DescribeInvadeEventList - Cloud Firewall - Alibaba Cloud Documentation Center

Queries the information about the breach awareness events of a firewall.

Debugging

OpenAPI Explorer automatically calculates the signature value. For your convenience, we recommend that you call this operation in OpenAPI Explorer.

Debug

Authorization information

The following table shows the authorization information corresponding to the API. The authorization information can be used in the Action policy element to grant a RAM user or RAM role the permissions to call this API operation. Description:

Operation: the value that you can use in the Action element to specify the operation on a resource.
Access level: the access level of each operation. The levels are read, write, and list.
Resource type: the type of the resource on which you can authorize the RAM user or the RAM role to perform the operation. Take note of the following items:
- The required resource types are displayed in bold characters.
- If the permissions cannot be granted at the resource level, All Resources is used in the Resource type column of the operation.
Condition Key: the condition key that is defined by the cloud service.
Associated operation: other operations that the RAM user or the RAM role must have permissions to perform to complete the operation. To complete the operation, the RAM user or the RAM role must have the permissions to perform the associated operations.

Operation	Access level	Resource type	Condition key	Associated operation
yundun-cloudfirewall:DescribeInvadeEventList	get	All Resources *	none	none

Request parameters

Parameter	Type	Required	Description	Example
SourceIp`deprecated`	string	No	The source IP address of the request.	192.0.XX.XX
Lang	string	No	The language of the content within the response. Valid values: zh: Chinese (default) en: English	zh
StartTime	string	No	The beginning of the time range to query. The value is a UNIX timestamp. Unit: seconds. If you do not specify this parameter, the query starts from 30 days before the current time.	1656750960
EndTime	string	No	The end of the time range to query. The value is a UNIX timestamp. Unit: seconds. If you do not specify this parameter, the query ends at the current time.	1656837360
CurrentPage	string	No	The number of the page to return. Default value: 1.	1
PageSize	string	No	The number of entries to return on each page. Default value: 6. Maximum value: 10.	1
AssetsInstanceId	string	No	The ID of the instance.	ins_1321_asedb_****
AssetsInstanceName	string	No	The name of the instance.	ECS_test
IsIgnore	string	No	Specifies whether the breach awareness event is ignored. Valid values: true: The breach awareness event is ignored. false: The breach awareness event is not ignored.	true
AssetsIP	string	No	The IP address of the affected asset.	10.0.XX.XX
EventKey	string	No	The ID of the breach awareness event.	69d189e2-ec17-4676-a2fe-02969234****
EventName	string	No	The name of the breach awareness event.	event_test
EventUuid	string	No	The UUID of the breach awareness event.	fadd-dfdd-****
MemberUid	long	No	The ID of the member.	135809047715****
ProcessStatusList	array	No	The handling status of breach awareness events.
	integer	No	The handling status of the breach awareness event. Valid values: 0: unhandled 20: handled	0
RiskLevel	array	No	The risk levels.
	integer	No	The risk level. Valid values: 1: low 2: medium 3: high	3

Response parameters

Parameter	Type	Description	Example
	object
LowLevelPercent	integer	The percentage of low-risk events.	20
RequestId	string	The ID of the request.	F0F82705-CFC7-5F83-86C8-A063892F****
MiddleLevelPercent	integer	The percentage of medium-risk events.	40
HighLevelPercent	integer	The percentage of high-risk events.	40
PageInfo	object	The pagination information.
CurrentPage	integer	The page number of the returned page.	1
PageSize	integer	The number of entries returned per page.	10
TotalCount	integer	The total number of breach awareness events.	40
EventList	array<object>	An array that consists of breach awareness events.
	object
RiskLevel	integer	The risk level. Valid values: 1: low 2: medium 3: high	1
EventName	string	The name of the breach awareness event.	event_test
EventKey	string	The ID of the breach awareness event.	69d189e2-ec17-4676-a2fe-02969234****
EventUuid	string	The UUID of the breach awareness event.	fadd-dfdd-****
MemberUid	string	The ID of the member.	135809047715****
AssetsType	string	The type of the affected asset. Valid values: BastionHostIP: the egress IP address of a bastion host BastionHostIngressIP: the ingress IP address of a bastion host EcsEIP: the elastic IP address (EIP) of an Elastic Compute Service (ECS) instance EcsPublicIP: the public IP address of an ECS instance EIP: the EIP EniEIP: the EIP of an elastic network interface (ENI) NatEIP: the EIP of a NAT gateway SlbEIP: the EIP of a Server Load Balancer (SLB) instance SlbPublicIP: the public IP address of an SLB instance NatPublicIP: the public IP address of a NAT gateway HAVIP: the high-availability virtual IP address (HAVIP)	EcsPublicIp
FirstTime	integer	The time when the breach awareness event first occurred. The value is a UNIX timestamp. Unit: seconds.	1656750960
EventSrc	string	The type of the breach awareness event. Valid values: IPS: intrusion prevention event offline: disconnection event	IPS
PrivateIP	string	The private IP address of the affected asset.	192.168.XX.XX
AssetsInstanceName	string	The name of the affected asset.	ECS_test
LastTime	integer	The time when the breach awareness event last occurred. The value is a UNIX timestamp. Unit: seconds.	1656837360
PublicIpType	string	The type of the affected asset. Valid values: BastionHostIP: the egress IP address of a bastion host BastionHostIngressIP: the ingress IP address of a bastion host EcsEIP: the EIP of an ECS instance EcsPublicIP: the public IP address of an ECS instance EIP: the EIP EniEIP: the EIP of an ENI NatEIP: the EIP of a NAT gateway SlbEIP: the EIP of an SLB instance SlbPublicIP: the public IP address of an SLB instance NatPublicIP: the public IP address of a NAT gateway HAVIP: the HAVIP	EcsPublicIp
IsIgnore	boolean	Indicates whether the breach awareness event is ignored. Valid values: true: The breach awareness event is ignored. false: The breach awareness event is not ignored.	true
PublicIP	string	The public IP address of the affected asset.	198.51.XX.XX
ProcessStatus	integer	The handling status of the breach awareness event. Valid values: 0: unhandled 20: handled	20
AssetsInstanceId	string	The ID of the affected asset.	i-ECS****

Examples

Sample success responses

JSONformat

{
  "LowLevelPercent": 20,
  "RequestId": "F0F82705-CFC7-5F83-86C8-A063892F****",
  "MiddleLevelPercent": 40,
  "HighLevelPercent": 40,
  "PageInfo": {
    "CurrentPage": 1,
    "PageSize": 10,
    "TotalCount": 40
  },
  "EventList": [
    {
      "RiskLevel": 1,
      "EventName": "event_test",
      "EventKey": "69d189e2-ec17-4676-a2fe-02969234****",
      "EventUuid": "fadd-dfdd-****",
      "MemberUid": "135809047715****",
      "AssetsType": "EcsPublicIp",
      "FirstTime": 1656750960,
      "EventSrc": "IPS",
      "PrivateIP": "192.168.XX.XX",
      "AssetsInstanceName": "ECS_test",
      "LastTime": 1656837360,
      "PublicIpType": "EcsPublicIp",
      "IsIgnore": true,
      "PublicIP": "198.51.XX.XX",
      "ProcessStatus": 20,
      "AssetsInstanceId": "i-ECS****"
    }
  ]
}

Error codes

For a list of error codes, visit the Service error codes.

Change history

Change time	Summary of changes	Operation
2022-07-07	Add Operation	View Change Details