DescribeSdlEventList-阿里云帮助中心

Query data breach events.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

yundun-cloudfirewall:DescribeSdlEventList

none

*All Resource

*

None

Request parameters

Parameter	Type	Required	Description	Example
Lang	string	No	The language of the response. Valid values: en : English zh : Chinese	zh
StartTime	integer	No	The start of the time range to query. This value is a UNIX timestamp representing seconds.	1759198702
EndTime	integer	No	The end of the time range to query. This value is a UNIX timestamp representing seconds.	1756433077
CurrentPage	integer	No	The page number of the returned page.	1
PageSize	integer	No	The number of entries per page.	10
SrcIp	string	No	The source IP address.	172.16.0.XXX
DstIp	string	No	The destination IP address.	47.100.102.XXX
Uuid	string	No	The unique ID of the event.	aa58cdf6-6cf8-493c-912d-97619a24****
Location	string	No	The region.	Zhangjiakou
Sort	string	No	The field to sort by.	TotalBytes
Order	string	No	The sort order. Valid values: `asc` (ascending) and `desc` (descending).	desc
OnlyAiEvt	integer	No	Specifies whether to return only events detected by AI.	0
SensitiveLevel	string	No	The sensitivity level of the data in the event.	S3

Response elements

Element	Type	Description	Example
	object	The returned data.
RequestId	string	The request ID.	F06DE24D-6EB9-5F55-B588-7BB946DF****
SdlEventDetailList	array<object>	An array of data leakage events.
	object	The details of a data leakage event.
AssetName	string	The asset name.	test
AssetPrivateIp	string	The private IP address of the asset.	47.100.102.XXX
AssetType	string	The asset type.	EIP
CategoryName	string	The category name.	Trusted
CategoryClassId	string	The intelligence tag category. Valid values: Suspicious: suspicious Malicious: malicious Trusted: trusted	Trusted
CityId	string	The city ID.	000
CountryId	string	The country ID.	cn
DstIp	string	The destination IP address.	106.14.74.XXX
DstPortList	string	The destination port.	22
EventCnt	integer	The number of events.	1
EventLevel	string	The event's risk level.	high
EventName	string	The event name.	Sensitive ID card data leakage
FirstTime	integer	The first time the event occurred, as a Unix timestamp in seconds.	1735697768
LastTime	integer	The last time the event occurred, as a Unix timestamp in seconds.	1738636157
LocationName	string	The location of the destination IP address.	Yuhang District, Hangzhou City, Zhejiang Province
Payload	string	The payload of the intrusion prevention event.	3082002f02010004067075626c6963a082002002044c33a756020100020100308200103082000c06082b060102010105000500
ProtoList	string	The protocol.	TCP
RegionId	string	The region ID.	cn-hangzhou
SensitiveDataCnt	integer	The number of sensitive data items.	10
SensitiveDataList	array	An array of sensitive data.
	string	A sensitive data item.	hege***********.com
SensitiveLevel	string	The sensitive data level.	S3
SensitiveType	string	The sensitive data type.	Identity Card
SrcIp	string	The source IP address.	104.28.226.XX
SrcPortList	string	The source port.	443
TrafficBytes	integer	The traffic volume in bytes.	0
Uuid	string	The unique identifier for the event.	b91035dc-8be4-411d-bec5-e6320af9****
ResourceId	string	The resource ID.	ce347a98f41e849188aa51c56b02a****
ResourceIdType	integer	The resource type.	0
TotalCount	integer	The total number of entries.	6

Examples

Success response

JSON format

{
  "RequestId": "F06DE24D-6EB9-5F55-B588-7BB946DF****",
  "SdlEventDetailList": [
    {
      "AssetName": "test",
      "AssetPrivateIp": "47.100.102.XXX",
      "AssetType": "EIP",
      "CategoryName": "Trusted",
      "CategoryClassId": "Trusted",
      "CityId": "000",
      "CountryId": "cn",
      "DstIp": "106.14.74.XXX",
      "DstPortList": "22",
      "EventCnt": 1,
      "EventLevel": "high",
      "EventName": "Sensitive ID card data leakage",
      "FirstTime": 1735697768,
      "LastTime": 1738636157,
      "LocationName": "Yuhang District, Hangzhou City, Zhejiang Province",
      "Payload": "3082002f02010004067075626c6963a082002002044c33a756020100020100308200103082000c06082b060102010105000500",
      "ProtoList": "TCP",
      "RegionId": "cn-hangzhou",
      "SensitiveDataCnt": 10,
      "SensitiveDataList": [
        "hege***********.com"
      ],
      "SensitiveLevel": "S3",
      "SensitiveType": "Identity Card",
      "SrcIp": "104.28.226.XX",
      "SrcPortList": "443",
      "TrafficBytes": 0,
      "Uuid": "b91035dc-8be4-411d-bec5-e6320af9****",
      "ResourceId": "ce347a98f41e849188aa51c56b02a****",
      "ResourceIdType": 0
    }
  ],
  "TotalCount": 6
}

Error codes

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.