GetSuspEventSummary - Managed Security Service - Alibaba Cloud Documentation Center

Retrieves statistics of security alerts.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

yundun-mss:GetSuspEventSummary

list

*All Resource

*

None

Request parameters

Parameter	Type	Required	Description	Example
DateType	string	Yes	The time filter type. You can filter by the last 7 days, last 30 days, last half year, or a custom time range. Valid values: oneYear : last year. month : last 30 days. halfYear : last half year. customize : custom time range.	month
StartDate	integer	Yes	The start time.	1729478485000
EndDate	integer	Yes	The end time.	1732156885986
SuspEventSource	string	No	The source of the alert event. Valid values: SYSTEM_SECURITY_EVENT : legacy data source of Security Center alerts. SUSP_CUSTOM_WAF : MDR_WAF events. SUSP_EVENT : Security Center. SUSP_CUSTOM_DDOS : MDR_DDOS events. SUSP_CUSTOM_CFW : MDR_CFW events.	SUSP_EVENT

Response elements

Element	Type	Description	Example
	object	The response.
Data	object	The data returned by the operation.
SuspEventDealSummaryDTO	object	The alert handling summary.
WaitHandleCount	integer	Number of unhandled alerts.	10
HandingCount	integer	In progress.	5
CompletedCount	integer	Completed.	20
TotalCount	integer	Total number of alerts.	35
HandingRate	string	Alert handling rate.	90
TotalGrowthRate	string	Year-over-year comparison of alerts.	10
SuspEventTrendDTO	object	The alert response trend.
TrendList	array<object>	Trend of alerts.
	object	Data object.
Date	string	Time point.	202405或者20240501
DealCount	integer	Number of handled alerts.	10
FindCount	integer	Number of discovered alerts.	15
SuspEventTopDTO	object	The top 10 alerts before handling.
SuspEventList	array<object>	Top 10 before handling alarms
	object	Data object.
EventName	string	Alert name.	主动外连风险 IP
TaskCount	integer	Count.	7
NetworkAttackTrendDTO	object	The network attack trend.
TrendList	array<object>	Collection of trend nodes for each attack item.
	object	Data object.
Date	string	Date.	202409或20240901
DdosCount	integer	DDoS count.	10
WafCount	integer	WAF count.	10
EipCount	integer	EIP count.	10
RequestId	string	The request ID.	9B2DAE9B-B901-5818-AFEF-E5637D938280
Code	string	The response code.	200
Message	string	The message returned for the result.	Successful!
HttpStatusCode	integer	The HTTP status code.	200
Success	boolean	Indicates whether the call was successful. Valid values: true: The call was successful. false: The call failed.	true

Examples

Success response

JSON format

{
  "Data": {
    "SuspEventDealSummaryDTO": {
      "WaitHandleCount": 10,
      "HandingCount": 5,
      "CompletedCount": 20,
      "TotalCount": 35,
      "HandingRate": "90",
      "TotalGrowthRate": "10"
    },
    "SuspEventTrendDTO": {
      "TrendList": [
        {
          "Date": "202405或者20240501",
          "DealCount": 10,
          "FindCount": 15
        }
      ]
    },
    "SuspEventTopDTO": {
      "SuspEventList": [
        {
          "EventName": "主动外连风险 IP",
          "TaskCount": 7
        }
      ]
    },
    "NetworkAttackTrendDTO": {
      "TrendList": [
        {
          "Date": "202409或20240901",
          "DdosCount": 10,
          "WafCount": 10,
          "EipCount": 10
        }
      ]
    }
  },
  "RequestId": "9B2DAE9B-B901-5818-AFEF-E5637D938280",
  "Code": "200",
  "Message": "Successful!",
  "HttpStatusCode": 200,
  "Success": true
}

Error codes

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.