All Products
Search

This Product

    Security Center:ExportSuspEvents

    Document Center

    Security Center:ExportSuspEvents

    Last Updated:Sep 17, 2026

    Exports anomaly alert information.

    Try it now

    Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

    Test

    RAM authorization

    The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

    • Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.

    • API: The API that you can call to perform the action.

    • Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.

    • Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.

      • For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.

      • For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.

    • Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.

    • Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

    Action

    Access level

    Resource type

    Condition key

    Dependent action

    yundun-sas:ExportSuspEvents

    none

    *All Resource

    *

    		 None None

    Request parameters

    Parameter

    Type

    Required

    Description

    Example
    SourceIp

    string

    No

    The source IP address of the request. You do not need to specify this parameter. The system automatically obtains this value.

    127.0.XX.XX
    Dealed

    string

    No

    Specifies whether the alert event is handled. Valid values:

    • N: Unhandled.

    • Y: Handled.

    Y
    TimeStart

    string

    No

    The start time of the anomaly event occurrence. Format: YYYY-MM-DD HH:mm:ss.

    2022-10-01 00:00:00
    TimeEnd

    string

    No

    The end time of the anomaly event. Format: YYYY-MM-DD HH:mm:ss.

    2022-12-05 00:00:00
    Name

    string

    No

    The full name of the anomaly event.

    WEBSHELL
    Levels

    string

    No

    The severity levels of the alert events to query. Separate multiple severity levels with commas (,). The severity levels are listed in descending order. Valid values:

    • serious: Urgent.

    • suspicious: Suspicious.

    • remind: Reminder.

    serious,suspicious,remind
    ParentEventTypes

    string

    No

    The alert type of the alert events to query. Valid values:

    • Abnormal process behavior

    • Web shell

    • Unusual logon

    • Abnormal event

    • Sensitive file tampering

    • Malicious process (cloud scan)

    • Suspicious network connection

    • Abnormal account

    • Application intrusion event

    • Cloud service threat detection

    • Precise defense

    • Application whitelist

    • Persistent backdoor

    • Web application threat detection

    • Malicious script

    • Threat intelligence

    • Malicious network behavior

    • Container cluster exception

    • Web shell (local scan)

    • Vulnerability exploits

    • Malicious process (local scan)

    • Trusted exception

    • Other

    WEBSHELL
    Remark

    string

    No

    The remarks.

    remark
    Status

    string

    No

    The handling status of the anomaly event. Valid values:

    • 0: All.

    • 1: Unhandled.

    • 2: Ignored.

    • 4: Confirmed.

    • 8: Marked as false positive.

    • 16: Handling.

    • 32: Handled.

    • 64: Expired.

    • 128: Deleted.

    0
    Lang

    string

    No

    The language type for the request and response messages. Default value: zh. Valid values:

    • zh: Chinese.

    • en: English.

    zh
    From

    string

    No

    The data source identifier of the anomaly event. Set the value to sas.

    sas
    ClusterId

    string

    No

    The ID of the cluster to query.

    Note

    You can call the DescribeGroupedContainerInstances operation to obtain this parameter.

    c4af4fdf38a98496a9b63c2be5dae****
    ContainerFieldName

    string

    No

    The container search field. Valid values:

    • instanceId: instance ID

    • appName: application name

    • clusterId: cluster ID

    • regionId: region

    • nodeName: node name

    • namespace: namespace

    • clusterName: cluster name

    • image: image name

    • imageRepoName: image repository name

    • imageRepoNamespace: image repository namespace

    • imageRepoTag: image tag

    • imageDigest: image digest

    clusterId
    ContainerFieldValue

    string

    No

    The value of the container search field.

    c819391d2d520485fa3e81e2dc2ea****
    TargetType

    string

    No

    The dimension of the target switch configuration. Valid values:

    • uuid: asset UUID

    • image_repo: image repository ID

    • Cluster: cluster ID

    uuid
    PageSize

    string

    No

    The maximum number of entries per page in a paged query. Default value: 20.

    20
    CurrentPage

    string

    No

    The page number of the current page in a paged query.

    1
    AssetsTypeList

    array

    No

    The collection of asset types.

    string

    No

    The collection of asset types.

    ECS
    Uuid

    string

    No

    The unique identifier of the associated instance.

    18b7336e-d469-473b-af83-8e5420f9****
    UniqueInfo

    string

    No

    The unique key of the security alert.

    1fbe8d16727f61d1478a674d6fa0****
    Id

    integer

    No

    The unique ID of the alert event record.

    17821
    OperateErrorCodeList

    array

    No

    The collection of alert event handling result codes.

    string

    No

    The alert event handling result code. Format: operation type.operation result code. The following operation types are supported:

    • Common: Common operation

    • deal: Handle

    • ignore: Ignore

    • offline_handled: Alert confirmed

    • mark_mis_info: Add to whitelist

    • rm_mark_mis_info: Remove from whitelist

    • quara: Quarantine

    • kill_and_quara: General scan and kill

    • kill_virus: Deep cleanup

    • block_ip: Block

    • manual_handled: Manual handling

    • advance_mark_mis_info: Precise defense whitelist

    • advance_mark_mis_info.System: Precise defense whitelist automatic addition

    • advance_mark_mis_info.User: Precise defense whitelist manual addition

    Operation result codes:

    • Success: Succeeded.

    • Failure: Failed.

    • AgentOffline: Agent offline.

    ignore. Success
    GroupId

    integer

    No

    The ID of the asset group.

    9454789
    ResourceDirectoryAccountId

    integer

    No

    The ID of the member accounts in the resource folder.

    Note

    You can invoke the DescribeMonitorAccounts operation to obtain this parameter.

    127608589417****

    Response elements

    Element

    Type

    Description

    Example

    object

    RequestId

    string

    The request ID.

    EF145C20-6A19-529A-8BDD-0671DXXXXXX
    FileName

    string

    The name of the exported file.

    suspicious_event_20221209
    Id

    integer

    The export record ID of the anomaly event.

    1

    Examples

    Success response

    JSON format

    {
  "RequestId": "EF145C20-6A19-529A-8BDD-0671DXXXXXX",
  "FileName": "suspicious_event_20221209",
  "Id": 1
}

    Error codes

    HTTP status code

    Error code

    Error message

    Description
    400 IllegalParam Illegal param
    400 FreeVersionNotPermit Free version is not permitted. The free version cannot be used.
    400 RdCheckNoPermission Resource directory account verification has no permission.
    500 ServerError ServerError
    500 RdCheckInnerError Resource directory account service internal error.
    403 NoPermission caller has no permission You are not authorized to do this operation.

    See Error Codes for a complete list.

    Release notes

    See Release Notes for a complete list.