DescribeDdosEventList - Anti-DDoS - Alibaba Cloud Documentation Center

Queries the details of the DDoS attack events that occur on an asset. The asset can be an Elastic IP address (EIP). The asset can also be an Elastic Compute Service (ECS) instance or Server Load Balancer (SLB) instance that is assigned a public IP address.

Operation description

You can call the DescribeDdosEventList operation to query the details of the DDoS attack events that occur on an asset by page. The details include the start time, end time, and status of each DDoS attack event.

Limits

You can call this operation up to 10 times per second per account. If the number of the calls per second exceeds the limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limit when you call this operation.

Debugging

OpenAPI Explorer automatically calculates the signature value. For your convenience, we recommend that you call this operation in OpenAPI Explorer.

Debug

Authorization information

There is currently no authorization information disclosed in the API.

Request parameters

Parameter	Type	Required	Description	Example
DdosRegionId	string	Yes	The region ID of the asset to query. Note You can call the DescribeRegions operation to query the most recent region list.	cn-hangzhou
InstanceType	string	Yes	The type of the asset to query. Valid values: ecs: ECS instance slb: SLB instance eip: EIP	ecs
InstanceId	string	Yes	The ID of asset to query. Note You can call the DescribeInstance operation to query the IDs of ECS instances, SLB instances, and EIPs within the current Alibaba Cloud account.	i-bp10bclrt56fblts****
CurrentPage	integer	No	The number of the page to return. Default value: 1.	1
PageSize	integer	No	The number of entries to return on each page. Default value: 10.	10
InternetIp	string	No	The IP address of the asset to query.	121.199.XX.XX

Response parameters

Parameter	Type	Description	Example
	object
Total	integer	The total number of DDoS attack events.	1
RequestId	string	The ID of the request, which is used to locate and troubleshoot issues.	BC0907F8-A9F3-5E11-977B-D59CD98C64ED
DdosEventList	object []	An array that consists of the details of a DDoS attack event.
DdosType	string	The type of the DDoS attack event. Valid values: defense: an attack event that triggers traffic scrubbing blackhole: an attack event that triggers blackhole filtering	blackhole
EndTime	long	The end time of the DDoS attack event. The value is a UNIX timestamp. Unit: milliseconds.	1637817679000
StartTime	long	The start time of the DDoS attack event. The value is a UNIX timestamp. Unit: milliseconds.	1637812279000
DelayTime	long	The time of the last attack. The value is a UNIX timestamp. Unit: milliseconds. Note This parameter is returned only when the asset is attacked multiple times within a DDoS attack event.	1637817679000
DdosStatus	string	The status of the DDoS attack event. Valid values: mitigating: indicates that traffic scrubbing is in progress. blackholed: indicates that blackhole filtering is triggered for the asset. normal: indicates that the DDoS attack event ends.	normal
UnBlackholeTime	long	The time when blackhole filtering is deactivated. The value is a UNIX timestamp. Unit: milliseconds. Note This parameter is returned only when the value of the DdosType parameter is blackhole.	1637814079000

Examples

Sample success responses

JSONformat

{
  "Total": 1,
  "RequestId": "BC0907F8-A9F3-5E11-977B-D59CD98C64ED",
  "DdosEventList": {
    "DdosEvent": [
      {
        "DdosType": "blackhole",
        "EndTime": 1637817679000,
        "StartTime": 1637812279000,
        "DelayTime": 1637817679000,
        "DdosStatus": "normal",
        "UnBlackholeTime": 1637814079000
      }
    ]
  }
}

Error codes

For a list of error codes, visit the Service error codes.