Add WD K01 V9.0.2 query and threat-intel service

services/bin/octobus-tentacles.js

@@ -601,6 +601,10 @@ const services = {
     entryFile: "../openinfra__openstack-yoga_2022-1/bin/openstack-yoga-2022-1.js",
     serviceModule: "../openinfra__openstack-yoga_2022-1/src/service.js",
   },
+  "wd-k01-v9-0-2": {
+    entryFile: "../wd__k01_v9-0-2/bin/wd-k01-v9-0-2.js",
+    serviceModule: "../wd__k01_v9-0-2/src/service.js",
+  },
 };
 
 const serviceNames = Object.keys(services);

services/bin/wd-k01-v9-0-2.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+
+import { fileURLToPath } from "node:url";
+import { runServiceMain } from "@chaitin-ai/octobus-sdk";
+
+import { service } from "../wd__k01_v9-0-2/src/service.js";
+
+runServiceMain(service, {
+  entryFile: fileURLToPath(new URL("../wd__k01_v9-0-2/bin/wd-k01-v9-0-2.js", import.meta.url)),
+});

services/package.json

@@ -150,7 +150,8 @@
     "siem": "bin/siem.js",
     "security-engine": "bin/security-engine.js",
     "kubernetes-api": "bin/kubernetes-api.js",
-    "openstack-yoga-2022-1": "bin/openstack-yoga-2022-1.js"
+    "openstack-yoga-2022-1": "bin/openstack-yoga-2022-1.js",
+    "wd-k01-v9-0-2": "bin/wd-k01-v9-0-2.js"
   },
   "files": [
     "bin/huawei-ccm.js",
@@ -296,6 +297,7 @@
     "bin/opencti.js",
     "bin/qianxin-caasm.js",
     "bin/api7-enterprise-v3-10-2.js",
+    "bin/wd-k01-v9-0-2.js",
     "bin/wangsu-label-ip.js",
     "bin/reportedip.js",
     "bin/anyi-cloud-native-security.js",
@@ -414,6 +416,7 @@
     "qianxin__caasm_v1",
     "api7__enterprise_v3-10-2",
     "fofa__network-space-mapper",
+    "wd__k01_v9-0-2",
     "wangsu__label-ip",
     "reportedip__reportedip",
     "anyi__cloud-native-security",

services/wd__k01_v9-0-2/README.md

@@ -0,0 +1,96 @@
+# WD K01 V9.0.2
+
+网盾 K01 威胁情报联防阻断系统 **V9.0.2** RESTful API(V9 新增接口)的 OctoBus service package。
+覆盖只读告警/名单查询与私有情报(攻击类)的增删查。
+
+> 与已有 `wd__k01`(BlockIP / UnblockIP,基于 `/api/v1/security/iplist/save`)互补:本包聚焦
+> **查询与情报管理**,不与其封禁写操作重叠。
+
+## 支持版本
+
+网盾 K01 V9.0.2(北京中盾网空防务技术有限公司)。文档中标注「V9 新增接口」的接口。
+
+## 认证方式
+
+仅支持 api 组用户(默认 `apiuser`)。每次方法调用是一段无状态会话:
+
+1. `POST /api/cms/user/login`,body `{username, password}`,成功返回 `token.access_token`。
+2. 业务请求带 `Authorization: Bearer <access_token>`。
+3. `POST /api/cms/user/logout` 注销。
+
+会话不跨调用缓存；登出在 `finally` 中执行，登出失败只记录脱敏的运行日志，不会覆盖业务结果。
+
+## 配置
+
+`config.schema.json`(非敏感):
+
+```json
+{ "host": "https://192.168.10.10", "timeoutMs": 1500, "skipTlsVerify": true }
+```
+
+`secret.schema.json`(敏感):
+
+```json
+{ "user": "apiuser", "password": "<password>" }
+```
+
+## 方法
+
+| RPC | 上游接口 | 说明 | 写操作 |
+| --- | --- | --- | --- |
+| `QueryAttackLog` | `POST /api/v1/logsystem/atkmntlog/query` | 攻击监测日志查询 | 否 |
+| `QueryIPList` | `POST /api/v1/security/iplist/query` | IP 黑/白名单查询 | 否 |
+| `QueryThreatIntel` | `POST /api/v1/threatintelligence/attack/query` | 私有情报(攻击类)查询 | 否 |
+| `AddThreatIntel` | `POST /api/v1/threatintelligence/attack/save` | 添加私有情报(攻击类) | 是 |
+| `DeleteThreatIntel` | `POST /api/v1/threatintelligence/attack/delete` | 按 id 删除私有情报 | 是 |
+
+### 关键输入
+
+- 所有查询的 `page` 必须为正整数且不超过 10000，`count` 取值为 `10`、`20`、`50` 或 `100`（默认 10）。
+- `QueryAttackLog`:`page`/`count`,以及 `type_mask[]`(情报类型，如 256=IP黑名单)、`severity_mask[]`(0低/1中/2高)、`party_3rd_mask[]`(0公有/1私有)、`action_mask[]`(1监控/2阻断)、`r_sip`/`r_dip`/`r_s_time`/`r_e_time` 等过滤项;未提供的可选项不下发，负数列表项会被忽略。
+- `QueryIPList`:`color`(0黑/1白,默认0)、`dir`(0源/1目的/2两者,默认2)、`page`/`count`、`ip_search`/`comment_search`/时间过滤。
+- `AddThreatIntel`:`ip`(IPv4,必填)、`type`(攻击类型,>0)、`severity`(优先级,>0)。`method` 固定 `add`。
+- `DeleteThreatIntel`:`id`(>0)。`method` 固定 `delete`。
+
+### 输出
+
+- 查询类返回 `success/msg_type/msg/total/page/count/raw_json`。
+- 写类返回 `success/msg_type/msg/id/raw_json`。
+
+`raw_json` 会按 SDK 的敏感字段规则脱敏；登录和登出响应、Bearer token、密码和请求头不会进入 RPC 响应或日志。
+
+## 风险边界
+
+- **写操作**:`AddThreatIntel`、`DeleteThreatIntel`。私有情报增删会即时影响联防阻断决策——误加会导致正常 IP 被研判为威胁,误删会降低检出。无自动回滚:`Add` 用 `Delete`(凭返回 id)还原,`Delete` 需重新 `Add`。
+- 设备 `success/msgType` 非成功一律映射为 `FAILED_PRECONDITION` 并带原始 `msg`,不静默吞错。
+- 默认校验 TLS;私有自签部署需显式 `skipTlsVerify: true`。
+
+## 错误映射
+
+| 场景 | gRPC code |
+| --- | --- |
+| 缺 host/账号/密码、ip 非法、type/severity/id ≤0、color/dir 越界 | `INVALID_ARGUMENT` |
+| 登录失败 / 业务 msgType 非 success | `FAILED_PRECONDITION` |
+| 上游 401 | `UNAUTHENTICATED` |
+| 上游 403 | `PERMISSION_DENIED` |
+| 网络错误 / 5xx | `UNAVAILABLE` |
+| 超时 / 重定向 | `UNAVAILABLE` |
+| 响应空体 / 非 JSON | `UNKNOWN` |
+
+## 建议 capset
+
+只读核查:`query-attack-log` + `query-ip-list` + `query-threat-intel`。
+情报维护(写,需授权与审计):追加 `add-threat-intel` + `delete-threat-intel`。
+
+## 验证方式
+
+```bash
+cd services
+npm run validate -- --service-dir wd__k01_v9-0-2
+npm test -- --service-dir wd__k01_v9-0-2 --coverage
+npm run pack:check
+```
+
+真机验证:`query-attack-log`/`query-ip-list` 直接读;情报写操作用测试 IP(如 `198.51.100.x`)
+执行 `add-threat-intel` → `query-threat-intel` 确认 → `delete-threat-intel` 清理。
+PR 附设备版本、认证方式、调用截图与已知限制。**截图/代码里不得出现真实账号、密码、token 或生产地址。**

services/wd__k01_v9-0-2/bin/wd-k01-v9-0-2.js

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+import { runServiceMain } from '@chaitin-ai/octobus-sdk';
+
+import { service } from '../src/service.js';
+
+runServiceMain(service);

services/wd__k01_v9-0-2/config.schema.json

@@ -0,0 +1,48 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "host": {
+      "type": "string",
+      "description": "WD K01 Web API base URL, including scheme and optional port."
+    },
+    "restBaseUrl": {
+      "type": "string",
+      "description": "Alias for host."
+    },
+    "baseUrl": {
+      "type": "string",
+      "description": "Alias for host."
+    },
+    "timeoutMs": {
+      "type": "integer",
+      "minimum": 1,
+      "maximum": 60000,
+      "default": 1500,
+      "description": "HTTP timeout in milliseconds."
+    },
+    "skipTlsVerify": {
+      "type": "boolean",
+      "default": false,
+      "description": "Skip TLS certificate verification for private deployments."
+    },
+    "tlsInsecureSkipVerify": {
+      "type": "boolean",
+      "default": false,
+      "description": "Legacy alias for skipTlsVerify."
+    },
+    "insecureSkipVerify": {
+      "type": "boolean",
+      "default": false,
+      "description": "Legacy alias for skipTlsVerify."
+    },
+    "headers": {
+      "type": "object",
+      "additionalProperties": {
+        "type": "string"
+      },
+      "description": "Optional additional HTTP headers."
+    }
+  }
+}

services/wd__k01_v9-0-2/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "wd-k01-v9-0-2",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "bin": {
+    "wd-k01-v9-0-2": "bin/wd-k01-v9-0-2.js"
+  },
+  "dependencies": {
+    "@chaitin-ai/octobus-sdk": "^0.6.0"
+  }
+}

services/wd__k01_v9-0-2/proto/wd_k01_v9_0_2.proto

@@ -0,0 +1,85 @@
+syntax = "proto3";
+
+package WD_K01_V9_0_2;
+
+option go_package = "miner/grpc-service/WD_K01_V9_0_2";
+
+// 网盾 K01 威胁情报联防阻断系统 V9.0.2 RESTful API（V9 新增接口）。
+// 认证: POST /api/cms/user/login 取 token.access_token，业务请求带 Authorization: Bearer <token>，
+//       完成后 POST /api/cms/user/logout。每次方法调用为一次 login→操作→logout 的无状态会话。
+// 本 service 覆盖只读告警/黑白名单查询与私有情报(攻击类)的增删查，
+// 与已有 wd__k01（BlockIP/UnblockIP）互补。
+service WD_K01_V9_0_2 {
+  // 攻击监测日志查询: /api/v1/logsystem/atkmntlog/query
+  rpc QueryAttackLog(QueryAttackLogRequest) returns (QueryResponse) {}
+  // IP 黑白名单查询: /api/v1/security/iplist/query
+  rpc QueryIPList(QueryIPListRequest) returns (QueryResponse) {}
+  // 私有情报(攻击类)查询: /api/v1/threatintelligence/attack/query
+  rpc QueryThreatIntel(QueryThreatIntelRequest) returns (QueryResponse) {}
+  // 私有情报(攻击类)添加: /api/v1/threatintelligence/attack/save
+  rpc AddThreatIntel(AddThreatIntelRequest) returns (MutationResponse) {}
+  // 私有情报(攻击类)删除: /api/v1/threatintelligence/attack/delete
+  rpc DeleteThreatIntel(DeleteThreatIntelRequest) returns (MutationResponse) {}
+}
+
+message QueryAttackLogRequest {
+  optional int32 page = 1;          // 页码，默认 1；显式 0 非法
+  optional int32 count = 2;         // 每页数量，取值 [10,20,50,100]，默认 10；显式 0 非法
+  repeated int32 type_mask = 3;     // 情报类型编码（见文档表1，如 256=IP黑名单）
+  repeated int32 severity_mask = 4; // 威胁等级（0 低 / 1 中危 / 2 高危）
+  repeated int32 party_3rd_mask = 5;// 命中情报源（0 公有 / 1 私有）
+  repeated int32 action_mask = 6;   // 处理动作（1 监控 / 2 阻断）
+  string r_sip = 7;                 // 攻击 IP
+  string r_dip = 8;                 // 被攻击 IP
+  int32 country = 9;                // 国家编码
+  int32 province = 10;              // 省份编码
+  string r_s_time = 11;            // 开始时间，如 2025-07-01 00:00:00
+  string r_e_time = 12;            // 结束时间
+}
+
+message QueryIPListRequest {
+  optional int32 page = 1;  // 页码，默认 1；显式 0 非法
+  optional int32 count = 2; // 每页数量，取值 [10,20,50,100]，默认 10；显式 0 非法
+  int32 color = 3;          // 名单类型（0 IP 黑名单 / 1 IP 白名单），默认 0
+  int32 dir = 4;            // 方向（0 源 / 1 目的 / 2 源和目的），默认 2
+  string ip_search = 5;     // 过滤 IP/网段，可选
+  string comment_search = 6;// 过滤备注，可选
+  string r_s_time = 7;      // 过滤开始时间，可选
+  string r_e_time = 8;      // 过滤结束时间，可选
+}
+
+message QueryThreatIntelRequest {
+  optional int32 page = 1;  // 页码，默认 1；显式 0 非法
+  optional int32 count = 2; // 每页数量，取值 [10,20,50,100]，默认 10；显式 0 非法
+  int32 source_id = 3; // 情报源 id，可选（接口新增的情报源查询时传 63）
+}
+
+message AddThreatIntelRequest {
+  string ip = 1;     // 私有情报 IP，必填，IPv4
+  int32 type = 2;    // 攻击类型，必填
+  int32 severity = 3;// 攻击优先级，必填
+}
+
+message DeleteThreatIntelRequest {
+  int64 id = 1; // 情报 id，必填，>0
+}
+
+// 查询类统一响应：data 透传为 raw_json，并抽取分页字段。
+message QueryResponse {
+  bool success = 1;          // 设备 success 字段或 msgType=success
+  string msg_type = 2;       // 设备 msgType
+  string msg = 3;            // 设备 msg
+  int64 total = 4;           // data.total
+  int64 page = 5;            // data.page
+  int64 count = 6;           // data.count
+  string raw_json = 7;       // 经敏感字段脱敏后的业务 JSON
+}
+
+// 写类统一响应。
+message MutationResponse {
+  bool success = 1;          // 设备 success 字段或 msgType=success
+  string msg_type = 2;       // 设备 msgType
+  string msg = 3;            // 设备 msg
+  int64 id = 4;             // 设备返回的 id（如有）
+  string raw_json = 5;       // 经敏感字段脱敏后的业务 JSON
+}

services/wd__k01_v9-0-2/secret.schema.json

@@ -0,0 +1,19 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "user": {
+      "type": "string",
+      "description": "WD K01 API-group login username (e.g. apiuser)."
+    },
+    "username": {
+      "type": "string",
+      "description": "Alias for user."
+    },
+    "password": {
+      "type": "string",
+      "description": "WD K01 login password."
+    }
+  }
+}

services/wd__k01_v9-0-2/service.json

@@ -0,0 +1,45 @@
+{
+  "schema": "chaitin.octobus.service.v1",
+  "name": "wd-k01-v9-0-2",
+  "displayName": "WD K01 V9.0.2",
+  "description": "OctoBus package for WD K01 threat-intelligence joint-defense system V9.0.2: attack-monitor log query, IP blacklist/whitelist query, and private (attack) threat-intel add/delete/query.",
+  "runtime": {
+    "mode": "long-running"
+  },
+  "proto": {
+    "roots": [
+      "proto"
+    ],
+    "files": [
+      "proto/wd_k01_v9_0_2.proto"
+    ]
+  },
+  "configSchema": "config.schema.json",
+  "secretSchema": "secret.schema.json",
+  "sdk": {
+    "cli": {
+      "commands": {
+        "WD_K01_V9_0_2.WD_K01_V9_0_2/QueryAttackLog": {
+          "name": "query-attack-log",
+          "description": "Query WD K01 attack-monitor logs."
+        },
+        "WD_K01_V9_0_2.WD_K01_V9_0_2/QueryIPList": {
+          "name": "query-ip-list",
+          "description": "Query WD K01 IP blacklist/whitelist entries."
+        },
+        "WD_K01_V9_0_2.WD_K01_V9_0_2/QueryThreatIntel": {
+          "name": "query-threat-intel",
+          "description": "Query WD K01 private (attack) threat intelligence."
+        },
+        "WD_K01_V9_0_2.WD_K01_V9_0_2/AddThreatIntel": {
+          "name": "add-threat-intel",
+          "description": "Add a WD K01 private (attack) threat-intel IP."
+        },
+        "WD_K01_V9_0_2.WD_K01_V9_0_2/DeleteThreatIntel": {
+          "name": "delete-threat-intel",
+          "description": "Delete a WD K01 private (attack) threat-intel entry by id."
+        }
+      }
+    }
+  }
+}

services/wd__k01_v9-0-2/src/service.js

@@ -0,0 +1,7 @@
+import { defineService } from '@chaitin-ai/octobus-sdk';
+
+import { handlers } from './wd-k01-v9-0-2.js';
+
+export { handlers } from './wd-k01-v9-0-2.js';
+
+export const service = defineService({ handlers });