DescribeCloudCenterInstances API Overview - Security Center - Alibaba Cloud - Security Center

Sets search conditions to perform a conditional query for asset information that matches the specified criteria, such as asset instance name or asset instance region. Both pagination and NextToken methods are supported. The NextToken method is recommended.

Operation description

You can search for assets by instance ID, instance name, VPC ID, region, public IP address, and other conditions. You can also set logical relationships between different search conditions to search for assets that match multiple criteria.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

No authorization for this operation. If you encounter issues with this operation, contact technical support.

Request parameters

Parameter	Type	Required	Description	Example
RegionId `deprecated`	string	No	The ID of the region in which the instance resides.	cn-hangzhou
Criteria	string	No	The search conditions for assets. This parameter is in JSON format. Note that the parameter names are case-sensitive. Note You can search for assets by instance ID, instance name, VPC ID, region, public IP address, and other conditions. Call the DescribeCriteria operation to query the supported search conditions.	[{"name":"riskStatus","value":"YES"},{"name":"internetIp","value":"1.2.XX.XX"}]
MachineTypes	string	No	The type of asset to query. Valid values: ecs: server cloud_product: cloud product eci: elastic container instance rund: RunD container instance runc: RunC container instance	ecs
LogicalExp	string	No	The logical relationship between multiple search conditions. Default value: OR. Valid values: OR: The search conditions are in an OR relationship. AND: The search conditions are in an AND relationship.	OR
PageSize	integer	No	The number of entries per page in a paged query. Default value: 20.	100
CurrentPage	integer	No	The page number of the first page to return. Default value: 1.	1
Importance	integer	No	The importance of the asset. Valid values: 2: important asset 1: general asset 0: test asset	2
NoGroupTrace	boolean	No	Specifies whether to skip internationalization processing for the default group Ungrouped in Security Center. Default value: false. Valid values: true: Internationalization processing is skipped. When the value of the GroupTrace response parameter is the Security Center default group Ungrouped, it is displayed as 未分组. false: Internationalization processing is applied. When the value of the GroupTrace response parameter is the Security Center default group Ungrouped, it is displayed as default.	false
Lang	string	No	The language of the request and response. Default value: zh. Valid values: zh: Chinese en: English	zh
UseNextToken	boolean	No	Specifies whether to use the NextToken method to retrieve asset list data. If this parameter is set to true, TotalCount is no longer returned. Valid values: true: Uses the NextToken method. false: Does not use the NextToken method.	false
NextToken	string	No	The NextToken value returned when the NextToken method is used. Leave this parameter empty for the first request.	E17B501887A2D3AA5E8360A6EFA3B***
ResourceDirectoryAccountId	integer	No	The Alibaba Cloud account ID of the member accounts in the resource folder. Note Invoke the DescribeMonitorAccounts operation to obtain this parameter.	1232428423234****
Flags	string	No	The asset vendor. Separate multiple vendors with commas (,). Valid values: 0: Alibaba Cloud asset 1: non-cloud asset 2: IDC asset 3, 4, 5, 7, 14, 16: third-party cloud asset 8: lightweight asset 9: SAE 10: PAI	1,2,3

Response elements

Element	Type	Description	Example
	object
Success	boolean	Indicates whether the call was successful. Valid values: true: The call was successful. false: The call failed.	true
RequestId	string	The request ID, which is a unique identifier generated by Alibaba Cloud for the request. You can use this ID to troubleshoot issues.	32A73759-4C0F-4801-BE98-901223ACEE9A
PageInfo	object	The pagination information.
CurrentPage	integer	The page number of the current page in a paged query.	1
PageSize	integer	The number of entries per page in a paged query. Default value: 20.	20
TotalCount	integer	The total number of assets returned.	50
Count	integer	The number of assets on the current page.	10
NextToken	string	The NextToken value returned when the NextToken method is used.	B604532DEF982B875E8360A6EFA3B***
Instances	array<object>	The list of asset details.
	object	The asset details.
Status	string	The running status of the instance. Valid values: Running: Running. notRunning: Stopped.	Running
CpuInfo	string	The CPU information of the asset.	Intel(R) Xeon(R) Platinum 8269CY CPU @ 2.50GHz
InternetIp	string	The public IP address of the instance.	1.2.XX.XX
Kernel	string	The kernel version information.	3.10.0-1127.19.1.el7.x86_64
Bind	boolean	Indicates whether the asset is bound to an authorization. Valid values: true: Bound. false: Not bound.	true
OsName	string	The kernel version of the instance.	-
Tag	string	The tag name of the asset instance.	InternetIp,test
ClientStatus	string	The online status of the client on the instance. Valid values: online: Online. The Agent client status is Enabled. offline: Offline. The Agent client status is Disabled. pause: Paused. The Agent client status is Protection Paused.	online
Mem	integer	The memory size, in MB.	1024
VpcInstanceId	string	The ID of the VPC to which the instance belongs.	vpc-uf60agqq65bs98zoo****
TagId	string	The tag ID of the asset.	121313,41412
Flag	integer	Indicates whether the instance is an Alibaba Cloud asset. Valid values: 0: Alibaba Cloud asset 1: non-Alibaba Cloud asset	0
LastLoginTimestamp	integer	The timestamp when the client last went online. Unit: milliseconds.	1637592907000
AuthVersion	integer	The authorization version of the asset. Valid values: 1: Free Edition 6: Anti-virus Edition 5: Advanced 3: Enterprise Edition 7: Ultimate Edition 1: Free Edition 6: Anti-virus Edition 5: Advanced 3: Enterprise Edition 7: Ultimate Edition	1
Region	string	The ID of the region to which the instance belongs.	cn-hangzhou-cm*-*
InstanceName	string	The instance name.	yztest-l***
PodCount	integer	The number of pods.	1
VulCount	integer	The number of vulnerabilities on the instance.	2
HcStatus	string	Indicates whether baseline risks are detected on the instance. Valid values: YES: Baseline risks are detected. NO: No baseline risks are detected.	YES
CreatedTime	integer	The timestamp when the cluster was created. Unit: milliseconds.	1607365213000
GroupTrace	string	The name of the group to which the asset belongs.	default
ClusterId	string	The cluster ID.	c690a0789419f4284a4e0a29e12fe****
RiskStatus	string	Indicates whether security risks exist on the asset. Valid values: YES: Security risks exist. NO: No security risks exist.	NO
Cores	integer	The number of CPU cores of the asset.	4
VulStatus	string	Indicates whether vulnerabilities exist on the instance. Valid values: YES: Vulnerabilities exist. NO: No vulnerabilities exist.	YES
AlarmStatus	string	Indicates whether security alerts exist on the asset. Valid values: YES: Security alerts exist. NO: No security alerts exist.	NO
MacListString	string	The MAC address of the system.	00:13:3e:31:13:39,02:12:67:b8::
Importance	integer	The importance of the asset. Valid values: 2: important asset 1: general asset 0: test asset	2
HealthCheckCount	integer	The number of baseline risks on the instance.	1
Ip	string	The public IP address of the instance.	1.2.XX.XX
Os	string	The operating system of the instance.	Linux
AuthModifyTime	integer	The timestamp when the authorization was bound to the asset. Unit: milliseconds.	1627974044000
SafeEventCount	integer	The number of security alerts on the asset.	5
InstanceId	string	The instance ID.	i-m5***
AssetType	string	The type of the asset. Valid values: 0: server 1: load balancer 2: NAT gateway 3: ApsaraDB RDS database 4: ApsaraDB for MongoDB database 5: ApsaraDB for Redis database 6: container image 7: container	0
IntranetIp	string	The private IP address of the instance.	1.2.XX.XX
Vendor	integer	The asset vendor. Valid values: 0: Alibaba Cloud asset 1: non-cloud asset 2: IDC asset 3, 4, 5, 7, 14, 16: third-party cloud asset 8: lightweight asset 9: SAE 10: PAI	0
RegionId	string	The ID of the region in which the asset resides.	cn-hanghzou
Uuid	string	The UUID of the instance.	c9107c04-942f-40c1-981a-f1c1***
GroupId	integer	The ID of the group to which the instance belongs.	4120080
RegionName	string	The name of the region in which the asset resides.	China (Hangzhou)
VendorName	string	The name of the asset vendor. Valid values: ALIYUN: Alibaba Cloud OUT: non-cloud asset IDC: IDC TENCENT: third-party cloud HUAWEICLOUD: third-party cloud Microsoft: third-party cloud AWS: third-party cloud TRIPARTITE: lightweight server SAE: SAE PAI: PAI VOLCENGINE: third-party cloud google: third-party cloud	IDC
AuthVersionName	string	The name of the authorization version of the asset. Valid values: Free Edition Anti-virus Edition Advanced Enterprise Edition Ultimate Edition	Ultimate Edition
ClusterName	string	The cluster name.	cluster1
ExposedStatus	integer	The exposure status of the asset. Valid values: 0: Not exposed. 1: Exposed.	0
RiskCount	string	The risk statistics of the asset. The value is in JSON format and contains the following fields: account: the number of accounts with unusual logons or successful brute-force attacks appNum: the number of scanner vulnerabilities asapVulCount: the total number of high-priority vulnerabilities baselineHigh: the number of high-risk baseline risks baselineLow: the number of low-risk baseline risks baselineMedium: the number of medium-risk baseline risks baselineNum: the total number of cloud product configuration risks cmsNum: the number of Web-CMS vulnerabilities containerAsap: the number of high-priority container vulnerabilities containerLater: the number of medium-priority container vulnerabilities containerNntf: the number of low-priority container vulnerabilities containerRemind: the number of container reminder alerting events containerSerious: the number of container critical alerting events containerSuspicious: the number of container suspicious alerting events cveNum: the number of Linux vulnerabilities emgNum: the number of emergency vulnerabilities health: the number of unhandled baseline alerting events imageBaselineHigh: the number of high-risk image baseline risks imageBaselineLow: the number of low-risk image baseline risks imageBaselineMedium: the number of medium-risk image baseline risks imageBaselineNum: the total number of image baseline risks imageMaliciousFileRemind: the number of image reminder-level malicious files imageMaliciousFileSerious: the number of image critical-level malicious files imageMaliciousFileSuspicious: the number of image suspicious-level malicious files imageVulAsap: the number of high-priority image vulnerabilities imageVulLater: the number of medium-priority image vulnerabilities imageVulNntf: the number of low-priority image vulnerabilities laterVulCount: the number of medium-priority vulnerabilities newSuspicious: the number of alerting events nntfVulCount: the number of low-priority vulnerabilities remindNum: the number of reminder alerting events scaNum: the number of software composition analysis vulnerabilities seriousNum: the number of critical alerting events suspNum: the number of suspicious alerting events suspicious: the total number of alerting events sysNum: the number of Windows vulnerabilities trojan: the number of trojans uuid: the UUID of the asset vul: the number of vulnerabilities weakPWNum: the number of weak passwords	{ "account": 0, "appNum": 0, "asapVulCount": 0, "baselineHigh": 0, "baselineLow": 0, "baselineMedium": 0, "baselineNum": 0, "cmsNum": 0, "containerAsap": 0, "containerLater": 0, "containerNntf": 0, "containerRemind": 0, "containerSerious": 0, "containerSuspicious": 0, "cveNum": 0, "emgNum": 0, "health": 0, "imageBaselineHigh": 0, "imageBaselineLow": 0, "imageBaselineMedium": 0, "imageBaselineNum": 0, "imageMaliciousFileRemind": 0, "imageMaliciousFileSerious": 0, "imageMaliciousFileSuspicious": 0, "imageVulAsap": 0, "imageVulLater": 0, "imageVulNntf": 0, "laterVulCount": 0, "newSuspicious": 0, "nntfVulCount": 0, "remindNum": 0, "scaNum": 0, "seriousNum": 0, "suspNum": 0, "suspicious": 0, "sysNum": 0, "trojan": 0, "uuid": "inet-37316411-37fe-4b72-b245-346a2721****", "vul": 0, "weakPWNum": 0 }
IpListString	string	The IP address list of the system.	172.31.XX.XX,172.171.XX.XX
AssetTypeName	string	The name of the asset type.	Elastic Compute Service
FlagName	string	The asset vendor. Valid values: ALIYUN OUT IDC Tencent HUAWEICLOUD Azure AWS ASK TRIPARTITE SAE PAI google VOLCENGINE	ASK
AppId	string	The application ID. Note This field is returned only when Vendor is set to 9.	test
AppName	string	The application name. Note This field is returned only when Vendor is set to 9.	testAppName
ClientSubStatus	string	The sub-status of the client on the instance. Valid values: online: Online. The Agent client status is Enabled. offline: Offline. The Agent client status is Disabled. pause: Paused. The Agent client status is Protection Paused. uninstalled: Not installed. The Agent client is Not Installed. stopped: Server shut down. The Agent client status is Server Shut Down.	online
TagResources	string	The custom tags of the Lingjun AI Computing Service node. This field is returned only when the server is a Lingjun AI Computing Service server.	app:test,type:lingjun
PostPaidFlag	integer	The billable methods of the protection edition bound to the asset. Valid values: 0: subscription 1: pay-as-you-go	0
HasContainer	string	Indicates whether the asset contains containers. Valid values: YES: Contains containers. NO: Does not contain containers.	YES
ServiceId	string	The service ID. This field has a value only when the instance is a serverless instance that belongs to the PAI platform.	dsw-76jlywunsif09bp15p
VendorUid	string	The account ID of the multi-cloud instance.	123
VendorUserName	string	The account name of the multi-cloud instance.	VendorUserName
Namespace	string	The namespace.	crm-test
BindFileProtectType	string	Indicates whether tamper-proofing authorization is bound. Valid values: block: Bound. none: Not bound.	block
EdrAuthVersion	string

Examples

Success response

JSON format

{
  "Success": true,
  "RequestId": "32A73759-4C0F-4801-BE98-901223ACEE9A",
  "PageInfo": {
    "CurrentPage": 1,
    "PageSize": 20,
    "TotalCount": 50,
    "Count": 10,
    "NextToken": "B604532DEF982B875E8360A6EFA3B***"
  },
  "Instances": [
    {
      "Status": "Running",
      "CpuInfo": "Intel(R) Xeon(R) Platinum 8269CY CPU @ 2.50GHz",
      "InternetIp": "1.2.XX.XX",
      "Kernel": "3.10.0-1127.19.1.el7.x86_64",
      "Bind": true,
      "OsName": "-",
      "Tag": "InternetIp,test",
      "ClientStatus": "online",
      "Mem": 1024,
      "VpcInstanceId": "vpc-uf60agqq65bs98zoo****",
      "TagId": "121313,41412",
      "Flag": 0,
      "LastLoginTimestamp": 1637592907000,
      "AuthVersion": 1,
      "Region": "cn-hangzhou-cm***-***",
      "InstanceName": "yztest-l***",
      "PodCount": 1,
      "VulCount": 2,
      "HcStatus": "YES",
      "CreatedTime": 1607365213000,
      "GroupTrace": "default",
      "ClusterId": "c690a0789419f4284a4e0a29e12fe****",
      "RiskStatus": "NO",
      "Cores": 4,
      "VulStatus": "YES",
      "AlarmStatus": "NO",
      "MacListString": "00:13:3e:31:13:39,02:12:67:b8:**:**",
      "Importance": 2,
      "HealthCheckCount": 1,
      "Ip": "1.2.XX.XX",
      "Os": "Linux",
      "AuthModifyTime": 1627974044000,
      "SafeEventCount": 5,
      "InstanceId": "i-m5***",
      "AssetType": "0",
      "IntranetIp": "1.2.XX.XX",
      "Vendor": 0,
      "RegionId": "cn-hanghzou",
      "Uuid": "c9107c04-942f-40c1-981a-f1c1***",
      "GroupId": 4120080,
      "RegionName": "China (Hangzhou)",
      "VendorName": "IDC",
      "AuthVersionName": "Ultimate Edition",
      "ClusterName": "cluster1",
      "ExposedStatus": 0,
      "RiskCount": "{\n      \"account\": 0,\n      \"appNum\": 0,\n      \"asapVulCount\": 0,\n      \"baselineHigh\": 0,\n      \"baselineLow\": 0,\n      \"baselineMedium\": 0,\n      \"baselineNum\": 0,\n      \"cmsNum\": 0,\n      \"containerAsap\": 0,\n      \"containerLater\": 0,\n      \"containerNntf\": 0,\n      \"containerRemind\": 0,\n      \"containerSerious\": 0,\n      \"containerSuspicious\": 0,\n      \"cveNum\": 0,\n      \"emgNum\": 0,\n      \"health\": 0,\n      \"imageBaselineHigh\": 0,\n      \"imageBaselineLow\": 0,\n      \"imageBaselineMedium\": 0,\n      \"imageBaselineNum\": 0,\n      \"imageMaliciousFileRemind\": 0,\n      \"imageMaliciousFileSerious\": 0,\n      \"imageMaliciousFileSuspicious\": 0,\n      \"imageVulAsap\": 0,\n      \"imageVulLater\": 0,\n      \"imageVulNntf\": 0,\n      \"laterVulCount\": 0,\n      \"newSuspicious\": 0,\n      \"nntfVulCount\": 0,\n      \"remindNum\": 0,\n      \"scaNum\": 0,\n      \"seriousNum\": 0,\n      \"suspNum\": 0,\n      \"suspicious\": 0,\n      \"sysNum\": 0,\n      \"trojan\": 0,\n      \"uuid\": \"inet-37316411-37fe-4b72-b245-346a2721****\",\n      \"vul\": 0,\n      \"weakPWNum\": 0\n}",
      "IpListString": "172.31.XX.XX,172.171.XX.XX",
      "AssetTypeName": "Elastic Compute Service",
      "FlagName": "ASK",
      "AppId": "test",
      "AppName": "testAppName",
      "ClientSubStatus": "online",
      "TagResources": "app:test,type:lingjun",
      "PostPaidFlag": 0,
      "HasContainer": "YES",
      "ServiceId": "dsw-76jlywunsif09bp15p",
      "VendorUid": "123",
      "VendorUserName": "VendorUserName",
      "Namespace": "crm-test",
      "BindFileProtectType": "block",
      "EdrAuthVersion": ""
    }
  ]
}

Error codes

HTTP status code	Error code	Error message
400	NoPermission	no permission
400	RdCheckNoPermission	Resource directory account verification has no permission.
500	ServerError	ServerError
500	RdCheckInnerError	Resource directory account service internal error.
403	NoPermission	caller has no permission

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.