DescribeDDosAllEventList

Returns a list of DDoS attack events.

Operation description

This operation returns a paginated list of DDoS attack events within a specified time range. A DDoS attack event includes details such as its start and end times, attack type, the attacked asset, and its peak traffic, measured as either peak bandwidth or packet forwarding rate.

QPS limit

This operation has a queries-per-second (QPS) limit of 10 for each user. The system throttles calls that exceed this limit. This may affect your business operations. Plan your API calls accordingly.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

No authorization for this operation. If you encounter issues with this operation, contact technical support.

Request parameters

Parameter	Type	Required	Description	Example
EventType	string	No	The type of DDoS attack event to return. Valid values: web-cc: a web resource exhaustion attack. cc: a connection flood attack. defense: a volumetric attack (scrubbing event). blackhole: a volumetric attack (blackhole event). You can specify multiple event types. Separate them with a comma (,). If you do not specify this parameter, all types of attack events are returned.	defense
StartTime	integer	Yes	The start of the time range to query. The operation returns DDoS attack events that occurred at or after this time. Specify the time as a UNIX timestamp in seconds. Note You can query events from the last three months only.	1609430400
EndTime	integer	Yes	The end of the time range to query. The operation returns DDoS attack events that occurred before this time. Specify the time as a UNIX timestamp in seconds. Note You can query events from the last three months only.	1640966399
PageNumber	integer	Yes	The page number to return.	1
PageSize	integer	Yes	The number of events to return per page.	10
Ip	string	No	The IP address of the Anti-DDoS Pro instance to query.	192.168.1.1

You must also include the common request parameters for Alibaba Cloud APIs when you call this operation. For more information, see Common parameters.

For more information about the request format, see the request sample in the Examples section.

Response elements

Element	Type	Description	Example
	object
Total	integer	The total number of events returned.	1
RequestId	string	The request ID.	25D83ED5-28CB-5683-9CF7-AECE521F3005
AttackEvents	array<object>	An array of DDoS attack events.
	object
EndTime	integer	The time the attack ended, as a UNIX timestamp in seconds.	1634546030
StartTime	integer	The time the attack started, as a UNIX timestamp in seconds.	1634543764
EventType	string	The type of DDoS attack event. Valid values: web-cc: a web resource exhaustion attack. cc: a connection flood attack. defense: a volumetric attack (scrubbing event). blackhole: a volumetric attack (blackhole event).	cc
Mbps	integer	The peak bandwidth of the attack traffic, in Mbps.	101899
Ip	string	The attacked asset. The type of asset returned depends on the `EventType` value. If EventType is web-cc, this is the attacked website domain name. If EventType is cc, this is the attacked Anti-DDoS Pro IP. If EventType is defense or blackhole, this is the attacked Anti-DDoS Pro IP.	203.107.XX.XX
Area	string	The source region of the attack. Valid values: cn: Chinese mainland. alb-cn-hongkong-gf-2: China (Hong Kong). alb-us-west-1-gf-2: US (Silicon Valley). alb-ap-northeast-1-gf-1: Japan (Tokyo). alb-ap-southeast-gf-1: Singapore. alb-eu-central-1-gf-1: Germany (Frankfurt). alb-eu-west-1-gf-1 and selb-eu-west-1-gf-1a: UK (London). alb-us-east-gf-1: US (Virginia). CT-yundi: China (Hong Kong). This value is returned only for Anti-DDoS Premium instances that use the Secure Acceleration plan.	cn
Port	string	The attacked port number. Note This parameter is not returned when EventType is web-cc.	80
Pps	integer	The peak packet forwarding rate of the attack traffic, in packets per second (pps).	9664270

Examples

Success response

JSON format

{
  "Total": 1,
  "RequestId": "25D83ED5-28CB-5683-9CF7-AECE521F3005",
  "AttackEvents": [
    {
      "EndTime": 1634546030,
      "StartTime": 1634543764,
      "EventType": "cc",
      "Mbps": 101899,
      "Ip": "203.107.XX.XX",
      "Area": "cn",
      "Port": "80",
      "Pps": 9664270
    }
  ]
}

Error codes

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.