Query Alert Exception Details with DescribeSuspEventDetail - Security Center - Alibaba Cloud - Security Center

Retrieves the details of a specific alert exception. An alert event consists of an alert and multiple associated exceptions.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

yundun-sas:DescribeSuspEventDetail

get

*All Resource

*

None

Request parameters

Parameter	Type	Required	Description	Example
SourceIp	string	No	The source IP address of the request.	121.33.XX.XX
Lang	string	No	The language of the request and response content. Default value: zh. Valid values: zh: Chinese en: English	zh
SuspiciousEventId	integer	Yes	The ID of the exception.	32750999
From	string	Yes	The data source of the exception. Set the value to sas.	sas
ResourceDirectoryAccountId	integer	No	The Alibaba Cloud account ID of the member in the resource directory. Note You can call the DescribeMonitorAccounts operation to query the ID.	16670360956*****

Response elements

Element	Type	Description	Example
	object	The data returned.
DataSource	string	The data source of the exception.	aegis_suspicious_****
EventName	string	The name of the exception.	WEBSHELL
InternetIp	string	The public IP address of the server on which the exception was detected.	101.132.XX.XX
AlarmUniqueInfo	string	The unique ID of the alarm event. Note To query anomaly information for a single alarm event, provide the unique ID, which you can obtain by calling the DescribeSuspEvents operation.	8df914418f4211fb****
IntranetIp	string	The private IP address of the server on which the exception was detected.	172.26.XX.XX
LastTime	string	The time when the exception was last detected.	2018-10-30 11:43:46
OperateMsg	string	The handling result message for the exception.	success
Uuid	string	The UUID of the server on which the exception was detected.	bffb12c3-590a-4db2-b538-****
CanBeDealOnLine	boolean	Indicates whether the exception can be handled online, such as blocking, whitelisting, or ignoring it. Valid values: true: Online handling is supported. false: Online handling is not supported.	true
RequestId	string	The ID of the request.	0B48AB3C-84FC-424D-A01D-B9270EF46038
EventTypeDesc	string	The type of the exception.	Malicious Software-Variable Trojan
EventDesc	string	The description of the exception.	The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.
InstanceName	string	The name of the server on which the exception was detected.	ca_cpm_****
EventStatus	string	The status of the exception. Valid values: 1: pending handling 2: ignored 4: confirmed 8: marked as a false positive 16: handling 32: handled 64: expired	1
SaleVersion	string	The Security Center edition that can detect the exception. Valid values: 0: Basic edition 1: Advanced edition 2: Enterprise edition	1
OperateErrorCode	string	The handling result code for the exception.	quara.Succes
Level	string	The risk level of the exception. Valid values: serious suspicious remind	serious
Id	integer	The ID of the exception.	11416624
Details	array<object>	The exception details.
	object	The details of the exception.
Type	string	The format in which the details of the exception are displayed. Valid values: text html	html
Value	string	The attribute information about the exception. For example, for an unusual logon alert, this includes the logon time and source location. For a webshell alert, this includes the trojan file path and type.	getopt
NameDisplay	string	The display name of the alert event.	Trojan Path

Examples

Success response

JSON format

{
  "DataSource": "aegis_suspicious_****",
  "EventName": "WEBSHELL",
  "InternetIp": "101.132.XX.XX",
  "AlarmUniqueInfo": "8df914418f4211fb****",
  "IntranetIp": "172.26.XX.XX",
  "LastTime": " 2018-10-30 11:43:46 ",
  "OperateMsg": "success",
  "Uuid": "bffb12c3-590a-4db2-b538-****",
  "CanBeDealOnLine": true,
  "RequestId": "0B48AB3C-84FC-424D-A01D-B9270EF46038",
  "EventTypeDesc": "Malicious Software-Variable Trojan",
  "EventDesc": "The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.",
  "InstanceName": "ca_cpm_****",
  "EventStatus": "1",
  "SaleVersion": "1",
  "OperateErrorCode": "quara.Succes",
  "Level": "serious",
  "Id": 11416624,
  "Details": [
    {
      "Type": "html",
      "Value": "getopt",
      "NameDisplay": "Trojan Path"
    }
  ]
}

Error codes

HTTP status code	Error code	Error message	Description
400	UnknownError	UnknownError
400	DataExists	%s data exist
400	RdCheckNoPermission	Resource directory account verification has no permission.
500	ServerError	ServerError
500	RdCheckInnerError	Resource directory account service internal error.
403	NoPermission	caller has no permission	You are not authorized to do this operation.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.