GetAttackPathEventDetail API Reference & Parameters - Security Center - Alibaba Cloud - Security Center

Queries the details of an attack path event.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

No authorization for this operation. If you encounter issues with this operation, contact technical support.

Request parameters

Parameter	Type	Required	Description	Example
EventId	integer	No	The event ID. Note You can call ListAttackPathEvent to query event IDs.	123
Lang	string	No	The language of the request and response. Default value: zh. Valid values: zh: Chinese en: English	en
EventSource	string	No	The data source. Default value: default. Valid values: caasm: attack surface default: attack path	default

Response elements

Element	Type	Description	Example
	object
RequestId	string	The request ID, which is a unique identifier generated by Alibaba Cloud for the request. You can use this ID to troubleshoot issues.	7BC55C8F-226E-5AF5-9A2C-2EC43864****
AttackPathEvent	object	The details of the attack path event.
DstAsset	object	The destination asset.
AssetSubType	integer	The subtype of the cloud service asset.	2
AssetType	integer	The type of the cloud service asset.	3
InstanceId	string	The ID of the cloud service asset instance.	i-bp18ifsr1tu1dx39****
InstanceName	string	The instance name.	test
RegionId	string	The region ID of the cloud service asset instance.	cn-shanghai
Vendor	integer	The vendor of the cloud service asset.	0
SensitiveAssetFlag	integer	The sensitive asset flag. Valid values: 0: Not a sensitive asset. 1: A sensitive asset.	0
FirstTime	integer	The timestamp when the event first occurred. Unit: milliseconds.	1735956726000
LastTime	integer	The timestamp when the event was last detected. Unit: milliseconds.	1741832168000
PathEventEdgeList	array<object>	The list of path event edges.
	object	The path event edge.
EdgeId	integer	The edge ID.	123
EdgeType	string	The edge type.	role_trust_user
ElementType	string	The element type of the edge.	branch
EndNodeUuid	string	The UUID of the end node of the edge.	52d59cca9d1768bab5fe081317637990
RepairSuggestionDisplay	string	The description of the remediation suggestion.	The RAM role is granted the administrator permissions and trusts the user of another Alibaba Cloud account. In this case, the current Alibaba Cloud account may be fully controlled by the trusted Alibaba Cloud account. We recommend that you delete the trust relationship. If you need to trust another Alibaba Cloud account, we recommend that you split your business requirements and follow the principle of least privilege to grant permissions across accounts in a fine-grained manner. You can also use RAM.\n\nIf you confirm that the role does not need to trust an Alibaba Cloud account, perform the following operations: In the RAM console, click the required RAM role. On the page that appears, view the trust policy of the role. Then, edit the Service field to delete the trust relationship. If you confirm that permissions can be reduced, perform the following operations: In the RAM console, click the required RAM role. On the page that appears, view the permissions of the role. Then, find the policy that defines the administrator permissions and revoke the policy. Attach another policy to the role based on your business requirements.
StartNodeUuid	string	The UUID of the start node of the edge.	b7e1bd42c4ca47f69020f4a27b47d2b4
PathEventNodeList	array<object>	The list of path nodes.
	object	The path node.
ElementType	string	The element type of the node.	branch
NodeDetail	string	The node details.	{"assetId":0}
NodeName	string	The node name.	hypermatch_uploader
NodeType	string	The node type.	user
NodeUuid	string	The node UUID.	52d59cca9d1768bab5fe081317637990
SensitiveAssetFlag	integer	The sensitive asset flag. Valid values: 0: Not a sensitive asset. 1: A sensitive asset.	0
AiAssetFlag	integer	The AI asset flag. Valid values: 0: Not an AI asset. 1: An AI asset.	1
PathName	string	The path name.	ecs_get_credential_by_create_login_profile
PathNameDesc	string	The description of the path name.	ECS Instance Can Obtain Long-term Access Credential by Enabling Console Logon for RAM User
PathType	string	The path type.	role_escalation
RiskLevel	string	The risk level.	suspicious
SrcAsset	object	The source asset.
AssetSubType	integer	The subtype of the cloud service asset.	4
AssetType	integer	The type of the cloud service asset.	14
InstanceId	string	The ID of the cloud service asset instance.	i-25b24****
InstanceName	string	The instance name.	test
RegionId	string	The region ID of the cloud service asset instance.	cn-hangzhou
Vendor	integer	The vendor of the cloud service asset.	0
SensitiveAssetFlag	integer	The sensitive asset flag. Valid values: 0: Not a sensitive asset. 1: A sensitive asset.	0
PathTypeDesc	string	The description of the path type.	Privilege Escalation by Role
PathDetailDesc	string	The description of the path details.	The system detects that the role that trusts another Alibaba Cloud account has administrator permissions. This can cause the system to be fully controlled. We recommend that you delete the trust relationship and review the permissions of the role.
PathInterpretationStatus	string
PathInterpretationUrl	string

Examples

Success response

JSON format

{
  "RequestId": "7BC55C8F-226E-5AF5-9A2C-2EC43864****",
  "AttackPathEvent": {
    "DstAsset": {
      "AssetSubType": 2,
      "AssetType": 3,
      "InstanceId": "i-bp18ifsr1tu1dx39****\n",
      "InstanceName": "test",
      "RegionId": "cn-shanghai",
      "Vendor": 0,
      "SensitiveAssetFlag": 0
    },
    "FirstTime": 1735956726000,
    "LastTime": 1741832168000,
    "PathEventEdgeList": [
      {
        "EdgeId": 123,
        "EdgeType": "role_trust_user",
        "ElementType": "branch",
        "EndNodeUuid": "52d59cca9d1768bab5fe081317637990",
        "RepairSuggestionDisplay": "The RAM role is granted the administrator permissions and trusts the user of another Alibaba Cloud account. In this case, the current Alibaba Cloud account may be fully controlled by the trusted Alibaba Cloud account. We recommend that you delete the trust relationship. If you need to trust another Alibaba Cloud account, we recommend that you split your business requirements and follow the principle of least privilege to grant permissions across accounts in a fine-grained manner. You can also use RAM.\\n\\nIf you confirm that the role does not need to trust an Alibaba Cloud account, perform the following operations: In the RAM console, click the required RAM role. On the page that appears, view the trust policy of the role. Then, edit the Service field to delete the trust relationship. If you confirm that permissions can be reduced, perform the following operations: In the RAM console, click the required RAM role. On the page that appears, view the permissions of the role. Then, find the policy that defines the administrator permissions and revoke the policy. Attach another policy to the role based on your business requirements.",
        "StartNodeUuid": "b7e1bd42c4ca47f69020f4a27b47d2b4"
      }
    ],
    "PathEventNodeList": [
      {
        "ElementType": "branch",
        "NodeDetail": "{\"assetId\":0}",
        "NodeName": "hypermatch_uploader",
        "NodeType": "user",
        "NodeUuid": "52d59cca9d1768bab5fe081317637990",
        "SensitiveAssetFlag": 0,
        "AiAssetFlag": 1
      }
    ],
    "PathName": "ecs_get_credential_by_create_login_profile",
    "PathNameDesc": "ECS Instance Can Obtain Long-term Access Credential by Enabling Console Logon for RAM User",
    "PathType": "role_escalation",
    "RiskLevel": "suspicious",
    "SrcAsset": {
      "AssetSubType": 4,
      "AssetType": 14,
      "InstanceId": "i-25b24****",
      "InstanceName": "test",
      "RegionId": "cn-hangzhou",
      "Vendor": 0,
      "SensitiveAssetFlag": 0
    },
    "PathTypeDesc": "Privilege Escalation by Role",
    "PathDetailDesc": "The system detects that the role that trusts another Alibaba Cloud account has administrator permissions. This can cause the system to be fully controlled. We recommend that you delete the trust relationship and review the permissions of the role.\n",
    "PathInterpretationStatus": "",
    "PathInterpretationUrl": ""
  }
}

Error codes

HTTP status code	Error code	Error message	Description
500	ServerError	ServerError
403	NoPermission	caller has no permission

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.