GetAlarmDetailById - Managed Security Service - Alibaba Cloud Documentation Center

Queries the details of an alert.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

yundun-mss:GetAlarmDetailById

get

*All Resource

*

None

Request parameters

Parameter	Type	Required	Description	Example
Id	integer	Yes	The primary key ID.	20077761

Response elements

Element	Type	Description	Example
	object	The response.
Data	object	The data returned by the operation.
EventDetails	array<object>	The event details.
	object	The data object.
NameDisplay	string	Alarm event display name.	Login with unusual location
ValueDisplay	string	Path where the alarm event occurred.	/etc/crontab
Type	string	Alarm event type.	text
Value	string	Path where the alarm event occurred.	/etc/crontab
Desc	string	The description.	webshell
TacticDisplayName	string	The ATT&CK tactic name.	Malicious scripts-Malicious script code execution
AlarmEventTypeDisplay	string	The alerting event type.	Login with unusual location
ContainHwMode	boolean	Indicates whether critical event protection mode is enabled. Valid values: true: Enabled. false: Not enabled.	false
AlarmId	integer	The alert ID.	202427220
AlarmSource	string	The alert source.	SUSP_EVENT
AlarmName	string	The alert name.	负载均衡可挂载服务器数量告警
AlarmTime	string	The most recent alert time.	2018-09-26 01:51:01
DealTime	string	The time when the alert was handled.	2018-09-26 01:51:01
Status	string	The handling status.	要查询的告警事件状态。取值： 0：全部 1：待处理 2：已忽略 4：已确认 8：已标记为误报 16：处理中 32：处理完毕 64：已经过期 128：已经删除 512：自动拦截中 513：自动拦截完毕
OwnerId	string	The owner.	324546
Remark	string	The handling method.	192.168.XX.XX
InstanceName	string	The affected asset.	nginx
EventLevel	string	The alert level.	suspicious
OccurrenceTime	string	The time when the alert first occurred.	2018-09-26 01:51:01
InternetIp	string	The public IP address.	47.116.126.79
IntranetIp	string	The internal IP address.	172.19.195.176
Id	integer	The primary key ID of the ticket.	9772
AlarmEventType	string	The alerting event type.	Unusual Logon
AnalysisResult	string	The analysis process.	[{"value":"服务器可能已被黑客攻击，存在恶意进程在运行。分析过程：告警显示，服务端存在一个名为”dns.exe”的进程在访问”polling.burpcollaborator.net”，这是一个被黑名单列出的恶意域名。在正常情况下,”dns.exe”不应该单独存在于系统的路径下，并且也不应该访问这类恶意域名。因此，这个进程可能是黑客留下的恶意进程。","key":"结论"},{"value":"尽快对服务器进行全面扫描，清除恶意进程。同时，联系网络安全专家进行深入调查，以确定是否有其他潜在的安全威胁。","key":"处置建议"}]
RequestId	string	The request ID.	5C1B0668-442C-57AE-9668-D894B0B012EB
Code	string	The response code.	200
Message	string	The returned message.	successful
HttpStatusCode	integer	The HTTP status code.	200
Success	boolean	Indicates whether the operation was successful. Valid values: true: Successful. false: Failed.	true

Examples

Success response

JSON format

{
  "Data": {
    "EventDetails": [
      {
        "NameDisplay": "Login with unusual location",
        "ValueDisplay": "/etc/crontab",
        "Type": "text",
        "Value": "/etc/crontab"
      }
    ],
    "Desc": "webshell",
    "TacticDisplayName": "Malicious scripts-Malicious script code execution",
    "AlarmEventTypeDisplay": "Login with unusual location",
    "ContainHwMode": false,
    "AlarmId": 202427220,
    "AlarmSource": "SUSP_EVENT",
    "AlarmName": "负载均衡可挂载服务器数量告警",
    "AlarmTime": "2018-09-26 01:51:01",
    "DealTime": "2018-09-26 01:51:01",
    "Status": "要查询的告警事件状态。取值：\n\n0：全部\n1：待处理\n2：已忽略\n4：已确认\n8：已标记为误报\n16：处理中\n32：处理完毕\n64：已经过期\n128：已经删除\n512：自动拦截中\n513：自动拦截完毕",
    "OwnerId": "324546",
    "Remark": "192.168.XX.XX",
    "InstanceName": "nginx",
    "EventLevel": "suspicious",
    "OccurrenceTime": "2018-09-26 01:51:01",
    "InternetIp": "47.116.126.79",
    "IntranetIp": "172.19.195.176",
    "Id": 9772,
    "AlarmEventType": "Unusual Logon",
    "AnalysisResult": "[{\"value\":\"服务器可能已被黑客攻击，存在恶意进程在运行。 分析过程：告警显示，服务端存在一个名为”dns.exe”的进程在访问”polling.burpcollaborator.net”，这是一个被黑名单列出的恶意域名。在正常情况下,”dns.exe”不应该单独存在于系统的路径下，并且也不应该访问这类恶意域名。因此，这个进程可能是黑客留下的恶意进程。\",\"key\":\"结论\"},{\"value\":\"尽快对服务器进行全面扫描，清除恶意进程。同时，联系网络安全专家进行深入调查，以确定是否有其他潜在的安全威胁。\",\"key\":\"处置建议\"}]"
  },
  "RequestId": "5C1B0668-442C-57AE-9668-D894B0B012EB",
  "Code": "200",
  "Message": "successful",
  "HttpStatusCode": 200,
  "Success": true
}

Error codes

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.