---
title: "Webshell Behavior Detector overview"
slug: "security-webshellbehaviordetector"
tags: ["Webshell Behavior Detector"]
updated: 2026-09-17T10:13:34Z
published: 2026-09-17T10:13:34Z
canonical: "api.ncloud-docs.com/security-webshellbehaviordetector"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://api.ncloud-docs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Webshell Behavior Detector overview

Available in VPC

Webshell Behavior Detector is a NAVER Cloud Platform service that allows for a quick response to suspicious webshell behaviors by carrying out real-time detections and providing notifications. The Webshell Behavior Detector service provides APIs for Webshell, Excepted Webshell, Quarantine, Exception Rule, Deleted Exception Rule, Notification, and Detection Setting features in RESTful form.

## Common Webshell Behavior Detector settings

The following describes commonly used request and response formats in Webshell Behavior Detector APIs.

### Request

The following describes the common request format.

#### API URL

The request API URL is as follows.

```
https://wbd.apigw.ntruss.com
```

#### Request headers

The following describes the headers.

| Field | Required | Description |
| --- | --- | --- |
| `x-ncp-apigw-timestamp` | Required | This is the number of milliseconds that have elapsed since January 1, 1970 00:00:00 UTC. - Request is considered invalid if the timestamp differs from the current time by more than 5 minutes. - Unix timestamp format. |
| `x-ncp-iam-access-key` | Required | Access key issued on NAVER Cloud Platform - Issue and check access key: See [Create authentication key](/docs/en/common-ncpapi). - Issue and check access key for sub account: See [Create sub account](https://guide.ncloud-docs.com/docs/en/subaccount-use#%EC%84%9C%EB%B8%8C-%EA%B3%84%EC%A0%95-%EC%83%9D%EC%84%B1). |
| `x-ncp-apigw-signature-v2` | Required | Base64-encoded signature that encrypts the request information with a secret key that maps to the access key issued on NAVER Cloud Platform, using the HMAC encryption algorithm (HmacSHA256) - Issue and check secret key: See [Create authentication key](/docs/en/common-ncpapi). - Create signature: See [Create signature](/docs/en/common-ncpapi). |
| `Content-Type` | Required | Request data format - `application/json` |
| `X-NCP-USE_PLATFORM_TYPE` | Required | Platform environment in use - `VPC` |

### Response

The following describes the common response format.

#### Response status codes

The following describes the response status codes.

| HTTP status code | Code | Messages | Description |
| --- | --- | --- | --- |
| 200 | 400 | Platform must be not null. | Platform header missing |
| 200 | 8008 | Invalid file status.The status of file is quarantineFailed | Invalid file due to quarantine failure |
| 200 | 8004 | Invaliddata.The detection data deleted is false, excepted is false. | Invalid data due to deletion or exception failure |

Note

For response status codes common to NAVER Cloud Platform, see [Ncloud API response status codes](/docs/en/common-ncpapi#3%EC%9D%91%EB%8B%B5%EC%83%81%ED%83%9C%EC%BD%94%EB%93%9C).

## Webshell Behavior Detector API

The following describes the APIs provided by the Webshell Behavior Detector service.

### Webshell

The following describes the APIs related to the detection history of webshell behavior.

| API | Description |
| --- | --- |
| [GetWebshell](/docs/en/security-webshellbehaviordetector-webshell-getwebshell) | Get webshell behavior detection history |
| [UpdateWebshellMemo](/docs/en/security-webshellbehaviordetector-webshell-updatewebshellmemo) | Change the notes for the webshell behavior detection history |
| [DeleteWebshell](/docs/en/security-webshellbehaviordetector-webshell-deletewebshell) | Delete webshell behavior detection history |
| [SearchWebshell](/docs/en/security-webshellbehaviordetector-webshell-searchwebshell) | Search webshell behavior detection history |
| [GetWebshellSuspiciousObject](/docs/en/security-webshellbehaviordetector-webshell-getwebshellsuspiciousobject) | Get webshell suspect file |
| [QuarantineWebshellSuspiciousObject](/docs/en/security-webshellbehaviordetector-webshell-quarantinewebshellsuspiciousobject) | Quarantine webshell suspect file |
| [RecoverWebshellSuspiciousObject](/docs/en/security-webshellbehaviordetector-webshell-recoverwebshellsuspiciousobject) | Recover quarantined webshell suspect file |
| [UpdateWebshellSuspiciousObjectMemo](/docs/en/security-webshellbehaviordetector-webshell-updatewebshellsuspiciousobjectmemo) | Change the notes in the webshell suspect file |

### ExceptedWebshell

The following describes the APIs related to exception handling for detected webshell behavior.

| API | Description |
| --- | --- |
| [GetExceptedWebshell](/docs/en/security-webshellbehaviordetector-exceptedwebshell-getexceptedwebshell) | Get exception-handled webshell behavior detection history |
| [RevokeExceptedWebshell](/docs/en/security-webshellbehaviordetector-exceptedwebshell-revokeexceptedwebshell) | Clear exception for exception-handled webshell behavior detection history |
| [UpdateExceptedWebshellMemo](/docs/en/security-webshellbehaviordetector-exceptedwebshell-updateexceptedwebshellmemo) | Change the notes for the exception-handled webshell behavior detection history |
| [SearchExceptedWebshell](/docs/en/security-webshellbehaviordetector-exceptedwebshell-searchexceptedwebshell) | Search exception-handled webshell behavior detection history |
| [GetExceptedWebshellSuspiciousObject](/docs/en/security-webshellbehaviordetector-exceptedwebshell-getexceptedwebshellsuspiciousobject) | Get suspect files in exception-handled webshell behavior detection history |
| [QuarantineExceptedWebshellSuspiciousObject](/docs/en/security-webshellbehaviordetector-exceptedwebshell-quarantineexceptedwebshellsuspiciousobject) | Quarantine suspect files in exception-handled webshell behavior detection history |
| [RecoverExceptedWebshellSuspiciousObject](/docs/en/security-webshellbehaviordetector-exceptedwebshell-recoverexceptedwebshellsuspiciousobject) | Recover suspect files in exception-handled webshell behavior detection history |
| [UpdateExceptedWebshellSuspiciousObjectMemo](/docs/en/security-webshellbehaviordetector-exceptedwebshell-updateexceptedwebshellsuspiciousobjectmemo) | Change suspect file notes in exception-handled web shell behavior detection history |

### Quarantine

The following describes the quarantine-related APIs.

| API | Description |
| --- | --- |
| [GetQuarantine](/docs/en/security-webshellbehaviordetector-quarantine-getquarantine) | Get quarantined webshell suspect file |
| [RecoverQuarantine](/docs/en/security-webshellbehaviordetector-quarantine-recoverquarantine) | Recover quarantined webshell suspect file |
| [SearchQuarantine](/docs/en/security-webshellbehaviordetector-quarantine-searchquarantine) | Search quarantined webshell suspect files |
| [UpdateQuarantineMemo](/docs/en/security-webshellbehaviordetector-quarantine-updatequarantinememo) | Change the notes for quarantined webshell suspect files |

### ExceptionRule

The following describes the APIs related to exception rules.

| API | Description |
| --- | --- |
| [GetExceptionRule](/docs/en/security-webshellbehaviordetector-exceptionrule-getexceptionrule) | Get exception rule |
| [SearchExceptionRule](/docs/en/security-webshellbehaviordetector-exceptionrule-searchexceptionrule) | Search exception rules |
| [UpdateExceptionRuleMemo](/docs/en/security-webshellbehaviordetector-exceptionrule-updateexceptionrulememo) | Change the notes for exception rules |
| [DeleteExceptionRule](/docs/en/security-webshellbehaviordetector-exceptionrule-deleteexceptionrule) | Delete exception rule |

### DeletedExceptionRule

The following describes the APIs for deleted exception rules.

| API | Description |
| --- | --- |
| [GetDeletedExceptionRule](/docs/en/security-webshellbehaviordetector-deletedexceptionrule-getdeletedexceptionrule) | Get deleted exception rule |
| [SearchDeletedExceptionRule](/docs/en/security-webshellbehaviordetector-deletedexceptionrule-searchdeletedexceptionrule) | Search deleted exception rules |
| [UpdateDeletedExceptionRuleMemo](/docs/en/security-webshellbehaviordetector-deletedexceptionrule-updatedeletedexceptionrulememo) | Change the notes for deleted exception rules |
| [RecoverDeletedExceptionRule](/docs/en/security-webshellbehaviordetector-deletedexceptionrule-recoverdeletedexceptionrule) | Restore deleted exception rules |

### Notification

The following describes the APIs related to notification settings.

| API | Description |
| --- | --- |
| [GetNotificationInterval](/docs/en/security-webshellbehaviordetector-notification-getnotificationinterval) | Get set notification interval |
| [UpdateNotificationInterval](/docs/en/security-webshellbehaviordetector-notification-updatenotificationinterval) | Set notification interval |

### Detection Setting

The following describes the APIs related to detection settings.

| API | Description |
| --- | --- |
| [GetDetectionTarget](/docs/en/security-webshellbehaviordetector-detectionsetting-getdetectiontarget) | Get detection target |
| [SearchDetectionTarget](/docs/en/security-webshellbehaviordetector-detectionsetting-searchdetectiontarget) | Search detection targets |
| [ActivateAgent](/docs/en/security-webshellbehaviordetector-detectionsetting-activateagent) | Enable agent installed on the server |
| [DeactivateAgent](/docs/en/security-webshellbehaviordetector-detectionsetting-deactivateagent) | Disable agent installed on the server |
| [UpdateDetectionTargetMemo](/docs/en/security-webshellbehaviordetector-detectionsetting-updatedetectiontargetmemo) | Change the notes for the detection targets |

## Webshell Behavior Detector related resources

NAVER Cloud Platform provides a variety of related resources to help users better understand Webshell Behavior Detector APIs.

- Webshell Behavior Detector API guides
  - [Create signature](/docs/en/common-ncpapi#1-%EC%9D%B8%EC%A6%9D%ED%82%A4-%EC%83%9D%EC%84%B1): how to create a signature to add to the request header
  - [Common Ncloud response status codes](/docs/en/common-ncpapi#3-%EC%9D%91%EB%8B%B5-%EC%83%81%ED%83%9C-%EC%BD%94%EB%93%9C): information on common response status codes of NAVER Cloud Platform used by the Webshell Behavior Detector service
  - [API Gateway User Guide](https://guide.ncloud-docs.com/docs/en/apigw-apigw-1): how to issue the API key to be added to the request header
  - [Sub Account user guide](https://guide.ncloud-docs.com/docs/en/subaccount-overview): how to issue the access key to be added to the request header
- How to use the Webshell Behavior Detector service
  - [Webshell Behavior Detector User Guide](https://guide.ncloud-docs.com/docs/en/wbd-wbdoverview): how to use Webshell Behavior Detector in the NAVER Cloud Platform console
  - [Ncloud use environment guide](/docs/en/environment-environment-1-1): guide on VPC and Classic environments and supported features
  - [Introduction to pricing, characteristics, and detailed features](https://www.ncloud.com/product/security/webshellBehaviorDetector): summary of Webshell Behavior Detector pricing system, characteristics, and detailed features of Webshell Behavior Detector
  - [Latest service news](https://www.ncloud.com/intro/news): the latest news on Webshell Behavior Detector
  - [FAQ](https://www.ncloud.com/support/faq/all?searchKeyword=webshell%20behavior%20detector&page=1): Frequently asked questions from Webshell Behavior Detector users
  - [Contact us](https://www.ncloud.com/support/question): Send direct inquiries in case of any unresolved questions that aren't answered by the user guide.