DescribeAlarmEventList - Security Center - Alibaba Cloud Documentation Center

Queries aggregated alert events.

Operation Description

The alert aggregation feature of Security Center analyzes the paths of alerts to aggregate multiple alerts generated on the intrusions that are launched from the same IP address or service, or on the same user.

You can call the DescribeAlarmEventList or DescribeSuspEvents operation to query alert events.

If your Security Center runs the Enterprise or Ultimate edition and you turned on Alert Association on the Feature Settings page of the Security Center console, you can call the DescribeAlarmEventList operation to query alert events.
If your Security Center runs the Enterprise or Ultimate edition but you turned off Alert Association on the Feature Settings page of the Security Center console, you can call the DescribeSuspEvents operation to query alert events.
If your Security Center does not run the Enterprise or Ultimate edition, you can call the DescribeSuspEvents operation to query alert events.

Authorization information

There is currently no authorization information disclosed in the API.

Request parameters

Parameter	Type	Required	Description	Example
SourceIp	string	No	The source IP address of the request.	27.9.XX.XX
Lang	string	No	The language of the content within the request and response. Default value: zh. Valid values: zh: Chinese en: English	zh
Dealed	string	No	Specifies whether the alert event is handled. Valid values: N: unhandled Y: handled	Y
Id	long	No	The ID of the alert event.	1
From	string	Yes	The ID of the request source. Set the value to sas, which indicates that the request is sent from Security Center.	sas
Levels	string	No	The severity of the alert event. Separate multiple severities with commas (,). Valid values: serious suspicious remind	serious
Remark	string	No	The name of the alert or the information about the asset.	database_server
Uuids	string	No	The UUIDs of the assets. Separate multiple UUIDs with commas (,).	e8d8a2da-f9ce-4402-a1c6-0c4dc15b****
GroupId	string	No	The ID of the asset group to which the affected asset belongs.	18732
AlarmEventName	string	No	The name of the alert event. NoteYou can call the DescribeNsasSuspEventType operation to query the names of alert events.	Trojan
AlarmEventType	string	No	The type of the alert event. NoteYou can call the DescribeNsasSuspEventType operation to query the types of alert events.	Malicious Software
CurrentPage	integer	Yes	The number of the page to return. Pages start from page 1. Default value: 1.	1
PageSize	string	Yes	The number of entries to return on each page. Default value: 20.	20
TacticId	string	No	The tactic ID of ATT&CK.	TA0001
OperateErrorCodeList	array	No	An array that consists of the handling result codes of alert events.
	string	No	The handling result code of the alert event. Set the value in the following format: Operation type.Operation result code. The following operation types are supported: Common: performs common operations. deal: handles the alert event. ignore: ignores the alert event. offline_handled: marks the alert as handled. mark_mis_info: adds the alert event to the whitelist. rm_mark_mis_info: cancels adding the alert event to the whitelist. quara: quarantines the source file of the malicious process. kill_and_quara: terminates the malicious process and quarantines the source file. kill_virus: deletes the source file of the malicious process. block_ip: blocks the source IP address. manual_handled: marks the alert event as manually handled. advance_mark_mis_info: adds the alert event to the whitelist that is configured for precise defense. advance_mark_mis_info.System: automatically adds the alert event to the whitelist that is configured for precise defense. advance_mark_mis_info.User: manually adds the alert event to the whitelist that is configured for precise defense. The following handling result codes are supported: Success: The operation is successful. Failure: The operation fails. AgentOffline: The agent is offline.	ignore. Success
UniqueInfo	string	No	The ID of the alert event.	81c43b54073bbd922bcd887fddd8ba98
TimeStart	string	No	The start time when the alert event was last detected.	2022-07-05 13:50:38
TimeEnd	string	No	The end time when the alert event was last detected.	2022-07-06 13:50:38
SortColumn	string	No	The custom sorting field. Default value: operateTime. Valid values: lastTime: the latest occurrence time operateTime: the handling time NoteThis parameter takes effect if you set the Dealed parameter to Y.	operateTime
SortType	string	No	The custom sorting order. Default value: desc. Valid values: asc: the ascending order desc: the descending order NoteThis parameter takes effect if you set the Dealed parameter to Y.	desc
OperateTimeStart	string	No	The time when the handing operation starts.	2022-07-05 13:50:38
OperateTimeEnd	string	No	The time when the handling operation ends.	2022-07-06 13:50:38

Response parameters

Parameter	Type	Description	Example
	object	The data returned.
RequestId	string	The ID of the request, which is used to locate and troubleshoot issues.	28267723-D857-4DD8-B295-013100000000
PageInfo	object	The pagination information.
CurrentPage	integer	The page number of the returned page.	1
PageSize	integer	The number of entries returned per page. Default value: 20.	20
TotalCount	integer	The total number of entries returned.	1
Count	integer	The number of entries returned per page.	1
SuspEvents	array	An array that consists of the alert events.
	object
Dealed	boolean	Indicates whether the alert event is handled. Valid values: true: yes false: no	false
Stages	string	The stage at which the attack or intrusion is detected.	[\"authority_maintenance\"]
TacticItems	array	An array that consists of the stage information about ATT&CK.
	object
TacticId	string	The tactic ID of ATT&CK.	TA0001
TacticDisplayName	string	The tactic name of ATT&CK.	Command and Control
InternetIp	string	The public IP address of the affected asset.	123.21.XX.XX
SuspiciousEventCount	integer	The number of associated exceptions.	1
GmtModified	long	The timestamp when the alert event was last modified. Unit: milliseconds.	1569235879000
AlarmEventNameOriginal	string	The original parent name of the alert event.	Trojan
AlarmUniqueInfo	string	The ID of the alert event.	8df914418f4211fbf756efe7a6f4****
CanCancelFault	boolean	Indicates whether you can cancel marking the alert event as a false positive. Valid values: true: yes false: no	false
SecurityEventIds	string	The IDs of the associated exceptions.	270789
CanBeDealOnLine	boolean	Indicates whether the online processing of the alert event is supported, such as quarantining the source file of the malicious process, adding the alert event to the whitelist, and ignoring the alert event. Valid values: true: yes false: no	true
Description	string	The description of the alert event.	The detection model finds that there is a Trojan horse program on your server. The Trojan horse program is a program specially used to invade the user's host. Generally, it will download and release another malicious program after being implanted into the system through disguise.
InstanceName	string	The name of the affected asset.	TestInstance
SaleVersion	string	The edition of Security Center in which the alert event can be detected. Valid values: 0: Basic edition 1: Advanced edition 2: Enterprise edition	1
OperateErrorCode	string	The handling result code of the alert event.	kill_and_quara.Success
Solution	string	The solution to the alert event.	A malicious program implanted by hacker after intrusion will occupy your bandwidth and attack other servers, and may affect you own service. The malicious process may also have self-deleting behavior or disguise as a system service to evade detection.
HasTraceInfo	boolean	Indicates whether the alert event has tracing information. Valid values: true: yes false: no	true
DataSource	string	The data source of the alert event.	aegis_****
OperateTime	long	The timestamp when the alert event was handled. Unit: milliseconds.	1631699497000
InstanceId	string	The ID of the affected asset.	i-e****
IntranetIp	string	The private IP address of the affected asset.	192.168.XX.XX
EndTime	long	The timestamp when the alert event was last detected. Unit: milliseconds.	1543740301000
Uuid	string	The ID of the associated instance.	47900178-885d-4fa4-9d77-****
StartTime	long	The timestamp when the alert event starts. Unit: milliseconds.	1543740301000
AlarmEventType	string	The type of the alert event.	Malicious Software
AlarmEventName	string	The name of the alert event.	Trojan
Level	string	The risk level of the alert event. Valid values: serious suspicious remind	serious

Example

Normal return example

JSONFormat

{
  "RequestId": "28267723-D857-4DD8-B295-013100000000",
  "PageInfo": {
    "CurrentPage": 1,
    "PageSize": 20,
    "TotalCount": 1,
    "Count": 1
  },
  "SuspEvents": [
    {
      "Dealed": true,
      "Stages": "[\\\"authority_maintenance\\\"]",
      "TacticItems": [
        {
          "TacticId": "TA0001",
          "TacticDisplayName": "Command and Control"
        }
      ],
      "InternetIp": "123.21.XX.XX",
      "SuspiciousEventCount": 1,
      "GmtModified": 1569235879000,
      "AlarmEventNameOriginal": "Trojan\n",
      "AlarmUniqueInfo": "8df914418f4211fbf756efe7a6f4****",
      "CanCancelFault": true,
      "SecurityEventIds": "270789",
      "CanBeDealOnLine": true,
      "Description": "The detection model finds that there is a Trojan horse program on your server. The Trojan horse program is a program specially used to invade the user's host. Generally, it will download and release another malicious program after being implanted into the system through disguise.",
      "InstanceName": "TestInstance",
      "SaleVersion": "1",
      "OperateErrorCode": "kill_and_quara.Success",
      "Solution": "A malicious program implanted by hacker after intrusion will occupy your bandwidth and attack other servers, and may affect you own service. The malicious process may also have self-deleting behavior or disguise as a system service to evade detection. ",
      "HasTraceInfo": true,
      "DataSource": "aegis_****",
      "OperateTime": 1631699497000,
      "InstanceId": "i-e****",
      "IntranetIp": "192.168.XX.XX",
      "EndTime": 1543740301000,
      "Uuid": "47900178-885d-4fa4-9d77-****",
      "StartTime": 1543740301000,
      "AlarmEventType": "Malicious Software",
      "AlarmEventName": "Trojan",
      "Level": "serious"
    }
  ]
}

Error codes

Http code	Error code	Error message	Description
400	NoPermission	no permission	-
400	UnknownError	UnknownError	-
403	NoPermission	caller has no permission	You are not authorized to do this operation.
500	ServerError	ServerError	-

For a list of error codes, visit the API error center.

Change history

Change time

Summary of changes

Operate

2022-02-28

The error codes of the API operation has changed, The input parameters of the API operation has changed

Change item	Change content
Error Codes	The error codes of the API operation has changed
	delete Error Codes: 400
	delete Error Codes: 500
Input Parameters	The input parameters of the API operation has changed
	Added Input Parameters: UniqueInfo