Remediate Vulnerabilities with the ModifyOperateVul API - Security Center - Alibaba Cloud - Security Center

Handles detected vulnerabilities. Supported operations include fixing, verifying, and ignoring vulnerabilities.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

yundun-sas:ModifyOperateVul

update

*All Resource

*

None

Request parameters

Parameter	Type	Required	Description	Example
Info	string	Yes	The information about the vulnerability to handle. This parameter is in JSON format and contains the following fields: name: The name of the vulnerability. uuid: The UUID of the server that has the vulnerability. tag: The label of the vulnerability. Valid values: oval: Linux software vulnerability system: Windows system vulnerability cms: Web-CMS vulnerability Note For other vulnerability types, call the DescribeVulList operation to obtain vulnerability information. isFront: Specifies whether the Windows patch is a prerequisite patch. Set this parameter only when handling Windows system vulnerabilities. You can ignore this parameter for other vulnerability types. Valid values: 0: No. 1: Yes. Note Batch processing is supported. Separate multiple vulnerability entries with commas (,). Call the DescribeVulList operation to obtain vulnerability information.	[{"name":"alilinux2:2.1903:ALINUX2-SA-2022:0007","uuid":"a3bb82a8-a3bd-4546-acce-45ac34af**","tag":"oval","isFront":0},{"name":"alilinux2:2.1903:ALINUX2-SA-2022:0007","uuid":"98a6fecc-88cd-46f2-8e35-f808a388**","tag":"oval","isFront":0}]
OperateType	string	Yes	The operation to perform on the vulnerability. Valid values: vul_fix: Fix the vulnerability. vul_verify: Verify the vulnerability. vul_ignore: Ignore the vulnerability. vul_undo_ignore: Cancel ignoring the vulnerability. vul_delete: Delete the vulnerability.	vul_fix
Type	string	Yes	The type of vulnerability to handle. Valid values: cve: Linux software vulnerability sys: Windows system vulnerability cms: Web-CMS vulnerability emg: Emergency vulnerability app: Application vulnerability sca: Software constituency parsing vulnerability Note Fix operations are not supported for emergency vulnerabilities (emg), application vulnerabilities (app), or software constituency parsing vulnerabilities (sca). These vulnerability types do not support the execute vulnerability fix operation.	cve
Reason	string	No	The reason for ignoring the vulnerability. This parameter is required only when the operation is set to ignore (that is, OperateType is set to vul_ignore).	not operate
From	string	No	The source identifier of the request. Set this parameter to sas.	sas
ClientToken	string	No	The client token used to ensure request idempotence. Use a different token for each request. Only ASCII characters are supported. The value can be up to 64 characters in length.	02fb3da4-130e-11e9-8e44-0016e04115b
ResourceDirectoryAccountId	integer	No	The ID of the Alibaba Cloud account associated with a member account in the resource directory. Note Call the DescribeMonitorAccounts operation to obtain this parameter.
DryRun	boolean	No	Specifies whether to perform only a dry run for this request. Valid values: true: performs only a dry run without executing the actual operation. false: sends the request normally. Default value: false.

Response elements

Element	Type	Description	Example
	object
RequestId	string	The ID of the request. The ID is a unique identifier generated by Alibaba Cloud for the request. You can use the ID to troubleshoot and locate issues.	DFE4F166-1AC9-4FAC-A4E4-F0608AD705A6

Examples

Success response

JSON format

{
  "RequestId": "DFE4F166-1AC9-4FAC-A4E4-F0608AD705A6"
}

Error codes

HTTP status code	Error code	Error message	Description
400	InsufficientAuthorizationCount	Authorization count is insufficient.
400	UnauthorizedMachineNotSupportFix	Unauthorized machines do not support vulnerability fixing.
400	UserInstanceVersionNotSupportFix	Vulnerability fixing is not supported for the instance version.
400	RdCheckNoPermission	Resource directory account verification has no permission.
400	IdempotentParameterMismatch	相同的 ClientToken 被用于不同的请求参数。
500	ServerError	ServerError
500	RdCheckInnerError	Resource directory account service internal error.
403	NoPermission	caller has no permission	You are not authorized to do this operation.
409	IdempotentRequestInProgress	使用相同 ClientToken 的请求正在处理中。

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.