DescribeDdosEventList - Anti-DDoS - Alibaba Cloud Documentation Center

This operation queries the details of DDoS attack events for an asset with a public IP address.

Operation description

This operation performs a paged query to retrieve the details of DDoS attack events for a specific asset with a public IP address. The details include the start time, end time, and status of each event.

QPS limits

The queries per second (QPS) limit for this operation is 10 for each user. API calls are throttled if you exceed the limit. This can affect your business. We recommend that you call this operation a reasonable number of times.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

yundun-ddos:DescribeDdosEventList

get

*All Resource

*

None

Request parameters

Parameter	Type	Required	Description	Example
DdosRegionId	string	Yes	The region ID of the asset that is assigned a public IP address. Note Call DescribeRegions to query all region IDs.	cn-hangzhou
InstanceType	string	Yes	The instance type of the asset that is assigned a public IP address. Valid values: ecs: an Elastic Compute Service (ECS) instance. slb: a Server Load Balancer (SLB) instance. eip: an elastic IP address (EIP) instance. ipv6: an IPv6 Gateway instance. swas: a simple application server instance. waf: a dedicated Web Application Firewall (WAF) instance. ga_basic: a Global Accelerator instance.	ecs
InstanceId	string	Yes	The ID of the instance for the asset that is assigned a public IP address. Note Call DescribeInstance to query the IDs of the ECS, SLB, and EIP instances that belong to your Alibaba Cloud account.	i-bp10bclrt56fblts****
CurrentPage	integer	No	The number of the page to return for a paged query. Default value: 1.	1
PageSize	integer	No	The number of attack events to return on each page for a paged query. Default value: 10.	10
InternetIp	string	No	The IP address of the asset that is assigned a public IP address.	121.199.XX.XX
QueryDays	integer	No	The number of days to query backwards from the current time. Default value: 7.	7

Response elements

Element	Type	Description	Example
	object	The response parameters.
Total	integer	The total number of DDoS attack events found.	1
RequestId	string	The ID of the request. Alibaba Cloud generates a unique ID for each request. You can use the ID to troubleshoot issues.	BC0907F8-A9F3-5E11-977B-D59CD98C64ED
DdosEventList	object
DdosEvent	array<object>	A list of DDoS attack events.
	object	A list of DDoS attack events.
DdosType	string	The type of the DDoS attack event. Valid values: defense: a traffic scrubbing event. blackhole: a blackhole filtering event.	blackhole
EndTime	integer	The end time of the event. This is a UNIX timestamp. Unit: milliseconds.	1637817679000
StartTime	integer	The start time of the event. This is a UNIX timestamp. Unit: milliseconds.	1637812279000
DelayTime	integer	The time of the last attack. This is a UNIX timestamp. Unit: milliseconds. Note This parameter is returned only for some blackhole filtering events where the asset that is assigned a public IP address was attacked multiple times.	1637817679000
DdosStatus	string	The status of the event. Valid values: mitigating: Traffic is being scrubbed. blackholed: Blackhole filtering is activated for the asset. normal: The event has ended.	normal
UnBlackholeTime	integer	The time when blackhole filtering was deactivated. This is a UNIX timestamp. Unit: milliseconds. Note This parameter is returned only when DdosType is blackhole, which indicates a blackhole filtering event.	1637814079000

Examples

Success response

JSON format

{
  "Total": 1,
  "RequestId": "BC0907F8-A9F3-5E11-977B-D59CD98C64ED",
  "DdosEventList": {
    "DdosEvent": [
      {
        "DdosType": "blackhole",
        "EndTime": 1637817679000,
        "StartTime": 1637812279000,
        "DelayTime": 1637817679000,
        "DdosStatus": "normal",
        "UnBlackholeTime": 1637814079000
      }
    ]
  }
}

Error codes

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.