All Products
Search

This Product

    Cloud Firewall:DescribeRiskEventPayload

    Document Center

    Cloud Firewall:DescribeRiskEventPayload

    Last Updated:Aug 28, 2026

    Queries the attack payloads of intrusion events.

    Try it now

    Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

    Test

    RAM authorization

    No authorization for this operation. If you encounter issues with this operation, contact technical support.

    Request parameters

    Parameter

    Type

    Required

    Description

    Example
    StartTime

    string

    Yes

    The beginning of the time range to query. The value is a timestamp. Unit: seconds.

    1669533617
    EndTime

    string

    Yes

    The end of the time range to query. The value is a timestamp. Unit: seconds.

    1681288980
    SrcIP

    string

    No

    The source IP address to query. If you specify this parameter, all intrusion events from the specified source IP address are queried.

    203.0.113.1
    DstIP

    string

    No

    The destination IP address to query. If you specify this parameter, all intrusion events with the specified destination IP address are queried.

    203.0.113.2
    UUID

    string

    Yes

    The UUID of the intrusion event.

    e62c25e0-1073-46bd-9567-b8f12b3d****
    FirewallType

    string

    No

    The type of the firewall. Valid values:

    • VpcFirewall: virtual private cloud (VPC) firewall

    • InternetFirewall (default): Internet firewall

    InternetFirewall
    SrcVpcId

    string

    No

    The ID of the source VPC to query. If you specify this parameter, all intrusion events that contain the specified ID of the source VPC are queried.

    vpc-wz9j2lqyo15udw5nt****
    DstVpcId

    string

    No

    The ID of the destination VPC to query. If you specify this parameter, all intrusion events that contain the specified ID of the destination VPC are queried.

    vpc-uf6jr1klwqb60dyn2****
    PublicIP

    string

    No

    The public IP address. If you specify this parameter, all intrusion events that contain the specified public IP address are queried.

    203.0.113.3

    Response elements

    Element

    Type

    Description

    Example

    object

    DstIP

    string

    The destination IP address of the intrusion event.

    203.0.113.1
    DstPort

    integer

    The destination port of the intrusion event.

    8080
    DstVpcId

    string

    The destination VPC ID of the intrusion event.

    vpc-bp10w5nb30r4jzfyc****
    HitContentType

    integer

    Type of the hit.

    1
    HitTo

    integer

    The position where the hit ends.

    67
    ParsedContent

    string

    Hit payload.

    2f636f6d706f7365722f73656e645f656d61696c3f746f3d6d61667740776f66736f7961792675726c3d687474703a2f2f302e302e302e303a31323334352f692f6431366530312f313664622f673670772f
    Payload

    string

    The attack payload of the intrusion event.

    302902010004067075626c6963a01c0204036a5f43020100020100300e300c06082b060102010101000500
    PayloadLen

    integer

    The length of the attack payload of the intrusion event.

    457
    Proto

    string

    The protocol type of intrusion event. Valid values:

    • TCP

    • UDP

    TCP
    RealIp

    string

    The HTTP X-Real-IP field.

    203.0.113.3
    RequestId

    string

    The request ID.

    68055BA4-D8BD-5611-AC49-C651E619A12E
    SrcIP

    string

    The source IP address of the intrusion event.

    203.0.113.2
    SrcPort

    integer

    The source port of the intrusion event.

    54360
    SrcVpcId

    string

    The source VPC ID of the intrusion event.

    vpc-t4nlt09olhpazpoeg****
    XForwardFor

    string

    The HTTP X-Forwarded-For field.

    203.0.113.4

    Examples

    Success response

    JSON format

    {
  "DstIP": "203.0.113.1",
  "DstPort": 8080,
  "DstVpcId": "vpc-bp10w5nb30r4jzfyc****",
  "HitContentType": 1,
  "HitTo": 67,
  "ParsedContent": "2f636f6d706f7365722f73656e645f656d61696c3f746f3d6d61667740776f66736f7961792675726c3d687474703a2f2f302e302e302e303a31323334352f692f6431366530312f313664622f673670772f",
  "Payload": "302902010004067075626c6963a01c0204036a5f43020100020100300e300c06082b060102010101000500",
  "PayloadLen": 457,
  "Proto": "TCP",
  "RealIp": "203.0.113.3",
  "RequestId": "68055BA4-D8BD-5611-AC49-C651E619A12E",
  "SrcIP": "203.0.113.2",
  "SrcPort": 54360,
  "SrcVpcId": "vpc-t4nlt09olhpazpoeg****",
  "XForwardFor": "203.0.113.4"
}

    Error codes

    HTTP status code

    Error code

    Error message

    Description
    400 ErrorParameters A parameter error occurred. A parameter error occurred.
    400 ErrorIpFormat The IP address is invalid. The IP address is invalid.
    400 ErrorTimeError The time is invalid. The time is invalid.
    400 ErrorFirewallType The specified firewall type is invalid. The firewall type of traffic log is invalid.
    400 ErrorSLSLogStore Failed to get SLS logstore. Failed to obtain the Log Service logstore.
    400 ErrorMarshalJSON internal error. Internal error.

    See Error Codes for a complete list.

    Release notes

    See Release Notes for a complete list.