All Products
Search

This Product

    :DescribeApisecEvents

    Document Center

    :DescribeApisecEvents

    Last Updated:Nov 15, 2024

    Queries API security events.

    Debugging

    You can run this interface directly in OpenAPI Explorer, saving you the trouble of calculating signatures. After running successfully, OpenAPI Explorer can automatically generate SDK code samples.

    Authorization information

    The following table shows the authorization information corresponding to the API. The authorization information can be used in the Action policy element to grant a RAM user or RAM role the permissions to call this API operation. Description:

    • Operation: the value that you can use in the Action element to specify the operation on a resource.
    • Access level: the access level of each operation. The levels are read, write, and list.
    • Resource type: the type of the resource on which you can authorize the RAM user or the RAM role to perform the operation. Take note of the following items:
      • The required resource types are displayed in bold characters.
      • If the permissions cannot be granted at the resource level, All Resources is used in the Resource type column of the operation.
    • Condition Key: the condition key that is defined by the cloud service.
    • Associated operation: other operations that the RAM user or the RAM role must have permissions to perform to complete the operation. To complete the operation, the RAM user or the RAM role must have the permissions to perform the associated operations.
    OperationAccess levelResource typeCondition keyAssociated operation
    yundun-waf:DescribeApisecEventsget
    *All Resources
    *
      none
    		none

    Request parameters

    ParameterTypeRequiredDescriptionExample
    InstanceIdstringYes

    The ID of the Web Application Firewall (WAF) instance.

    Note You can call the DescribeInstance operation to query the ID of the WAF instance.
    		waf_v2_public_cn-5y***d31
    EventIdstringNo

    The ID of the API security event.

    		18ba94fea9***e66ba0557b7b91
    ApiFormatstringNo

    The API.

    		/apisec/v1/register.php
    MatchedHoststringNo

    The domain name or IP address of the API.

    		a.aliyun.com
    EventTagstringNo

    The type of the event.

    Note You can call the DescribeApisecRules operation to query the supported event types.
    		ObtainSensitiveUnauthorized
    StartTslongNo

    The beginning of the time range to query. This value is a UNIX timestamp in UTC. Unit: seconds.

    		1683648000
    EndTslongNo

    The end of the time range to query. This value is a UNIX timestamp in UTC. Unit: seconds.

    		1683703260
    OrderKeystringNo

    The name of the sorting field. Valid values:

    • allCnt: the number of attacks
    • startTs: the start time of the event
    • endTs: the end time of the event
    		startTs
    OrderWaystringNo

    The sorting method. Valid values:

    • desc (default): descending order
    • asc: ascending order
    		desc
    PageNumberlongNo

    The page number. Default value: 1.

    		1
    PageSizelongNo

    The number of entries per page. Default value: 10.

    		10
    ApiTagstringNo

    The business purpose of the API.

    Note You can call the DescribeApisecRules operation to query the business purpose of the API.
    		SendMail
    OriginstringNo

    The source of the event type. Valid values:

    • custom
    • default
    		default
    EventLevelstringNo

    The severity level of the event. Valid values:

    • high
    • medium
    • low
    		low
    UserStatusstringNo

    The event status. Valid values:

    • toBeConfirmed
    • confirmed
    • ignored
    		Ignore
    AttackIpstringNo

    The Attack source IP.

    		42.224.*.*
    ApiIdstringNo

    The ID of the event-related API.

    		820b860***6205da93b935b28
    ClusterIdstringNo

    The ID of the hybrid cloud cluster.

    Note For hybrid cloud scenarios only, you can call the DescribeHybridCloudClusters operation to query the hybrid cloud clusters.
    		428
    RegionIdstringNo

    The region in which the WAF instance is deployed. Valid values:

    • cn-hangzhou: Chinese mainland.
    • ap-southeast-1: outside the Chinese mainland.
    		cn-hangzhou
    ResourceManagerResourceGroupIdstringNo

    The ID of the Alibaba Cloud resource group.

    		rg-acfm***q

    Response parameters

    ParameterTypeDescriptionExample
    object

    The response parameters.

    TotalCountlong

    The total number of entries returned.

    		3
    RequestIdstring

    The request ID.

    		12F4CC8F-7E9F-5E4D-BF7C-BD1EDDE0C282
    Dataarray<object>

    The security events.

    resourceobject

    The information about the security event.

    Originstring

    The source of the event type. Valid values:

    • custom
    • default
    		custom
    EventLevelstring

    The severity level of the event. Valid values:

    • high
    • medium
    • low
    		medium
    StartTslong

    The beginning of the time range to query. This value is a UNIX timestamp in UTC. Unit: seconds.

    		1683648000
    EventInfostring

    The details of the event. The value of this parameter is a JSON string that contains multiple parameters. The value includes the following parameters:

    • ip_info: the information about the attack source IP address. This parameter corresponds to the AttackIpInfo response parameter.
    • rule_id: the ID of the rule corresponding to the event.
    • rule_tag: the information about the rule corresponding to the event.
    		{}
    ApiFormatstring

    The API.

    		/apisec/v1/register.php
    ApiTagstring

    The business purpose of the API.

    Note You can call the DescribeApisecRules operation to query the business purpose of the API.
    		SendMail
    UserStatusstring

    The event status. Valid values:

    • toBeConfirmed
    • confirmed
    • ignored
    		Ignore
    Followinteger

    Indicates whether the API is followed. Valid values:

    • 1: The API is followed.
    • 0: The API is not followed.
    		0
    RequestDatastring

    The sample API request. The value of this parameter is a JSON string that contains multiple parameters.

    		{}
    EventIdstring

    The ID of the event.

    		c82cb276847e9c96f9597d9f4b0cdcff
    AttackIpstring

    The source IP address of the attack.

    		104.234.140.33
    AttackIpInfostring

    The information about the attack source IP address. The value of this parameter is a JSON string that contains multiple parameters. The value includes the following parameters:

    • ip: the IP address
    • country_id: the country ID
    • region_id: the region ID
    • cnt: the number of attacks
    		[{\"ip\":\"72.*.*.119\",\"country_id\":\"US\",\"region_id\":\"\",\"cnt\":\"2100\"}]
    EndTslong

    The end of the time range to query. This value is a UNIX timestamp in UTC. Unit: seconds.

    		1683703260
    AttackCntInfostring

    The information about the number of attacks. The value of this parameter is a JSON string that contains multiple parameters. Key indicates the timestamp in seconds, and Value indicates the number of attacks.

    		{\"1717498320\":500,\"1717498380\":529,\"1717498440\":20,\"1717498260\":518,\"1717498200\":481,\"1717498140\":52}
    AllCntlong

    The number of attacks.

    		10
    RemoteRegionstring

    The region to which the attack source IP address belongs.

    		110000
    ResponseDatastring

    The sample API response. The value of this parameter is a JSON string that contains multiple parameters.

    		{}
    AttackClientstring

    The client that is attacked.

    		Chrome
    EventTagstring

    The type of the event.

    Note You can call the DescribeApisecRules operation to query the supported event types.
    		ObtainSensitiveUnauthorized
    MatchedHoststring

    The domain name or IP address of the API.

    		a.aliyun.com
    Notestring

    The remarks.

    		Notified
    ApiIdstring

    The ID of the API that is associated with the security event.

    		2ecc1cf67b91853bc55545052ccf06a8
    RemoteCountrystring

    The country to which the attack source IP address belongs.

    		US

    Examples

    Sample success responses

    JSONformat

    {
  "TotalCount": 3,
  "RequestId": "12F4CC8F-7E9F-5E4D-BF7C-BD1EDDE0C282",
  "Data": [
    {
      "Origin": "custom",
      "EventLevel": "medium",
      "StartTs": 1683648000,
      "EventInfo": "{}",
      "ApiFormat": "/apisec/v1/register.php",
      "ApiTag": "SendMail",
      "UserStatus": "Ignore",
      "Follow": 0,
      "RequestData": "{}",
      "EventId": "c82cb276847e9c96f9597d9f4b0cdcff",
      "AttackIp": "104.234.140.33",
      "AttackIpInfo": "[{\\\"ip\\\":\\\"72.*.*.119\\\",\\\"country_id\\\":\\\"US\\\",\\\"region_id\\\":\\\"\\\",\\\"cnt\\\":\\\"2100\\\"}]",
      "EndTs": 1683703260,
      "AttackCntInfo": "{\\\"1717498320\\\":500,\\\"1717498380\\\":529,\\\"1717498440\\\":20,\\\"1717498260\\\":518,\\\"1717498200\\\":481,\\\"1717498140\\\":52}",
      "AllCnt": 10,
      "RemoteRegion": "110000",
      "ResponseData": "{}",
      "AttackClient": "Chrome",
      "EventTag": "ObtainSensitiveUnauthorized",
      "MatchedHost": "a.aliyun.com",
      "Note": "Notified",
      "ApiId": "2ecc1cf67b91853bc55545052ccf06a8",
      "RemoteCountry": "US"
    }
  ]
}

    Error codes

    For a list of error codes, visit the Service error codes.