cwp — Cloud Workload Protection
cwp · 2018-02-28
DescribeSecurityTrends
POST
Obtain the security event statistics data.
Wire call
Converge Cloud is RPC over HTTP. There is one path — / — and the action travels in the X-TC-Action header. The /cwp/DescribeSecurityTrends path used in the OpenAPI document is a documentation convenience so each action is addressable; it is not a route on the server.
curl
curl -sS https://cwp.api3.convergecloud.com/ \
-H 'Authorization: TC3-HMAC-SHA256 Credential=<SecretId>/<YYYY-MM-DD>/cwp/tc3_request, SignedHeaders=content-type;host;x-tc-action, Signature=<sig>' \
-H 'Content-Type: application/json; charset=utf-8' \
-H 'Host: cwp.api3.convergecloud.com' \
-H 'X-TC-Action: DescribeSecurityTrends' \
-H 'X-TC-Version: 2018-02-28' \
-H 'X-TC-Timestamp: <unix-seconds>' \
-H 'X-TC-Region: luzon' \
-d '{"BeginDate":"<BeginDate>","EndDate":"<EndDate>"}'Request parameters
| Field | Type | Required | Description |
|---|---|---|---|
| BeginDate | string | Yes | Start time. Example: 2021-07-10 |
| EndDate | string | Yes | End time. Example: 2021-07-10 |
Response
Fields are returned inside the Response envelope. Converge Cloud answers HTTP 200 for errors as well as successes, so read Response.Error rather than the status code — and test for the presence of that object, because Code is occasionally the empty string.
| Field | Type | Description |
|---|---|---|
| Malwares | SecurityTrend[] | Array of counted Trojan events |
| NonLocalLoginPlaces | SecurityTrend[] | Array of counted cross-region log-in events |
| BruteAttacks | SecurityTrend[] | Array of counted password cracking events |
| Vuls | SecurityTrend[] | Array of counted vulnerabilities |
| BaseLines | SecurityTrend[] | Array of counted baselines |
| MaliciousRequests | SecurityTrend[] | Array of counted malicious requests |
| HighRiskBashs | SecurityTrend[] | Array of counted high-risk command |
| ReverseShells | SecurityTrend[] | Array of counted reverse shell |
| PrivilegeEscalations | SecurityTrend[] | Array of counted local privilege escalation |
| CyberAttacks | SecurityTrend[] | Array of counted network attacks |
| RequestId | string | The unique request ID, generated by the server, will be returned for every request (if the request fails to reach the server for other reasons, the request will not obtain a RequestId). RequestId is required for locating a problem. |
Success
{
"Response": {
"Malwares": …,
"NonLocalLoginPlaces": …,
"RequestId": "…"
}
}Error
{
"Response": {
"Error": { "Code": "…", "Message": "…" },
"RequestId": "…"
}
}Try it
CredentialThe key never leaves this tab — it signs the request here. The signed request goes to /api-relay/cwp.
Request bodyvalid JSONPOST cwp.api3.convergecloud.com · DescribeSecurityTrends
Read-only. Creates nothing.