ThreatIntelligence组件主要提供查询阿里云威胁情报功能。
功能描述
动作 | 描述 | 使用场景 |
describeInformation | 查询阿里云威胁情报。 | 查询IP、文件等是否为恶意。 |
组件配置示例
本文提供了ThreatIntelligence组件各动作的参数配置示例，您可将其作为测试剧本导入。通过可视化流程编辑器，能更直观地了解和测试各动作的配置参数，轻松掌握组件的功能逻辑与使用方式。操作步骤可参考剧本导入。
请先将示例数据保存为JSON文件。
示例数据
{
"cells": [
{
"position": {
"x": -440,
"y": -170
},
"size": {
"width": 36,
"height": 36
},
"attrs": {
"body": {
"fill": "white",
"strokeOpacity": 0.95,
"stroke": "#63ba4d",
"strokeWidth": 2
},
"label": {
"text": "start",
"fontSize": 12,
"refX": 0.5,
"refY": "100%",
"refY2": 4,
"textAnchor": "middle",
"textVerticalAnchor": "top"
},
"path": {
"stroke": "#63ba4d"
}
},
"visible": true,
"shape": "circle",
"id": "58d87b7d-28d9-4f0e-b135-4adc4f1a70e4",
"zIndex": 1,
"data": {
"nodeType": "startEvent",
"appType": "basic",
"nodeName": "start",
"icon": "icon-circle",
"description": "剧本开始节点，一个剧本必须有且仅有一个开始节点，需为剧本配置输入数据。"
},
"markup": [
{
"tagName": "circle",
"selector": "body"
},
{
"tagName": "text",
"selector": "label"
}
],
"isNode": true
},
{
"shape": "custom-edge",
"attrs": {
"line": {
"stroke": "#63ba4d",
"targetMarker": {
"stroke": "#63ba4d"
}
}
},
"zIndex": 1,
"id": "5293c3f9-e1c9-4a49-b0eb-635067dc67e8",
"data": {
"nodeType": "sequenceFlow",
"appType": "basic",
"isRequired": true,
"icon": "icon-upper-right-arrow"
},
"isNode": false,
"source": {
"cell": "58d87b7d-28d9-4f0e-b135-4adc4f1a70e4"
},
"target": {
"cell": "a0ba5cc1-7308-47c6-8c20-ea97ff4ba982"
},
"visible": true,
"router": {
"name": "manhattan",
"args": {
"padding": 5,
"excludeHiddenNodes": true,
"excludeNodes": [
"clone_node_id"
]
}
},
"vertices": [ ]
},
{
"position": {
"x": -70,
"y": -170
},
"size": {
"width": 36,
"height": 36
},
"attrs": {
"body": {
"fill": "white",
"strokeOpacity": 0.95,
"stroke": "#63ba4d",
"strokeWidth": 2
},
"path": {
"r": 12,
"refX": "50%",
"refY": "50%",
"fill": "#63ba4d",
"strokeOpacity": 0.95,
"stroke": "#63ba4d",
"strokeWidth": 4
},
"label": {
"text": "end",
"fontSize": 12,
"refX": 0.5,
"refY": "100%",
"refY2": 4,
"textAnchor": "middle",
"textVerticalAnchor": "top"
}
},
"visible": true,
"shape": "circle",
"id": "317dd1be-2d20-460e-977e-1fc936ffb583",
"zIndex": 1,
"data": {
"nodeType": "endEvent",
"appType": "basic",
"nodeName": "end",
"icon": "icon-radio-off-full",
"description": "end"
},
"markup": [
{
"tagName": "circle",
"selector": "body"
},
{
"tagName": "circle",
"selector": "path"
},
{
"tagName": "text",
"selector": "label"
}
],
"isNode": true
},
{
"position": {
"x": -325,
"y": -185
},
"size": {
"width": 137,
"height": 66
},
"view": "react-shape-view",
"attrs": {
"label": {
"text": "ThreatIntelligence_1"
}
},
"shape": "activity",
"id": "a0ba5cc1-7308-47c6-8c20-ea97ff4ba982",
"data": {
"componentName": "ThreatIntelligence",
"appType": "component",
"nodeType": "action",
"icon": "https://sophon-gen-v2.oss-cn-zhangjiakou.aliyuncs.com/componentUpload/1709621963021_ThreatIntelligence_logo.png?Expires=1745653947&OSSAccessKeyId=STS.NVSf************&Signature=5sM3Yf1mMUYucQMk0Qdl7ms7Q6k%3D&security-token=CAIS2AJ1q6Ft5B2yfSjIr5XmLdnOq51W35DYehD9rEU2b%2FlOioeZoTz2IHhMenFpAegcv%2Fw%2BlGFZ6%2F8elrp6SJtIXleCZtF94oxN9h2gb4fb42oQKDOK0s%2FLI3OaLjKm9u2wCryLYbGwU%2FOpbE%2B%2B5U0X6LDmdDKkckW4OJmS8%2FBOZcgWWQ%2FKBlgvRq0hRG1YpdQdKGHaONu0LxfumRCwNkdzvRdmgm4NgsbWgO%2Fks0OP3AOrlrBN%2Bdiuf8T9NvMBZskvD42Hu8VtbbfE3SJq7BxHybx7lqQs%2B02c5onDWwAJu0%2FXa7uEo4wydVNjFbM9A65Dqufxn%2Fpgt%2Braj4X7xhhEIOVJSSPbSZBbSxJNvU1RXDxQVcEYWxylurjnXvF%2B45y49dcUGin%2B2svzhw6RGJ1dq8DgINtD0jokjPndRVbLXs84nxS7gbsGn76oY2zradH%2FdU79rm%2FlMytAXxqAAac9os3AP8Nzzgoznum6vHAy6hg20xps4DvoSeI%2FpHxuGwDOpnBW28WBgatsejfq3xcbniKRLqja8PA609xdkIt9%2F2fUaH7cAgAZxkFj8ZazMYuZ4jCdN2VM5qLHdj5CMBNTU2VIm8rQaKk9e1umHFILg%2Fsn1sBNnqzGfhZyq%2BlJIAA%3D",
"ownType": "sys",
"zIndex": 1,
"tenantId": "baba",
"customInput": false,
"description": "威胁情报查询。",
"id": 0,
"name": "describeInformation",
"operateType": "general",
"parameters": [
{
"dataType": "String",
"defaultValue": "",
"description": "情报的类型，支持ip、file、domain。",
"enDescription": "",
"formConfig": "{\"component\":\"Select\",\"options\":{\"selectMode\":\"mixSelect\",\"remote\":false,\"optionList\":[{\"label\":\"域名\",\"value\":\"domain\"},{\"label\":\"IP\",\"value\":\"ip\"},{\"label\":\"文件HASH\",\"value\":\"file\"}],\"mode\":\"single\",\"labelKey\":\"label\",\"valueKey\":\"value\"}}",
"name": "entityType",
"needCascader": false,
"required": true,
"tags": ""
},
{
"dataType": "String",
"defaultValue": "",
"description": "entityType为ip，输入要查询的 ip，示例值：192.0.XX.XX；entityType为file，输入的文件 hash（MD5 值），示例值：b4208cc50cb***0f82a47d***fde4312a；entityType为domain，输入需要查询的域名，支持通配符域名。示例值：example.com。",
"enDescription": "",
"name": "entityValue",
"needCascader": false,
"required": true,
"tags": ""
}
],
"riskLevel": 2,
"nodeName": "ThreatIntelligence_1",
"actionName": "describeInformation",
"actionDisplayName": "describeInformation",
"cascaderValue": [ ],
"valueData": {
"entityType": "ip",
"entityValue": "127.0.0.1"
},
"status": "success"
},
"zIndex": 1
},
{
"shape": "custom-edge",
"attrs": {
"line": {
"stroke": "#63ba4d",
"targetMarker": {
"stroke": "#63ba4d"
}
}
},
"zIndex": 1,
"id": "cdf4a475-3dd1-4883-a56b-d90444e11c64",
"data": {
"nodeType": "sequenceFlow",
"appType": "basic",
"isRequired": true,
"icon": "icon-upper-right-arrow"
},
"isNode": false,
"visible": true,
"router": {
"name": "manhattan",
"args": {
"padding": 5,
"excludeHiddenNodes": true,
"excludeNodes": [
"clone_node_id"
]
}
},
"source": {
"cell": "a0ba5cc1-7308-47c6-8c20-ea97ff4ba982"
},
"target": {
"cell": "317dd1be-2d20-460e-977e-1fc936ffb583"
},
"vertices": [ ]
}
]
}describeInformation
参数说明
参数 | 描述 |
entityType | 情报的类型，支持ip、file、domain。 |
entityValue |
|
输出示例
IP类型
输出参数说明：
参数 | 描述 |
Intelligences | 威胁情报事件信息，类型为JSON字符串。该参数JSON字段含义如下：类型为JSON字符串。该参数JSON字段含义如下：
|
Whois | IP 的 Whois 信息。 |
RequestId | 阿里云为此次调用请求生成的唯一标识符。 |
AttackPreferenceTop5 | 该 IP 攻击目标的 Top 5 行业分布。
|
Confidence | 对判定结果的置信程度。置信度值越高，说明对判定结果（判定结果是 ThreatLevel 字段）越有信心。通常认为置信度大于 90 的结果可以作为精准结果，对于恶意的高威胁等级的指标可以进行拦截。对于正常（ThreatLevel 等于 0）的结果可以放行。 取值范围 0-100：
|
ThreatTypes | 从威胁情报、安全事件分析出来的风险标签，例如远程控制、恶意软件等。该参数类型为JSON字符串，JSON字段含义如下：
|
Scenario | 该 IP 所适用的攻击场景。
|
Ip | IP 的基础信息，该参数类型为JSON字符串。JSON字段含义如下：该参数类型为JSON字符串。JSON字段含义如下：
|
ThreatLevel | 威胁等级，命中以后造成的危害等级，等级有高危、中危、低危、正常和未知五个等级。使用的时候可以结合置信度（Confidence 字段）来使用，对高危并且高置信度的数据进行拦截。对于正常（即白名单）的类型可以进行放行。
|
AttackCntByThreatType | 不同攻击阶段的攻击次数。该参数使用 JSON 数组表示，数组中的字段含义说明如下：该参数使用 JSON 数组表示，数组中的字段含义说明如下：
|
输出示例：
{
"Context": "",
"Group": "",
"Whois": "",
"AttackCntByThreatType": [
{
"event_cnt": 1,
"threat_type": "应用层入侵"
}
],
"ThreatLevel": -1,
"Confidence": "",
"Ip": {
"country": "",
"province": "",
"city": "",
"ip": "127.0.0.1",
"isp": "",
"asn": "",
"asn_label": ""
},
"ThreatTypes": "",
"Intelligences": [],
"AttackPreferenceTop5": [
{
"event_cnt": 2407,
"industry_name": "物联网",
"gmt_last_attack": "2021-12-15 23:59:15"
},
{
"event_cnt": 4813,
"industry_name": "制造",
"gmt_last_attack": "2021-12-15 23:59:49"
},
{
"event_cnt": 2240,
"industry_name": "金融",
"gmt_last_attack": "2021-12-15 23:59:41"
},
{
"event_cnt": 16954,
"industry_name": "零售",
"gmt_last_attack": "2021-12-15 23:59:31"
},
{
"event_cnt": 28764,
"industry_name": "互联网",
"gmt_last_attack": "2021-12-15 23:59:48"
}
],
"Scenario": ""
}file类型
输出参数说明：
参数 | 描述 |
Intelligences | 威胁情报事件，使用 JSON 数组表示。数组的元素取值包括 DDoS木马、挖矿程序、网络层入侵、网络服务扫描、网络共享发现、矿池 、漏洞利用 、暗网、恶意登录、恶意下载源、中控、Web Shell 、Web 攻击等。数组的元素取值包括 DDoS木马、挖矿程序、网络层入侵、网络服务扫描、网络共享发现、矿池 、漏洞利用 、暗网、恶意登录、恶意下载源、中控、Web Shell 、Web 攻击等。 |
RequestI | 阿里云为此次调用请求生成的唯一标识符。 |
FileHash | 文件 Hash 值。 |
ThreatTypes | 从威胁情报、安全事件分析出来的风险标签和服务器标签。使用数组表示，每一个数组中的取值如下：
|
Basic | 基础信息。该参数类型为JSON字符串，JSON字段含义如下：
|
ThreatLevel | 威胁等级。
|
输出示例：
{
"Intelligences": [
"DDoS木马"
],
"RequestId": "3F2BBCA2-4EE5-456F-****-DE0B69CAFD71",
"FileHash": "02e6b7cf0d34c6eac05*****751208b",
"ThreatTypes": [
{
"threat_type_desc": "DDoS木马",
"risk_type": 1,
"threat_type": "DDoS"
}
],
"Basic": {
"sha1": "",
"virus_result": "1",
"sandbox_result": "-1",
"sha256": "",
"sha512": "",
"virus_name": "自变异木马",
"source": "aegis"
},
"ThreatLevel": "2",
"Sandbox": ""
}domain类
输出参数说明：
参数 | 描述 |
Intelligences | 详细的威胁情报事件，使用 JSON 数组表示，JSON字段含义如下：
|
Domain | 域名。 |
SslCert | 域名绑定的 SSL 证书信息，使用 JSON 串表示。 |
AttackPreferenceTop5 | 被攻击的网站所属的 Top 5 行业。使用 JSON 数组表示，JSON字段含义如下：
|
ThreatTypes | 该域名相关的详细威胁情报数据，使用 JSON 数组表示，每一个数组的字段含义如下：
|
Confidence | 对判定结果的置信程度，置信度值越高，说明对判定结果（判定结果是 ThreatLevel 字段）有多少信心。通常认为置信度大于 90 的结果可以作为精准结果，对于恶意的高威胁等级的指标可以进行拦截。对于正常（ThreatLevel 等于 0）的结果可以放行。 取值范围 60-100：
|
ThreatLevel | 威胁等级，命中以后造成的危害等级，恶意的等级有高危、中危、低危、正常和未知五个等级。使用的时候可以结合置信度（Confidence 字段）来使用，对高危并且高置信度的数据进行拦截。对于正常（即白名单）的类型可以进行放行。
|
AttackCntByThreatType | 不同攻击阶段的攻击次数。该参数使用 JSON 数组表示，数组中的字段含义说明如下：
|
Whois | 域名的 Whois 信息。 |
RequestId | 阿里云为此次调用请求生成的唯一标识符。 |
Scenario | 该域名所适用的攻击场景。可以取以下的一个或者多个值：
|
Basic | 域名的基础信息。使用 JSON 格式表示，字段含义如下：
|
输出示例：
{
"Intelligences": [
{
"last_find_time": "2020-06-17 03:54:23",
"threat_type_l2": "恶意下载源",
"first_find_time": "2020-01-01 00:59:52",
"source": "aliyun"
},
{
"last_find_time": "2020-11-10 14:45:12",
"threat_type_l2": "rexxx.exe执行恶意文件",
"first_find_time": "2017-09-22 11:15:00",
"source": "aliyun"
}
],
"Domain": "example.com",
"SslCert": {
"serial_number": "183954751680****4",
"validity_end": "2029-12-02 06:00:31",
"issuer": "example.ca"
},
"AttackPreferenceTop5": "[{\"event_cnt\":586,\"industry_name\":\"Gaming\",\"gmt_last_attack\":\"2020-06-14 21:54:04\"}]",
"ThreatTypes": [
{
"threat_type_desc": "恶意下载源",
"last_find_time": "2020-06-17 03:54:23",
"risk_type": 3,
"scenario": "失陷指标",
"threat_type": "Malicious Source",
"first_find_time": "2020-01-01 00:59:52",
"attck_stage": "delivery"
},
{
"threat_type_desc": "Regsvr32执行",
"last_find_time": "2020-11-10 14:45:12",
"risk_type": 3,
"scenario": "失陷指标",
"threat_type": "Regsvr32",
"first_find_time": "2017-09-22 11:15:00",
"attck_stage": "defense evasion"
}
],
"Confidence": "95",
"ThreatLevel": "2",
"AttackCntByThreatType": {
"event_cnt": 27,
"threat_type": "网络层入侵"
},
"Context": "",
"Whois": {
"registrant_phone": "",
"registrar": "xx科技有限公司",
"registrar_url": "",
"whois_server": "whois.cnnic.cn",
"admin_phone": "",
"registrar_phone": "",
"registrant_email": "",
"admin_email": "",
"admin_organization": "",
"tech_name": "",
"registrant_city": "",
"tech_street": "",
"tech_phone": "",
"dnssec": "unsigned",
"admin_province": "",
"tech_organization": "",
"registrant_country": "",
"admin_city": "",
"registrant_province": "",
"admin_street": "",
"tech_email": "",
"nameservers": "ns4.myhostadmin.net,ns1.myhostadmin.net,ns2.myhostadmin.net,ns3.myhostadmin.net,ns5.myhostadmin.net,ns6.myhostadmin.net",
"registrar_email": "",
"domain_status": "ok",
"domain": "example.com",
"tech_city": "",
"registrant_name": "",
"registrant_organization": "",
"tech_country": "",
"registrant_street": "",
"admin_name": "",
"tech_province": "",
"admin_country": ""
},
"RequestId": "718747A4-9A75-4130-88F9-C9B47350B7F5",
"Scenario": "失陷指标",
"Basic": {
"ip_cnt": "36",
"domain": "example.com",
"child_domain_cnt": "18",
"sld_domain": "example.com",
"malicious_ip_cnt": "28",
"malicious_child_domain_cnt": "4"
},
"Group": ""
}