@alicloud/cloud-siem20220616 6.0.2 → 6.2.0

package/src/models/PostCustomizeRuleRequest.ts

@@ -5,7 +5,7 @@ import * as $dara from '@darabonba/typescript';
 export class PostCustomizeRuleRequest extends $dara.Model {
   /**
    * @remarks
-   * The risk type.
+   * The threat type.
    * 
    * @example
    * WEBSHELL
@@ -13,7 +13,7 @@ export class PostCustomizeRuleRequest extends $dara.Model {
   alertType?: string;
   /**
    * @remarks
-   * The internal code of the risk type.
+   * The Medusa code of the threat type.
    * 
    * @example
    * ${siem_rule_type_process_abnormal_command}
@@ -21,7 +21,7 @@ export class PostCustomizeRuleRequest extends $dara.Model {
   alertTypeMds?: string;
   /**
    * @remarks
-   * att&ck.
+   * The ATT\\&CK technique.
    * 
    * @example
    * T1595.002 Vulnerability Scanning
@@ -29,7 +29,7 @@ export class PostCustomizeRuleRequest extends $dara.Model {
   attCk?: string;
   /**
    * @remarks
-   * The extended information about event generation. If eventTransferType is set to allToSingle, the value of this parameter indicates the length and unit of the alert aggregation window.
+   * The extended information for event generation. This parameter is returned only when EventTransferType is set to allToSingle. The value indicates the length and unit of the alert aggregation window.
    * 
    * @example
    * {"time":"1","unit":"MINUTE"}
@@ -37,10 +37,11 @@ export class PostCustomizeRuleRequest extends $dara.Model {
   eventTransferExt?: string;
   /**
    * @remarks
-   * Specifies whether to convert an alert to an event. Valid values:
+   * Specifies whether to convert alerts into events. Valid values:
    * 
-   * *   0: no
-   * *   1: yes
+   * - 0: no
+   * 
+   * - 1: yes
    * 
    * @example
    * 1
@@ -50,9 +51,11 @@ export class PostCustomizeRuleRequest extends $dara.Model {
    * @remarks
    * The event generation method. Valid values:
    * 
-   * *   default: The default method is used.
-   * *   singleToSingle: The system generates an event for each alert.
-   * *   allToSingle: The system generates an event for alerts within a period of time.
+   * - default: the default method
+   * 
+   * - singleToSingle: An event is generated for each alert.
+   * 
+   * - allToSingle: An event is generated for all alerts in a period.
    * 
    * @example
    * allToSingle
@@ -60,7 +63,7 @@ export class PostCustomizeRuleRequest extends $dara.Model {
   eventTransferType?: string;
   /**
    * @remarks
-   * The ID of the rule.
+   * The ID of the custom rule.
    * 
    * @example
    * 123456789
@@ -76,7 +79,7 @@ export class PostCustomizeRuleRequest extends $dara.Model {
   logSource?: string;
   /**
    * @remarks
-   * The internal code of the log source.
+   * The Medusa code of the log source.
    * 
    * @example
    * ${sas.cloudsiem.prod.cloud_siem_aegis_sas_alert}
@@ -92,7 +95,7 @@ export class PostCustomizeRuleRequest extends $dara.Model {
   logType?: string;
   /**
    * @remarks
-   * The internal code of the log type.
+   * The Medusa code of the log type.
    * 
    * @example
    * ${security_event_config.event_name.webshellName_clientav}
@@ -100,7 +103,7 @@ export class PostCustomizeRuleRequest extends $dara.Model {
   logTypeMds?: string;
   /**
    * @remarks
-   * The window length of the rule.
+   * The length of the rule window.
    * 
    * @example
    * {"time":"1","unit":"HOUR"}
@@ -108,10 +111,11 @@ export class PostCustomizeRuleRequest extends $dara.Model {
   queryCycle?: string;
   /**
    * @remarks
-   * The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:
+   * The region where the data management center of Threat Analysis is located. Select the region where your assets are located. Valid values:
+   * 
+   * - cn-hangzhou: assets in the Chinese mainland and China (Hong Kong)
    * 
-   * *   cn-hangzhou: Your assets reside in regions in China.
-   * *   ap-southeast-1: Your assets reside in regions outside China.
+   * - ap-southeast-1: assets outside China
    * 
    * @example
    * cn-hangzhou
@@ -119,7 +123,7 @@ export class PostCustomizeRuleRequest extends $dara.Model {
   regionId?: string;
   /**
    * @remarks
-   * The ID of the account that you switch from the management account.
+   * The user ID that is used to switch the administrator\\"s perspective to a member\\"s perspective.
    * 
    * @example
    * 113091674488****
@@ -127,9 +131,11 @@ export class PostCustomizeRuleRequest extends $dara.Model {
   roleFor?: number;
   /**
    * @remarks
-   * The type of the view. Valid values:
-   * - 0: the current Alibaba Cloud account
-   * - 1: the global account
+   * The view type.
+   * 
+   * - 0: the view of the current Alibaba Cloud account.
+   * 
+   * - 1: the view of all accounts that are managed by the administrator.
    * 
    * @example
    * 1
@@ -137,7 +143,7 @@ export class PostCustomizeRuleRequest extends $dara.Model {
   roleType?: number;
   /**
    * @remarks
-   * The query condition of the rule. The value is in the JSON format.
+   * The query condition of the rule. The value is a JSON string.
    * 
    * @example
    * [[{"not":false,"left":"alert_name","operator":"=","right":"WEBSHELL"}]]
@@ -153,7 +159,7 @@ export class PostCustomizeRuleRequest extends $dara.Model {
   ruleDesc?: string;
   /**
    * @remarks
-   * The log aggregation field of the rule. The value is a JSON string.
+   * The fields that are used to group logs. The value is a JSON array.
    * 
    * @example
    * ["asset_id"]
@@ -169,7 +175,7 @@ export class PostCustomizeRuleRequest extends $dara.Model {
   ruleName?: string;
   /**
    * @remarks
-   * The threshold configuration of the rule. The value is in the JSON format.
+   * The threshold configuration of the rule. The value is a JSON string.
    * 
    * @example
    * {"aggregateFunction":"count","aggregateFunctionName":"count","field":"activity_name","operator":"<=","value":1}
@@ -177,11 +183,13 @@ export class PostCustomizeRuleRequest extends $dara.Model {
   ruleThreshold?: string;
   /**
    * @remarks
-   * The risk level. Valid values:
+   * The threat level. Valid values:
+   * 
+   * - serious: high
+   * 
+   * - suspicious: medium
    * 
-   * *   serious: high
-   * *   suspicious: medium
-   * *   remind: low
+   * - remind: low
    * 
    * @example
    * remind

package/src/models/PostCustomizeRuleResponseBody.ts

@@ -5,7 +5,7 @@ import * as $dara from '@darabonba/typescript';
 export class PostCustomizeRuleResponseBodyData extends $dara.Model {
   /**
    * @remarks
-   * The risk type.
+   * The threat type.
    * 
    * @example
    * WEBSHELL
@@ -13,7 +13,7 @@ export class PostCustomizeRuleResponseBodyData extends $dara.Model {
   alertType?: string;
   /**
    * @remarks
-   * The internal code of the risk type.
+   * The Medusa code of the threat type.
    * 
    * @example
    * ${siem_rule_type_process_abnormal_command}
@@ -21,7 +21,7 @@ export class PostCustomizeRuleResponseBodyData extends $dara.Model {
   alertTypeMds?: string;
   /**
    * @remarks
-   * The ID of the Alibaba Cloud account that is used to purchase the threat analysis feature.
+   * The ID of the Alibaba Cloud account that is used to purchase Threat Analysis.
    * 
    * @example
    * 127608589417****
@@ -29,7 +29,7 @@ export class PostCustomizeRuleResponseBodyData extends $dara.Model {
   aliuid?: number;
   /**
    * @remarks
-   * 告警附加字段attck
+   * The ATT\\&CK attack technique.
    * 
    * @example
    * T1595.002 Vulnerability Scanning
@@ -37,7 +37,7 @@ export class PostCustomizeRuleResponseBodyData extends $dara.Model {
   attCk?: string;
   /**
    * @remarks
-   * 自动化响应规则条件字段数据类型。
+   * The data type of the condition field in the automated response rule.
    * 
    * @example
    * varchar
@@ -45,7 +45,7 @@ export class PostCustomizeRuleResponseBodyData extends $dara.Model {
   dataType?: number;
   /**
    * @remarks
-   * The extended information about event generation. If eventTransferType is set to allToSingle, the value of this parameter indicates the length and unit of the alert aggregation window. The HTML escape characters are reversed.
+   * The extended information for event generation. This parameter is returned only when EventTransferType is set to allToSingle. The value indicates the length and unit of the alert aggregation window. You must unescape the HTML escape characters.
    * 
    * @example
    * {"time":"1","unit":"MINUTE"}
@@ -53,10 +53,11 @@ export class PostCustomizeRuleResponseBodyData extends $dara.Model {
   eventTransferExt?: string;
   /**
    * @remarks
-   * Indicates whether the system generates an event for the alert. Valid values:
+   * Indicates whether alerts are converted into events. Valid values:
    * 
-   * *   0: no
-   * *   1: yes
+   * - 0: no
+   * 
+   * - 1: yes
    * 
    * @example
    * 1
@@ -66,9 +67,11 @@ export class PostCustomizeRuleResponseBodyData extends $dara.Model {
    * @remarks
    * The event generation method. Valid values:
    * 
-   * *   default: The default method is used.
-   * *   singleToSingle: The system generates an event for each alert.
-   * *   allToSingle: The system generates an event for alerts within a period of time.
+   * - default: the default method
+   * 
+   * - singleToSingle: An event is generated for each alert.
+   * 
+   * - allToSingle: An event is generated for all alerts in a period.
    * 
    * @example
    * allToSingle
@@ -108,7 +111,7 @@ export class PostCustomizeRuleResponseBodyData extends $dara.Model {
   logSource?: string;
   /**
    * @remarks
-   * The internal code of the log source.
+   * The Medusa code of the log source.
    * 
    * @example
    * ${sas.cloudsiem.prod.cloud_siem_aegis_sas_alert}
@@ -124,7 +127,7 @@ export class PostCustomizeRuleResponseBodyData extends $dara.Model {
   logType?: string;
   /**
    * @remarks
-   * The internal code of the log type.
+   * The Medusa code of the log type.
    * 
    * @example
    * ${security_event_config.event_name.webshellName_clientav}
@@ -132,7 +135,7 @@ export class PostCustomizeRuleResponseBodyData extends $dara.Model {
   logTypeMds?: string;
   /**
    * @remarks
-   * The window length of the rule. The HTML escape characters are reversed.
+   * The length of the rule window. You must unescape the HTML escape characters.
    * 
    * @example
    * {"time":"1","unit":"HOUR"}
@@ -140,7 +143,7 @@ export class PostCustomizeRuleResponseBodyData extends $dara.Model {
   queryCycle?: string;
   /**
    * @remarks
-   * The query condition of the rule. The value is in the JSON format. The HTML escape characters are reversed.
+   * The query condition of the rule in the JSON format. You must unescape the HTML escape characters.
    * 
    * @example
    * [[{"not":false,"left":"alert_name","operator":"=","right":"WEBSHELL"}]]
@@ -156,7 +159,7 @@ export class PostCustomizeRuleResponseBodyData extends $dara.Model {
   ruleDesc?: string;
   /**
    * @remarks
-   * The log aggregation field of the rule. The value is a JSON string. The HTML escape characters are reversed.
+   * The fields that are used to group logs. The value is a JSON array. You must unescape the HTML escape characters.
    * 
    * @example
    * ["asset_id"]
@@ -172,7 +175,7 @@ export class PostCustomizeRuleResponseBodyData extends $dara.Model {
   ruleName?: string;
   /**
    * @remarks
-   * The threshold configuration of the rule. The value is in the JSON format. The HTML escape characters are reversed.
+   * The threshold configuration of the rule in the JSON format. You must unescape the HTML escape characters.
    * 
    * @example
    * {"aggregateFunction":"count","aggregateFunctionName":"count","field":"activity_name","operator":"<=","value":1}
@@ -180,10 +183,11 @@ export class PostCustomizeRuleResponseBodyData extends $dara.Model {
   ruleThreshold?: string;
   /**
    * @remarks
-   * The type of the rule. Valid values:
+   * The rule type. Valid values:
    * 
-   * *   predefine
-   * *   customize
+   * - predefine: predefined
+   * 
+   * - customize: custom
    * 
    * @example
    * customize
@@ -191,13 +195,17 @@ export class PostCustomizeRuleResponseBodyData extends $dara.Model {
   ruleType?: string;
   /**
    * @remarks
-   * The rule status. Valid values:
+   * The status of the rule. Valid values:
+   * 
+   * - 0: initial
+   * 
+   * - 10: testing with simulated data
    * 
-   * *   0: The rule is in the initial state.
-   * *   10: The simulation data is tested.
-   * *   15: The business data is being tested.
-   * *   20: The business data test ends.
-   * *   100: The rule takes effect.
+   * - 15: testing with business data
+   * 
+   * - 20: test with business data ends
+   * 
+   * - 100: published
    * 
    * @example
    * 0
@@ -205,11 +213,13 @@ export class PostCustomizeRuleResponseBodyData extends $dara.Model {
   status?: number;
   /**
    * @remarks
-   * The risk level. Valid values:
+   * The threat level. Valid values:
+   * 
+   * - serious: high
    * 
-   * *   serious: high
-   * *   suspicious: medium
-   * *   remind: low
+   * - suspicious: medium
+   * 
+   * - remind: low
    * 
    * @example
    * remind
@@ -319,8 +329,9 @@ export class PostCustomizeRuleResponseBody extends $dara.Model {
    * @remarks
    * Indicates whether the request was successful. Valid values:
    * 
-   * *   true
-   * *   false
+   * - true: The request was successful.
+   * 
+   * - false: The request failed.
    * 
    * @example
    * true

package/src/models/PostCustomizeRuleTestRequest.ts

@@ -5,7 +5,7 @@ import * as $dara from '@darabonba/typescript';
 export class PostCustomizeRuleTestRequest extends $dara.Model {
   /**
    * @remarks
-   * The ID of the rule.
+   * The ID of the custom rule.
    * 
    * @example
    * 123456789
@@ -13,10 +13,11 @@ export class PostCustomizeRuleTestRequest extends $dara.Model {
   id?: number;
   /**
    * @remarks
-   * The data management center of the threat analysis feature. Specify this parameter based on the region in which your assets reside. Valid values:
+   * The region where the Data Management center of threat analysis is located. Select the region based on the region where your assets are located. Valid values:
    * 
-   * *   cn-hangzhou: Your assets reside in regions inside China.
-   * *   ap-southeast-1: Your assets reside in regions outside China.
+   * - cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).
+   * 
+   * - ap-southeast-1: Your assets are in regions outside China.
    * 
    * @example
    * cn-hangzhou
@@ -24,7 +25,7 @@ export class PostCustomizeRuleTestRequest extends $dara.Model {
   regionId?: string;
   /**
    * @remarks
-   * The ID of the account that you switch from the management account.
+   * The user ID of the member that the administrator wants to impersonate to view data.
    * 
    * @example
    * 113091674488****
@@ -32,9 +33,11 @@ export class PostCustomizeRuleTestRequest extends $dara.Model {
   roleFor?: number;
   /**
    * @remarks
-   * The type of the view. Valid values:
-   * - 0: the current Alibaba Cloud account
-   * - 1: the global account
+   * The view type.
+   * 
+   * - 0: the view of the current Alibaba Cloud account.
+   * 
+   * - 1: the view of all accounts in the enterprise.
    * 
    * @example
    * 1
@@ -42,7 +45,7 @@ export class PostCustomizeRuleTestRequest extends $dara.Model {
   roleType?: number;
   /**
    * @remarks
-   * The simulation data for the test. This parameter is available only when TestType is set to simulate.
+   * The simulated data for the test. This parameter is required only when TestType is set to simulate.
    * 
    * @example
    * [{"key1":"value1","key2":"value2","key3":"value3","key4":"value4","key5":"value5"}]
@@ -52,8 +55,9 @@ export class PostCustomizeRuleTestRequest extends $dara.Model {
    * @remarks
    * The test type. Valid values:
    * 
-   * *   simulate: simulation data test
-   * *   business: business data test
+   * - simulate: tests the rule with simulated data
+   * 
+   * - business: tests the rule with business data
    * 
    * @example
    * simulate

package/src/models/PostCustomizeRuleTestResponseBody.ts

@@ -5,7 +5,7 @@ import * as $dara from '@darabonba/typescript';
 export class PostCustomizeRuleTestResponseBody extends $dara.Model {
   /**
    * @remarks
-   * The HTTP status code that is returned.
+   * The status code of the request.
    * 
    * @example
    * 200
@@ -13,7 +13,7 @@ export class PostCustomizeRuleTestResponseBody extends $dara.Model {
   code?: number;
   /**
    * @remarks
-   * The data returned.
+   * The return value of the request.
    * 
    * @example
    * 123456
@@ -21,7 +21,7 @@ export class PostCustomizeRuleTestResponseBody extends $dara.Model {
   data?: any;
   /**
    * @remarks
-   * The returned message.
+   * The message returned for the request.
    * 
    * @example
    * success
@@ -39,8 +39,9 @@ export class PostCustomizeRuleTestResponseBody extends $dara.Model {
    * @remarks
    * Indicates whether the request was successful. Valid values:
    * 
-   * *   true
-   * *   false
+   * - true: The request was successful.
+   * 
+   * - false: The request failed.
    * 
    * @example
    * true

package/src/models/PostEventDisposeAndWhiteruleListRequest.ts

@@ -3,10 +3,17 @@ import * as $dara from '@darabonba/typescript';
 
 
 export class PostEventDisposeAndWhiteruleListRequest extends $dara.Model {
+  /**
+   * @remarks
+   * A comma-separated list of response strategy IDs.
+   * 
+   * @example
+   * 12,13,14
+   */
   disposeStrategyIds?: string;
   /**
    * @remarks
-   * The configuration of event handling. The value is a JSON object.
+   * A JSON object that defines the incident response configuration.
    * 
    * @example
    * [
@@ -38,20 +45,23 @@ export class PostEventDisposeAndWhiteruleListRequest extends $dara.Model {
   eventDispose?: string;
   /**
    * @remarks
-   * The UUID of the event.
+   * The globally unique UUID of the incident.
    * 
    * @example
    * 85ea4241-798f-4684-a876-65d4f0c3****
    */
   incidentUuid?: string;
   /**
+   * @remarks
+   * The UID of the incident owner.
+   * 
    * @example
    * 1234567890xxxxxx
    */
   owner?: string;
   /**
    * @remarks
-   * The configuration of the alert recipient. The value is a JSON object.
+   * A JSON object that defines the alert recipient configuration.
    * 
    * @example
    * {
@@ -63,10 +73,11 @@ export class PostEventDisposeAndWhiteruleListRequest extends $dara.Model {
   receiverInfo?: string;
   /**
    * @remarks
-   * The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:
+   * The region where the Data Management service for threat analysis is deployed. Select a region based on where your assets are located. Valid values:
    * 
-   * *   cn-hangzhou: Your assets reside in regions in China.
-   * *   ap-southeast-1: Your assets reside in regions outside China.
+   * - cn-hangzhou: Assets in the Chinese mainland or Hong Kong (China)
+   * 
+   * - ap-southeast-1: Assets outside China
    * 
    * @example
    * cn-hangzhou
@@ -74,16 +85,23 @@ export class PostEventDisposeAndWhiteruleListRequest extends $dara.Model {
   regionId?: string;
   /**
    * @remarks
-   * The remarks of the event.
+   * A note about the incident.
    * 
    * @example
    * dealed
    */
   remark?: string;
+  /**
+   * @remarks
+   * The source of the response policy.
+   * 
+   * @example
+   * system
+   */
   responseSource?: string;
   /**
    * @remarks
-   * The ID of the account that you switch from the management account.
+   * The UID of the member whose perspective an administrator switches to.
    * 
    * @example
    * 113091674488****
@@ -91,9 +109,11 @@ export class PostEventDisposeAndWhiteruleListRequest extends $dara.Model {
   roleFor?: number;
   /**
    * @remarks
-   * The type of the view. Valid values:
-   * - 0: the current Alibaba Cloud account
-   * - 1: the global account
+   * The view type. Valid values:
+   * 
+   * - 0: Current Alibaba Cloud account view
+   * 
+   * - 1: View for all accounts in your enterprise
    * 
    * @example
    * 1
@@ -101,17 +121,33 @@ export class PostEventDisposeAndWhiteruleListRequest extends $dara.Model {
   roleType?: number;
   /**
    * @remarks
-   * The status of the event. Valid values:
+   * The incident status. Valid values:
+   * 
+   * - 0: Not handled
+   * 
+   * - 1: Handling
    * 
-   * *   0: unhandled
-   * *   1: handing
-   * *   5: handling failed
-   * *   10: handled
+   * - 5: Failed
+   * 
+   * - 10: Handled
    * 
    * @example
    * 0
    */
   status?: number;
+  /**
+   * @remarks
+   * The threat level. Valid values:
+   * 
+   * - serious: Important
+   * 
+   * - suspicious: Medium
+   * 
+   * - remind: Low
+   * 
+   * @example
+   * remind
+   */
   threatLevel?: string;
   static names(): { [key: string]: string } {
     return {

package/src/models/PostEventDisposeAndWhiteruleListResponseBody.ts

@@ -13,7 +13,7 @@ export class PostEventDisposeAndWhiteruleListResponseBody extends $dara.Model {
   code?: number;
   /**
    * @remarks
-   * The data returned.
+   * The response value.
    * 
    * @example
    * 123456
@@ -21,7 +21,7 @@ export class PostEventDisposeAndWhiteruleListResponseBody extends $dara.Model {
   data?: string;
   /**
    * @remarks
-   * The returned message.
+   * The response message.
    * 
    * @example
    * success
@@ -29,7 +29,7 @@ export class PostEventDisposeAndWhiteruleListResponseBody extends $dara.Model {
   message?: string;
   /**
    * @remarks
-   * The request ID.
+   * The ID of the request.
    * 
    * @example
    * 9AAA9ED9-78F4-5021-86DC-D51C7511****
@@ -37,10 +37,11 @@ export class PostEventDisposeAndWhiteruleListResponseBody extends $dara.Model {
   requestId?: string;
   /**
    * @remarks
-   * Indicates whether the request was successful. Valid values:
+   * Indicates whether the request succeeded. Valid values:
    * 
-   * *   true
-   * *   false
+   * - true: succeeded
+   * 
+   * - false: failed
    * 
    * @example
    * true