All Products
Search

This Product

    Web Application Firewall:DescribeThreatEvent

    Document Center

    Web Application Firewall:DescribeThreatEvent

    Last Updated:Dec 25, 2025

    Queries a paginated list of notable security events.

    Try it now

    Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

    Test

    RAM authorization

    No authorization for this operation. If you encounter issues with this operation, contact technical support.

    Request parameters

    Parameter

    Type

    Required

    Description

    Example
    DomainName

    string

    No

    The domain name to query.

    www.abc.com
    StartTime

    integer

    Yes

    The start time. The value must be a UNIX timestamp in milliseconds. The time is in UTC.

    1668496310000
    EndTime

    integer

    Yes

    The end time. The value must be a UNIX timestamp in milliseconds. The time is in UTC.

    1749916800000
    PageNumber

    integer

    No

    The page number of the results to return. The default value is 1.

    1
    PageSize

    integer

    No

    The number of entries to return on each page. The default value is 5. Valid values: 1 to 200.

    10
    InstanceId

    string

    Yes

    The ID of the WAF instance.

    Note

    Call DescribeInstance to query the ID of the WAF instance.

    waf_v2_public_cn-2bl4****
    RegionId

    string

    No

    The region where the WAF instance resides. Valid values:

    • cn-hangzhou: the Chinese mainland.

    • ap-southeast-1: outside the Chinese mainland.

    cn-hangzhou
    ResourceManagerResourceGroupId

    string

    No

    The ID of the Alibaba Cloud resource group.

    rg-aeky65ka*****

    Response elements

    Element

    Type

    Description

    Example

    object

    TotalCount

    integer

    The total number of events returned.

    10
    RequestId

    string

    The ID of the request.

    98106632-6865-5600-A834-3D909***
    ThreatEvents

    array<object>

    The list of notable security events.

    object

    A security event.

    EventLevel

    string

    The severity level of the event. Valid values:

    • critical: critical.

    • high: high.

    • medium: medium.

    • low: low.

    high
    EndTime

    integer

    The time of the most recent attack. The value is a UNIX timestamp in milliseconds. The time is in UTC.

    1768406400000
    EventSrc

    string

    The source IP address of the attack.

    Note

    A security event may have multiple source IP addresses. This operation returns only one of them.

    3.3.3.3
    EventId

    string

    The ID of the security event.

    f439994c8ab39f84eced33490f0c4388
    BlockRate

    string

    The block rate.

    100%
    EventTag

    string

    The name of the event. Valid values:

    • MultipleDomainDirscan: a directory and file scan on multiple domain names.

    • SingleDomainDirscan: a directory and file scan on a single domain name.

    • MultipleDomainWebscan: a web vulnerability scan on multiple domain names.

    • SingleDomainWebscan: a web vulnerability scan on a single domain name.

    • MultipleDomainWebattack: a web vulnerability attack on multiple domain names.

    • SingleDomainWebattack: a web vulnerability attack on a single domain name.

    • SingleURLWebattack: a web vulnerability attack on a specific URL.

    • SingleURLSqlattack: an SQL injection attack on a specific URL.

    • SingleURLXssattack: an XSS attack on a specific URL.

    • WebshellUpload: an attempt to upload backdoor trojans.

    • RandomVulnTest: a random web vulnerability probe.

    Event_InternalLoginWeakPasswd
    EventTarget

    string

    The protected object that is the target of the attack.

    Note

    A security event may have multiple protected objects as attack targets. This operation returns only one of them.

    test.aliyundemo.com-waf

    Examples

    Success response

    JSON format

    {
  "TotalCount": 10,
  "RequestId": "98106632-6865-5600-A834-3D909***",
  "ThreatEvents": [
    {
      "EventLevel": "high",
      "EndTime": 1768406400000,
      "EventSrc": "3.3.3.3",
      "EventId": "f439994c8ab39f84eced33490f0c4388",
      "BlockRate": "100%",
      "EventTag": "Event_InternalLoginWeakPasswd",
      "EventTarget": "test.aliyundemo.com-waf"
    }
  ]
}

    Error codes

    See Error Codes for a complete list.

    Release notes

    See Release Notes for a complete list.