Use DescribeTraceInfoDetail to query trace information of alerts - Security Center - Alibaba Cloud - Security Center

Queries the tracing information of a security alert.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

yundun-sas:DescribeTraceInfoDetail

get

*All Resource

*

None

Request parameters

Parameter	Type	Required	Description	Example
SourceIp	string	No	The source IP address of the request. You do not need to specify this parameter. The system automatically obtains the value.	127.0.0.1
Lang	string	No	The language of the request and response. Valid values: zh: Chinese en: English.	zh
VertexId	string	Yes	The vertex ID. You can obtain this value from the AlarmUniqueInfo parameter returned by the DescribeSuspEvents operation.	cce1d28dxxxxxxxxxxxxxxxx
Uuid	string	Yes	The UUID of the server to query.	1627f2d7-aaa2-4ed1-b07a-xxxxxxxxxxxxxx
Type	string	Yes	The vertex type. Set the value to SAS_INCIDENT for security alerts.	SAS_INCIDENT
From	string	Yes	The identifier of the request source. Set the value to sas.	sas
IncidentTime	integer	No	The detection timestamp. Unit: milliseconds.	1670555392000

Response elements

Element	Type	Description	Example
	object
Success	boolean	Indicates whether the call was successful. Valid values: true: The call was successful. false: The call failed.	true
RequestId	string	The ID of the request.	24A20733-10A0-4AF6-BE6B-XXXXXXXXX
TraceInfoDetail	object	The details of the trace graph.
EdgeList	array<object>	The edge information in the trace graph.
	object	The edge information in the trace graph.
Type	string	The type of the edge of the tracing diagram.	trigger_file_alert
Time	string	The point in time.	2022-12-21 10:24:42
StartId	string	The starting vertex ID of the edge of the tracing diagram.	02b4bf933c8e3bb8b9465eee502xxxxx
Count	integer	The number of times.	1
EndId	string	The ending vertex ID of the edge of the tracing diagram.	a1d1fa39e5345dcef3f9712172cxxxxx
VertexList	array<object>	The information about all vertices in the trace graph.
	array<object>	The information about a vertex in the trace graph.
Type	string	The type of the entity represented by the vertex.	file_path
Time	string	The point in time.	2022-12-21 10:24:42
Name	string	The name of the entity represented by the vertex.	/usr/local/tomcat
Id	string	The ID of the vertex.	a1d1fa39e5345dcef3f9712172xxxxxx
Count	integer	The number of times.	1
NeighborList	array<object>	An array that consists of the neighbor nodes.
	object	The information about the neighbor node.
Type	string	The type of the neighbor node. The value is fixed as alert.	alert
HasMore	boolean	Indicates whether one more page is returned.	False
Count	integer	The number of neighbor nodes.	1
EntityTypeList	array<object>	The metadata configuration of vertex types.
	object	The metadata configuration record of a vertex type.
DisplayColor	string	The rendering color of the vertex.	#fff
DbId	integer	This parameter is deprecated.	Deprecated
DisplayTemplate	string	This parameter is deprecated.	[{"name":"${logtime}","value":"$!{time}"}]
DisplayIcon	string	The icon style of the vertex.	https://img.alicdn.com/tfs/TB176P5OgDqK1RjSZSyXXaxEVXa-49-48.png
Limit	integer	This parameter is deprecated.	Deprecated
GmtCreate	integer	The timestamp when the vertex was created.	2022-10-09T11:47Z
Offset	integer	This parameter is deprecated.	Deprecated
Namespace	string	The namespace.	*
Name	string	The name of the vertex type.	Alert
GmtModified	integer	The time when the vertex was last modified.	2022-10-09T11:47Z
Id	string	The ID of the vertex type.	Alert
RelationTypeList	array<object>	The metadata configuration of edge types.
	object	The metadata configuration record of an edge type.
ShowType	string	This parameter is deprecated.	Deprecated
DisplayColor	string	The rendering color of the edge.	#fff
Name	string	The name of the edge type.	file
Directed	integer	Indicates whether the edge is a directional edge. Valid values: 1: yes 0: no	1
RelationTypeId	string	The ID of the edge type.	netflow_to_process

Examples

Success response

JSON format

{
  "Success": true,
  "RequestId": "24A20733-10A0-4AF6-BE6B-XXXXXXXXX",
  "TraceInfoDetail": {
    "EdgeList": [
      {
        "Type": "trigger_file_alert",
        "Time": "2022-12-21 10:24:42",
        "StartId": "02b4bf933c8e3bb8b9465eee502xxxxx",
        "Count": 1,
        "EndId": "a1d1fa39e5345dcef3f9712172cxxxxx"
      }
    ],
    "VertexList": [
      {
        "Type": "file_path",
        "Time": "2022-12-21 10:24:42",
        "Name": "/usr/local/tomcat",
        "Id": "a1d1fa39e5345dcef3f9712172xxxxxx",
        "Count": 1,
        "NeighborList": [
          {
            "Type": "alert",
            "HasMore": true,
            "Count": 1
          }
        ]
      }
    ],
    "EntityTypeList": [
      {
        "DisplayColor": "#fff",
        "DbId": 0,
        "DisplayTemplate": "[{\"name\":\"${logtime}\",\"value\":\"$!{time}\"}]",
        "DisplayIcon": "https://img.alicdn.com/tfs/TB176P5OgDqK1RjSZSyXXaxEVXa-49-48.png",
        "Limit": 0,
        "GmtCreate": 0,
        "Offset": 0,
        "Namespace": "*",
        "Name": "Alert",
        "GmtModified": 0,
        "Id": "Alert"
      }
    ],
    "RelationTypeList": [
      {
        "ShowType": "Deprecated",
        "DisplayColor": "#fff",
        "Name": "file",
        "Directed": 1,
        "RelationTypeId": "netflow_to_process"
      }
    ]
  }
}

Error codes

HTTP status code	Error code	Error message	Description
500	ServerError	ServerError
403	NoPermission	caller has no permission

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.