All Products
Search

This Product

    Managed Security Service:GetSuspEventPage

    Document Center

    Managed Security Service:GetSuspEventPage

    Last Updated:Sep 09, 2026

    Queries alert handling records.

    Try it now

    Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

    Test

    RAM authorization

    The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

    • Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.

    • API: The API that you can call to perform the action.

    • Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.

    • Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.

      • For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.

      • For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.

    • Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.

    • Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

    Action

    Access level

    Resource type

    Condition key

    Dependent action

    yundun-mss:GetSuspEventPage

    list

    *All Resource

    *

    		 None None

    Request parameters

    Parameter

    Type

    Required

    Description

    Example
    CurrentPage

    integer

    Yes

    The current page number.

    1
    PageSize

    integer

    Yes

    The number of entries per page.

    10
    Source

    string

    No

    The alert source.

    Valid values:

    • SYSTEM_SECURITY_EVENT :

      Legacy data source of Security Center alerts.

    • SUSP_CUSTOM_WAF :

      MDR_WAF event.

    • SUSP_EVENT :

      Security Center.

    • SUSP_CUSTOM_DDOS :

      MDR_DDOS event.

    • SUSP_CUSTOM_CFW :

      MDR_CFW event.

    SUSP_EVENT
    Status

    integer

    No

    The handling status.

    Valid values:

    • 1 :

      pending.

    • 2 :

      processing.

    • 3 :

      completed.

    • 4 :

      false positive.

    • 5 :

      ignored.

    • 15 :

      whitelisted in the console.

    • 16 :

      whitelisted on the customer side.

    1
    AlarmStartTime

    integer

    No

    The start time of the alert.

    1722515522000
    AlarmEndTime

    integer

    No

    The end time of the alert.

    1732515522000

    Response elements

    Element

    Type

    Description

    Example

    object

    The response.

    PageInfo

    object

    The pagination information.

    CurrentPage

    integer

    The page number of the current page in a paging query.

    1
    PageSize

    integer

    The number of entries per page in the returned data.

    10
    TotalCount

    integer

    The total number of entries in the query result.

    100
    Data

    array<object>

    The data returned by the operation.

    object

    The data object.

    AlarmId

    integer

    The alert ID.

    5b1eeebe4f22daa2b177298234214fa3
    AlarmSource

    string

    The alert source.

    SUSP_EVENT
    AlarmName

    string

    The alert name.

    Web服务漏洞利用
    AlarmTime

    string

    The most recent alert time.

    1722515522000

    DealTime

    string

    The time when the alert was handled.

    1732515522000

    Status

    string

    The handling status.

    Valid values:

    • 1 :

      Unhandled.

    • 2 :

      processing.

    • 3 :

      Handled.

    • 4 :

      Handled.

    • 5 :

      Handled.

    • 15 :

      Handled.

    • 16 :

      Handled.

    未处理
    OwnerId

    string

    The owner.

    张三
    Remark

    string

    The handling method.

    处理完成
    InstanceName

    string

    The affected asset.

    shells-azhou
    EventLevel

    string

    The alert level.

    Valid values:

    • serious :

      Critical.

    • suspicious :

      Suspicious.

    • remind :

      Reminder.

    suspicious
    OccurrenceTime

    string

    The time of the first occurrence.

    该字段暂未使用，有问题请联系管理员
    InternetIp

    string

    The public IP address.

    47.99.188.31
    IntranetIp

    string

    The internal IP address.

    172.16.109.130
    Id

    integer

    The primary key ID of the ticket.

    9947
    AlarmEventType

    string

    The alert event type.

    精准防御
    AnalysisResult

    string

    The analysis process.

    [{"value":"服务器可能已被黑客攻击，存在恶意进程在运行。 分析过程：告警显示，服务端存在一个名为”dns.exe”的进程在访问”polling.burpcollaborator.net”，这是一个被黑名单列出的恶意域名。在正常情况下,”dns.exe”不应该单独存在于系统的路径下，并且也不应该访问这类恶意域名。因此，这个进程可能是黑客留下的恶意进程。","key":"结论"},{"value":"尽快对服务器进行全面扫描，清除恶意进程。同时，联系网络安全专家进行深入调查，以确定是否有其他潜在的安全威胁。","key":"处置建议"}]
    RequestId

    string

    The request ID.

    AFA6F7B7-7C4B-58BB-B8FB-E0FFA4483561
    Code

    string

    The response code.

    OK
    Message

    string

    The message returned with the result.

    system error
    HttpStatusCode

    integer

    The HTTP status code.

    200
    Success

    boolean

    Indicates whether the call was successful.

    • true: The call was successful.

    • false: The call failed.

    true

    Examples

    Success response

    JSON format

    {
  "PageInfo": {
    "CurrentPage": 1,
    "PageSize": 10,
    "TotalCount": 100
  },
  "Data": [
    {
      "AlarmId": 0,
      "AlarmSource": "SUSP_EVENT",
      "AlarmName": "Web服务漏洞利用",
      "AlarmTime": "1722515522000\n",
      "DealTime": "1732515522000\n",
      "Status": "未处理",
      "OwnerId": "张三",
      "Remark": "处理完成",
      "InstanceName": "shells-azhou",
      "EventLevel": "suspicious",
      "OccurrenceTime": "该字段暂未使用，有问题请联系管理员",
      "InternetIp": "47.99.188.31",
      "IntranetIp": "172.16.109.130",
      "Id": 9947,
      "AlarmEventType": "精准防御",
      "AnalysisResult": "[{\"value\":\"服务器可能已被黑客攻击，存在恶意进程在运行。 分析过程：告警显示，服务端存在一个名为”dns.exe”的进程在访问”polling.burpcollaborator.net”，这是一个被黑名单列出的恶意域名。在正常情况下,”dns.exe”不应该单独存在于系统的路径下，并且也不应该访问这类恶意域名。因此，这个进程可能是黑客留下的恶意进程。\",\"key\":\"结论\"},{\"value\":\"尽快对服务器进行全面扫描，清除恶意进程。同时，联系网络安全专家进行深入调查，以确定是否有其他潜在的安全威胁。\",\"key\":\"处置建议\"}]"
    }
  ],
  "RequestId": "AFA6F7B7-7C4B-58BB-B8FB-E0FFA4483561",
  "Code": "OK",
  "Message": "system error",
  "HttpStatusCode": 200,
  "Success": true
}

    Error codes

    See Error Codes for a complete list.

    Release notes

    See Release Notes for a complete list.