DocsICP FilingConsole
Documentation

ListHoneypotEventFlows

Updated at:
Copy as MD
Product
My Favorites

Retrieves the details of an intrusion event in a honeypot.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

  • Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.

  • API: The API that you can call to perform the action.

  • Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.

  • Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.

    • For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.

    • For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.

  • Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.

  • Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

yundun-sas:ListHoneypotEventFlows

list

*All Resource

*

 None None

Request parameters

Parameter

Type

Required

Description

Example
Dealed

string

No

The status of the event. Valid values: y, n, and a. The value y indicates handled. The value n indicates unhandled. The value a indicates all.

n
SecurityEventId

integer

No

The ID of the alert event. The ID of the management account of the ListHoneypotEvents resource directory.

Note

You can call the ListHoneypotEvents operation to query the IDs of alert events.

7455818
CurrentPage

integer

No

The page number. Default value: 1.

1
PageSize

integer

No

The number of entries per page. Default value: 20. If you leave this parameter empty, 20 entries are returned on each page.

Note

We recommend that you do not leave this parameter empty.

20
RequestId

string

No

The request ID.

9F4E6157-9600-5588-86B9-38F09067****
Lang

string

No

The language of the content within the request and response. Default value: zh. Valid values:

  • zh: Chinese

  • en: English

zh

Response elements

Element

Type

Description

Example

object

The response parameters.

HoneypotEventFlows

array<object>

The attack timelines.

object

SecurityEventId

integer

The ID of the intrusion event.

306527555
HoneypotEventId

string

The ID of the intrusion event. The value is a string.

19bec028-d98b-45c4-a4d9-cc3d593f****
LastTime

integer

The timestamp when the intrusion event was last occurred.

1686622222000
FirstTime

integer

The timestamp when the intrusion event was first occurred.

1686621122000
EventConnection

string

The UUID of the connection in the attack.

fd7f1ff4-0c4b-41cb-99ad-0724349d****
AgentId

string

The ID of the probe.

d3c0dafa-5059-4eb0-8c28-7d40f58*****
AgentName

string

The name of the probe.

hw-d***
HoneypotId

string

The ID of the honeypot.

911df9d6fe20451c059edbcffa1d1c33452f6a71e59d4826da067af224*****
HoneypotName

string

The name of the honeypot.

hw-zhi*****
DockerId

string

The ID of the container.

eca09895****
DstIp

string

The destination IP address.

112.126.205.***
DstPort

integer

The destination port.

80
SrcIp

string

The source IP address.

121.41.48.***
SrcMac

string

The source media access control (MAC) address.

00:0C:29:CA:**:**
SrcPort

integer

The source port number.

80
TypeId

string

The ID of the attack type.

web_access
RiskLevel

string

The risk level. Valid values:

  • 2: low

  • 3: medium

  • 4: high

4
Extra

string

The extended information about the attack payload.

{\"payload\":{\"format\":\"line\",\"name\":{\"cn\":\"\",\"en\":\"payload\"},\"value\":\"\"},\"uid\":{\"format\":\"line\",\"name\":{\"cn\":\"\",\"en\":\"\"},\"uid\":\"5fa2ece9-aa08-4bbd-a272-5d27*********\",\"value\":\"\"}}
Extra1

string

The extension information about the virtual private cloud (VPC).

{\"vpc_id\":\"\",\"vpc_dest_port\":\"\",\"vpc_dest_ip\":\"\"}
Uid

string

The UUID of an attack in the intrusion event.

5fa2ece9-aa08-4bbd-a272-5d27d1c6*****
Status

integer

The handling status of the intrusion event. Valid values:

  • 1: pending handling

  • 2: ignored

  • 4: confirmed

1
FileOssUrl

string

The Object Storage Service (OSS) URL of the file.

https://pop-test-file-upload.oss-cn-beijing.aliyuncs.com/5626_26331*****
PageInfo

object

The pagination information.

CurrentPage

integer

The page number.

1
PageSize

integer

The number of entries per page.

20
TotalCount

integer

The total number of entries returned.

78
Count

integer

The number of entries returned on the current page.

20
Success

boolean

Indicates whether the request was successful. Valid values:

  • true

  • false

true
Code

string

The status code. The status code 200 indicates that the request was successful. Other status codes indicate that the request failed. You can identify the cause of the failure based on the status code.

200
Message

string

The returned message.

successful
RequestId

string

The request ID.

9F4E6157-9600-5588-86B9-38F09067****
HttpStatusCode

integer

The HTTP status code.

200

Examples

Success response

JSON format

{
  "HoneypotEventFlows": [
    {
      "SecurityEventId": 306527555,
      "HoneypotEventId": "19bec028-d98b-45c4-a4d9-cc3d593f****",
      "LastTime": 1686622222000,
      "FirstTime": 1686621122000,
      "EventConnection": "fd7f1ff4-0c4b-41cb-99ad-0724349d****",
      "AgentId": "d3c0dafa-5059-4eb0-8c28-7d40f58*****",
      "AgentName": "hw-d***",
      "HoneypotId": "911df9d6fe20451c059edbcffa1d1c33452f6a71e59d4826da067af224*****",
      "HoneypotName": "hw-zhi*****",
      "DockerId": "eca09895****",
      "DstIp": "112.126.205.***",
      "DstPort": 80,
      "SrcIp": "121.41.48.***",
      "SrcMac": "00:0C:29:CA:**:**",
      "SrcPort": 80,
      "TypeId": "web_access",
      "RiskLevel": "4",
      "Extra": "{\\\"payload\\\":{\\\"format\\\":\\\"line\\\",\\\"name\\\":{\\\"cn\\\":\\\"\\\",\\\"en\\\":\\\"payload\\\"},\\\"value\\\":\\\"\\\"},\\\"uid\\\":{\\\"format\\\":\\\"line\\\",\\\"name\\\":{\\\"cn\\\":\\\"\\\",\\\"en\\\":\\\"\\\"},\\\"uid\\\":\\\"5fa2ece9-aa08-4bbd-a272-5d27*********\\\",\\\"value\\\":\\\"\\\"}}",
      "Extra1": "{\\\"vpc_id\\\":\\\"\\\",\\\"vpc_dest_port\\\":\\\"\\\",\\\"vpc_dest_ip\\\":\\\"\\\"}",
      "Uid": "5fa2ece9-aa08-4bbd-a272-5d27d1c6*****",
      "Status": 1,
      "FileOssUrl": "https://pop-test-file-upload.oss-cn-beijing.aliyuncs.com/5626_26331*****"
    }
  ],
  "PageInfo": {
    "CurrentPage": 1,
    "PageSize": 20,
    "TotalCount": 78,
    "Count": 20
  },
  "Success": true,
  "Code": "200",
  "Message": "successful",
  "RequestId": "9F4E6157-9600-5588-86B9-38F09067****",
  "HttpStatusCode": 200
}

Error codes

HTTP status code

Error code

Error message

Description
400 IllegalParam Illegal param
500 ServerError ServerError
403 NoPermission caller has no permission You are not authorized to do this operation.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.