安全云脑 SECMASTER-创建事件:Go

时间：2023-12-06 18:52:42
安全云脑 SECMASTER
Go

创建一条事件，事件标题为MyXXX，标签为MyXXX，严重级别为tips，发生次数为4次。
package main

import (
	"fmt"
	"github.com/huaweicloud/huaweicloud-sdk-go-v3/core/auth/basic"
    secmaster "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/secmaster/v2"
	"github.com/huaweicloud/huaweicloud-sdk-go-v3/services/secmaster/v2/model"
    region "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/secmaster/v2/region"
)

func main() {
    // The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
    // In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
    ak := os.Getenv("CLOUD_SDK_AK")
    sk := os.Getenv("CLOUD_SDK_SK")

    auth := basic.NewCredentialsBuilder().
        WithAk(ak).
        WithSk(sk).
        Build()

    client := secmaster.NewSecMasterClient(
        secmaster.SecMasterClientBuilder().
            WithRegion(region.ValueOf("cn-north-4")).
            WithCredential(auth).
            Build())

    request := &model.CreateIncidentRequest{}
	filePathFileInfo:= "MyXXX"
	fileContentFileInfo:= "MyXXX"
	fileNewPathFileInfo:= "MyXXX"
	fileHashFileInfo:= "MyXXX"
	fileMd5FileInfo:= "MyXXX"
	fileSha256FileInfo:= "MyXXX"
	fileAttrFileInfo:= "MyXXX"
	var listFileInfoDataObject = []model.IncidentFileInfo{
        {
            FilePath: &filePathFileInfo,
            FileContent: &fileContentFileInfo,
            FileNewPath: &fileNewPathFileInfo,
            FileHash: &fileHashFileInfo,
            FileMd5: &fileMd5FileInfo,
            FileSha256: &fileSha256FileInfo,
            FileAttr: &fileAttrFileInfo,
        },
    }
	userIdUserInfo:= "909494e3-558e-46b6-a9eb-07a8e18ca62f"
	userNameUserInfo:= "MyXXX"
	var listUserInfoDataObject = []model.IncidentUserInfo{
        {
            UserId: &userIdUserInfo,
            UserName: &userNameUserInfo,
        },
    }
	processNameProcess:= "MyXXX"
	processPathProcess:= "MyXXX"
	processPidProcess:= int32(123)
	processUidProcess:= int32(123)
	processCmdlineProcess:= "MyXXX"
	var listProcessDataObject = []model.IncidentProcess{
        {
            ProcessName: &processNameProcess,
            ProcessPath: &processPathProcess,
            ProcessPid: &processPidProcess,
            ProcessUid: &processUidProcess,
            ProcessCmdline: &processCmdlineProcess,
        },
    }
	malwareFamilyMalware:= "family"
	malwareClassMalware:= "恶意占用内存"
	malwareDataObject := &model.IncidentMalware{
		MalwareFamily: &malwareFamilyMalware,
		MalwareClass: &malwareClassMalware,
	}
	recommendationRemediation:= "MyXXX"
	urlRemediation:= "MyXXX"
	remediationDataObject := &model.IncidentRemediation{
		Recommendation: &recommendationRemediation,
		Url: &urlRemediation,
	}
	idResourceList:= "909494e3-558e-46b6-a9eb-07a8e18ca62f"
	nameResourceList:= "MyXXX"
	typeResourceList:= "MyXXX"
	regionIdResourceList:= "909494e3-558e-46b6-a9eb-07a8e18ca62f"
	domainIdResourceList:= "909494e3-558e-46b6-a9eb-07a8e18ca62f"
	projectIdResourceList:= "909494e3-558e-46b6-a9eb-07a8e18ca62f"
	epIdResourceList:= "909494e3-558e-46b6-a9eb-07a8e18ca62f"
	epNameResourceList:= "MyXXX"
	tagsResourceList:= "909494e3-558e-46b6-a9eb-07a8e18ca62f"
	var listResourceListDataObject = []model.IncidentResourceList{
        {
            Id: &idResourceList,
            Name: &nameResourceList,
            Type: &typeResourceList,
            RegionId: &regionIdResourceList,
            DomainId: &domainIdResourceList,
            ProjectId: &projectIdResourceList,
            EpId: &epIdResourceList,
            EpName: &epNameResourceList,
            Tags: &tagsResourceList,
        },
    }
	latitudeDestGeo:= float32(90)
	longitudeDestGeo:= float32(180)
	destGeoNetworkList := &model.IncidentDestGeo{
		Latitude: &latitudeDestGeo,
		Longitude: &longitudeDestGeo,
	}
	latitudeSrcGeo:= float32(90)
	longitudeSrcGeo:= float32(180)
	srcGeoNetworkList := &model.IncidentSrcGeo{
		Latitude: &latitudeSrcGeo,
		Longitude: &longitudeSrcGeo,
	}
	directionNetworkList:= model.GetIncidentNetworkListDirectionEnum().{}
	protocolNetworkList:= "TCP"
	srcIpNetworkList:= "192.168.0.1"
	srcPortNetworkList:= int32(1)
	srcDomainNetworkList:= "xxx"
	destIpNetworkList:= "192.168.0.1"
	destPortNetworkList:= "1"
	destDomainNetworkList:= "xxx"
	var listNetworkListDataObject = []model.IncidentNetworkList{
        {
            Direction: &directionNetworkList,
            Protocol: &protocolNetworkList,
            SrcIp: &srcIpNetworkList,
            SrcPort: &srcPortNetworkList,
            SrcDomain: &srcDomainNetworkList,
            SrcGeo: srcGeoNetworkList,
            DestIp: &destIpNetworkList,
            DestPort: &destPortNetworkList,
            DestDomain: &destDomainNetworkList,
            DestGeo: destGeoNetworkList,
        },
    }
	categoryIncidentType:= "909494e3-558e-46b6-a9eb-07a8e18ca62f"
	incidentTypeIncidentType:= "909494e3-558e-46b6-a9eb-07a8e18ca62f"
	incidentTypeDataObject := &model.IncidentIncidentType{
		Category: &categoryIncidentType,
		IncidentType: &incidentTypeIncidentType,
	}
	sourceTypeDataSource:= int32(3)
	domainIdDataSource:= "909494e3-558e-46b6-a9eb-07a8e18ca62f"
	projectIdDataSource:= "909494e3-558e-46b6-a9eb-07a8e18ca62f"
	regionIdDataSource:= "909494e3-558e-46b6-a9eb-07a8e18ca62f"
	productNameDataSource:= "test"
	productFeatureDataSource:= "test"
	dataSourceDataObject := &model.IncidentDataSource{
		SourceType: &sourceTypeDataSource,
		DomainId: &domainIdDataSource,
		ProjectId: &projectIdDataSource,
		RegionId: &regionIdDataSource,
		ProductName: &productNameDataSource,
		ProductFeature: &productFeatureDataSource,
	}
	vendorTypeEnvironment:= "MyXXX"
	domainIdEnvironment:= "909494e3-558e-46b6-a9eb-07a8e18ca62f"
	regionIdEnvironment:= "909494e3-558e-46b6-a9eb-07a8e18ca62f"
	projectIdEnvironment:= "909494e3-558e-46b6-a9eb-07a8e18ca62f"
	environmentDataObject := &model.IncidentEnvironment{
		VendorType: &vendorTypeEnvironment,
		DomainId: &domainIdEnvironment,
		RegionId: &regionIdEnvironment,
		ProjectId: &projectIdEnvironment,
	}
	versionDataObject:= "1.0"
	idDataObject:= "909494e3-558e-46b6-a9eb-07a8e18ca62f"
	workspaceIdDataObject:= "909494e3-558e-46b6-a9eb-07a8e18ca620"
	labelsDataObject:= "MyXXX"
	firstObservedTimeDataObject:= "2021-01-30T23:00:00Z+0800"
	lastObservedTimeDataObject:= "2021-01-30T23:00:00Z+0800"
	createTimeDataObject:= "2021-01-30T23:00:00Z+0800"
	arriveTimeDataObject:= "2021-01-30T23:00:00Z+0800"
	titleDataObject:= "MyXXX"
	descriptionDataObject:= "This my XXXX"
	sourceUrlDataObject:= "http://xxx"
	countDataObject:= int32(4)
	confidenceDataObject:= int32(4)
	severityDataObject:= model.GetIncidentSeverityEnum().TIPS
	criticalityDataObject:= int32(4)
	verificationStateDataObject:= model.GetIncidentVerificationStateEnum().UNKNOWN_–_未知,TRUE_POSITIVE_–_确认,FALSE_POSITIVE_–_误报。默认填写UNKNOWN
	handleStatusDataObject:= model.GetIncidentHandleStatusEnum().OPEN_–_打开,BLOCK_–_阻塞,CLOSED_–_关闭。默认填写OPEN
	slaDataObject:= int32(60000)
	updateTimeDataObject:= "2021-01-30T23:00:00Z+0800"
	closeTimeDataObject:= "2021-01-30T23:00:00Z+0800"
	ipdrrPhaseDataObject:= model.GetIncidentIpdrrPhaseEnum().PREPARTION|DETECTION_AND_ANALYSIS|CONTAINM,ERADICATION&_RECOVERY|_POST_INCIDENT_ACTIVITY
	simulationDataObject:= "false"
	actorDataObject:= "刘一博"
	ownerDataObject:= "MyXXX"
	creatorDataObject:= "MyXXX"
	closeReasonDataObject:= model.GetIncidentCloseReasonEnum().误检;已解决;重复;其他
	closeCommentDataObject:= "误检;已解决;重复;其他"
	var systemInfoDataObject interface{} = make(map[string]string)
	dataObjectbody := &model.Incident{
		Version: &versionDataObject,
		Id: &idDataObject,
		WorkspaceId: &workspaceIdDataObject,
		Labels: &labelsDataObject,
		Environment: environmentDataObject,
		DataSource: dataSourceDataObject,
		FirstObservedTime: &firstObservedTimeDataObject,
		LastObservedTime: &lastObservedTimeDataObject,
		CreateTime: &createTimeDataObject,
		ArriveTime: &arriveTimeDataObject,
		Title: &titleDataObject,
		Description: &descriptionDataObject,
		SourceUrl: &sourceUrlDataObject,
		Count: &countDataObject,
		Confidence: &confidenceDataObject,
		Severity: &severityDataObject,
		Criticality: &criticalityDataObject,
		IncidentType: incidentTypeDataObject,
		NetworkList: &listNetworkListDataObject,
		ResourceList: &listResourceListDataObject,
		Remediation: remediationDataObject,
		VerificationState: &verificationStateDataObject,
		HandleStatus: &handleStatusDataObject,
		Sla: &slaDataObject,
		UpdateTime: &updateTimeDataObject,
		CloseTime: &closeTimeDataObject,
		IpdrrPhase: &ipdrrPhaseDataObject,
		Simulation: &simulationDataObject,
		Actor: &actorDataObject,
		Owner: &ownerDataObject,
		Creator: &creatorDataObject,
		CloseReason: &closeReasonDataObject,
		CloseComment: &closeCommentDataObject,
		Malware: malwareDataObject,
		SystemInfo: &systemInfoDataObject,
		Process: &listProcessDataObject,
		UserInfo: &listUserInfoDataObject,
		FileInfo: &listFileInfoDataObject,
	}
	request.Body = &model.CreateIncidentRequestBody{
		DataObject: dataObjectbody,
	}
	response, err := client.CreateIncident(request)
	if err == nil {
        fmt.Printf("%+v\n", response)
    } else {
        fmt.Println(err)
    }
}