:
type: integer
cnt:
type: integer
channel_account:
type: string
staff_email:
type: string
required:
- staff_name
- md5_hash
- console_user
- channel
- has_cls
- dept_paths
- data_level
- sha256_hash
- dept_names
- filepath
- staff_tags
- cl_id
- file_type
- staff_id
- action
- os_friendly_name
- file_updated_timestamp
- file_type_categories
- device_id
- expand
- filename
- file_suffix
- file_updated_time
- file_policies
- device_code
- extract_file
- file_description
- data_level_name
- risk_name
- status
- file_created_time
- file_created_timestamp
- policy_id
- dept_ids
- data_level_names
- is_hidden
- filesize
- policy_group_id
- is_compressed
- data_levels
- timestamp
- channel_name
- cl_name
- company_id
- policy_name
- staff_code
- created_timestamp
- ip_address
- cl_ids
- policy_group_name
- risk_level
- agent_version
- is_blocked
- event_id
- '@timestamp'
- is_password_protected
- os_name
- time
- category
- operation
- staff_tag_ids
- cl_names
- log_cnt
- score
- cnt
- channel_account
- staff_email
required:
- status
- data
required:
- code
- msg
- data
example:
code: 0
msg: success
data:
status: succeeded
data:
- status: created
comment: ''
created_timestamp: '2023-11-21T03:43:28Z'
expand:
compressed_filenames: ''
dest: ''
file_source: ''
rule_version:
cond_ticket: 2a563efd44b89f56d69e615c8eda4363
cond_version: 15
dc_ticket: 2a563efd44b89f56d69e615c8eda4363
dc_version: 174
filetype_version: 34
im_version: 63
policy_ticket: 027af9e67223aeb02434251c1dc8bc4b
policy_version: 283
screen_recording: false
screenshot: false
category: channel
device_id: 7b45e606-c7b4-40a2-a08e-4aa9fb0ddcf1
device_code: PC-000006
ip_address: 192.168.96.148
console_user: wenghuangge
os_name: macOS
os_friendly_name: macOS 12.6.5
staff_id: ''
staff_name: ''
staff_code: ''
staff_tag_ids: []
staff_tags: []
dept_ids: []
dept_names: []
dept_paths: []
time: 1700477266000
'@timestamp': 1700477266000
timestamp: '2023-11-20T10:47:46Z'
agent_version: 3.0.228
event_id: 7c708b6c-8e94-4fa3-b71a-9025c26e2a20
company_id: eeff7c64-5070-4582-8b93-fbcc57db7771
policy_id: afcf096e-0d7a-4ebf-98f8-6c4aab55bb3f
policy_name: whg_test_01
policy_group_id: ea581dad-40f7-45e0-b37a-f92878876cc9
policy_group_name: 默认组
risk_name: 高危
risk_level: 1
action: block
is_blocked: true
is_password_protected: false
channel: feishu
channel_name: 飞书
operation: outgoing
filename: file_flow_05.docx
filepath: /Users/wenghuangge/Desktop/文件加解密/file_flow_05.docx
filesize: 12125
md5_hash: a7b0a40dc540c02eb4142e159e7ba39f
is_hidden: false
is_compressed: false
sha256_hash: 1440e0726ef93b80c16d2d06ee6ec6e3fb8feba4c60d18059b52cce6e8e66020
file_type: Microsoft Word 2007+
file_suffix: docx
file_created_time: 1700134309775
file_created_timestamp: '2023-11-16T11:31:49Z'
file_updated_time: 1700475386941
file_updated_timestamp: '2023-11-20T10:16:26Z'
file_type_categories:
- Microsoft Word
- Word
file_description: Microsoft Word 2007+
simhash_value: ''
file_policies:
- action: block
classifications:
- data_level: 3
data_level_name: 保密数据
name: whg_class
uid: f42cba49-cd9a-485f-897a-d118c4b24765
file_created_time: 1700134309000
file_created_timestamp: '2023-11-16T11:31:49Z'
file_description: Microsoft Word 2007+
file_suffix: docx
file_type: docx
file_type_categories:
- Microsoft Word
- Word
file_updated_time: 1700475386000
file_updated_timestamp: '2023-11-20T10:16:26Z'
filename: file_flow_05.docx
filepath: /Users/wenghuangge/Desktop/文件加解密/file_flow_05.docx
filesize: 12125
is_compressed: false
is_hidden: false
is_password_protected: false
md5_hash: a7b0a40dc540c02eb4142e159e7ba39f
policy_group_id: ea581dad-40f7-45e0-b37a-f92878876cc9
policy_group_name: 默认组
policy_id: afcf096e-0d7a-4ebf-98f8-6c4aab55bb3f
policy_name: whg_test_01
risk_level: 1
risk_name: 高危
content_summary_list: []
extract_file: false
cl_id: f42cba49-cd9a-485f-897a-d118c4b24765
cl_name: whg_class
data_level: 3
data_level_name: 保密数据
cl_ids:
- f42cba49-cd9a-485f-897a-d118c4b24765
cl_names:
- whg_class
data_levels:
- 3
data_level_names:
- 保密数据
has_cls: true
metasource:
- original:
data: 机密
url: https://twitter.com/
source:
- name: Chrome
display_name: 谷歌浏览器
category: browser
log_cnt: 27
score: 60
cnt: 276
- staff_name: ''
md5_hash: bf9ea12e04e4d549a7f40d7ce7a0c528
console_user: nanzhi
channel: feishu
has_cls: false
dept_paths: []
data_level: 0
sha256_hash: 23cc83f7e81e97e76fb12d95914eda460be3adbf8cc3f043386a4a807a949f84
dept_names: []
filepath: /Users/nanzhi/Downloads/iOS.and.macOS.Performance.Tuning.2017.3.pdf
staff_tags: []
cl_id: ''
file_type: PDF document, version 1.6, 24 pages
staff_id: ''
action: approval
channel_account: ''
os_friendly_name: macOS 12.7
file_updated_timestamp: '2023-10-13T10:34:45Z'
file_type_categories:
- PDF document
device_id: 1c16c892-242c-467c-add4-8ab0f00f26e9
expand:
rule_version:
policy_version: 99
cond_version: 13
filetype_version: 2
dc_version: 64
dc_ticket: ca798651bccd2e673a55d71557084b28
cond_ticket: ca798651bccd2e673a55d71557084b28
policy_ticket: 424ab3962e2c487ef455b709e19d26c3
compressed_filenames: ''
screen_recording: false
file_source: 未知
screenshot: false
dest: ''
filename: iOS.and.macOS.Performance.Tuning.2017.3.pdf
file_suffix: pdf
file_updated_time: 1697193285442
file_policies:
- file_created_timestamp: '2023-10-13T10:34:43Z'
file_updated_timestamp: '2023-10-13T10:34:45Z'
md5_hash: bf9ea12e04e4d549a7f40d7ce7a0c528
policy_id: 21f9c2cb-5c86-47ab-a514-72bcade6facc
is_hidden: false
policy_name: 南测1
filesize: 8357559
policy_group_id: ea581dad-40f7-45e0-b37a-f92878876cc9
policy_group_name: 默认组
risk_level: 1
classifications: []
filename: iOS.and.macOS.Performance.Tuning.2017.3.pdf
filepath: /Users/nanzhi/Downloads/iOS.and.macOS.Performance.Tuning.2017.3.pdf
is_compressed: false
file_type: pdf
file_suffix: pdf
file_updated_time: 1697193285000
is_password_protected: false
file_description: ''
action: approval
risk_name: 高危
file_created_time: 1697193283000
device_code: PC-000003
extract_file: false
file_description: PDF document, version 1.6, 24 pages
data_level_name: 未分级
risk_name: 高危
staff_email: ''
status: created
file_created_time: 1697193283938
file_created_timestamp: '2023-10-13T10:34:43Z'
policy_id: 21f9c2cb-5c86-47ab-a514-72bcade6facc
dept_ids: []
data_level_names:
- 未分级
is_hidden: false
filesize: 8357559
policy_group_id: ea581dad-40f7-45e0-b37a-f92878876cc9
is_compressed: false
data_levels:
- 0
timestamp: '2023-10-20T05:56:11Z'
channel_name: 飞书
cl_name: 未分类
company_id: eeff7c64-5070-4582-8b93-fbcc57db7771
policy_name: 南测1
staff_code: ''
created_timestamp: '2023-10-20T05:56:39Z'
ip_address: 192.168.96.36
cl_ids:
- ''
policy_group_name: 默认组
risk_level: 1
agent_version: 3.0.202
is_blocked: false
event_id: 78B0A060-A809-46A8-A605-B35803F4DE32
'@timestamp': 1697781371000
is_password_protected: false
os_name: macOS
time: 1697781371000
category: channel
operation: outgoing
staff_tag_ids: []
cl_names:
- 未分类
log_cnt: 110
score: 60
cnt: 276
- is_compressed: false
file_type_categories: []
filename: 1-200M.txt
is_hidden: false
file_type: txt
time: 1701743034240
device_code: PC-000024
file_suffix: txt
ip_address: 192.168.96.142
operation: outgoing
status: created
event_id: '1701743029048054'
policy_name: win
file_description: '-'
agent_version: 3.2.12
is_password_protected: false
filesize: 252776000
channel: feishu
os_friendly_name: Windows 10 CoreCountrySpecific (10.0.19045)
file_created_time: 1701254357000
file_updated_time: 1678192036000
extract_file: true
risk_name: 中危
policy_group_name: 默认组
file_policies:
- is_compressed: false
filename: 1-200M.txt
is_hidden: false
file_type: txt
file_suffix: txt
policy_name: win
is_password_protected: false
filesize: 252776000
file_created_time: 1701254357000
file_updated_time: 1678192036000
classifications:
- data_level: 2
data_level_name: 内部数据
name: 关键词组4
uid: f19a4d58-5211-4311-ab03-f4ebbe6
# --- truncated at 32 KB (48 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/chaitin/refs/heads/main/openapi/chaitin-ueba-test-event-id-api-openapi.yml