@alicloud/waf-openapi20211001 6.8.0 → 6.8.2

package/src/models/DescribeTemplateResourcesResponseBody.ts

@@ -3,11 +3,27 @@ import * as $dara from '@darabonba/typescript';
 
 
 export class DescribeTemplateResourcesResponseBody extends $dara.Model {
+  /**
+   * @remarks
+   * The number of entries returned on each page. Valid values: 1 to 500. Default value: 500.
+   * 
+   * @example
+   * 20
+   */
   maxResults?: number;
+  /**
+   * @remarks
+   * The token that is used to retrieve the next page of results. This parameter is returned if a next page exists.
+   * 
+   * > If a value is returned for this parameter, a next page exists. You can use the returned **NextToken** value as a request parameter to retrieve the data on the next page. When no value is returned, all data has been retrieved.
+   * 
+   * @example
+   * AAAAABLQv******37sHZaHk4=
+   */
   nextToken?: string;
   /**
    * @remarks
-   * The ID of the request.
+   * The request ID.
    * 
    * @example
    * C7BC9373-3960-53B0-8968-2B13454AE18F
@@ -15,10 +31,24 @@ export class DescribeTemplateResourcesResponseBody extends $dara.Model {
   requestId?: string;
   /**
    * @remarks
-   * An array of protected objects or protected object groups that are associated to the protection rule template.
+   * A list of the names of the attached protected objects or protected object groups, or the IDs of the protected assets.
    */
   resources?: string[];
+  /**
+   * @remarks
+   * The ID of the protection template.
+   * 
+   * @example
+   * 168465
+   */
   templateId?: number;
+  /**
+   * @remarks
+   * The total number of returned entries.
+   * 
+   * @example
+   * 25
+   */
   totalCount?: number;
   static names(): { [key: string]: string } {
     return {

package/src/models/DescribeThreatEventDetailRequest.ts

@@ -5,6 +5,8 @@ import * as $dara from '@darabonba/typescript';
 export class DescribeThreatEventDetailRequest extends $dara.Model {
   /**
    * @remarks
+   * The ID of the security event.
+   * 
    * This parameter is required.
    * 
    * @example
@@ -13,6 +15,10 @@ export class DescribeThreatEventDetailRequest extends $dara.Model {
   eventId?: string;
   /**
    * @remarks
+   * The ID of the Web Application Firewall (WAF) instance.
+   * 
+   * > You can call the [DescribeInstance](https://help.aliyun.com/document_detail/433756.html) operation to query the ID of the WAF instance.
+   * 
    * This parameter is required.
    * 
    * @example
@@ -20,11 +26,21 @@ export class DescribeThreatEventDetailRequest extends $dara.Model {
    */
   instanceId?: string;
   /**
+   * @remarks
+   * The region where the WAF instance resides. Valid values:
+   * 
+   * - **cn-hangzhou**: the Chinese mainland.
+   * 
+   * - **ap-southeast-1**: outside the Chinese mainland.
+   * 
    * @example
    * cn-hangzhou
    */
   regionId?: string;
   /**
+   * @remarks
+   * The ID of the Alibaba Cloud resource group.
+   * 
    * @example
    * rg-aekzhks66****
    */

package/src/models/DescribeThreatEventDetailResponseBody.ts

@@ -4,61 +4,149 @@ import * as $dara from '@darabonba/typescript';
 
 export class DescribeThreatEventDetailResponseBodyThreatEventDetail extends $dara.Model {
   /**
+   * @remarks
+   * The time of the most recent attack. This value is a UNIX timestamp. Unit: milliseconds.
+   * 
    * @example
    * 1749916800000
    */
   endTime?: number;
   /**
+   * @remarks
+   * The number of attacks that were blocked in the security event.
+   * 
    * @example
    * 20
    */
   eventBlock?: string;
   /**
+   * @remarks
+   * The total number of attacks in the security event.
+   * 
    * @example
    * 20
    */
   eventCnt?: string;
   /**
+   * @remarks
+   * The filter condition for viewing logs. The value is a JSON object in the string format.
+   * 
    * @example
    * {"end_ts": 1766637714, "start_ts": 1764096746, "condition": {"real_client_ip": ["78.153.140.179", "78.153.140.203", "78.153.140.177", "78.153.140.178", "78.153.140.151"]}}
    */
   eventCondition?: string;
   /**
+   * @remarks
+   * The threat intelligence associated with the event. The value is a JSON array in the string format.
+   * 
    * @example
    * ["CVE-2020-14882","DDoS Attack"]
    */
   eventIntelligence?: string;
   /**
+   * @remarks
+   * The severity level of the event. Valid values:
+   * 
+   * - **critical**: Critical severity.
+   * 
+   * - **high**: High severity.
+   * 
+   * - **medium**: Medium severity.
+   * 
+   * - **low**: Low severity.
+   * 
    * @example
    * high
    */
   eventLevel?: string;
   /**
+   * @remarks
+   * The source IP address of the attack.
+   * 
+   * > A security event may have multiple source IP addresses. This operation returns only one of them.
+   * 
    * @example
    * XX.XX.XX.XX
    */
   eventSrc?: string;
   /**
+   * @remarks
+   * The country of the source IP address of the attack.
+   * 
    * @example
    * GB
    */
   eventSrcCountry?: string;
   /**
+   * @remarks
+   * The region of the source IP address of the attack.
+   * 
    * @example
    * GB-ENG
    */
   eventSrcRegion?: string;
   /**
+   * @remarks
+   * The security suggestion. Valid values:
+   * 
+   * - **ProtectInterface**: The attack target appears to be a backend management address. If the address has specific access patterns, configure custom rules in the access control module to restrict access.
+   * 
+   * - **BlockArea**: Monitor the attack source region. If the attack source region is different from your normal business regions, configure a location blacklist or an IP address blacklist in the access control module to restrict access.
+   * 
+   * - **SwitchBlock**: The current protection rule is in Alert mode. To ensure business security, switch to Block mode. Before you switch, check for false positives.
+   * 
+   * - **FixBug**: Check the attack target for security vulnerabilities. If any vulnerabilities exist, fix them promptly to prevent exploitation.
+   * 
+   * - **SwitchStrict**: If it does not affect your normal business, change the policies of modules, such as protection rules and scan protection, to a stricter mode. Before you change the policies, check for false positives.
+   * 
+   * - **ProtectFile**: Check the target domain name for sensitive files or paths to prevent them from being detected and exploited.
+   * 
+   * - **BlockIP**: The source IP address has a high degree of maliciousness. Keep monitoring it. If it does not affect your normal business, use an IP address blacklist to block access from the malicious IP address.
+   * 
+   * - **KeepConcerned**: No threats are found. Continue to monitor the situation.
+   * 
    * @example
    * FixBug
    */
   eventSuggest?: string;
   /**
+   * @remarks
+   * The name of the event. Valid values:
+   * 
+   * - **MultipleDomainDirscan**: A directory and file scan for multiple domain names.
+   * 
+   * - **SingleDomainDirscan**: A directory and file scan for a single domain name.
+   * 
+   * - **MultipleDomainWebscan**: A web vulnerability scan for multiple domain names.
+   * 
+   * - **SingleDomainWebscan**: A web vulnerability scan for a single domain name.
+   * 
+   * - **MultipleDomainWebattack**: A web vulnerability attack on multiple domain names.
+   * 
+   * - **SingleDomainWebattack**: A web vulnerability attack on a single domain name.
+   * 
+   * - **SingleURLWebattack**: A web vulnerability attack on a specific URL.
+   * 
+   * - **SingleURLSqlattack**: An SQL injection attack on a specific URL.
+   * 
+   * - **SingleURLXssattack**: A cross-site scripting (XSS) attack on a specific URL.
+   * 
+   * - **WebshellUpload**: An attempt to upload backdoor trojans.
+   * 
+   * - **RandomVulnTest**: A random web vulnerability probe.
+   * 
    * @example
    * MultipleDomainWebattack
    */
   eventTag?: string;
   /**
+   * @remarks
+   * Indicates whether the event is a persistent attack. Valid values:
+   * 
+   * - **0**: The event is not a persistent attack.
+   * 
+   * - **1**: The event is a persistent attack.
+   * 
    * @example
    * 1
    */
@@ -108,10 +196,17 @@ export class DescribeThreatEventDetailResponseBodyThreatEventDetail extends $dar
 
 export class DescribeThreatEventDetailResponseBody extends $dara.Model {
   /**
+   * @remarks
+   * The request ID.
+   * 
    * @example
    * D7861F61-5B61-46CE-A47C-6B1****
    */
   requestId?: string;
+  /**
+   * @remarks
+   * The details of the security event.
+   */
   threatEventDetail?: DescribeThreatEventDetailResponseBodyThreatEventDetail;
   static names(): { [key: string]: string } {
     return {

package/src/models/DescribeThreatEventRequest.ts

@@ -4,12 +4,17 @@ import * as $dara from '@darabonba/typescript';
 
 export class DescribeThreatEventRequest extends $dara.Model {
   /**
+   * @remarks
+   * The domain name that is protected by WAF. If you do not specify this parameter, security events for all domain names are queried.
+   * 
    * @example
    * www.abc.com
    */
   domainName?: string;
   /**
    * @remarks
+   * The end of the time range to query. This value is a UNIX timestamp in milliseconds.
+   * 
    * This parameter is required.
    * 
    * @example
@@ -18,6 +23,10 @@ export class DescribeThreatEventRequest extends $dara.Model {
   endTime?: number;
   /**
    * @remarks
+   * The ID of the Web Application Firewall (WAF) instance.
+   * 
+   * > You can call [DescribeInstance](https://help.aliyun.com/document_detail/433756.html) to query the ID of the WAF instance.
+   * 
    * This parameter is required.
    * 
    * @example
@@ -25,27 +34,45 @@ export class DescribeThreatEventRequest extends $dara.Model {
    */
   instanceId?: string;
   /**
+   * @remarks
+   * The page number of the page to return. Default value: 1.
+   * 
    * @example
    * 1
    */
   pageNumber?: number;
   /**
+   * @remarks
+   * The number of entries per page. Default value: **5**. Valid values: 1 to 200.
+   * 
    * @example
    * 10
    */
   pageSize?: number;
   /**
+   * @remarks
+   * The region where the WAF instance resides. Valid values:
+   * 
+   * - **cn-hangzhou**: the Chinese mainland.
+   * 
+   * - **ap-southeast-1**: a region outside the Chinese mainland.
+   * 
    * @example
    * cn-hangzhou
    */
   regionId?: string;
   /**
+   * @remarks
+   * The ID of the resource group.
+   * 
    * @example
    * rg-aeky65ka*****
    */
   resourceManagerResourceGroupId?: string;
   /**
    * @remarks
+   * The beginning of the time range to query. This value is a UNIX timestamp in milliseconds.
+   * 
    * This parameter is required.
    * 
    * @example

package/src/models/DescribeThreatEventResponseBody.ts

@@ -4,36 +4,91 @@ import * as $dara from '@darabonba/typescript';
 
 export class DescribeThreatEventResponseBodyThreatEvents extends $dara.Model {
   /**
+   * @remarks
+   * The percentage of attack requests that were blocked by WAF.
+   * 
    * @example
    * 100%
    */
   blockRate?: string;
   /**
+   * @remarks
+   * The time when the last attack occurred. This value is a UNIX timestamp in milliseconds.
+   * 
    * @example
    * 1768406400000
    */
   endTime?: number;
   /**
+   * @remarks
+   * The ID of the security event.
+   * 
    * @example
    * f439994c8ab39f84eced33490f0c4388
    */
   eventId?: string;
   /**
+   * @remarks
+   * The severity level of the security event. Valid values:
+   * 
+   * - **critical**
+   * 
+   * - **high**
+   * 
+   * - **medium**
+   * 
+   * - **low**
+   * 
    * @example
    * high
    */
   eventLevel?: string;
   /**
+   * @remarks
+   * The source IP address of the attack.
+   * 
+   * > A security event may have multiple source IP addresses. This operation returns only one of them.
+   * 
    * @example
    * 3.3.3.3
    */
   eventSrc?: string;
   /**
+   * @remarks
+   * The type of the security event. Valid values:
+   * 
+   * - **MultipleDomainDirscan**: a directory and file scan against multiple domain names.
+   * 
+   * - **SingleDomainDirscan**: a directory and file scan against a single domain name.
+   * 
+   * - **MultipleDomainWebscan**: a web vulnerability scan against multiple domain names.
+   * 
+   * - **SingleDomainWebscan**: a web vulnerability scan against a single domain name.
+   * 
+   * - **MultipleDomainWebattack**: a web vulnerability attack against multiple domain names.
+   * 
+   * - **SingleDomainWebattack**: a web vulnerability attack against a single domain name.
+   * 
+   * - **SingleURLWebattack**: a web vulnerability attack against a specific URL.
+   * 
+   * - **SingleURLSqlattack**: an SQL injection attack against a specific URL.
+   * 
+   * - **SingleURLXssattack**: an XSS attack against a specific URL.
+   * 
+   * - **WebshellUpload**: an attack that attempts to upload backdoor trojans.
+   * 
+   * - **RandomVulnTest**: a random web vulnerability probe.
+   * 
    * @example
    * Event_InternalLoginWeakPasswd
    */
   eventTag?: string;
   /**
+   * @remarks
+   * The protected object that is the target of the attack.
+   * 
+   * > A security event may have multiple protected objects as targets. This operation returns only one of them.
+   * 
    * @example
    * test.aliyundemo.com-waf
    */
@@ -73,12 +128,22 @@ export class DescribeThreatEventResponseBodyThreatEvents extends $dara.Model {
 
 export class DescribeThreatEventResponseBody extends $dara.Model {
   /**
+   * @remarks
+   * The request ID.
+   * 
    * @example
    * 98106632-6865-5600-A834-3D909***
    */
   requestId?: string;
+  /**
+   * @remarks
+   * The list of notable security events.
+   */
   threatEvents?: DescribeThreatEventResponseBodyThreatEvents[];
   /**
+   * @remarks
+   * The total number of security events that match the query conditions.
+   * 
    * @example
    * 10
    */

package/src/models/DescribeThreatEventTopMetricRequest.ts

@@ -5,6 +5,8 @@ import * as $dara from '@darabonba/typescript';
 export class DescribeThreatEventTopMetricRequest extends $dara.Model {
   /**
    * @remarks
+   * The ID of the security event.
+   * 
    * This parameter is required.
    * 
    * @example
@@ -13,6 +15,10 @@ export class DescribeThreatEventTopMetricRequest extends $dara.Model {
   eventId?: string;
   /**
    * @remarks
+   * The ID of the WAF instance.
+   * 
+   * > You can call [DescribeInstance](https://help.aliyun.com/document_detail/433756.html) to query the ID of the current WAF instance.
+   * 
    * This parameter is required.
    * 
    * @example
@@ -21,6 +27,13 @@ export class DescribeThreatEventTopMetricRequest extends $dara.Model {
   instanceId?: string;
   /**
    * @remarks
+   * The statistical metric. Different values of Metric correspond to different statistical objects. Valid values:
+   * - **time**: aggregates statistics by attack time, sorts them in descending order, and returns the top 5 records.
+   * - **src**: aggregates statistics by source IP address of attack requests, sorts them in descending order, and returns the top 5 records.
+   * - **target**: aggregates statistics by URL of attack requests (excluding query strings), sorts them in descending order, and returns the top 5 records.
+   * - **type**: aggregates statistics by attack type, sorts them in descending order, and returns the top 5 records.
+   * - **tools**: aggregates statistics by attack tool, sorts them in descending order, and returns the top 5 records.
+   * 
    * This parameter is required.
    * 
    * @example
@@ -28,11 +41,21 @@ export class DescribeThreatEventTopMetricRequest extends $dara.Model {
    */
   metric?: string;
   /**
+   * @remarks
+   * The region where the WAF instance is deployed. Valid values:
+   * 
+   * - **cn-hangzhou**: the Chinese mainland.
+   * 
+   * - **ap-southeast-1**: outside the Chinese mainland.
+   * 
    * @example
    * cn-hangzhou
    */
   regionId?: string;
   /**
+   * @remarks
+   * The ID of the Alibaba Cloud resource group.
+   * 
    * @example
    * rg-acfm***q
    */

package/src/models/DescribeThreatEventTopMetricResponseBody.ts

@@ -4,21 +4,41 @@ import * as $dara from '@darabonba/typescript';
 
 export class DescribeThreatEventTopMetricResponseBodyTopMetrics extends $dara.Model {
   /**
+   * @remarks
+   * The number of attacks.
+   * 
    * @example
    * 20
    */
   cnt?: number;
   /**
+   * @remarks
+   * The country to which the source IP address of the attack belongs.
+   * > This field returns a meaningful value only when the statistical object (**Metric**) is set to source IP address (**src**).
+   * 
    * @example
    * CN
    */
   country?: string;
   /**
+   * @remarks
+   * The region to which the source IP address of the attack belongs.
+   * > This field returns a meaningful value only when the statistical object (**Metric**) is set to source IP address (**src**).
+   * 
    * @example
    * cn-hangzhou
    */
   region?: string;
   /**
+   * @remarks
+   * The attack value. The meaning of this field varies depending on the value of **Metric**.
+   * 
+   * - If **Metric** is set to **time**, this field indicates the attack time.
+   * - If **Metric** is set to **src**, this field indicates the source IP address of the attack.
+   * - If **Metric** is set to **target**, this field indicates the URL of the attack request.
+   * - If **Metric** is set to **type**, this field indicates the attack type. **dirscan** indicates directory scanning, **webscan** indicates web scanning, and other attack types are described in the **detectType** (detection type) parameter of the **custom regular rule** (**regular_custom**) in the [**CreateDefenseRule**](https://help.aliyun.com/document_detail/461421.html) operation.
+   * - If **Metric** is set to **tools**, this field indicates the attack tool.
+   * 
    * @example
    * 115.28.209.212
    */
@@ -52,10 +72,17 @@ export class DescribeThreatEventTopMetricResponseBodyTopMetrics extends $dara.Mo
 
 export class DescribeThreatEventTopMetricResponseBody extends $dara.Model {
   /**
+   * @remarks
+   * The request ID.
+   * 
    * @example
    * 12EF3845-CCEB-4B84-AE60-2B49B*****EE5
    */
   requestId?: string;
+  /**
+   * @remarks
+   * The list of statistics.
+   */
   topMetrics?: DescribeThreatEventTopMetricResponseBodyTopMetrics[];
   static names(): { [key: string]: string } {
     return {

package/src/models/DescribeUserAbnormalTrendRequest.ts

@@ -6,7 +6,8 @@ export class DescribeUserAbnormalTrendRequest extends $dara.Model {
   /**
    * @remarks
    * The ID of the hybrid cloud cluster.
-   * >For hybrid cloud scenarios only, you can call the [DescribeHybridCloudClusters](https://help.aliyun.com/document_detail/2849376.html) operation to query the hybrid cloud clusters.
+   * 
+   * > This parameter is applicable only to hybrid cloud scenarios. Call the [DescribeHybridCloudClusters](https://help.aliyun.com/document_detail/2849376.html) operation to obtain the hybrid cloud cluster ID.
    * 
    * @example
    * 428
@@ -14,9 +15,9 @@ export class DescribeUserAbnormalTrendRequest extends $dara.Model {
   clusterId?: string;
   /**
    * @remarks
-   * The ID of the Web Application Firewall (WAF) instance.
+   * The ID of the WAF instance.
    * 
-   * >  You can call the [DescribeInstance](https://help.aliyun.com/document_detail/433756.html) operation to query the ID of the WAF instance.
+   * > Call the [DescribeInstance](https://help.aliyun.com/document_detail/433756.html) operation to obtain the ID of the WAF instance.
    * 
    * This parameter is required.
    * 
@@ -26,10 +27,11 @@ export class DescribeUserAbnormalTrendRequest extends $dara.Model {
   instanceId?: string;
   /**
    * @remarks
-   * The region in which the WAF instance is deployed. Valid values:
+   * The region in which the WAF instance resides. Valid values:
+   * 
+   * - **cn-hangzhou**: the Chinese mainland.
    * 
-   * *   **cn-hangzhou**: Chinese mainland
-   * *   **ap-southeast-1**: outside the Chinese mainland
+   * - **ap-southeast-1**: outside the Chinese mainland.
    * 
    * @example
    * cn-hangzhou

package/src/models/DescribeUserAbnormalTrendResponseBody.ts

@@ -5,7 +5,7 @@ import * as $dara from '@darabonba/typescript';
 export class DescribeUserAbnormalTrendResponseBodyTrend extends $dara.Model {
   /**
    * @remarks
-   * The number of high risks.
+   * The number of high-severity security risks.
    * 
    * @example
    * 12
@@ -13,7 +13,7 @@ export class DescribeUserAbnormalTrendResponseBodyTrend extends $dara.Model {
   abnormalHigh?: number;
   /**
    * @remarks
-   * The number of low risks.
+   * The number of low-severity security risks.
    * 
    * @example
    * 23
@@ -21,7 +21,7 @@ export class DescribeUserAbnormalTrendResponseBodyTrend extends $dara.Model {
   abnormalLow?: number;
   /**
    * @remarks
-   * The number of medium risks.
+   * The number of medium-severity security risks.
    * 
    * @example
    * 14
@@ -29,9 +29,7 @@ export class DescribeUserAbnormalTrendResponseBodyTrend extends $dara.Model {
   abnormalMedium?: number;
   /**
    * @remarks
-   * The time at which the API was called. The value is a UNIX timestamp displayed in UTC. Unit: seconds.
-   * 
-   * >Notice: The parameter has been deprecated, it is recommended to use the Timestamp parameter.
+   * The point in time when the statistics were collected. This value is a UNIX timestamp in UTC. Unit: seconds.
    * 
    * @example
    * 1722268800
@@ -41,7 +39,7 @@ export class DescribeUserAbnormalTrendResponseBodyTrend extends $dara.Model {
   timeStamp?: number;
   /**
    * @remarks
-   * The time at which the API was called. The value is a UNIX timestamp displayed in UTC. Unit: seconds.
+   * The point in time when the statistics were collected. This value is a UNIX timestamp in UTC. Unit: seconds.
    * 
    * @example
    * 1722268800
@@ -79,7 +77,7 @@ export class DescribeUserAbnormalTrendResponseBodyTrend extends $dara.Model {
 export class DescribeUserAbnormalTrendResponseBody extends $dara.Model {
   /**
    * @remarks
-   * The request ID.
+   * The ID of the request.
    * 
    * @example
    * D7861F61-5B61-46CE-A47C-6B19160D5EB0
@@ -87,7 +85,7 @@ export class DescribeUserAbnormalTrendResponseBody extends $dara.Model {
   requestId?: string;
   /**
    * @remarks
-   * The trends of risks.
+   * The list of API security risk trend data points.
    */
   trend?: DescribeUserAbnormalTrendResponseBodyTrend[];
   static names(): { [key: string]: string } {