@alicloud/waf-openapi20211001 6.6.0 → 6.6.1

package/src/models/DescribeTemplateResourceCountResponseBody.ts

@@ -4,13 +4,16 @@ import * as $dara from '@darabonba/typescript';
 
 export class DescribeTemplateResourceCountResponseBodyResourceCount extends $dara.Model {
   /**
+   * @remarks
+   * The number of protected assets that are associated with the protection template.
+   * 
    * @example
    * 10
    */
   assetCount?: number;
   /**
    * @remarks
-   * The number of protected object groups.
+   * The number of protected object groups that are associated with the protection template.
    * 
    * @example
    * 30
@@ -18,7 +21,7 @@ export class DescribeTemplateResourceCountResponseBodyResourceCount extends $dar
   groupCount?: number;
   /**
    * @remarks
-   * The number of protected objects.
+   * The number of protected objects that are associated with the protection template.
    * 
    * @example
    * 30
@@ -70,7 +73,7 @@ export class DescribeTemplateResourceCountResponseBody extends $dara.Model {
   requestId?: string;
   /**
    * @remarks
-   * The number of protected objects or protected object groups for which the protection template takes effect.
+   * An array of resource count objects. Each object contains the number of protected objects, protected object groups, and protected assets that are associated with a protection template.
    */
   resourceCount?: DescribeTemplateResourceCountResponseBodyResourceCount[];
   static names(): { [key: string]: string } {

package/src/models/DescribeTemplateResourcesRequest.ts

@@ -4,15 +4,18 @@ import * as $dara from '@darabonba/typescript';
 
 export class DescribeTemplateResourcesRequest extends $dara.Model {
   /**
+   * @remarks
+   * The API of the protected asset for the fuzzy query.
+   * 
    * @example
    * abc.com
    */
   assetApi?: string;
   /**
    * @remarks
-   * The ID of the Web Application Firewall (WAF) instance.
+   * The ID of the WAF instance.
    * 
-   * >  You can call the [DescribeInstance](https://help.aliyun.com/document_detail/433756.html) operation to obtain the ID of the WAF instance.
+   * > You can call the [DescribeInstance](https://help.aliyun.com/document_detail/433756.html) operation to query the ID of the WAF instance.
    * 
    * This parameter is required.
    * 
@@ -20,19 +23,41 @@ export class DescribeTemplateResourcesRequest extends $dara.Model {
    * waf_cdnsdf3****
    */
   instanceId?: string;
+  /**
+   * @remarks
+   * The number of entries to return on each page for a paged query. Valid values: 1 to 500. Default value: 500.
+   * 
+   * @example
+   * 20
+   */
   maxResults?: number;
+  /**
+   * @remarks
+   * The token that is used to retrieve the next page of results. This is the value of the **NextToken** parameter returned from the last API call. You do not need to specify this parameter for the first query.
+   * 
+   * @example
+   * AAAAAJ7ob7*******MhJJ1ELRE=
+   */
   nextToken?: string;
   /**
    * @remarks
    * The region where the WAF instance resides. Valid values:
    * 
-   * *   **cn-hangzhou:** the Chinese mainland.
-   * *   **ap-southeast-1:** outside the Chinese mainland.
+   * - **cn-hangzhou**: the Chinese mainland.
+   * 
+   * - **ap-southeast-1**: outside the Chinese mainland.
    * 
    * @example
    * cn-hangzhou
    */
   regionId?: string;
+  /**
+   * @remarks
+   * The name of the protected object or protected object group for the fuzzy query.
+   * 
+   * @example
+   * abc.test.com-waf
+   */
   resource?: string;
   /**
    * @remarks
@@ -46,8 +71,11 @@ export class DescribeTemplateResourcesRequest extends $dara.Model {
    * @remarks
    * The type of the protected resource. Valid values:
    * 
-   * *   **single:** protected object.
-   * *   **group:** protected object group.
+   * - **single**: a protected object.
+   * 
+   * - **group**: a protected object group.
+   * 
+   * - **asset**: a protected asset.
    * 
    * This parameter is required.
    * 
@@ -57,7 +85,7 @@ export class DescribeTemplateResourcesRequest extends $dara.Model {
   resourceType?: string;
   /**
    * @remarks
-   * The ID of the protection rule template.
+   * The ID of the protection template.
    * 
    * This parameter is required.
    * 

package/src/models/DescribeTemplateResourcesResponseBody.ts

@@ -3,11 +3,27 @@ import * as $dara from '@darabonba/typescript';
 
 
 export class DescribeTemplateResourcesResponseBody extends $dara.Model {
+  /**
+   * @remarks
+   * The number of entries returned on each page. Valid values: 1 to 500. Default value: 500.
+   * 
+   * @example
+   * 20
+   */
   maxResults?: number;
+  /**
+   * @remarks
+   * The token that is used to retrieve the next page of results. This parameter is returned if a next page exists.
+   * 
+   * > If a value is returned for this parameter, a next page exists. You can use the returned **NextToken** value as a request parameter to retrieve the data on the next page. When no value is returned, all data has been retrieved.
+   * 
+   * @example
+   * AAAAABLQv******37sHZaHk4=
+   */
   nextToken?: string;
   /**
    * @remarks
-   * The ID of the request.
+   * The request ID.
    * 
    * @example
    * C7BC9373-3960-53B0-8968-2B13454AE18F
@@ -15,10 +31,24 @@ export class DescribeTemplateResourcesResponseBody extends $dara.Model {
   requestId?: string;
   /**
    * @remarks
-   * An array of protected objects or protected object groups that are associated to the protection rule template.
+   * A list of the names of the attached protected objects or protected object groups, or the IDs of the protected assets.
    */
   resources?: string[];
+  /**
+   * @remarks
+   * The ID of the protection template.
+   * 
+   * @example
+   * 168465
+   */
   templateId?: number;
+  /**
+   * @remarks
+   * The total number of returned entries.
+   * 
+   * @example
+   * 25
+   */
   totalCount?: number;
   static names(): { [key: string]: string } {
     return {

package/src/models/DescribeThreatEventDetailRequest.ts

@@ -5,6 +5,8 @@ import * as $dara from '@darabonba/typescript';
 export class DescribeThreatEventDetailRequest extends $dara.Model {
   /**
    * @remarks
+   * The ID of the security event.
+   * 
    * This parameter is required.
    * 
    * @example
@@ -13,6 +15,10 @@ export class DescribeThreatEventDetailRequest extends $dara.Model {
   eventId?: string;
   /**
    * @remarks
+   * The ID of the Web Application Firewall (WAF) instance.
+   * 
+   * > You can call the [DescribeInstance](https://help.aliyun.com/document_detail/433756.html) operation to query the ID of the WAF instance.
+   * 
    * This parameter is required.
    * 
    * @example
@@ -20,11 +26,21 @@ export class DescribeThreatEventDetailRequest extends $dara.Model {
    */
   instanceId?: string;
   /**
+   * @remarks
+   * The region where the WAF instance resides. Valid values:
+   * 
+   * - **cn-hangzhou**: the Chinese mainland.
+   * 
+   * - **ap-southeast-1**: outside the Chinese mainland.
+   * 
    * @example
    * cn-hangzhou
    */
   regionId?: string;
   /**
+   * @remarks
+   * The ID of the Alibaba Cloud resource group.
+   * 
    * @example
    * rg-aekzhks66****
    */

package/src/models/DescribeThreatEventDetailResponseBody.ts

@@ -4,61 +4,149 @@ import * as $dara from '@darabonba/typescript';
 
 export class DescribeThreatEventDetailResponseBodyThreatEventDetail extends $dara.Model {
   /**
+   * @remarks
+   * The time of the most recent attack. This value is a UNIX timestamp. Unit: milliseconds.
+   * 
    * @example
    * 1749916800000
    */
   endTime?: number;
   /**
+   * @remarks
+   * The number of attacks that were blocked in the security event.
+   * 
    * @example
    * 20
    */
   eventBlock?: string;
   /**
+   * @remarks
+   * The total number of attacks in the security event.
+   * 
    * @example
    * 20
    */
   eventCnt?: string;
   /**
+   * @remarks
+   * The filter condition for viewing logs. The value is a JSON object in the string format.
+   * 
    * @example
    * {"end_ts": 1766637714, "start_ts": 1764096746, "condition": {"real_client_ip": ["78.153.140.179", "78.153.140.203", "78.153.140.177", "78.153.140.178", "78.153.140.151"]}}
    */
   eventCondition?: string;
   /**
+   * @remarks
+   * The threat intelligence associated with the event. The value is a JSON array in the string format.
+   * 
    * @example
    * ["CVE-2020-14882","DDoS Attack"]
    */
   eventIntelligence?: string;
   /**
+   * @remarks
+   * The severity level of the event. Valid values:
+   * 
+   * - **critical**: Critical severity.
+   * 
+   * - **high**: High severity.
+   * 
+   * - **medium**: Medium severity.
+   * 
+   * - **low**: Low severity.
+   * 
    * @example
    * high
    */
   eventLevel?: string;
   /**
+   * @remarks
+   * The source IP address of the attack.
+   * 
+   * > A security event may have multiple source IP addresses. This operation returns only one of them.
+   * 
    * @example
    * XX.XX.XX.XX
    */
   eventSrc?: string;
   /**
+   * @remarks
+   * The country of the source IP address of the attack.
+   * 
    * @example
    * GB
    */
   eventSrcCountry?: string;
   /**
+   * @remarks
+   * The region of the source IP address of the attack.
+   * 
    * @example
    * GB-ENG
    */
   eventSrcRegion?: string;
   /**
+   * @remarks
+   * The security suggestion. Valid values:
+   * 
+   * - **ProtectInterface**: The attack target appears to be a backend management address. If the address has specific access patterns, configure custom rules in the access control module to restrict access.
+   * 
+   * - **BlockArea**: Monitor the attack source region. If the attack source region is different from your normal business regions, configure a location blacklist or an IP address blacklist in the access control module to restrict access.
+   * 
+   * - **SwitchBlock**: The current protection rule is in Alert mode. To ensure business security, switch to Block mode. Before you switch, check for false positives.
+   * 
+   * - **FixBug**: Check the attack target for security vulnerabilities. If any vulnerabilities exist, fix them promptly to prevent exploitation.
+   * 
+   * - **SwitchStrict**: If it does not affect your normal business, change the policies of modules, such as protection rules and scan protection, to a stricter mode. Before you change the policies, check for false positives.
+   * 
+   * - **ProtectFile**: Check the target domain name for sensitive files or paths to prevent them from being detected and exploited.
+   * 
+   * - **BlockIP**: The source IP address has a high degree of maliciousness. Keep monitoring it. If it does not affect your normal business, use an IP address blacklist to block access from the malicious IP address.
+   * 
+   * - **KeepConcerned**: No threats are found. Continue to monitor the situation.
+   * 
    * @example
    * FixBug
    */
   eventSuggest?: string;
   /**
+   * @remarks
+   * The name of the event. Valid values:
+   * 
+   * - **MultipleDomainDirscan**: A directory and file scan for multiple domain names.
+   * 
+   * - **SingleDomainDirscan**: A directory and file scan for a single domain name.
+   * 
+   * - **MultipleDomainWebscan**: A web vulnerability scan for multiple domain names.
+   * 
+   * - **SingleDomainWebscan**: A web vulnerability scan for a single domain name.
+   * 
+   * - **MultipleDomainWebattack**: A web vulnerability attack on multiple domain names.
+   * 
+   * - **SingleDomainWebattack**: A web vulnerability attack on a single domain name.
+   * 
+   * - **SingleURLWebattack**: A web vulnerability attack on a specific URL.
+   * 
+   * - **SingleURLSqlattack**: An SQL injection attack on a specific URL.
+   * 
+   * - **SingleURLXssattack**: A cross-site scripting (XSS) attack on a specific URL.
+   * 
+   * - **WebshellUpload**: An attempt to upload backdoor trojans.
+   * 
+   * - **RandomVulnTest**: A random web vulnerability probe.
+   * 
    * @example
    * MultipleDomainWebattack
    */
   eventTag?: string;
   /**
+   * @remarks
+   * Indicates whether the event is a persistent attack. Valid values:
+   * 
+   * - **0**: The event is not a persistent attack.
+   * 
+   * - **1**: The event is a persistent attack.
+   * 
    * @example
    * 1
    */
@@ -108,10 +196,17 @@ export class DescribeThreatEventDetailResponseBodyThreatEventDetail extends $dar
 
 export class DescribeThreatEventDetailResponseBody extends $dara.Model {
   /**
+   * @remarks
+   * The request ID.
+   * 
    * @example
    * D7861F61-5B61-46CE-A47C-6B1****
    */
   requestId?: string;
+  /**
+   * @remarks
+   * The details of the security event.
+   */
   threatEventDetail?: DescribeThreatEventDetailResponseBodyThreatEventDetail;
   static names(): { [key: string]: string } {
     return {

package/src/models/DescribeThreatEventRequest.ts

@@ -4,12 +4,17 @@ import * as $dara from '@darabonba/typescript';
 
 export class DescribeThreatEventRequest extends $dara.Model {
   /**
+   * @remarks
+   * The domain name that is protected by WAF. If you do not specify this parameter, security events for all domain names are queried.
+   * 
    * @example
    * www.abc.com
    */
   domainName?: string;
   /**
    * @remarks
+   * The end of the time range to query. This value is a UNIX timestamp in milliseconds.
+   * 
    * This parameter is required.
    * 
    * @example
@@ -18,6 +23,10 @@ export class DescribeThreatEventRequest extends $dara.Model {
   endTime?: number;
   /**
    * @remarks
+   * The ID of the Web Application Firewall (WAF) instance.
+   * 
+   * > You can call [DescribeInstance](https://help.aliyun.com/document_detail/433756.html) to query the ID of the WAF instance.
+   * 
    * This parameter is required.
    * 
    * @example
@@ -25,27 +34,45 @@ export class DescribeThreatEventRequest extends $dara.Model {
    */
   instanceId?: string;
   /**
+   * @remarks
+   * The page number of the page to return. Default value: 1.
+   * 
    * @example
    * 1
    */
   pageNumber?: number;
   /**
+   * @remarks
+   * The number of entries per page. Default value: **5**. Valid values: 1 to 200.
+   * 
    * @example
    * 10
    */
   pageSize?: number;
   /**
+   * @remarks
+   * The region where the WAF instance resides. Valid values:
+   * 
+   * - **cn-hangzhou**: the Chinese mainland.
+   * 
+   * - **ap-southeast-1**: a region outside the Chinese mainland.
+   * 
    * @example
    * cn-hangzhou
    */
   regionId?: string;
   /**
+   * @remarks
+   * The ID of the resource group.
+   * 
    * @example
    * rg-aeky65ka*****
    */
   resourceManagerResourceGroupId?: string;
   /**
    * @remarks
+   * The beginning of the time range to query. This value is a UNIX timestamp in milliseconds.
+   * 
    * This parameter is required.
    * 
    * @example

package/src/models/DescribeThreatEventResponseBody.ts

@@ -4,36 +4,91 @@ import * as $dara from '@darabonba/typescript';
 
 export class DescribeThreatEventResponseBodyThreatEvents extends $dara.Model {
   /**
+   * @remarks
+   * The percentage of attack requests that were blocked by WAF.
+   * 
    * @example
    * 100%
    */
   blockRate?: string;
   /**
+   * @remarks
+   * The time when the last attack occurred. This value is a UNIX timestamp in milliseconds.
+   * 
    * @example
    * 1768406400000
    */
   endTime?: number;
   /**
+   * @remarks
+   * The ID of the security event.
+   * 
    * @example
    * f439994c8ab39f84eced33490f0c4388
    */
   eventId?: string;
   /**
+   * @remarks
+   * The severity level of the security event. Valid values:
+   * 
+   * - **critical**
+   * 
+   * - **high**
+   * 
+   * - **medium**
+   * 
+   * - **low**
+   * 
    * @example
    * high
    */
   eventLevel?: string;
   /**
+   * @remarks
+   * The source IP address of the attack.
+   * 
+   * > A security event may have multiple source IP addresses. This operation returns only one of them.
+   * 
    * @example
    * 3.3.3.3
    */
   eventSrc?: string;
   /**
+   * @remarks
+   * The type of the security event. Valid values:
+   * 
+   * - **MultipleDomainDirscan**: a directory and file scan against multiple domain names.
+   * 
+   * - **SingleDomainDirscan**: a directory and file scan against a single domain name.
+   * 
+   * - **MultipleDomainWebscan**: a web vulnerability scan against multiple domain names.
+   * 
+   * - **SingleDomainWebscan**: a web vulnerability scan against a single domain name.
+   * 
+   * - **MultipleDomainWebattack**: a web vulnerability attack against multiple domain names.
+   * 
+   * - **SingleDomainWebattack**: a web vulnerability attack against a single domain name.
+   * 
+   * - **SingleURLWebattack**: a web vulnerability attack against a specific URL.
+   * 
+   * - **SingleURLSqlattack**: an SQL injection attack against a specific URL.
+   * 
+   * - **SingleURLXssattack**: an XSS attack against a specific URL.
+   * 
+   * - **WebshellUpload**: an attack that attempts to upload backdoor trojans.
+   * 
+   * - **RandomVulnTest**: a random web vulnerability probe.
+   * 
    * @example
    * Event_InternalLoginWeakPasswd
    */
   eventTag?: string;
   /**
+   * @remarks
+   * The protected object that is the target of the attack.
+   * 
+   * > A security event may have multiple protected objects as targets. This operation returns only one of them.
+   * 
    * @example
    * test.aliyundemo.com-waf
    */
@@ -73,12 +128,22 @@ export class DescribeThreatEventResponseBodyThreatEvents extends $dara.Model {
 
 export class DescribeThreatEventResponseBody extends $dara.Model {
   /**
+   * @remarks
+   * The request ID.
+   * 
    * @example
    * 98106632-6865-5600-A834-3D909***
    */
   requestId?: string;
+  /**
+   * @remarks
+   * The list of notable security events.
+   */
   threatEvents?: DescribeThreatEventResponseBodyThreatEvents[];
   /**
+   * @remarks
+   * The total number of security events that match the query conditions.
+   * 
    * @example
    * 10
    */

package/src/models/DescribeThreatEventTopMetricRequest.ts

@@ -5,6 +5,8 @@ import * as $dara from '@darabonba/typescript';
 export class DescribeThreatEventTopMetricRequest extends $dara.Model {
   /**
    * @remarks
+   * The ID of the security event.
+   * 
    * This parameter is required.
    * 
    * @example
@@ -13,6 +15,10 @@ export class DescribeThreatEventTopMetricRequest extends $dara.Model {
   eventId?: string;
   /**
    * @remarks
+   * The ID of the Web Application Firewall (WAF) instance.
+   * 
+   * > Call the [DescribeInstance](https://help.aliyun.com/document_detail/433756.html) operation to query the ID of the WAF instance.
+   * 
    * This parameter is required.
    * 
    * @example
@@ -21,6 +27,18 @@ export class DescribeThreatEventTopMetricRequest extends $dara.Model {
   instanceId?: string;
   /**
    * @remarks
+   * The metric that you want to use for statistics. Each metric corresponds to a different statistical object. Valid values:
+   * 
+   * - **time**: Aggregates statistics by attack time and returns the top 5 entries in descending order.
+   * 
+   * - **src**: Aggregates statistics by the source IP address of attack requests and returns the top 5 entries in descending order.
+   * 
+   * - **target**: Aggregates statistics by the URL of attack requests, excluding the query string, and returns the top 5 entries in descending order.
+   * 
+   * - **type**: Aggregates statistics by attack type and returns the top 5 entries in descending order.
+   * 
+   * - **tools**: Aggregates statistics by attack tool and returns the top 5 entries in descending order.
+   * 
    * This parameter is required.
    * 
    * @example
@@ -28,11 +46,21 @@ export class DescribeThreatEventTopMetricRequest extends $dara.Model {
    */
   metric?: string;
   /**
+   * @remarks
+   * The region where the WAF instance resides. Valid values:
+   * 
+   * - **cn-hangzhou**: the Chinese mainland.
+   * 
+   * - **ap-southeast-1**: outside the Chinese mainland.
+   * 
    * @example
    * cn-hangzhou
    */
   regionId?: string;
   /**
+   * @remarks
+   * The ID of the Alibaba Cloud resource group.
+   * 
    * @example
    * rg-acfm***q
    */

package/src/models/DescribeThreatEventTopMetricResponseBody.ts

@@ -4,21 +4,47 @@ import * as $dara from '@darabonba/typescript';
 
 export class DescribeThreatEventTopMetricResponseBodyTopMetrics extends $dara.Model {
   /**
+   * @remarks
+   * The number of attacks.
+   * 
    * @example
    * 20
    */
   cnt?: number;
   /**
+   * @remarks
+   * The country where the source IP address of the attack is located.
+   * 
+   * > This parameter is returned only when **Metric** is set to **src**.
+   * 
    * @example
    * CN
    */
   country?: string;
   /**
+   * @remarks
+   * The region where the source IP address of the attack is located.
+   * 
+   * > This parameter is returned only when **Metric** is set to **src**.
+   * 
    * @example
    * cn-hangzhou
    */
   region?: string;
   /**
+   * @remarks
+   * The attack value. The meaning of this parameter varies based on the value of **Metric**.
+   * 
+   * - If **Metric** is set to **time**, this parameter indicates the attack time.
+   * 
+   * - If **Metric** is set to **src**, this parameter indicates the source IP address of the attack.
+   * 
+   * - If **Metric** is set to **target**, this parameter indicates the URL of the attack request.
+   * 
+   * - If **Metric** is set to **type**, this parameter indicates the attack type. For example, **dirscan** indicates directory scan and **webscan** indicates web scan. For more information about other attack types, see the description of the **detectType** parameter for custom regular expression rules (**regular_custom**) in the [CreateDefenseRule](https://help.aliyun.com/document_detail/461421.html) operation.
+   * 
+   * - If **Metric** is set to **tools**, this parameter indicates the attack tool.
+   * 
    * @example
    * 115.28.209.212
    */
@@ -52,10 +78,17 @@ export class DescribeThreatEventTopMetricResponseBodyTopMetrics extends $dara.Mo
 
 export class DescribeThreatEventTopMetricResponseBody extends $dara.Model {
   /**
+   * @remarks
+   * The ID of the request.
+   * 
    * @example
    * 12EF3845-CCEB-4B84-AE60-2B49B*****EE5
    */
   requestId?: string;
+  /**
+   * @remarks
+   * The list of statistics.
+   */
   topMetrics?: DescribeThreatEventTopMetricResponseBodyTopMetrics[];
   static names(): { [key: string]: string } {
     return {