GetAttackPathEventDetail - 查询攻击路径事件详情

授权信息

请求参数

返回参数

示例

正常返回示例

JSON格式

{
  "RequestId": "7BC55C8F-226E-5AF5-9A2C-2EC43864****",
  "AttackPathEvent": {
    "DstAsset": {
      "AssetSubType": 2,
      "AssetType": 3,
      "InstanceId": "i-bp18ifsr1tu1dx39****\n",
      "InstanceName": "test",
      "RegionId": "cn-shanghai",
      "Vendor": 0,
      "SensitiveAssetFlag": 0
    },
    "FirstTime": 1735956726000,
    "LastTime": 1741832168000,
    "PathEventEdgeList": [
      {
        "EdgeId": 123,
        "EdgeType": "role_trust_user",
        "ElementType": "branch",
        "EndNodeUuid": "52d59cca9d1768bab5fe081317637990",
        "RepairSuggestionDisplay": "The RAM role is granted the administrator permissions and trusts the user of another Alibaba Cloud account. In this case, the current Alibaba Cloud account may be fully controlled by the trusted Alibaba Cloud account. We recommend that you delete the trust relationship. If you need to trust another Alibaba Cloud account, we recommend that you split your business requirements and follow the principle of least privilege to grant permissions across accounts in a fine-grained manner. You can also use RAM.\\n\\nIf you confirm that the role does not need to trust an Alibaba Cloud account, perform the following operations: In the RAM console, click the required RAM role. On the page that appears, view the trust policy of the role. Then, edit the Service field to delete the trust relationship. If you confirm that permissions can be reduced, perform the following operations: In the RAM console, click the required RAM role. On the page that appears, view the permissions of the role. Then, find the policy that defines the administrator permissions and revoke the policy. Attach another policy to the role based on your business requirements.",
        "StartNodeUuid": "b7e1bd42c4ca47f69020f4a27b47d2b4"
      }
    ],
    "PathEventNodeList": [
      {
        "ElementType": "branch",
        "NodeDetail": "{\"assetId\":0}",
        "NodeName": "hypermatch_uploader",
        "NodeType": "user",
        "NodeUuid": "52d59cca9d1768bab5fe081317637990",
        "SensitiveAssetFlag": 0,
        "AiAssetFlag": 1
      }
    ],
    "PathName": "ecs_get_credential_by_create_login_profile",
    "PathNameDesc": "ECS Instance Can Obtain Long-term Access Credential by Enabling Console Logon for RAM User",
    "PathType": "role_escalation",
    "RiskLevel": "suspicious",
    "SrcAsset": {
      "AssetSubType": 4,
      "AssetType": 14,
      "InstanceId": "i-25b24****",
      "InstanceName": "test",
      "RegionId": "cn-hangzhou",
      "Vendor": 0,
      "SensitiveAssetFlag": 0
    },
    "PathTypeDesc": "Privilege Escalation by Role",
    "PathDetailDesc": "The system detects that the role that trusts another Alibaba Cloud account has administrator permissions. This can cause the system to be fully controlled. We recommend that you delete the trust relationship and review the permissions of the role.\n",
    "PathInterpretationStatus": "",
    "PathInterpretationUrl": ""
  }
}

错误码

变更历史