GetFileProtectEvent - Security Center - Alibaba Cloud Documentation Center

Queries information about core file monitoring events.

Debugging

OpenAPI Explorer automatically calculates the signature value. For your convenience, we recommend that you call this operation in OpenAPI Explorer.

Debug

Authorization information

There is currently no authorization information disclosed in the API.

Request parameters

Parameter	Type	Required	Description	Example
Id	long	No	The ID of the event.	12

Response parameters

Parameter	Type	Description	Example
	object	Schema of Response
RequestId	string	The request ID.	0B48AB3C-84FC-424D-A01D-B9270EF46038
Data	object	The details of the returned data.
Uuid	string	The UUID of the asset.	49f1360f-62c8-4b48-a24c-5cc317656419
RuleName	string	The name of the rule.	test-000
FirstTime	long	The timestamp at which the event was first detected.	1694576692000
LatestTime	long	The time when the event last occurred.	1694576692000
Status	integer	The status of the event. Valid values: 0: not handled 1: handled 2: added to the whitelist	1
ProcPath	string	The path to the process.	/bin/bash33
FilePath	string	The path to the file.	/usr/local
CmdLine	string	The event command line.	["touch","/usr/local/aaaa"]
FilePermission	string	The permissions to run the process.	rwxr-xr-x
Operation	string	The operation that the process performed on the file.	DELETE
Id	long	The ID of the event.	55037
AlertLevel	integer	The severity of alerts. Valid values: 0: does not generate alerts 1: sends notifications 2: suspicious 3: high-risk	1
InstanceName	string	The name of the instance.	i-wz92q7m5hsbgfhdss***
InternetIp	string	The public IP address of the associated instance.	172.16.XX.XX
IntranetIp	string	The private IP address of the associated instance.	10.42.XX.XX
HandleTime	long	The time when the event was handled.	1694576692000
Remark	string	The remarks.	["test"]
ProcessId	string	The process ID of the event.	3453

Examples

Sample success responses

JSONformat

{
  "RequestId": "0B48AB3C-84FC-424D-A01D-B9270EF46038",
  "Data": {
    "Uuid": "49f1360f-62c8-4b48-a24c-5cc317656419",
    "RuleName": "test-000",
    "FirstTime": 1694576692000,
    "LatestTime": 1694576692000,
    "Status": 1,
    "ProcPath": "/bin/bash33",
    "FilePath": "/usr/local",
    "CmdLine": "[\"touch\",\"/usr/local/aaaa\"]",
    "FilePermission": "rwxr-xr-x",
    "Operation": "DELETE",
    "Id": 55037,
    "AlertLevel": 1,
    "InstanceName": "i-wz92q7m5hsbgfhdss***",
    "InternetIp": "172.16.XX.XX",
    "IntranetIp": "10.42.XX.XX",
    "HandleTime": 1694576692000,
    "Remark": "[\"test\"]",
    "ProcessId": "3453"
  }
}

Error codes

HTTP status code	Error code	Error message	Description
403	NoPermission	caller has no permission	You are not authorized to do this operation.
500	ServerError	ServerError	-

For a list of error codes, visit the Service error codes.