DescribeCloudSiemEvents - Security Center - Alibaba Cloud Documentation Center

Queries events in SIEM.

Debugging

You can run this interface directly in OpenAPI Explorer, saving you the trouble of calculating signatures. After running successfully, OpenAPI Explorer can automatically generate SDK code samples.

Debug

Authorization information

The following table shows the authorization information corresponding to the API. The authorization information can be used in the Action policy element to grant a RAM user or RAM role the permissions to call this API operation. Description:

Operation: the value that you can use in the Action element to specify the operation on a resource.
Access level: the access level of each operation. The levels are read, write, and list.
Resource type: the type of the resource on which you can authorize the RAM user or the RAM role to perform the operation. Take note of the following items:
- The required resource types are displayed in bold characters.
- If the permissions cannot be granted at the resource level, All Resources is used in the Resource type column of the operation.
Condition Key: the condition key that is defined by the cloud service.
Associated operation: other operations that the RAM user or the RAM role must have permissions to perform to complete the operation. To complete the operation, the RAM user or the RAM role must have the permissions to perform the associated operations.

Operation	Access level	Resource type	Condition key	Associated operation
yundun-sas:DescribeCloudSiemEvents	list	All Resources *	none	none

Request parameters

Parameter	Type	Required	Description	Example
StartTime	long	No	The beginning of the time range to query. Unit: milliseconds.	1577808000000
EndTime	long	No	The end of the time range to query. Unit: milliseconds.	1577808000000
ThreadLevel	array	No	The risk levels of the events. The value is a JSON array. Valid values: serious: high suspicious: medium remind: low
ThreadLevel	string	No	The risk level of the event. The value is a JSON string. Valid values: serious: high suspicious: medium remind: low	["remind","serious"]
EventName	string	No	The name of the event.	ECS unusual log in
IncidentUuid	string	No	The ID of the event.	85ea4241-798f-4684-a876-65d4f0c3****
AssetId	string	No	The ID of the asset that is associated with the event.	6c740667-80b2-476d-8924-2e706feb****
Status	integer	No	The status of the event. Valid values: 0: unhandled 1: handling 5: handling failed 10: handled	0
OrderField	string	No	The sort field. Valid values: GmtModified: sorts the events by creation time. This is the default value. ThreatScore: sorts the events by risk score.	ThreatScore
Order	string	No	The sort order. Valid values: desc: descending order asc: ascending order	desc
CurrentPage	integer	Yes	The page number. Pages start from page 1.	1
PageSize	integer	Yes	The number of entries per page. Maximum value: 100.	10
RoleType	integer	No	The type of the view. Valid values: 0: the current Alibaba Cloud account 1: the global account	1
RoleFor	long	No	The ID of the account that you switch from the management account.	113091674488****
RegionId	string	No	The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values: cn-hangzhou: Your assets reside in regions in China. ap-southeast-1: Your assets reside in regions outside China.	cn-hangzhou

Response parameters

Parameter	Type	Description	Example
	object	PageResponse<List>
Success	boolean	Indicates whether the request was successful. Valid values: true false	true
Code	integer	The HTTP status code.	200
Message	string	The returned message.	success
RequestId	string	The request ID.	9AAA9ED9-78F4-5021-86DC-D51C7511****
Data	object	The data returned.
PageInfo	object	The pagination information.
CurrentPage	integer	The current page number.	1
PageSize	integer	The number of entries per page.	10
TotalCount	long	The total number of entries returned.	100
ResponseData	array<object>	The detailed data.
ResponseData	object
GmtCreate	string	The time when the event occurred.	2021-01-06 16:37:29
GmtModified	string	The time when the event was last updated.	2021-01-06 16:37:29
Aliuid	long	The ID of the Alibaba Cloud account to which the event belongs.	127608589417****
AlertNum	integer	The number of alerts that are associated with the event.	4
AssetNum	integer	The number of assets that are associated with the event.	4
IncidentUuid	string	The UUID of the event.	85ea4241-798f-4684-a876-65d4f0c3****
IncidentName	string	The name of the event.	Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc
IncidentNameEn	string	The event name in English.	Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc
Description	string	The description of the event.	The threat event contains 13 Miner Network,1 Execute suspicious encoded commands on Linux, etc
DescriptionEn	string	The event description in English.	The threat event contains 13 Miner Network,1 Execute suspicious encoded commands on Linux, etc
DataSources	array	The sources of the alert.
DataSource	string	The source.	[sas,waf]
ThreatLevel	string	The risk level. Valid values: serious: high. suspicious: medium. remind: low.	remind
ThreatScore	float	The risk score of the event. Valid values: 0 to 100. A higher value indicates a higher risk level.	90.2
ExtContent	string	The extended event information in the JSON format.	{"event_transfer_type":"customize_rule"}
Status	integer	The status of the event. Valid values: 0: unhandled. 1: handling. 5: handling failed. 10: handled.	0
AttCkLabels	array	The tags of the ATT&CK techniques.
AttCkLabel	string	The tag of the ATT&CK technique.	["T1595.002 Vulnerability Scanning"]
ReferAccount	string	the refer account info.	127608589417****
Remark	string	The remarks of the event.	dealed

Examples

Sample success responses

JSONformat

{
  "Success": true,
  "Code": 200,
  "Message": "success",
  "RequestId": "9AAA9ED9-78F4-5021-86DC-D51C7511****",
  "Data": {
    "PageInfo": {
      "CurrentPage": 1,
      "PageSize": 10,
      "TotalCount": 100
    },
    "ResponseData": [
      {
        "GmtCreate": "2021-01-06 16:37:29",
        "GmtModified": "2021-01-06 16:37:29",
        "Aliuid": 0,
        "AlertNum": 4,
        "AssetNum": 4,
        "IncidentUuid": "85ea4241-798f-4684-a876-65d4f0c3****",
        "IncidentName": "Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc",
        "IncidentNameEn": "Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc",
        "Description": "The threat event contains 13 Miner Network,1 Execute suspicious encoded commands on Linux, etc",
        "DescriptionEn": "The threat event contains 13 Miner Network,1 Execute suspicious encoded commands on Linux, etc",
        "DataSources": [
          "[sas,waf]"
        ],
        "ThreatLevel": "remind",
        "ThreatScore": 90.2,
        "ExtContent": "{\"event_transfer_type\":\"customize_rule\"}",
        "Status": 0,
        "AttCkLabels": [
          "[\"T1595.002 Vulnerability Scanning\"]"
        ],
        "ReferAccount": "127608589417****",
        "Remark": "dealed"
      }
    ]
  }
}

Error codes

HTTP status code	Error code	Error message
500	InternalError	The request processing has failed due to some unknown error.

For a list of error codes, visit the Service error codes.

Change history

Change time	Summary of changes	Operation
2024-11-04	The Error code has changed. The request parameters of the API has changed. The response structure of the API has changed	View Change Details
2024-04-17	The Error code has changed. The request parameters of the API has changed. The response structure of the API has changed	View Change Details