功能介绍

主机安全服务（Host Security Service，HSS）是以工作负载为中心的安全产品，集成了主机安全、容器安全和网页防篡改，旨在解决混合云、多云数据中心基础架构中服务器工作负载的独特保护要求。 本示例介绍企业主机安全服务处理告警事件的场景，首先查出告警事件列表，然后获取单个的告警事件详情，然后对指定的告警事件列表做处理，处理的方式如下：“手动处理”、“忽略”、“加入告警白名单”、“取消忽略”、“删除告警白名单”等

前置条件

• 1、已注册华为云，并完成实名认证。
• 2、具备开发环境 ，支持python3.3及以上版本。可执行 python --version 检查当前 python 的版本信息。
• 3、已获取华为云账号对应的Access Key（AK）和Secret Access Key（SK）。请在华为云控制台“我的凭证 > 访问密钥”页面上创建和查看您的AK/SK。具体请参见访问密钥。

SDK获取和安装

华为云开发者 Python 软件开发工具包，HSS支持python3.3及其以上版本。

使用 pip 安装 SDK 依赖包。

示例代码

class ChangeEventDemo:

    def __init__(self):
        pass

    @staticmethod
    def main(args):
        """
        args[0] = "<YOUR IAM_END_POINT>"
        args[1] = "<YOUR END_POINT>"
        args[2] = "<YOUR AK>"
        args[3] = "<YOUR SK>"
        args[4] = "<Event Category, 事件分类主要有两种，包括host（主机）和container（容器）>"
        args[5] = "<YOUR REGION_ID>"
        args[6] = "<OPERATE TYPE, 操作类型包括mark_as_handled(手动处理), ignore(忽略), unhandle(取消手动处理)等>"
        args[7] = "<REMARK, remark(备注), 非必填>"

        @param args
        """
        iam_endpoint = args[0]
        endpoint = args[1]
        ak = args[2]
        sk = args[3]
        # 第一步：输入事件分类、操作类型
        # 事件分类主要有两种，包括host（主机）和container（容器）
        category = args[4]
        region_id = args[5]
        # 操作类型包括mark_as_handled(手动处理), ignore(忽略), unhandle(取消手动处理)等
        operate_type = args[6]
        # remark(备注), 非必填
        remark = args[7]
        auth = BasicCredentials(
            iam_endpoint=iam_endpoint,
            ak=ak,
            sk=sk
        )
        # 根据需要配置是否跳过SSL证书验证
        http_config = HttpConfig.get_default_config()
        http_config.ignore_ssl_verification = True
        http_config.proxy_protocol = "http"
        client = HssClient.new_builder() \
            .with_credentials(credentials=auth) \
            .with_region(region=Region(id=region_id, endpoint=endpoint)) \
            .with_http_config(config=http_config) \
            .build()
        handle_status = "unhandled"
        # 第二步：查入侵事件列表
        event_management_list = ChangeEventDemo.__get_event_management_list(client, region_id, category, handle_status)
        # 第三步：获取告警信息
        security_event = ChangeEventDemo.__get_event_management(event_management_list)
        if (security_event is None):
            print("securityEvent is empty")
            return
        # 封装请求体
        request = ChangeEventRequest()
        request.region = region_id
        body = ChangeEventRequestInfo()
        body.operate_type = operate_type
        if (!remark is None or len(remark) == 0):
            body.handler = remark
        operate_event_list = []
        event_info = OperateEventRequestInfo()
        event_info.event_id = security_event.event_id
        event_info.event_class_id = security_event.event_class_id
        event_info.event_type = security_event.event_type
        event_info.occur_time = security_event.occur_time
        event_info.operate_detail_list = ChangeEventDemo.__trans_event_detail(security_event.operate_detail_list)
        operate_event_list.append(event_info)
        body.operate_event_list = operate_event_list
        request.body = body
        # 第四步：处理告警事件
        ChangeEventDemo.__change_event(client, request)

    @staticmethod
    def __trans_event_detail(list_event_detail_response):
        """
        转换请求对象
        """
        if (list_event_detail_response is None or len(list_event_detail_response) == 0):
            print("listEventDetailResponse is empty")
            return None
        result = []
        for event_detail_response_info in list_event_detail_response:
            detail = EventDetailRequestInfo()
            detail.agent_id = event_detail_response_info.agent_id
            detail.hash = event_detail_response_info.hash
            detail.keyword = event_detail_response_info.keyword
            result.append(detail)
        return result

    @staticmethod
    def __get_event_management_list(client, region, category, handle_status):
        """
        查入侵事件列表

        @param client
        @param
        @return
        """
        request = ListSecurityEventsRequest()
        request.region = region
        request.category = category
        request.handle_status = handle_status
        list_security_events_response = client.list_security_events(request)
        if (list_security_events_response is not None and list_security_events_response.data_list is not None):
            return list_security_events_response.data_list
        return None

    @staticmethod
    def __get_event_management(data_list):
        """
        获取告警信息

        @param dataList
        @return
        """
        if (data_list is not None and len(data_list) > 0):
            return data_list[0]
        return None

    @staticmethod
    def __change_event(client, request):
        """
        处理告警事件

        @param client
        @param request
        """
        try:
            if (request is None):
                print("ChangeEventRequest is empty")
                return
            response = client.change_event(request)
            print(response)
        except ConnectionException as e:
            print("ConnectionException", e)
        except RequestTimeoutException as e:
            print("RequestTimeoutException ", e)
        except ServiceResponseException as e:
            print("httpStatusCode: {}, errorCode: {}, errorMsg: {}", e.status_code, e.error_code, e.error_msg)

参考

更多信息请参考API Explorer

修订记录

发布日期	文档版本	修订说明
2023-10-26	1.0	文档首次发布