ListAgentlessMaliciousFiles - Security Center - Alibaba Cloud Documentation Center

Queries malicious files that are detected by agentless detection tasks.

Debugging

OpenAPI Explorer automatically calculates the signature value. For your convenience, we recommend that you call this operation in OpenAPI Explorer.

Debug

Authorization information

There is currently no authorization information disclosed in the API.

Request parameters

Parameter	Type	Required	Description	Example
Lang	string	No	The language of the content within the request and response. Default value: zh. Valid values: zh: Chinese. en: English.	zh
Levels	string	No	The severities of the malicious files. Separate multiple values with commas (,). Valid values: serious suspicious remind	remind,suspicious
FuzzyMaliciousName	string	No	The name of the malicious file that you want to query. Note Fuzzy match is supported.	WebShell
CurrentPage	integer	Yes	The page number.	1
PageSize	string	Yes	The number of entries per page.	20
MaliciousMd5	string	No	The MD5 hash value of the malicious file.	d836968041f7683b5459****
Uuid	string	No	The UUID of the asset.	d2d94e8b-bb25-4744-8004-1e08a53c****
EventId	long	No	The event ID.	81****
Remark	string	No	The remarks for the asset affected by the vulnerability. The value can be the private IP address, public IP address, or name of the asset. Fuzzy match is supported.	192.168.XX.XX
Dealed	string	No	Specifies whether the vulnerability is handled. Valid values: Y: The vulnerability is handled. N: The vulnerability is not handled.	Y
MaliciousType	string	No	The alert type. Valid values when Lang is set to zh: WebShell Malicious Software Malicious Script Valid values when Lang is set to en: WebShell Malicious Software Malicious Script	WebShell

Response parameters

Parameter	Type	Description	Example
	object
RequestId	string	The request ID.	CE343162-35BF-565E-B85E-8E3B7A2B****
PageInfo	object	The pagination information.
CurrentPage	integer	The page number.	1
PageSize	integer	The number of entries per page.	20
TotalCount	integer	The total number of entries returned.	23
Count	integer	The number of entries returned on the current page.	20
List	object []	The malicious files.
Id	long	The event ID.	1****
FirstScanTimestamp	long	The timestamp generated when the first scan was performed. Unit: milliseconds.	168257753****
LatestScanTimestamp	long	The timestamp generated when the last scan was performed. Unit: milliseconds.	168257753****
Level	string	The severity of the malicious file. Valid values: serious suspicious remind	serious
MaliciousMd5	string	The MD5 hash value of the malicious file.	1f2e13a7c51ee89316ae50066515****
FilePath	long	The file path.	/root/etc/g****
Uuid	string	The UUID of the asset.	49e25e0f-bb51-4a5a-a1b3-13a4ddaa****
InstanceName	string	The name of the asset.	sql-test-001****
InternetIp	string	The public IP address of the server.	8.210.XX.XX
IntranetIp	string	The private IP address of the server.	172.25.XX.XX
TargetId	string	The ID of the asset that is scanned.	m-****
TargetName	string	The name of the asset that is scanned.	jenkins****
TargetType	string	The type of the asset that is scanned. Valid values: 2: The scanned asset is an image.	2
DownloadUrl	string	The URL to download the malicious image sample.	https://upgrade-rule-pkg.oss-cn-beijing.aliyuncs.com/totalpackage/rule/V3.166.2/totalpackage_rule_V3.16_6.2_tip_20230220110****
HighLight	string	The highlighted JSON string.	{\"highlight\":{\"ruleVersion\":\"20230223\",\"ruleId\":600139,\"events\":[[207,284]]}}
Notes	object []	The remarks.
Note	string	The remark.	Serious***
NoteId	string	The ID of the remark.	50****
NoteTime	string	The time when the remark was created.	2023-04-27 14:49:21
Details	object []	The details of the alert event.
Name	string	The name of the detailed item.	MD5
Type	string	The type of the detailed item.	text
Value	string	The value of the detailed item.	1
NameKey	string	The name key of the detailed item.	${suspicious.mp.db.maliciousfilemd5}
MaliciousName	string	The name of the malicious file.	WebShell
Partition	string	The partition of the disk.	/dev/xvda1
OperateResult	string	The handling result of the alert.	addWhitelist.USER.Success
OperateTimestamp	string	The timestamp generated when the alert is handled. Unit: milliseconds.	168257753****
MaliciousType	string	The type of the virus.	WebShell

Examples

Sample success responses

JSONformat

{
  "RequestId": "CE343162-35BF-565E-B85E-8E3B7A2B****",
  "PageInfo": {
    "CurrentPage": 1,
    "PageSize": 20,
    "TotalCount": 23,
    "Count": 20
  },
  "List": [
    {
      "Id": 0,
      "FirstScanTimestamp": 0,
      "LatestScanTimestamp": 0,
      "Level": "serious",
      "MaliciousMd5": "1f2e13a7c51ee89316ae50066515****",
      "FilePath": 0,
      "Uuid": "49e25e0f-bb51-4a5a-a1b3-13a4ddaa****",
      "InstanceName": "sql-test-001****",
      "InternetIp": "8.210.XX.XX",
      "IntranetIp": "172.25.XX.XX",
      "TargetId": "m-****",
      "TargetName": "jenkins****",
      "TargetType": "2",
      "DownloadUrl": "https://upgrade-rule-pkg.oss-cn-beijing.aliyuncs.com/totalpackage/rule/V3.166.2/totalpackage_rule_V3.16_6.2_tip_20230220110****",
      "HighLight": "{\\\"highlight\\\":{\\\"ruleVersion\\\":\\\"20230223\\\",\\\"ruleId\\\":600139,\\\"events\\\":[[207,284]]}}",
      "Notes": [
        {
          "Note": "Serious***",
          "NoteId": "50****",
          "NoteTime": "2023-04-27 14:49:21"
        }
      ],
      "Details": [
        {
          "Name": "MD5",
          "Type": "text",
          "Value": "1",
          "NameKey": "${suspicious.mp.db.maliciousfilemd5}"
        }
      ],
      "MaliciousName": "WebShell",
      "Partition": "/dev/xvda1",
      "OperateResult": "addWhitelist.USER.Success",
      "OperateTimestamp": "168257753****",
      "MaliciousType": "WebShell"
    }
  ]
}

Error codes

HTTP status code	Error code	Error message	Description
403	NoPermission	caller has no permission	You are not authorized to do this operation.
500	ServerError	ServerError	-

For a list of error codes, visit the Service error codes.

Change history

Change time

Summary of changes

Operation

2023-09-12

The Error code has changed. The request parameters of the API has changed. The response structure of the API has changed

see changesets

Change item	Change content
Error Codes	The Error code has changed.
	delete Error Codes: 403
	delete Error Codes: 500
Input Parameters	The request parameters of the API has changed.
	Added Input Parameters: MaliciousType
Output Parameters	The response structure of the API has changed.