ListFileProtectEvent - Security Center - Alibaba Cloud Documentation Center

Queries core file monitoring rules that meet the specified filter condition.

Debugging

OpenAPI Explorer automatically calculates the signature value. For your convenience, we recommend that you call this operation in OpenAPI Explorer.

Debug

Authorization information

There is currently no authorization information disclosed in the API.

Request parameters

Parameter	Type	Required	Description	Example
RuleName	string	No	The name of the rule.	test-rule-1
Status	string	No	The status of the event. Valid values: 0: unhandled 1: handled 2: added to the whitelist	2
AlertLevels	array	No	The severities of alerts.
	integer	No	The severity of the alert. Valid values: 0: does not generate alerts 1: sends notifications 2: suspicious 3: high-risk	1
CurrentPage	integer	No	The page number.	1
PageSize	string	No	The number of entries per page.	20
InstanceId	string	No	The instance ID of the asset.	i-bp1fu4aqltf1huhc****
Uuid	string	No	The server UUID. Note You can call the DescribeCloudCenterInstances operation to query the server UUID.	inet-ecs-4e876cb0-09f7-43b8-82ef-4bc7a937***
InstanceName	string	No	The name of the server.	ca_cpm_****
InternetIp	string	No	The public IP address of the asset that you want to query.	120.27.XX.XX
IntranetIp	string	No	The private IP address of the asset that you want to query.	172.26.XX.XX
StartTime	long	No	The start of the time range to query.	1683080489594
EndTime	long	No	The end of the time range to query.	1683195595204

Response parameters

Parameter	Type	Description	Example
	object	Schema of Response
RequestId	string	The request ID.	23AD0BD2-8771-5647-819E-6BA51E212F80
EventList	object []	The events.
AlertLevel	integer	The severity of the alert. Valid values: 0: does not generate alerts 1: sends notifications 2: suspicious 3: high-risk	1
Uuid	string	The UUID of the server that is associated with the process.	94b44720-d982-4d20-a4e1-80a1a57b5a8e
RuleName	string	The name of the rule.	test-rule-1
LatestTime	long	The time when the event last occurred.	1694576692000
Status	integer	The status of the event. Valid values: 0: unhandled 1: handled 2: added to the whitelist	1
Id	long	The ID of the event.	161757
InstanceName	string	The name of the server.	kyy-admin-01
InternetIp	string	The public IP address of the server.	121.40.211.194
IntranetIp	string	The private IP address of the asset.	172.22.5.36
FilePath	string	The path to the file.	/etc/pam.d/su
Operation	string	The operation performed by the process on the file.	DELETE
Remark	string	The remarks.	test
ProcPermission	string	The permissions required to start the process.	rwxr-xr-x
CmdLine	string	The command line of the event.	["touch","/test/aaaa"]
ProcPath	string	The path to the process.	/usr/bin/sshpass
HandleTime	long	The time when the event was handled.	1694576692000
ProcessId	string	The process ID (PID) of the event process.	52636
PageInfo	object	The pagination information.
CurrentPage	integer	The page number.	1
PageSize	integer	The number of entries per page.	20
TotalCount	integer	The total number of entries returned.	149

Examples

Sample success responses

JSONformat

{
  "RequestId": "23AD0BD2-8771-5647-819E-6BA51E212F80",
  "EventList": [
    {
      "AlertLevel": 1,
      "Uuid": "94b44720-d982-4d20-a4e1-80a1a57b5a8e",
      "RuleName": "test-rule-1\n",
      "LatestTime": 1694576692000,
      "Status": 1,
      "Id": 161757,
      "InstanceName": "kyy-admin-01",
      "InternetIp": "121.40.211.194",
      "IntranetIp": "172.22.5.36",
      "FilePath": "/etc/pam.d/su",
      "Operation": "DELETE",
      "Remark": "test",
      "ProcPermission": "rwxr-xr-x",
      "CmdLine": "[\"touch\",\"/test/aaaa\"]",
      "ProcPath": " /usr/bin/sshpass",
      "HandleTime": 1694576692000,
      "ProcessId": "52636"
    }
  ],
  "PageInfo": {
    "CurrentPage": 1,
    "PageSize": 20,
    "TotalCount": 149
  }
}

Error codes

HTTP status code	Error code	Error message	Description
403	NoPermission	caller has no permission	You are not authorized to do this operation.
500	ServerError	ServerError	-

For a list of error codes, visit the Service error codes.

Change history

Change time

Summary of changes

Operation

2024-04-29

The request parameters of the API has changed

see changesets

Change item	Change content
Input Parameters	The request parameters of the API has changed.
	Added Input Parameters: InstanceId
	Added Input Parameters: Uuid
	Added Input Parameters: InstanceName
	Added Input Parameters: InternetIp
	Added Input Parameters: IntranetIp
	Added Input Parameters: StartTime
	Added Input Parameters: EndTime

2023-10-09

The internal configuration of the API is changed, but the call is not affected

see changesets

Change item	Change content
	The internal configuration of the API is changed, but the call is not affected.