AliyunCloudOpenAPI Component-Security Center(Security Center)-阿里云帮助中心

Response playbooks provide the OpenAPI component to call Alibaba Cloud service APIs through role assumption. You can use this component to integrate cloud service API operations into your automated response workflows.

Features

Action	Description	Scenario
assumeApi	Calls Alibaba Cloud OpenAPI through role assumption.	Automate security response actions by calling cloud service APIs.

Procedure

After you select an OpenAPI for a cloud service, verify that the required access policy is bound. If not, authorize the role first.

Step 1: Select a cloud service

In the Component Actions area, click Cloud Service Component.
In the Cloud Service Component dialog box, select a cloud-native Alibaba Cloud product (not Threat Intelligence).

For the threat intelligence component, see AliyunThreatIntelligence Component.

Step 2: Select an API

On the canvas, click the cloud service component. In the Actions area, select the API that you want to call.

Click the component node. The configuration panel appears on the right side. In the Alibaba Cloud Product area, verify that the target cloud service and API version are selected. Then, in the Actions area, expand the action category (such as Security Alerts) to find the target API operation.

Step 3: Configure API parameters

Open the configuration page: After you select an API, the parameter configuration page automatically appears. You can also click the API configuration button to open the page.
The API configuration button is the gear icon to the right of the API action (such as DescribeCustomizeReportList).
Configure the API
- Alibaba Cloud account
  - The default is the UID of your current Alibaba Cloud account. Use the expression ${event._tenant_id} to obtain the current account.
  - If multi-account management is configured for your account, enter a member account UID. To view member account UIDs, see Multi-account security management or call the DescribeMonitorAccounts API operation.
- Server address: Click Recommended Address to obtain a system-recommended address. Common recommended addresses include:
  Recommended addresses are for reference only. We recommend that you visit Alibaba Cloud official documentation for accurate endpoint information.
  - [ProductCode].[RegionId].aliyuncs.com. Example: ecs.cn-hangzhou.aliyuncs.com.
  - [ProductCode].aliyuncs.com. Example: ram.aliyuncs.com.
- Parameter settings: The parameter list is automatically populated based on the API reference for the selected API. Enter parameter values as described in the documentation.
  Click in the lower-left corner to open the API reference.
- Advanced settings
  If the API supports paged queries, configure pagination parameters in the advanced settings. The component supports automatic pagination (PageSize + PageNumber) and scroll-based pagination (cursor key). It automatically maps pagination parameters and calls the API in a loop until all data is retrieved.

Step 4: Authorize the API

The system displays the role name for calling the current API and the access policies to bind. Follow these steps:

Create an execution role (optional): Skip this step if the role already exists.
Click the link to go to the RAM console to create the role. On the quick authorization page in access control, click Confirm Authorization.
If you do not have permissions to create roles, contact the RAM administrator (a RAM user with resource management permissions or the Alibaba Cloud account owner) to create the role and bind the trust policy in the RAM console. For more information, see Create a RAM role for Alibaba Cloud services. Configure the following settings:
- Trust principal: Cloud service.
- Trust principal name: cloudsiem.sas.aliyuncs.com.
- Role name: AliyunSiemSoarExecutionDefaultRole
Bind API access policies (optional): Skip this step if the access policies are already bound.
- Click Bind Access Policy. In the access policy dialog box, select an appropriate policy. We recommend that you use the System Recommended Access Policy.
  If no suitable access policy is available, log on to the RAM console to create an access policy. For more information, see Create a custom policy.
- Click OK to go to the access control authorization page. Click Confirm Authorization.
If you do not have authorization permissions, contact the RAM administrator (a RAM user with resource management permissions or the Alibaba Cloud account owner) to bind the System Recommended Access Policy to the role AliyunSiemSoarExecutionDefaultRole. For more information, see Manage permissions for a RAM role.

Automatic paged query

Maximum requests: The maximum number of paged requests, which equals the number of loop API calls.
Total entries path: The path to obtain the total number of entries from the response, in JSONPath format. Multi-level nesting is supported.
- For a flat response structure, use the format .targetFieldName. In the following example, the path is .TotalCount:
```
{
  "TotalCount": 1,
  "PageNumber": 1,
  "PageSize": 10
}
```
- For a nested response structure, concatenate the full parameter path in hierarchical order until you reach the target field. Use the format .firstLevelField.secondLevelField...targetFieldName.
  In the following example with two-level nesting, the path is .Page.TotalCount:
```
{
  "Page": {
    "TotalCount": 22,
    "PageNumber": 1,
    "PageSize": 10
  }
}
```
Pagination field mapping: The pagination field mapping in the request parameters, such as PageNumber.
Page size field mapping: The page size field mapping in the request parameters, such as PageSize.

Automatic scroll-based query

Maximum requests: The maximum number of paged requests, which equals the number of loop API calls.
Cursor field mapping: The cursor field mapping in the request parameters, such as NextToken.
Cursor path: The cursor value in the response, in JSONPath format.
- For a flat response structure, use the format .targetFieldName. In the following example, the path is .NextToken:
```
{
  "CurrentPage": 1,
  "PageSize": 10,
  "TotalCount": 202,
  "Count": 4,
  "NextToken": "B604532DEF982B875E8360A6EFA3B***"
}
```
- For a nested response structure, concatenate the full parameter path in hierarchical order until you reach the target field. Use the format .firstLevelField.secondLevelField...targetFieldName.
  In the following example with two-level nesting, the path is .PageInfo.NextToken:
```
{
  "PageInfo": {
    "CurrentPage": 1,
    "PageSize": 10,
    "TotalCount": 202,
    "Count": 4,
    "NextToken": "B604532DEF982B875E8360A6EFA3B***"
  },
  "Success": true,
  "Code": 200,
  "Message": "successful",
  "RequestId": "CB414DB5-F692-5DAB-9F0F-975C060AF***",
  "HttpStatusCode": 200
}
```

Loop call

API loop call interval: Set the interval between paged API calls to prevent API throttling.