All Products
Search

This Product

    Web Application Firewall:DescribeThreatEventDetail

    Document Center

    Web Application Firewall:DescribeThreatEventDetail

    Last Updated:Jan 04, 2026

    Retrieves the details of a security event that requires attention.

    Try it now

    Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

    Test

    RAM authorization

    The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

    • Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.

    • API: The API that you can call to perform the action.

    • Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.

    • Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.

      • For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.

      • For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.

    • Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.

    • Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

    Action

    Access level

    Resource type

    Condition key

    Dependent action

    yundun-waf:DescribeThreatEventDetail

    get

    *All Resource

    *
    • acs:ResourceGroupId
    		 None

    Request parameters

    Parameter

    Type

    Required

    Description

    Example
    EventId

    string

    Yes

    The ID of the security event.

    1661131a028f72a976703f4a4082ad87
    InstanceId

    string

    Yes

    The ID of the WAF instance.

    Note

    You can call the DescribeInstance operation to query the ID of your WAF instance.

    waf_v2_public_cn-lbj*****
    RegionId

    string

    No

    The region where the WAF instance resides. Valid values:

    • cn-hangzhou: the Chinese mainland.

    • ap-southeast-1: outside the Chinese mainland.

    cn-hangzhou
    ResourceManagerResourceGroupId

    string

    No

    The ID of the Alibaba Cloud resource group.

    rg-aekzhks66****

    Response elements

    Element

    Type

    Description

    Example

    object

    RequestId

    string

    The ID of the request.

    D7861F61-5B61-46CE-A47C-6B1****
    ThreatEventDetail

    object

    The details of the security event.

    IsPersistent

    integer

    Indicates whether the event is a persistent attack.

    • 0: The attack is not persistent.

    • 1: The attack is persistent.

    1
    EventLevel

    string

    The severity level of the event. Valid values:

    • critical: critical

    • high: high

    • medium: medium

    • low: low

    high
    EventBlock

    string

    The number of blocked attacks.

    20
    EventCnt

    string

    The total number of attacks.

    20
    EndTime

    integer

    The time of the most recent attack. This is a UNIX timestamp in seconds.

    1749916800000
    EventIntelligence

    string

    The threat intelligence associated with the event. This value is a string that is converted from a JSON array.

    ["CVE-2020-14882","DDoS Attack"]
    EventSrcRegion

    string

    The region of the source IP address of the attack.

    GB-ENG
    EventSrc

    string

    The source IP address of the attack.

    Note

    A security event may have multiple source IP addresses. This operation returns only one of them.

    XX.XX.XX.XX
    EventSuggest

    string

    The security suggestion. Valid values:

    • ProtectInterface: The attack target appears to be a backend management address. If the address has specific access patterns, configure custom rules in the access control module to restrict access.

    • BlockArea: Monitor the attack source region. If the attack source region is different from your normal business regions, configure a location blacklist or an IP address blacklist in the access control module to restrict access.

    • SwitchBlock: The current protection rule is in Alert mode. To ensure business security, switch to Block mode. Before you switch, check for false positives.

    • FixBug: Check the attack target for security vulnerabilities. If any vulnerabilities exist, fix them promptly to prevent exploitation.

    • SwitchStrict: If it does not affect your normal business, change the policies of modules, such as protection rules and scan protection, to a stricter mode. Before you change the policies, check for false positives.

    • ProtectFile: Check the target domain name for sensitive files or paths to prevent them from being detected and exploited.

    • BlockIP: The source IP address has a high degree of maliciousness. Keep monitoring it. If it does not affect your normal business, use an IP address blacklist to block access from the malicious IP address.

    • KeepConcerned: No threats are found. Continue to monitor the situation.

    FixBug
    EventCondition

    string

    The filter condition for viewing logs. This value is a string that is converted from a JSON object that is constructed from a series of parameters.

    {"end_ts": 1766637714, "start_ts": 1764096746, "condition": {"real_client_ip": ["78.153.140.179", "78.153.140.203", "78.153.140.177", "78.153.140.178", "78.153.140.151"]}}
    EventTag

    string

    The name of the event. Valid values:

    • MultipleDomainDirscan: A directory and file scan for multiple domain names.

    • SingleDomainDirscan: A directory and file scan for a single domain name.

    • MultipleDomainWebscan: A web vulnerability scan for multiple domain names.

    • SingleDomainWebscan: A web vulnerability scan for a single domain name.

    • MultipleDomainWebattack: A web vulnerability attack on multiple domain names.

    • SingleDomainWebattack: A web vulnerability attack on a single domain name.

    • SingleURLWebattack: A web vulnerability attack on a specific URL.

    • SingleURLSqlattack: An SQL injection attack on a specific URL.

    • SingleURLXssattack: A cross-site scripting (XSS) attack on a specific URL.

    • WebshellUpload: An attempt to upload backdoor trojans.

    • RandomVulnTest: A random web vulnerability probe.

    MultipleDomainWebattack
    EventSrcCountry

    string

    The country of the source IP address of the attack.

    GB

    Examples

    Success response

    JSON format

    {
  "RequestId": "D7861F61-5B61-46CE-A47C-6B1****",
  "ThreatEventDetail": {
    "IsPersistent": 1,
    "EventLevel": "high",
    "EventBlock": "20",
    "EventCnt": "20",
    "EndTime": 1749916800000,
    "EventIntelligence": "[\"CVE-2020-14882\",\"DDoS Attack\"]",
    "EventSrcRegion": "GB-ENG",
    "EventSrc": "XX.XX.XX.XX",
    "EventSuggest": "FixBug",
    "EventCondition": "{\"end_ts\": 1766637714, \"start_ts\": 1764096746, \"condition\": {\"real_client_ip\": [\"78.153.140.179\", \"78.153.140.203\", \"78.153.140.177\", \"78.153.140.178\", \"78.153.140.151\"]}}",
    "EventTag": "MultipleDomainWebattack",
    "EventSrcCountry": "GB"
  }
}

    Error codes

    See Error Codes for a complete list.

    Release notes

    See Release Notes for a complete list.