ListFileProtectEvent - Security Center - Alibaba Cloud Documentation Center

Queries core file monitoring rules that meet the specified filter condition.

Debugging

You can run this interface directly in OpenAPI Explorer, saving you the trouble of calculating signatures. After running successfully, OpenAPI Explorer can automatically generate SDK code samples.

Debug

Authorization information

There is currently no authorization information disclosed in the API.

Request parameters

Parameter	Type	Required	Description	Example
RuleName	string	No	The name of the rule.	test-rule-1
Status	string	No	The status of the event. Valid values: 0: unhandled 1: handled 2: added to the whitelist 3: ignored	2
AlertLevels	array	No	The severities of alerts.
	integer	No	The severity of the alert. Valid values: 0: does not generate alerts 1: sends notifications 2: suspicious 3: high-risk	1
CurrentPage	integer	No	The page number.	1
PageSize	string	No	The number of entries per page.	20
InstanceId	string	No	The instance ID of the asset.	i-bp1fu4aqltf1huhc****
Uuid	string	No	The UUID of the server. Note You can call the DescribeCloudCenterInstances operation to query the UUID of the server.	inet-ecs-4e876cb0-09f7-43b8-82ef-4bc7a937***
InstanceName	string	No	The name of the server.	ca_cpm_****
InternetIp	string	No	The public IP address of the server.	120.27.XX.XX
IntranetIp	string	No	The private IP address of the server.	172.26.XX.XX
StartTime	long	No	The start timestamp of the query.	1683080489594
EndTime	long	No	The end timestamp of the query.	1683195595204
Operation	string	No	Type of operation on a file. eg: DELETE: delete the file. WRITE: write the file. READ: read the file. RENAME: rename the file. CHOWN: set the file owner and file association group operations.	READ

Response parameters

Parameter	Type	Description	Example
	object	The schema of response.
RequestId	string	The request ID.	23AD0BD2-8771-5647-819E-6BA51E212F80
EventList	array<object>	The events.
list	object
AlertLevel	integer	The severity of the alert. Valid values: 0: no alerts 1: reminder 2: suspicious 3: high-risk	1
Uuid	string	The UUID of the server that is associated with the process.	94b44720-d982-4d20-a4e1-80a1a57b5a8e
RuleName	string	The name of the rule.	test-rule-1
LatestTime	long	The time when the event last occurred.	1694576692000
Status	integer	The status of the event. Valid values: 0: unhandled 1: handled 2: added to the whitelist 3: ignored	1
Id	long	The ID of the event.	161757
InstanceName	string	The instance name of the server.	kyy-admin-01
InternetIp	string	The public IP address of the server.	121.40.211.194
IntranetIp	string	The private IP address of the server.	172.22.5.36
FilePath	string	The path to the file that is managed by the process.	/etc/pam.d/su
Operation	string	The operation performed by the process on the file.	DELETE
Remark	string	The description.	test
ProcPermission	string	The permissions required to start the process.	rwxr-xr-x
CmdLine	string	The command line of the event.	["touch","/test/aaaa"]
ProcPath	string	The path to the process.	/usr/bin/sshpass
HandleTime	long	The time when the event was handled.	1694576692000
ProcessId	string	The ID of the process.	52636
Platform	string	The type of the operating system. Valid values: windows: Windows linux: Linux	linux
PageInfo	object	The pagination information.
CurrentPage	integer	The page number.	1
PageSize	integer	The number of entries per page.	20
TotalCount	integer	The total number of entries returned.	149

Examples

Sample success responses

JSONformat

{
  "RequestId": "23AD0BD2-8771-5647-819E-6BA51E212F80",
  "EventList": [
    {
      "AlertLevel": 1,
      "Uuid": "94b44720-d982-4d20-a4e1-80a1a57b5a8e",
      "RuleName": "test-rule-1\n",
      "LatestTime": 1694576692000,
      "Status": 1,
      "Id": 161757,
      "InstanceName": "kyy-admin-01",
      "InternetIp": "121.40.211.194",
      "IntranetIp": "172.22.5.36",
      "FilePath": "/etc/pam.d/su",
      "Operation": "DELETE",
      "Remark": "test",
      "ProcPermission": "rwxr-xr-x",
      "CmdLine": "[\"touch\",\"/test/aaaa\"]",
      "ProcPath": " /usr/bin/sshpass",
      "HandleTime": 1694576692000,
      "ProcessId": "52636",
      "Platform": "linux"
    }
  ],
  "PageInfo": {
    "CurrentPage": 1,
    "PageSize": 20,
    "TotalCount": 149
  }
}

Error codes

HTTP status code	Error code	Error message	Description
400	IllegalParameter	Illegal parameter, please check the param.	Parameter error, please check the input parameters.
403	NoPermission	caller has no permission	You are not authorized to do this operation.
500	ServerError	ServerError	-

For a list of error codes, visit the Service error codes.

Change history

Change time	Summary of changes	Operation
2024-09-02	The Error code has changed. The response structure of the API has changed	View Change Details
2024-07-25	The Error code has changed	View Change Details
2024-06-21	The request parameters of the API has changed	View Change Details
2024-04-29	The request parameters of the API has changed	View Change Details
2023-10-09	The internal configuration of the API is changed, but the call is not affected	View Change Details