Webshell Behavior Detector overview

Prev Next

Available in VPC

Webshell Behavior Detector is a NAVER Cloud Platform service that allows for a quick response to suspicious webshell behaviors by carrying out real-time detections and providing notifications. The Webshell Behavior Detector service provides APIs for Webshell, Excepted Webshell, Quarantine, Exception Rule, Deleted Exception Rule, Notification, and Detection Setting features in RESTful form.

Common Webshell Behavior Detector settings

The following describes commonly used request and response formats in Webshell Behavior Detector APIs.

Request

The following describes the common request format.

API URL

The request API URL is as follows.

https://wbd.apigw.ntruss.com/api/v1/

Request headers

The following describes the headers.

Field Required Description
x-ncp-apigw-timestamp Required This is the number of milliseconds that have elapsed since January 1, 1970 00:00:00 UTC
  • Request is considered invalid if the timestamp differs from the current time by more than 5 minutes
    		•
    x-ncp-iam-access-key Required Access key issued on NAVER Cloud Platform
  • Issue and check access key: See Create authentication key
  • Issue and check access key for sub account: See Create sub account
    		•
    x-ncp-apigw-signature-v2 Required Base64-encoded signature that encrypts the request information with a secret key that maps to the access key issued on NAVER Cloud Platform, using the HMAC encryption algorithm (HmacSHA256)
  • Issue and check secret key: See Create authentication key
  • Create signature: See Create signature
    		•
    Content-type Required Request data format
  • application/json
    		•
    X-NCP-USE_PLATFORM_TYPE Required Platform environment in use
    • VPC

    Response

    The following describes the common response format.

    Response status codes

    The following describes the response status codes.

    HTTP status code Code Messages Description
    200 400 Platform must be not null. Platform header missing
    200 8008 Invalid file status.The status of file is quarantineFailed Invalid file due to quarantine failure
    200 8004 Invaliddata.The detection data deleted is false, excepted is false. Invalid data due to deletion or exception failure
    Note

    For response status codes common to NAVER Cloud Platform, see Ncloud API response status codes.

    Webshell Behavior Detector API

    The following describes the APIs provided by the Webshell Behavior Detector service.

    Webshell

    The following describes the APIs related to the detection history of webshell behavior.

    API Description
    GetWebshell Get webshell behavior detection history
    UpdateWebshellMemo Change the notes for the webshell behavior detection history
    DeleteWebshell Delete webshell behavior detection history
    SearchWebshell Search webshell behavior detection history
    GetWebshellSuspiciousObject Get webshell suspect file
    QuarantineWebshellSuspiciousObject Quarantine webshell suspect file
    RecoverWebshellSuspiciousObject Recover quarantined webshell suspect file
    UpdateWebshellSuspiciousObjectMemo Change the notes in the webshell suspect file

    ExceptedWebshell

    The following describes the APIs related to exception handling for detected webshell behavior.

    API Description
    GetExceptedWebshell Get exception-handled webshell behavior detection history
    RevokeExceptedWebshell Clear exception for exception-handled webshell behavior detection history
    UpdateExceptedWebshellMemo Change the notes for the exception-handled webshell behavior detection history
    SearchExceptedWebshell Search exception-handled webshell behavior detection history
    GetExceptedWebshellSuspiciousObject Get suspect files in exception-handled webshell behavior detection history
    QuarantineExceptedWebshellSuspiciousObject Quarantine suspect files in exception-handled webshell behavior detection history
    RecoverExceptedWebshellSuspiciousObject Recover suspect files in exception-handled webshell behavior detection history
    UpdateExceptedWebshellSuspiciousObjectMemo Change suspect file notes in exception-handled web shell behavior detection history

    Quarantine

    The following describes the quarantine-related APIs.

    API Description
    GetQuarantine Get quarantined webshell suspect file
    RecoverQuarantine Recover quarantined webshell suspect file
    SearchQuarantine Search quarantined webshell suspect files
    UpdateQuarantineMemo Change the notes for quarantined webshell suspect files

    ExceptionRule

    The following describes the APIs related to exception rules.

    API Description
    GetExceptionRule Get exception rule
    SearchExceptionRule Search exception rules
    UpdateExceptionRuleMemo Change the notes for exception rules
    DeleteExceptionRule Delete exception rule

    DeletedExceptionRule

    The following describes the APIs for deleted exception rules.

    API Description
    GetDeletedExceptionRule Get deleted exception rule
    SearchDeletedExceptionRule Search deleted exception rules
    UpdateDeletedExceptionRuleMemo Change the notes for deleted exception rules
    RecoverDeletedExceptionRule Restore deleted exception rules

    Notification

    The following describes the APIs related to notification settings.

    API Description
    GetNotificationInterval Get set notification interval
    UpdateNotificationInterval Set notification interval

    Detection Setting

    The following describes the APIs related to detection settings.

    API Description
    GetDetectionTarget Get detection target
    SearchDetectionTarget Search detection targets
    ActivateAgent Enable agent installed on the server
    DeactivateAgent Disable agent installed on the server
    UpdateDetectionTargetMemo Change the notes for the detection targets

    Webshell Behavior Detector related resources

    NAVER Cloud Platform provides a variety of related resources to help users better understand Webshell Behavior Detector APIs.