All Products
Search
Document Center

Security Center:DescribeCommonTargetConfig

Last Updated:Feb 20, 2024

Queries the configurations of the proactive defense feature.

Debugging

OpenAPI Explorer automatically calculates the signature value. For your convenience, we recommend that you call this operation in OpenAPI Explorer.

Authorization information

The following table shows the authorization information corresponding to the API. The authorization information can be used in the Action policy element to grant a RAM user or RAM role the permissions to call this API operation. Description:

  • Operation: the value that you can use in the Action element to specify the operation on a resource.
  • Access level: the access level of each operation. The levels are read, write, and list.
  • Resource type: the type of the resource on which you can authorize the RAM user or the RAM role to perform the operation. Take note of the following items:
    • The required resource types are displayed in bold characters.
    • If the permissions cannot be granted at the resource level, All Resources is used in the Resource type column of the operation.
  • Condition Key: the condition key that is defined by the cloud service.
  • Associated operation: other operations that the RAM user or the RAM role must have permissions to perform to complete the operation. To complete the operation, the RAM user or the RAM role must have the permissions to perform the associated operations.
OperationAccess levelResource typeCondition keyAssociated operation
yundun-sas:DescribeCommonTargetConfigRead
  • All Resources
    *
    none
none

Request parameters

ParameterTypeRequiredDescriptionExample
TypestringYes

The configuration type. Valid values:

  • kdump_switch: Active defense experience optimization.
  • threat_detect: Adaptive threat detection.
  • containerNetwork: Container network topology.
  • interceptionSwitch: Cluster microsegmentation.
  • suspicious_aggregation: Alert association.
  • alidetect: File detection.
  • USER-ENABLE-SWITCH-TYPE_38857: Entrance service performs high-risk operations (Linux).
  • USER-ENABLE-SWITCH-TYPE_50858: Web service performs high-risk operations (Linux).
  • USER-ENABLE-SWITCH-TYPE_50859: Entrance service performs suspicious operations (Linux).
  • USER-ENABLE-SWITCH-TYPE_50862: Cloud Assistant advanced protection for Linux.
  • USER-ENABLE-SWITCH-TYPE_50867: Injects malicious files (Linux).
  • USER-ENABLE-SWITCH-TYPE_50868: Injects suspicious files (Linux).
  • USER-ENABLE-SWITCH-TYPE_64025: Entrance service executes commands in an enhanced mode (Linux).
  • USER-ENABLE-SWITCH-TYPE_51229: Browser service performs high-risk operations (Windows).
  • USER-ENABLE-SWITCH-TYPE_51230: Entrance service performs suspicious operations (Windows).
  • USER-ENABLE-SWITCH-TYPE_51232: System processes perform high-risk operations (Windows).
  • USER-ENABLE-SWITCH-TYPE_51233: Java service performs high-risk operations (Windows).
  • USER-ENABLE-SWITCH-TYPE_51234: Office components perform high-risk operations (Windows).
  • USER-ENABLE-SWITCH-TYPE_51235: Web service performs high-risk operations (Windows).
  • USER-ENABLE-SWITCH-TYPE_52820: Injects malicious files (Windows).
  • USER-ENABLE-SWITCH-TYPE_52826: Entrance service performs high-risk operations (Windows).
  • USER-ENABLE-SWITCH-TYPE_55251: Database services perform high-risk operations (Windows).
  • USER-ENABLE-SWITCH-TYPE_63725: Entrance service injects suspicious scripts or binary files (Windows).
  • USER-ENABLE-SWITCH-TYPE_3277: Suspicious process startup (Linux).
  • USER-ENABLE-SWITCH-TYPE_50983: Obfuscated commands (Linux).
  • USER-ENABLE-SWITCH-TYPE_51200: Uses command line to download and run malicious files (Linux).
  • USER-ENABLE-SWITCH-TYPE_71131: Entrance service executes sequence of suspicious behavior (Linux).
  • USER-ENABLE-SWITCH-TYPE_51225: Powershell executes high-risk commands (Windows).
  • USER-ENABLE-SWITCH-TYPE_51226: Powershell executes suspicious commands (Windows).
  • USER-ENABLE-SWITCH-TYPE_52821: Suspicious process startup (Windows).
  • USER-ENABLE-SWITCH-TYPE_57242: Malicious command execution (Windows).
  • USER-ENABLE-SWITCH-TYPE_57340: Uses command line to download and run malicious files (Windows).
  • USER-ENABLE-SWITCH-TYPE_39659: Sensitive registry key protection (Windows).
  • USER-ENABLE-SWITCH-TYPE_52816: High-risk account manipulation behavior (Windows).
  • USER-ENABLE-SWITCH-TYPE_54365: Creates service auto-startup items (Windows).
  • USER-ENABLE-SWITCH-TYPE_54366: Creates high-risk auto-startup items (Windows).
  • USER-ENABLE-SWITCH-TYPE_54367: Creates scheduled task auto-startup items (Windows).
  • USER-ENABLE-SWITCH-TYPE_54368: Creates registry auto-startup items (Windows).
  • USER-ENABLE-SWITCH-TYPE_54369: Creates WMI auto-startup items (Windows).
  • USER-ENABLE-SWITCH-TYPE_50869: Unauthorized execution of high-risk commands (Linux).
  • USER-ENABLE-SWITCH-TYPE_53272: Exploits kernel vulnerabilities to elevate privileges (Linux).
  • USER-ENABLE-SWITCH-TYPE_54395: Unauthorized reading and writing of sensitive files (Linux).
  • USER-ENABLE-SWITCH-TYPE_57897: Suspected privilege escalation (Linux).
  • USER-ENABLE-SWITCH-TYPE_52825: Unauthorized execution of high-risk commands (Windows).
  • USER-ENABLE-SWITCH-TYPE_5507: Malicious drivers (Linux).
  • USER-ENABLE-SWITCH-TYPE_50876: Uninstalls security software (Linux).
  • USER-ENABLE-SWITCH-TYPE_53168: Process debugging (Linux).
  • USER-ENABLE-SWITCH-TYPE_54699: Hijacks dynamic link library (Linux).
  • USER-ENABLE-SWITCH-TYPE_62981: Bypasses security monitoring (Linux).
  • USER-ENABLE-SWITCH-TYPE_52815: Loads high-risk drivers (Windows).
  • USER-ENABLE-SWITCH-TYPE_52823: Runs high-risk anti-rootkit (ARK) tools (Windows).
  • USER-ENABLE-SWITCH-TYPE_54373: Uninstalls security software (Windows).
  • USER-ENABLE-SWITCH-TYPE_54374: Intrusion trace cleanup (Windows).
  • USER-ENABLE-SWITCH-TYPE_54265: Hijacks the pluggable authentication module (PAM) (Linux).
  • USER-ENABLE-SWITCH-TYPE_54953: Hashdump attack (Linux).
  • USER-ENABLE-SWITCH-TYPE_54383: MimiKatz credential stealing (Windows).
  • USER-ENABLE-SWITCH-TYPE_54384: Hashdump attack (Windows).
  • USER-ENABLE-SWITCH-TYPE_50861: Information detection (Linux).
  • USER-ENABLE-SWITCH-TYPE_52818: Information detection (Windows).
  • USER-ENABLE-SWITCH-TYPE_54034: Intranet scan (Linux).
  • USER-ENABLE-SWITCH-TYPE_51228: High-risk lateral penetration tools (Windows).
  • USER-ENABLE-SWITCH-TYPE_50870: Rebound shell (Linux).
  • USER-ENABLE-SWITCH-TYPE_50873: WebShell executes commands.
  • USER-ENABLE-SWITCH-TYPE_51236: Rebound shell (Windows).
  • USER-ENABLE-SWITCH-TYPE_50877: Malicious program communication (Linux).
  • USER-ENABLE-SWITCH-TYPE_50884: Suspicious worm script behavior (Linux).
  • USER-ENABLE-SWITCH-TYPE_50885: Malicious script behavior (Linux).
  • USER-ENABLE-SWITCH-TYPE_51201: Ransomware (Linux).
  • USER-ENABLE-SWITCH-TYPE_51202: Suspected extortion (Linux).
  • USER-ENABLE-SWITCH-TYPE_52827: Ransomware (Windows).
  • USER-ENABLE-SWITCH-TYPE_52828: Suspected extortion (Windows).
  • USER-ENABLE-SWITCH-TYPE_52829: Deletes system backup behavior (Windows).
kdump_switch

Response parameters

ParameterTypeDescriptionExample
object

The data returned.

RequestIdstring

The ID of the request, which is used to locate and troubleshoot issues.

09969D2C-4FAD-429E-BFBF-9A60DEF8BF6F
TargetListobject []

An array that consists of the details of the configuration items.

Flagstring

The mode in which the configuration takes effect. Valid values:

  • add: In this mode, the configuration takes effect on the assets.
  • del: In this mode, the configuration does not take effect on the assets.
add
Targetstring

The ID of the asset on which the configuration takes effect.

Note
  • When you set the TargetType parameter to uuid, the value of this parameter indicates the UUID of an asset.

  • When you set the TargetType parameter to Cluster, the value of this parameter indicates the ID of a cluster.

  • When you set the TargetType parameter to image_repo, the value of this parameter indicates the ID of an image repository.

c23551de6149343e8a54e69fbefe6****
TargetTypestring

The dimension from on which the feature was configured. Valid values:

  • uuid: the UUID of the asset
  • Cluster: the ID of the cluster
  • image_repo: the ID of the image repository
image_repo

Examples

Sample success responses

JSONformat

{
  "RequestId": "09969D2C-4FAD-429E-BFBF-9A60DEF8BF6F",
  "TargetList": [
    {
      "Flag": "add",
      "Target": "c23551de6149343e8a54e69fbefe6****",
      "TargetType": "image_repo"
    }
  ]
}

Error codes

HTTP status codeError codeError messageDescription
403NoPermissioncaller has no permissionYou are not authorized to do this operation.
500ServerErrorServerError-

For a list of error codes, visit the Service error codes.

Change history

Change timeSummary of changesOperation
2023-05-31The internal configuration of the API is changed, but the call is not affectedsee changesets
Change itemChange content
The internal configuration of the API is changed, but the call is not affected.