DescribeSuspEventQuaraFiles - Security Center - Alibaba Cloud Documentation Center

Queries quarantined files by page.

Debugging

OpenAPI Explorer automatically calculates the signature value. For your convenience, we recommend that you call this operation in OpenAPI Explorer.

Debug

Authorization information

The following table shows the authorization information corresponding to the API. The authorization information can be used in the Action policy element to grant a RAM user or RAM role the permissions to call this API operation. Description:

Operation: the value that you can use in the Action element to specify the operation on a resource.
Access level: the access level of each operation. The levels are read, write, and list.
Resource type: the type of the resource on which you can authorize the RAM user or the RAM role to perform the operation. Take note of the following items:
- The required resource types are displayed in bold characters.
- If the permissions cannot be granted at the resource level, All Resources is used in the Resource type column of the operation.
Condition Key: the condition key that is defined by the cloud service.
Associated operation: other operations that the RAM user or the RAM role must have permissions to perform to complete the operation. To complete the operation, the RAM user or the RAM role must have the permissions to perform the associated operations.

Operation	Access level	Resource type	Condition key	Associated operation
yundun-sas:DescribeSuspEventQuaraFiles	Read	All Resources *	none	none

Request parameters

Parameter	Type	Required	Description	Example
SourceIp	string	No	The source IP address of the request.	59.82.XX.XX
PageSize	string	No	The number of entries to return on each page.	20
Status	string	No	The status of the quarantined file that you want to query. Valid values: quaraFailed: The file fails to be quarantined. quaraDone: The file is quarantined. quaraing: The file is being quarantined. rollbackFailed: The system fails to cancel quarantining the file. rollbackDone: The system cancelled quarantining the file. rollbacking: The system is cancelling quarantining the file.	quaraDone
GroupId`deprecated`	string	No	The ID of the asset group.	10541428
QuaraTag	string	No	The unique ID of the quarantined file.	a31337789f64d39b2219733ec99f9af7
CurrentPage	string	No	The number of the page to return.	1
From	string	No	The ID of the request source. Set the value to sas.	sas
GroupingId	long	No	The ID of the server group to which the server belongs. The quarantined file is located on the server.	11472451

Response parameters

Parameter	Type	Description	Example
	object
CurrentPage	integer	The page number of the returned page.	1
PageSize	integer	The number of entries returned per page.	20
RequestId	string	The ID of the request, which is used to locate and troubleshoot issues.	32A73759-4C0F-4801-BE98-901223ACEE9A
TotalCount	integer	The total number of entries returned.	38
Count	integer	The number of entries returned on the current page.	7
QuaraFiles	object []	An array that consists of the quarantined files.
Link	string	The download link of the quarantined file.	https://xxx.xxx/xxx
Status	string	The status of the quarantined file. Valid values: quaraFailed: The file fails to be quarantined. quaraDone: The file is quarantined. quaraing: The file is being quarantined. rollbackFailed: The system fails to cancel quarantining the file. rollbackDone: The system cancelled quarantining the file. rollbacking: The system is cancelling quarantining the file.	rollbackDone
EventName	string	The name of the event.	WEBSHELL
InternetIp	string	The public IP address of the server on which the quarantined file is located.	47.XX.XX.131
Ip	string	The public IP address of the server on which the quarantined file is located.	47.XX.XX.131
Tag	string	The unique ID of the event.	228f890e56eae9eec6a42c7ea801b538
InstanceId	string	The instance ID of the asset.	i-2ze9t1qp36n1436m****
Uuid	string	The UUID of the server.	04a0e735-ad32-4835-b635-0458d77b****
EventType	string	The type of the event.	WebshellQuaraEventType
InstanceName	string	The name of the server on which the quarantined file is located.	iZwz98dkiw3vbrtqrt5v****
Path	string	The path to the quarantined file on the server.	/var/www/html/webshell-sample-master/others/defc3e21bab59e2a2ab49f7eda99f65f83d4d349.jpg
Md5	string	The MD5 hash value of the quarantined file.	5ddebe926acc7ed39a664409bfd0ec10
Id	integer	The ID of the quarantined file.	26918
ModifyTime	string	The time when the quarantined file was last modified.	2020-06-11 20:37:08
IntranetIp	string	The private IP address of the server on which the quarantined file is located.	172.16.XX.XX

Examples

Sample success responses

JSONformat

{
  "CurrentPage": 1,
  "PageSize": 20,
  "RequestId": "32A73759-4C0F-4801-BE98-901223ACEE9A",
  "TotalCount": 38,
  "Count": 7,
  "QuaraFiles": [
    {
      "Link": "https://xxx.xxx/xxx",
      "Status": "rollbackDone",
      "EventName": "WEBSHELL",
      "InternetIp": "47.XX.XX.131",
      "Ip": "47.XX.XX.131",
      "Tag": "228f890e56eae9eec6a42c7ea801b538",
      "InstanceId": "i-2ze9t1qp36n1436m****",
      "Uuid": "04a0e735-ad32-4835-b635-0458d77b****",
      "EventType": "WebshellQuaraEventType",
      "InstanceName": "iZwz98dkiw3vbrtqrt5v****",
      "Path": "/var/www/html/webshell-sample-master/others/defc3e21bab59e2a2ab49f7eda99f65f83d4d349.jpg",
      "Md5": "5ddebe926acc7ed39a664409bfd0ec10",
      "Id": 26918,
      "ModifyTime": "2020-06-11 20:37:08",
      "IntranetIp": "172.16.XX.XX"
    }
  ]
}

Error codes

HTTP status code	Error code	Error message	Description
403	NoPermission	caller has no permission	You are not authorized to do this operation.
500	ServerError	ServerError	-

For a list of error codes, visit the Service error codes.

Change history

Change time

Summary of changes

Operation

2023-03-09

The response structure of the API has changed

see changesets

Change item	Change content
Output Parameters	The response structure of the API has changed.