Quake 服务索引聚合统计
接口说明
对 quake_service(服务维度网络测绘资产)索引执行分组聚合统计。在给定 Quake 查询语句的命中结果范围内,按指定字段(端口、服务、产品、标题、应用、地区等)做聚合,返回每个字段各取值的资产数量分布(Top N),或返回某字段的去重基数(unique_*)。 quake_service 是数据量最大的核心索引,可聚合维度远多于其他索引,覆盖服务指纹、HTTP 特征、应用组件、地理位置等。
请求地址
https://api.f.360.cn/api/v3/aggregation/quake_service
请求方法
POST
请求参数
| 名称 | 类型 | 位置 | 是否必填 | 示例值 | 说明 |
|---|---|---|---|---|---|
| query | string | body | 是 | - | 查询语句(支持的字段为获取聚合数据筛选字段接口返回的字段) |
| rule | string | body | 否 | - | 类型为IP列表的主机数据收藏名称 |
| ip_list | List[string] | body | 否 | - | IP列表 |
| size | int | body | 否 | - | 分页大小 |
| aggregation_list | List[string] | body | 是 | - | 需要获取的聚合名称列表 [注:最多仅支持聚合两个字段] |
| ignore_cache | bool | body | 否 | - | 是否忽略缓存 |
| start_time | string | body | 否 | - | 查询起始时间,接受2020-10-14 00:00:00格式的数据,时区为UTC |
| end_time | string | body | 否 | - | 查询截止时间,接受2020-10-14 00:00:00格式的数据,时区为UTC |
| latest | string | body | 否 | - | 是否只统计最新数据(去重库 unique);false 使用全量库 |
响应参数
| 一级字段 | 二级字段 | 类型 | 可选值 | 描述 |
|---|---|---|---|---|
| code | Integer | String | 0 | 响应状态码,0 表示成功 | |
| message | string | 响应说明 | ||
| data | object | 聚合结果,key 为聚合字段名 | ||
| data.{field} | array | 指定字段的聚合结果列表 | ||
| data.{field} | key | Integer | String | 聚合值(数值型字段返回 int,字符串字段返回 string) | |
| data.{field} | doc_count | integer | 该值对应的文档数量 | |
| meta | object | 固定返回空对象 {} |
请求示例
支持cUrl、Python、Java、PHP、Go语言的请求,示例如下
#!/usr/bin/env bash
set -euo pipefail
APPID="" # apikey
SECRET="" # salt
URL="https://api.f.360.cn/api/v3/aggregation/quake_service"
BODY='{"query":"city:beijing","aggregation_list":["port"]}'
NONCE=$(printf '%08d' $((RANDOM % 100000000)))
TIMESTAMP=$(date +%s)
BODY_MD5=$(printf '%s' "$BODY" | openssl dgst -md5 -hex | awk '{print $NF}')
SIGNATURE=$(printf '%s' "${BODY_MD5}${APPID}${NONCE}${TIMESTAMP}${SECRET}" | openssl dgst -md5 -hex | awk '{print $NF}')
SIGNATURE=${SIGNATURE:16}
curl --location --request POST "$URL" \
--header "Content-Type: application/json" \
--header "X-360-Key: ${APPID}" \
--header "X-360-Nonce: ${NONCE}" \
--header "X-360-Timestamp: ${TIMESTAMP}" \
--header "X-360-Signature: ${SIGNATURE}" \
--data "${BODY}"# -*- coding:utf-8 -*-
import hashlib
import json
import random
import time
import requests
APPID = "" # apikey
SECRET = "" # salt
def make_headers(appid, secret, body=""):
headers = {}
headers["X-360-Key"] = appid
headers["X-360-Nonce"] = str(random.randint(0, 99999999)).zfill(8)
headers["X-360-Timestamp"] = str(int(time.time()))
s = (
hashlib.md5(body.encode("utf8")).hexdigest()
+ headers["X-360-Key"]
+ headers["X-360-Nonce"]
+ headers["X-360-Timestamp"]
+ secret
)
md5 = hashlib.md5(s.encode("utf8")).hexdigest()
headers["X-360-Signature"] = md5[16:]
headers["Content-Type"] = "application/json"
return headers
def do_post(url, body):
res = requests.post(
url,
data=json.dumps(body),
headers=make_headers(APPID, SECRET, json.dumps(body)),
)
print(res.text)
if __name__ == "__main__":
url = "https://api.f.360.cn/api/v3/aggregation/quake_service"
params = {"query": "city:beijing", "aggregation_list": ["port"]}
do_post(url, params)import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.util.concurrent.ThreadLocalRandom;
public class Demo {
static String md5(String input) throws Exception {
byte[] digest = MessageDigest.getInstance("MD5")
.digest(input.getBytes(StandardCharsets.UTF_8));
StringBuilder sb = new StringBuilder();
for (byte b : digest) {
sb.append(String.format("%02x", b & 0xff));
}
return sb.toString();
}
public static void main(String[] args) throws Exception {
String appid = ""; // apikey
String secret = ""; // salt
String url = "https://api.f.360.cn/api/v3/aggregation/quake_service";
String body = "{\"query\":\"city:beijing\",\"aggregation_list\":[\"port\"]}";
String nonce = String.format("%08d", ThreadLocalRandom.current().nextInt(100000000));
String timestamp = String.valueOf(System.currentTimeMillis() / 1000);
String signature = md5(md5(body) + appid + nonce + timestamp + secret).substring(16);
HttpRequest request = HttpRequest.newBuilder()
.uri(URI.create(url))
.header("Content-Type", "application/json")
.header("X-360-Key", appid)
.header("X-360-Nonce", nonce)
.header("X-360-Timestamp", timestamp)
.header("X-360-Signature", signature)
.POST(HttpRequest.BodyPublishers.ofString(body, StandardCharsets.UTF_8))
.build();
HttpClient client = HttpClient.newHttpClient();
HttpResponse<String> response = client.send(
request, HttpResponse.BodyHandlers.ofString(StandardCharsets.UTF_8));
System.out.println(response.body());
}
}<?php
// apikey
$appid = "";
// salt
$secret = "";
$url = 'https://api.f.360.cn/api/v3/aggregation/quake_service';
$body = json_encode(['query' => 'city:beijing', 'aggregation_list' => ['port']], JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
$nonce = str_pad((string) random_int(0, 99999999), 8, "0", STR_PAD_LEFT);
$timestamp = (string) time();
$signature = substr(md5(md5($body) . $appid . $nonce . $timestamp . $secret), 16);
$ch = curl_init($url);
$options = [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"X-360-Key: {$appid}",
"X-360-Nonce: {$nonce}",
"X-360-Timestamp: {$timestamp}",
"X-360-Signature: {$signature}",
],
];
$options[CURLOPT_POST] = true;
$options[CURLOPT_POSTFIELDS] = $body;
curl_setopt_array($ch, $options);
$response = curl_exec($ch);
if ($response === false) {
echo curl_error($ch), PHP_EOL;
} else {
echo $response, PHP_EOL;
}
curl_close($ch);package main
import (
"bytes"
"crypto/md5"
"encoding/hex"
"fmt"
"io"
"math/rand"
"net/http"
"time"
)
func md5Hex(s string) string {
sum := md5.Sum([]byte(s))
return hex.EncodeToString(sum[:])
}
func main() {
appid := "" // apikey
secret := "" // salt
url := "https://api.f.360.cn/api/v3/aggregation/quake_service"
body := []byte(`{"query":"city:beijing","aggregation_list":["port"]}`)
nonce := fmt.Sprintf("%08d", rand.Intn(100000000))
timestamp := fmt.Sprintf("%d", time.Now().Unix())
signature := md5Hex(md5Hex(string(body)) + appid + nonce + timestamp + secret)[16:]
req, err := http.NewRequest(http.MethodPost, url, bytes.NewReader(body))
if err != nil {
panic(err)
}
req.Header.Set("Content-Type", "application/json")
req.Header.Set("X-360-Key", appid)
req.Header.Set("X-360-Nonce", nonce)
req.Header.Set("X-360-Timestamp", timestamp)
req.Header.Set("X-360-Signature", signature)
resp, err := http.DefaultClient.Do(req)
if err != nil {
panic(err)
}
defer resp.Body.Close()
respBody, err := io.ReadAll(resp.Body)
if err != nil {
panic(err)
}
fmt.Println(string(respBody))
}响应示例
业务正常响应
{
"code": 0,
"message": "Successful.",
"data": {
"port": [
{"key": 80, "doc_count": 46306737},
{"key": 443, "doc_count": 34593952},
{"key": 8888, "doc_count": 4584481},
{"key": 8080, "doc_count": 3758103},
{"key": 888, "doc_count": 2915647}
]
},
"meta": {}
}业务异常响应
{
"code": "t6003",
"message": "查询请求出错,请检查查询语句,或者与管理员联系",
"data": {},
"meta": {}
}{
"code": "q3005",
"message": "调用API过于频繁",
"data": {},
"meta": {}
}{
"code": "GC00105",
"src": "apiholder",
"msg": "appid over field"
}