DescribeEventDetail - API Reference| Alibaba Cloud Documentation Center

Debugging

OpenAPI Explorer automatically calculates the signature value. For your convenience, we recommend that you call this operation in OpenAPI Explorer. OpenAPI Explorer dynamically generates the sample code of the operation for different SDKs.

Request parameters


Parameter	Type	Required	Example	Description
Action	String	Yes	DescribeEventDetail	The operation that you want to perform. Set the value to DescribeEventDetail.
Id	Long	Yes	13456723343	The unique ID of the anomalous activity to query. Note You can call the DescribeEvents operation to query the ID of the anomalous activity.
Lang	String	No	zh	The language of the request and response. Valid values: zh: Chinese en: English

Response parameters


Parameter	Type	Example	Description
Event			The details of the anomalous activity.
AlertTime	Long	1545829129000	The time when an alert was triggered for the anomalous activity. This value is a UNIX timestamp representing the number of milliseconds that have elapsed since the epoch time January 1, 1970, 00:00:00 UTC.
Backed	Boolean	false	Indicates whether the processing result of the anomalous activity was used to enhance the detection of anomalous activities. By enhancing the detection, you can improve the detection accuracy and the rate of triggering alerts for anomalous activities. Valid values: true: The detection was enhanced. false: The detection was not enhanced.
DataInstance	String	in-222***	The name of the instance in the service where the anomalous activity was detected.
DealDisplayName	String	yundunsr	The display name of the account used to process the anomalous activity.
DealLoginName	String	det1111	The username of the account used to process the anomalous activity.
DealReason	String	Anomaly confirmed	The reason of the way in which the anomalous activity was processed.
DealTime	Long	1230000	The time when the anomalous activity was processed. This value is a UNIX timestamp representing the number of milliseconds that have elapsed since the epoch time January 1, 1970, 00:00:00 UTC.
DealUserId	Long	229157443385014140	The ID of the account used to process the anomalous activity.
Detail			The details of the anomalous activity.
Chart			The baseline behavior profile of the anomalous activity.
Data			The data in the baseline behavior profile of the anomalous activity.
X	String	[test1,test2,...]	The value of the data item on the X axis.
Y	String	[1,2,3,...]	The value of the data item on the Y axis.
Label	String	Baseline behavior profile	The name of the baseline behavior profile of the anomalous activity.
XLabel	String	Number of days	The descriptive label of data items on the X axis.
YLabel	String	Value	The descriptive label of data items on the Y axis.
Content			The anomalous activity content.
Label	String	Anomaly description	The name of the anomalous activity content.
Value	String	The account was used to access OSS from an unusual terminal (IP address: 1.2.3.4) from September 9 2019, 00:06:45 to September 9 2019, 00:57:37.	The description of the anomalous activity content.
ResourceInfo			The anomalous activity source.
Label	String	Activity risk	The name of the anomalous activity source.
Value	String	Based on the record of authentication through an unusual terminal, an external attacker may have obtained the access permission of the account or the employee accessed data from a personal terminal.	The description of the anomalous activity source.
DisplayName	String	yundunsr	The display name of the account that triggered the anomalous activity.
EventTime	Long	1545829129000	The time when the anomalous activity occurred. This value is a UNIX timestamp representing the number of milliseconds that have elapsed since the epoch time January 1, 1970, 00:00:00 UTC.
Id	Long	52234	The unique ID of the anomalous activity.
LoginName	String	det1111	The username of the account that triggered the anomalous activity.
ProductCode	String	MaxCompute	The name of the service where the anomalous activity was detected. Valid values: MaxCompute RDS OSS
Status	Integer	0	The ID of the processing status of the anomalous activity. Valid values: 0: unprocessed 1: confirmed as an anomaly 2: excluded as a false positive
StatusName	String	Unprocessed	The name of the processing status of the anomalous activity.
SubTypeCode	String	020008	The code of the anomalous activity subtype.
SubTypeName	String	Anomalous downloaded data volume	The name of the anomalous activity subtype.
TypeCode	String	02	The code of the anomalous activity type.
TypeName	String	Anomalous data flow	The name of the anomalous activity type. Valid values: Anomalous permission access Anomalous data flow Anomalous data operation
UserId	Long	229157443385014140	The ID of the account that triggered the anomalous activity.
RequestId	String	69FB3C1-F4C9-42DF-9B72-7077A8989C13	The ID of the request.

Examples

Sample requests


http(s)://[Endpoint]/? Action=DescribeEventDetail
&<Common request parameters>

Sample success responses

XML format

<DescribeEventDetail>
  <RequestId>769FB3C1-F4C9-42DF-9B72-7077A8989C13</RequestId>
  <Event>
        <Status>0</Status>
        <TypeName>Anomalous data flow</TypeName>
        <Backed>false</Backed>
        <TypeCode>02</TypeCode>
        <ProductCode>MaxCompute</ProductCode>
        <SubTypeName>Anomalous downloaded data volume</SubTypeName>
        <EventTime>1545829129000</EventTime>
        <UserId>229157443385014140</UserId>
        <LoginName>det1111</LoginName>
        <DisplayName>yundunsr</DisplayName>
        <Id>4</Id>
        <SubTypeCode>020008</SubTypeCode>
        <AlertTime>1545829129000</AlertTime>
        <StatusName>Unprocessed</StatusName>
        <DealUserId>229157443385014140</DealUserId>
        <DealLoginName>det1111</DealLoginName>
        <DealDisplayName>yundunsr</DealDisplayName>
        <DepartName>test</DepartName>
        <Detail>
              <Content>
                    <Value>The account was used to access OSS from an unusual terminal (IP address: 1.2.3.4) from September 9 2019, 00:06:45 to September 9 2019, 00:57:37. </Value>
                    <Label>Anomaly description</Label>
              </Content>
              <Chart>
                    <YLabel>Value</YLabel>
                    <Label>Baseline behavior profile</Label>
                    <Data>
                          <X>1</X>
                          <X>2</X>
                          <X>3</X>
                          <X>4</X>
                          <X>5</X>
                          <X>6</X>
                          <Y>1</Y>
                          <Y>2</Y>
                          <Y>3</Y>
                          <Y>4</Y>
                          <Y>5</Y>
                          <Y>6</Y>
                    </Data>
                    <XLabel>Number of days</XLabel>
              </Chart>
        </Detail>
        <DealReason>Anomaly confirmed</DealReason>
  </Event>
</DescribeEventDetail>

JSON format

{
	"Event":{
		"DealDisplayName":"yundunsr",
		"ProductCode":"MaxCompute",
		"LoginName":"det1111",
		"DepartName":"test",
		"Backed":false,
		"TypeName":"Anomalous data flow",
		"UserId":229157443385014132,
		"DisplayName":"yundunsr",
		"DealReason":"Anomaly confirmed",
		"Status":0,
		"Detail":{
			"Chart":[
				{
					"Data":{
						"Y":[
							1,
							2,
							3,
							4,
							5,
							6
						],
						"X":[
							1,
							2,
							3,
							4,
							5,
							6
						]
					},
					"XLabel":"Number of days",
					"Label":"Baseline behavior profile",
					"YLabel":"Value"
				}
			],
			"Content":[
				{
					"Value":"The account was used to access OSS from an unusual terminal (IP address: 1.2.3.4) from September 9 2019, 00:06:45 to September 9 2019, 00:57:37.",
					"Label":"Anomaly description"
				}
			]
		},
		"TypeCode":"02",
		"EventTime":1545829129000,
		"AlertTime":1545829129000,
		"StatusName":"Unprocessed",
		"Id":4,
		"DealLoginName":"det1111",
		"SubTypeName":"Anomalous downloaded data volume",
		"SubTypeCode":"020008",
		"DealUserId":229157443385014132
	},
	"RequestId":"769FB3C1-F4C9-42DF-9B72-7077A8989C13"
}

Error codes

For a list of error codes, visit the API Error Center.