Attack Analysis Data API Reference - Security Center - Alibaba Cloud - Security Center

Note

This API has been deprecated. We recommend migrating to Sas(2018-12-03) - ListAttackEventInfo for enhanced functionality and continued support. While the deprecated API remains temporarily accessible, no further updates or bug fixes will be provided.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

yundun-sas:DescribeAttackAnalysisData

get

*All Resource

*

None

Request parameters

Parameter	Type	Required	Description	Example
Lang	string	No	The language of the content within the request and response. Default value: zh. Valid values: zh: Chinese en: English	zh
Type	string	Yes	The details of attack analysis. Valid values: TOTAL: number of attacks TREND: attack trend PIE_CHART: distribution of attacks by type SOURCE_TOP: top 5 attack sources CLIENT_TOP: top 5 attacked assets DETAILS: attack details Note If the Type parameter is set to DETAILS, you must specify the CurrentPage and PageSize parameters.	DETAILS
StartTime	integer	Yes	The timestamp at which the attack starts. By default, the statistics of the previous seven days are queried. Unit: seconds. Note The start time that you specify must be within the previous 40 days.	1644027670
EndTime	integer	Yes	The timestamp when the attack stops. Unit: seconds.	1649040221
Data	string	No	The condition that is used to filter attack events. Note The following list describes the valid values of crack_type: 3: brute-force attack on MySQL 4: FTP brute-force attack 5: SSH brute-force attack 6: RDP brute-force attack 9: brute-force attack on Microsoft SQL Server 101: intercepted attack on Java Struts 2 102: intercepted attack on Redis 103: communication with AntSword Webshell 104: communication with China Chopper Webshell 133: communication with XISE Webshell sqli: SQL injection codei: code execution xss: cross-site scripting (XSS) lfi: local file inclusion rfi: remote file inclusion webshell: trojan script upload: vulnerability upload path: directory traversal bypass: unauthorized access csrf: cross-site request forgery (CSRF) crlf: carriage return line feed (CRLF) other: others	{"crack_type":"9"}
Base64	string	No	Specifies whether to encode the value of the client_url field in the query results by using the Base64 algorithm. Valid values: true: yes false: no	true
CurrentPage	integer	No	The number of the page to return. Pages start from page 1. Note If the Type parameter is set to DETAILS, you must specify the CurrentPage parameter.	1
PageSize	integer	No	The number of entries to return on each page. Note If the Type parameter is set to DETAILS, you must specify the PageSize parameter.	10

Response elements

Element	Type	Description	Example
	object	The returned data.
Data	string	The attack events. Valid values: client_url: the URL of the attack request. internetIp: the IP address of the asset. instanceName: the name of the asset. table_src: the data source. uuid: the UUID of the asset. crack_method: the method of the attack request. crack_hour: the attack time. crack_src_ip: the IP address from which the attack is launched. instanceId: the ID of the asset. dst_port: the attacked port. client_ip: the attacked IP address. location: the region from which the attack is launched. aliuid: the ID of the Alibaba Cloud account. crack_cnt: the number of times that the attack is launched. crack_type: the type of the attack. Valid values: 113: improper authorization. 112: redirection attack. upload: vulnerability upload. other: others. webshell: trojan script. 201: suspicious connection. 9: brute-force attack on Microsoft SQL Server. 5: SSH brute-force attack. 6: RDP brute-force attack. lfi: local file inclusion. 7: code execution. sqli: SQL injection. 209: web attack. 31: buffer overflow. 3: brute-force attack on MySQL. 30: clickjacking. 4: FTP brute-force attack. bypass: unauthorized access. 33: format string. deeplearning: others. 32: integer overflow. 203: brute-force attack. 34: race condition. rfi: remote file inclusion. 0: SQL injection attack. 212: mining behavior. 213: reverse shell. 211: worm. 61: session timeout. 20: directory traversal. xss: XSS attack. 22: unauthorized access. 21: scan attack. 24: file modification. 26: file deletion. 25: file reading. 28: CRLF injection. 27: logic error. 29: template injection. csrf: CSRF. path: directory traversal. crlf: CRLF. 102: CSRF. 103: server-side request forgery (SSRF). 101: XSS. 11: file inclusion. 10: file upload. 12: vulnerability upload. 15: unauthorized access. 14: information leakage. 17: XML entity injection. 16: insecure configuration. 19: Lightweight Directory Access Protocol (LDAP) injection. 18: XPath injection. codei: code execution. ai_webshell: intelligent defense against webshell upload. alinet_webrce: adaptive web attack defense. 210: JSP webshell upload. 161: webshell upload.	[{\"crack_hour\":1662480000000,\"crack_cnt\":471},{\"crack_hour\":1662483600000,\"crack_cnt\":461},{\"crack_hour\":1662487200000,\"crack_cnt\":445},{\"crack_hour\":1662490800000,\"crack_cnt\":471},{\"crack_hour\":1662494400000,\"crack_cnt\":534},{\"crack_hour\":1662498000000,\"crack_cnt\":652},{\"crack_hour\":1662501600000,\"crack_cnt\":706},{\"crack_hour\":1662505200000,\"crack_cnt\":613},{\"crack_hour\":1662508800000,\"crack_cnt\":578},{\"crack_hour\":1662512400000,\"crack_cnt\":577},{\"crack_hour\":1662516000000,\"crack_cnt\":616},{\"crack_hour\":1662519600000,\"crack_cnt\":597},{\"crack_hour\":1662523200000,\"crack_cnt\":575},{\"crack_hour\":1662526800000,\"crack_cnt\":507}]
PageSize	integer	The number of entries returned per page. Default value: 10.	10
RequestId	string	The ID of the request, which is used to locate and troubleshoot issues.	4C1AE3F3-18FA-4108-BBB9-AFA1A032756C
Total	integer	The total number of attack events returned.	1000
Page	integer	The page number of the returned page.	1

Examples

Success response

JSON format

{
  "Data": "[{\\\"crack_hour\\\":1662480000000,\\\"crack_cnt\\\":471},{\\\"crack_hour\\\":1662483600000,\\\"crack_cnt\\\":461},{\\\"crack_hour\\\":1662487200000,\\\"crack_cnt\\\":445},{\\\"crack_hour\\\":1662490800000,\\\"crack_cnt\\\":471},{\\\"crack_hour\\\":1662494400000,\\\"crack_cnt\\\":534},{\\\"crack_hour\\\":1662498000000,\\\"crack_cnt\\\":652},{\\\"crack_hour\\\":1662501600000,\\\"crack_cnt\\\":706},{\\\"crack_hour\\\":1662505200000,\\\"crack_cnt\\\":613},{\\\"crack_hour\\\":1662508800000,\\\"crack_cnt\\\":578},{\\\"crack_hour\\\":1662512400000,\\\"crack_cnt\\\":577},{\\\"crack_hour\\\":1662516000000,\\\"crack_cnt\\\":616},{\\\"crack_hour\\\":1662519600000,\\\"crack_cnt\\\":597},{\\\"crack_hour\\\":1662523200000,\\\"crack_cnt\\\":575},{\\\"crack_hour\\\":1662526800000,\\\"crack_cnt\\\":507}]",
  "PageSize": 10,
  "RequestId": "4C1AE3F3-18FA-4108-BBB9-AFA1A032756C",
  "Total": 1000,
  "Page": 1
}

Error codes

HTTP status code	Error code	Error message	Description
400	-101	Invalid parameter value.	Invalid parameter.
400	UserInstanceVersionNotSupportAttackAnalysisData	Attack analysis data is not supported for the instance version.	The user instance version does not support viewing attack analysis data.
500	ServerError	ServerError
403	NoPermission	caller has no permission	You are not authorized to do this operation.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.