All Products
Search

This Product

    Managed Security Service:SendCustomEvent

    Document Center

    Managed Security Service:SendCustomEvent

    Last Updated:Sep 09, 2026

    Sends a custom alert event.

    Try it now

    Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

    Test

    RAM authorization

    No authorization for this operation. If you encounter issues with this operation, contact technical support.

    Request parameters

    Parameter

    Type

    Required

    Description

    Example
    CustomerId

    string

    Yes

    The user ID.

    1214484929940219
    DataSource

    string

    No

    The data source.

    aegis_suspicious_event
    EventDescription

    string

    No

    The event details.

    疑似病毒木马启动运行。
    EventDetails

    string

    No

    The alert event details.

    [{"name":"提示","type":"text","value":"在您的系统上发现可疑进程启动行为，通常与病毒木马或入侵事件相关"},{"name":"ATT&CK攻击阶段","type":"text","value":"代码执行"},{"name":"恶意行为","type":"text","value":"可疑的漏洞利用代码执行"},{"name":"规则类型","type":"text","value":"进程启动"},{"name":"规则引擎","type":"text","value":"精准攻击识别引擎"},{"name":"处置动作","type":"text","value":"阻断行为"},{"name":"进程路径","type":"text","value":"/usr/bin/python3.9"},{"name":"命令行","type":"text","value":"python3 /root/poc/python/cve-2018-15473.py --username root --port 22"},{"name":"父进程路径","type":"text","value":"/bin/gunkit"},{"name":"父进程命令行","type":"text","value":"gunkit serve-grpc --addr unix:///data/gunkit-grpc.sock"},{"name":"进程ID","type":"text","value":"22714"},{"name":"父进程ID","type":"text","value":"2986"},{"name":"描述","type":"text","value":"主动防御检测到可疑进程启动行为，这类可疑进程通常存在于特殊的系统目录，或通过后缀伪装成文档/音频/图片等文件诱导用户运行，该异常行为已被成功拦截"},{"name":"处置建议","type":"text","value":"请您及时排查是否是正常的业务操作，如果您觉得此次拦截是非预期的，那您可以在主动防御 - 恶意行为防御页面中，关闭“可疑进程启动“规则集或者将受影响机器从管理主机中移除"},{"name":"父进程关系","type":"processChain","value":"1:::/usr/lib/systemd/systemd --switched-root --system --deserialize 22 &&& 2939:::/usr/local/bin/containerd-shim-runc-v2 -namespace moby -id 270f164903b47d4e219b410b8d11d9079a7ad1bac8133aea604598300d3b03d5 -address /run/containerd/containerd.sock &&& 2962:::/usr/bin/python3 /usr/bin/supervisord -n &&& 2986:::gunkit serve-grpc --addr unix:///data/gunkit-grpc.sock"}]
    EventName

    string

    Yes

    The event name.

    客户端离线 Client offline
    EventType

    string

    Yes

    The event type.

    Valid values:

    • SUMMARY_REPORT :

      summary report.

    • MONTH_REPORT :

      monthly report.

    • SYSTEM_EVENT :

      system event.

    • OTHER_REPORTS :

      other reports.

    • PLATFORM_VULNERABILITY_MONITOR :

      vulnerability scan monitoring.

    • PROJECT_SUMMARY_MEETING :

      project summary meeting.

    • CUSTOM_EVENT :

      custom event.

    • SLS_LOG_SUSP_EVENT :

      Security Center - LOG.

    • CUSTOMER_VIEW :

      customer follow-up.

    • MANUAL :

      manual.

    • RISK_NOTIFY :

      risk notification.

    • SUSP_CUSTOM_CFW :

      MDR_CFW event.

    • PROJECT_LAUNCH_MEETING :

      project launch meeting.

    • SYSTEM_VULNERABILITY_SCAN :

      scanner vulnerability scan.

    • RISK_BRIEFING :

      risk briefing.

    • DING_TALK_CUSTOMER :

      customer DingTalk consultation.

    • SUSP_CUSTOM_SAS :

      MDR_SAS event.

    • SYSTEM_SECURITY_EVENT :

      security event.

    • SYSTEM_SECURITY_ACCESS :

      security assessment.

    • SYSTEM_PROJECT_DELIVERY :

      project delivery.

    • SUSP_CUSTOM_WAF :

      MDR_WAF event.

    • SUSP_EVENT :

      Security Center - SUSP_EVENT.

    • PROJECT_QUARTERLY_MEETING :

      project quarterly meeting.

    • SUSP_CUSTOM_DDOS :

      MDR_DDOS event.

    • SUSP_CUSTOM_OTHER :

      MDR_Other event.

    • QUARTERLY_REPORT :

      quarterly report.

    • SUSP_CUSTOM_EVENT :

      custom event.

    • YUNDUN_VULNERABILITY_SCAN :

      Security Center vulnerability scan.

    SUSP_CUSTOM_CFW
    OccurrenceTime

    integer

    No

    The time when the alert event first occurred.

    1724956996000
    FindTime

    integer

    Yes

    The time when the alert was detected.

    2023-04-23 14:47:34
    InstanceId

    string

    No

    The instance ID.

    i-uf60h3ns25bzq9eyf8ps
    InstanceName

    string

    No

    The instance name.

    猫吉-售卖-MDR扫描器集群1
    IsSend

    string

    Yes

    Specifies whether to send the event.

    0
    Level

    string

    Yes

    The event level.

    Valid values:

    • serious :

      critical.

    • suspicious :

      suspicious.

    • remind :

      reminder.

    serious
    Product

    string

    No

    The product name.

    CloudSecCenter
    UniqueId

    string

    Yes

    The unique ID.

    68888f02-98f2-492b-a2b2-5b13295755b7
    Uuid

    string

    No

    The UUID.

    93B6CDAB-7D2E-33D2-9EBA-25D561A2E95F
    EventMarkdown

    string

    No

    The event details in Markdown format.

    None

    Response elements

    Element

    Type

    Description

    Example

    object

    The response.

    Data

    object

    The data returned by the operation.

    Id

    integer

    The ticket ID.

    1914348
    WorkTaskName

    string

    The ticket name.

    22端口禁止任意IP访问

    EventId

    string

    The alert ID.

    c0dc71d1-8a1d-4043-9767-f6c420e34901-81bd
    EventType

    string

    The alerting type.

    SUSP_CUSTOM_WAF
    CustomerId

    string

    The service UID.

    1601097845544644
    CustomerName

    string

    The customer name.

    Tianjin Ruipengsheng Technology Development Co., Ltd
    OwnerId

    string

    The owner.

    352675
    OwnerName

    string

    The owner name.

    Le Ya
    RequestId

    string

    The request ID.

    606EB377-155D-5AEB-AC4F-F013444A4C45
    Code

    string

    The response code.

    200
    Message

    string

    The returned message. If the request is successful, a success message is returned. If the request fails, the failure reason is returned.

    successful
    HttpStatusCode

    integer

    The HTTP status code.

    200
    Success

    boolean

    Indicates whether the call was successful. Valid values:

    • true: The call was successful.

    • false: The call failed.

    true

    Examples

    Success response

    JSON format

    {
  "Data": {
    "Id": 1914348,
    "WorkTaskName": "22端口禁止任意IP访问 ",
    "EventId": "c0dc71d1-8a1d-4043-9767-f6c420e34901-81bd",
    "EventType": "SUSP_CUSTOM_WAF",
    "CustomerId": "1601097845544644",
    "CustomerName": "天津瑞鹏昇科技发展有限公司",
    "OwnerId": "352675",
    "OwnerName": "乐牙"
  },
  "RequestId": "606EB377-155D-5AEB-AC4F-F013444A4C45",
  "Code": "200",
  "Message": "successful",
  "HttpStatusCode": 200,
  "Success": true
}

    Error codes

    See Error Codes for a complete list.

    Release notes

    See Release Notes for a complete list.