Alibabacloud Cfw Ips Event

IPS Alert Event Analysis

Skill Scope Notes:

- This skill is designed to use Aliyun CLI cloudfw commands as its primary data source.

- It does not depend on local log files, SIEM exports, or direct host access.

- It does not require SSH or direct connections to server IPs.

- For IP-focused investigations, prefer DescribeRiskEventGroup with --SrcIP or --DstIP.

Scenario Description

Query and analyze IPS (Intrusion Prevention System) security events and alerts detected by Alibaba Cloud Firewall, helping quickly locate threats and provide remediation recommendations.

Architecture: Cloud Firewall Service → IPS Engine → Event Detection + Attack Analysis + Protection Configuration

Capability Level: Query (read-only)

Data Source: All data is obtained exclusively through Aliyun CLI commands (aliyun cloudfw ...). No log files, no databases, no server access, no SIEM — just CLI commands. Do NOT search the workspace for files. Do NOT ask the user for anything. Just run the commands.

Core Capabilities: 1. Alert Overview — IPS alert statistics including attack counts, block counts, and severity distribution 2. Alert Event Details — Detailed list of IPS alert events with source/destination, attack type, and handling status 3. Top Attacked Assets — Ranking of most attacked assets 4. Attack Type Analysis — Distribution of attack types and applications 5. IPS Configuration Status — Current IPS run mode, rule switches, and rule library version 6. Remediation Recommendations — Prioritized security recommendations based on alert data

---

Prerequisites

Pre-check: Aliyun CLI >= 3.3.3 required

Run aliyun version to verify >= 3.3.3. If not installed or version too low,

run curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash to install/update,

or see references/cli-installation-guide.md for installation instructions.

Pre-check: Aliyun CLI plugin update required

[MUST] run aliyun configure set --auto-plugin-install true to enable automatic plugin installation.

[MUST] run aliyun plugin update to ensure that any existing plugins are always up-to-date.

[MUST] CLI User-Agent — Every aliyun CLI command invocation must include: --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-ips-event

At the start of the Core Workflow (before any CLI invocation): [MUST] Enable AI-Mode — AI-mode is required for Agent Skill execution. Run the following commands before any CLI invocation:

aliyun configure ai-mode enable
aliyun configure ai-mode set-user-agent --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-cfw-ips-event"

[MUST] Disable AI-Mode at EVERY exit point — Before delivering the final response for ANY reason, always disable AI-mode first. This applies to ALL exit paths: workflow success, workflow failure, error/exception, user cancellation, session end, or any other scenario where no further CLI commands will be executed. AI-mode is only used for Agent Skill invocation scenarios and MUST NOT remain enabled after the skill stops running.

aliyun configure ai-mode disable

---

Authentication

Pre-check: Alibaba Cloud Credentials Required

>

Security Rules:

- NEVER read, echo, print, cat, or display AK/SK values under any circumstances

- NEVER ask the user to input AK/SK directly in the conversation or command line

- NEVER use aliyun configure set with literal credential values

- ONLY use aliyun configure list to check credential status

>

```bash

aliyun configure list

```

>

Check the output for a valid profile (AK, STS, or OAuth identity).

>

If no valid profile exists, STOP here.

1. Obtain credentials from Alibaba Cloud Console

2. Configure credentials outside of this session (via aliyun configure in terminal or environment variables in shell profile)

3. Return and re-run after aliyun configure list shows a valid profile

---

RAM Policy

[MUST] RAM Permission Pre-check: Before executing any commands, verify the current user has the required permissions.

1. Use ram-permission-diagnose skill to get current user's permissions

2. Compare against references/ram-policies.md

3. Abort and prompt user if any permission is missing

Minimum required permissions — see references/ram-policies.md for full policy JSON.

Alternatively, attach the system policy: AliyunYundunCloudFirewallReadOnlyAccess

---

Parameter Confirmation

IMPORTANT: Parameter Confirmation — Before executing any command or API call,

check if the user has already provided necessary parameters in their request.

- If the user's request explicitly mentions a parameter value (e.g., "check IPS alerts for the last 7 days" means use 7-day time range), use that value directly without asking for confirmation.

- For optional parameters with sensible defaults (PageSize, CurrentPage, time ranges), use the defaults without asking unless the user indicates otherwise.

- Do NOT re-ask for parameters that the user has clearly stated.

Input Validation (MUST)

Treat all Agent-provided inputs as untrusted. Validate before building CLI commands.

Validation rules:

• RegionId: must be exactly one of cn-hangzhou or ap-southeast-1.
• StartTime / EndTime: must be 10-digit Unix seconds (^[0-9]{10}$), and StartTime < EndTime.
• CurrentPage: positive integer (>=1).
• PageSize: integer in range 1-100.
• SrcIP / DstIP: must be valid IPv4 format only (a.b.c.d, each octet 0-255).

Safe command construction rules:

• Never concatenate raw user text into shell commands.
• Only pass validated values into fixed CLI flag templates.
• If any validation fails, stop execution and return a clear validation error.

---

Error Handling and Workflow Resilience

CRITICAL: Continue on failure. If any individual API call fails, do NOT stop the entire workflow.

Log the error for that step, then proceed to the next step. Present whatever data was successfully collected.

Retry Logic

For each API call: 1. If the call fails with a transient error (network timeout, throttling Throttling.User, ServiceUnavailable, HTTP 500/502/503), retry up to 2 times with a 3-second delay between retries. 2. If the call fails with a permanent error (e.g., InvalidParameter, Forbidden, InvalidAccessKeyId), do NOT retry. Record the error and move on. 3. After all retries are exhausted, record "[Step X] Failed: {error message}" and continue to the next step.

Timeout Policy (MUST)

Before any API call, explicitly set CLI timeouts:

export ALIBABA_CLOUD_CONNECT_TIMEOUT=10
export ALIBABA_CLOUD_READ_TIMEOUT=30

• ALIBABA_CLOUD_CONNECT_TIMEOUT=10: fast fail for connect timeout.
• ALIBABA_CLOUD_READ_TIMEOUT=30: prevent long-running hangs per request.
• Timeout errors are treated as transient errors and follow retry logic.

No Alert Events

If Step 1 (DescribeRiskEventStatistic) returns all zeros: 1. Inform the user: "No IPS alert events detected in the specified time range." 2. Still proceed with Step 6 and Step 7 to report IPS configuration status.

Step Independence

The workflow steps have these dependencies:

• Step 1 (Statistics) should run first to provide context.
• Steps 2-7 are independent of each other — failure in any one step should NOT prevent other steps from executing.

Partial Results

When presenting the final summary report:

• For steps that succeeded, show the collected data normally.
• For steps that failed, show "N/A (error: {brief error})" in the corresponding section.
• Always present the summary report even if some steps failed — partial data is better than no data.

---

Core Workflow

All API calls use the Aliyun CLI cloudfw plugin. Request/response schemas are maintained only in references/api-analysis.md. Do not duplicate field-by-field descriptions in this file.

User-Agent: All commands must include --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-ips-event Region: Specified via --region {RegionId} global flag

CRITICAL: This skill is read-only (query only). All commands below are safe, read-only queries that do not modify any cloud resources.

Before executing, confirm the execution plan with the user: briefly list which steps will be executed and the target region. Proceed only after user confirmation.

Do NOT ask the user which specific APIs to call or what data sources to use — those are determined by the workflow below.

The intent routing table below is for optimization only — if the user's intent is unclear, plan to execute ALL steps (Step 1-7) by default.

Intent Routing (Auto-determined, Confirm Before Execution)

Automatically determine execution scope based on user wording. Present the execution plan to the user for confirmation before running commands:

Default behavior: If user intent cannot be clearly determined, plan to execute all Steps 1-7 and confirm with user before proceeding.

Time Parameters

Some APIs require StartTime and EndTime parameters (Unix timestamp in seconds).

How to get timestamps: Run date +%s to get the current timestamp, date -d '1 day ago' +%s for 24 hours ago, date -d '7 days ago' +%s for 7 days ago. Then use the returned numeric values directly in CLI commands.

IMPORTANT: Do NOT use bash variable substitution like $(date +%s) inside CLI commands — some execution environments block $(...). Instead, run date commands separately first, note the returned values, then use them as literal numbers in the --StartTime and --EndTime parameters.

Default time ranges:

• User says "today" → StartTime = 24 hours ago
• User says "recently"/"this week" → StartTime = 7 days ago
• No time range specified → default to 7 days ago
• EndTime → always current timestamp

Step 1: IPS Alert Statistics Overview

Retrieve overall alert statistics to understand the current security posture.

aliyun cloudfw describe-risk-event-statistic \
  --StartTime {StartTime} \
  --EndTime {EndTime} \
  --region {RegionId} \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-ips-event

Step 2: IPS Alert Event Details

Retrieve grouped alert event list. This is the core data for analysis.

aliyun cloudfw describe-risk-event-group \
  --CurrentPage 1 \
  --PageSize 50 \
  --StartTime {StartTime} \
  --EndTime {EndTime} \
  --DataType 1 \
  --region {RegionId} \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-ips-event

Optional filter parameters (auto-added based on user intent, no confirmation needed):

• By direction: --Direction in or --Direction out
• By source IP: --SrcIP x.x.x.x (query "attacks initiated by a specific IP")
• By target IP: --DstIP x.x.x.x (query "attacks on a specific server/IP", supports private IPs like 10.x.x.x)
• By vulnerability level: --VulLevel 3 (1=low, 2=medium, 3=high)

Key: When a user mentions a specific server or IP being attacked, use the --DstIP filter to query all attack records for that IP — no need to access the server itself.

Pagination: Check TotalCount. If it exceeds 50, increment CurrentPage.

Step 3: Top Attacked Assets Ranking

Identify which assets are attack hotspots.

aliyun cloudfw describe-risk-event-top-attack-asset \
  --StartTime {StartTime} \
  --EndTime {EndTime} \
  --region {RegionId} \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-ips-event

Step 4: Top Attack Types Ranking

Understand the main threat types being faced.

aliyun cloudfw describe-risk-event-top-attack-type \
  --StartTime {StartTime} \
  --EndTime {EndTime} \
  --Direction in \
  --region {RegionId} \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-ips-event

If outbound attack types are also needed, make another call with --Direction out.

Note: This API requires the Direction parameter, otherwise it will return an error.

Step 5: Top Attacked Applications Ranking

Understand which application-layer targets are being attacked.

aliyun cloudfw describe-risk-event-top-attack-app \
  --StartTime {StartTime} \
  --EndTime {EndTime} \
  --region {RegionId} \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-ips-event

Step 6: IPS Protection Configuration Status

Check the current IPS run mode and protection capabilities.

aliyun cloudfw describe-default-ipsconfig \
  --region {RegionId} \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-ips-event

Step 7: IPS Rule Library Version

aliyun cloudfw describe-signature-lib-version \
  --region {RegionId} \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-ips-event

---

Analysis & Report

After collecting data, generate a report in the following structure. Center the analysis around alert events, covering three dimensions: "who is attacking", "what is being attacked", and "how effective is the response". Only show sections with actual data; if an API call failed, note it and continue.

1. IPS Alert Posture Overview

Combine Step 1 statistics and Step 6 IPS configuration to display the current security posture:

Alert Statistics (Time Range: x):

IPS Configuration Status:

If IPS is in observe mode and there are high-severity events, prominently flag: "IPS is currently in observe mode — high-severity attacks are NOT being blocked".

2. High-Severity Alert Events (Immediate Action Required)

From Step 2, filter events with VulLevel=3 (high) or VulLevel=2 (medium with high event count), sorted by event count in descending order:

Handling status explanation:

• Observed (RuleResult=1): IPS detected but did not block — requires manual confirmation on whether blocking is needed
• Blocked (RuleResult=2): Automatically blocked by IPS

3. Attack Hotspot Analysis

Top Attacked Assets

Combine Step 3 data to display attack status by asset:

Focus on assets with low block rates — this means many attacks are only being observed, not blocked.

Attack Type Distribution

Combine Step 4 data:

Attack Application Distribution

Combine Step 5 data:

4. Attack Source Analysis

Summarize source IP dimensions from Step 2 event data:

Flag cases where the same source IP attacks multiple assets — this typically indicates organized scanning or attacks.

5. Remediation Recommendations

Generate specific recommendations based on actual data, sorted by priority. Each recommendation includes: Risk Description, Impact Scope, Recommended Action.

P0 — Critical (Immediate Action)

• High-severity events in "observe" mode, not blocked → Switch IPS to block mode, or manually block the attacking source IP
• Same source IP attacking multiple assets in volume → Add that IP to Cloud Firewall ACL blacklist
• IPS in observe mode with active high-severity attacks → Switch to block mode

P1 — High (Within 24 Hours)

• Medium-severity events recurring and not blocked → Check target asset vulnerabilities and remediate
• Basic protection/virtual patches not enabled → Recommend enabling to enhance protection
• Attacked assets with low block rate → Check IPS rule coverage

P2 — Medium (This Week)

• Multiple attack types targeting the same asset → Conduct security hardening review for that asset
• Threat intelligence/AI engine rules not enabled → Recommend enabling
• Rule library version outdated → Update to the latest version

P3 — Low (Periodic Review)

• Low-severity events persisting → Include in periodic review, assess whether they are false positives
• Optimize IPS whitelist to reduce business false positives

Note: For any step that failed, show "N/A (error: {brief error})" for that section's data fields, and list all errors in the bottom section.

---

Success Verification

See references/verification-method.md for detailed verification steps.

Quick verification: If all CLI commands return valid JSON responses without error codes, the skill executed successfully.

---

API and Command Tables

Use references/related-apis.md as the single source of truth for API tables and command mappings.

---

Best Practices

1. Query in order — Start with alert statistics (Step 1) to understand the overall security posture. If all values are zero, report that no alerts were detected in the time range. 2. Continue on failure — If any step (2-7) fails, log the error and continue with the remaining steps. Always produce a report with whatever data was collected. 3. Use pagination — For alert event lists (Step 2), use CurrentPage and PageSize. Default to PageSize=50. If TotalCount exceeds PageSize, iterate through all pages. 4. Time range selection — Default to last 24 hours for "today", last 7 days for "recently"/"this week". Use Unix timestamps in seconds. Calculate with: date +%s for current time, date -d '1 day ago' +%s for 24 hours ago, date -d '7 days ago' +%s for 7 days ago. Run these commands separately, then use the returned values as literal numbers in --StartTime and --EndTime. Do NOT use $(...) substitution inside CLI commands. 5. Region awareness — Cloud Firewall only has two regions: cn-hangzhou (mainland China) and ap-southeast-1 (Hong Kong/overseas). Default to cn-hangzhou unless user specifies otherwise. 6. Direction parameter — Step 4 (DescribeRiskEventTopAttackType) requires the Direction parameter. Default to in (inbound). Query out separately if needed. 7. Rate limiting — Space API calls to avoid throttling. If you receive a Throttling.User error, wait 3 seconds and retry. 8. Security — NEVER expose, log, echo, or display AK/SK values. 9. Retry on transient errors — For network timeouts or 5xx errors, retry up to 2 times with a 3-second delay. 10. Validate all inputs first — Reject invalid RegionId, timestamp, pagination, and IP values before command execution. 11. Set explicit timeout env vars — Always set ALIBABA_CLOUD_CONNECT_TIMEOUT=10 and ALIBABA_CLOUD_READ_TIMEOUT=30 before workflow commands.

---

Reference Links

Acceptance Criteria: alibabacloud-cfw-ips-event

Scenario: IPS Alert Event Analysis Purpose: Skill testing acceptance criteria

Correct CLI Invocation Patterns

1. Command Format

CORRECT:

aliyun cloudfw describe-risk-event-group \
  --CurrentPage 1 \
  --PageSize 50 \
  --StartTime 1711324800 \
  --EndTime 1711411200 \
  --DataType 1 \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills

INCORRECT - Wrong product name:

# WRONG: Using "cloudfirewall" instead of "cloudfw"
aliyun cloudfirewall describe-risk-event-group ...

# WRONG: Using "cfw" instead of "cloudfw"
aliyun cfw describe-risk-event-group ...

INCORRECT - Using PascalCase for API name:

# WRONG: API names must use plugin mode (lowercase-hyphenated), not PascalCase
aliyun cloudfw DescribeRiskEventGroup ...

INCORRECT - Missing --user-agent:

# WRONG: All commands MUST include --user-agent
aliyun cloudfw describe-risk-event-group \
  --CurrentPage 1 \
  --PageSize 50 \
  --region cn-hangzhou

INCORRECT - Using old Python SDK pattern:

# WRONG: Do not use Python SDK or other SDK patterns
from aliyunsdkcore.client import AcsClient
client = AcsClient(ak, sk, 'cn-hangzhou')

2. Parameter Format

CORRECT - PascalCase parameters:

aliyun cloudfw describe-risk-event-group \
  --CurrentPage 1 \
  --PageSize 50 \
  --StartTime 1711324800 \
  --EndTime 1711411200 \
  --DataType 1 \
  --VulLevel 3 \
  --Direction in \
  --SrcIP 1.2.3.4 \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills

INCORRECT - Wrong parameter casing:

# WRONG: Using camelCase
aliyun cloudfw describe-risk-event-group \
  --currentPage 1 \
  --pageSize 50 \
  --startTime 1711324800

# WRONG: Using snake_case
aliyun cloudfw describe-risk-event-group \
  --current_page 1 \
  --page_size 50 \
  --start_time 1711324800

# WRONG: Using kebab-case
aliyun cloudfw describe-risk-event-group \
  --current-page 1 \
  --page-size 50 \
  --start-time 1711324800

3. Authentication

CORRECT - Let CLI handle credentials automatically:

# Just call the API directly; CLI reads credentials from config
aliyun cloudfw describe-default-ipsconfig \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills

INCORRECT - Passing credentials in command:

# WRONG: Never pass AK/SK directly in commands
aliyun cloudfw describe-default-ipsconfig \
  --access-key-id LTAI5tXXXX \
  --access-key-secret 8dXXXX \
  --region cn-hangzhou

# WRONG: Never echo/print credentials
echo $ALIBABA_CLOUD_ACCESS_KEY_ID
cat ~/.aliyun/config.json

4. API Names

CORRECT - All 7 API names (plugin mode, lowercase-hyphenated):

• describe-risk-event-statistic
• describe-risk-event-group
• describe-risk-event-top-attack-asset
• describe-risk-event-top-attack-type
• describe-risk-event-top-attack-app
• describe-default-ipsconfig
• describe-signature-lib-version

INCORRECT - PascalCase (non-plugin mode):

# WRONG: Must use plugin mode (lowercase-hyphenated)
DescribeRiskEventStatistic
DescribeRiskEventGroup
DescribeDefaultIPSConfig

INCORRECT - Other wrong casing or naming:

# WRONG casing examples:
describeriskeventstatistic
describeRiskEventStatistic
Describe_Risk_Event_Statistic
DESCRIBERRISKEVENTSTATISTIC

# WRONG names:
DescribeRiskEventStats          (wrong abbreviation)
DescribeRiskEventList           (wrong API name)
DescribeIPSConfig               (wrong - should be describe-default-ipsconfig)
DescribeSignatureVersion        (wrong - should be describe-signature-lib-version)
DescribeRiskEventTopAttack      (incomplete name)

5. Region Parameter

CORRECT:

# Mainland China (default)
--region cn-hangzhou

# Hong Kong / Overseas
--region ap-southeast-1

INCORRECT:

# WRONG: Other regions are not valid for Cloud Firewall
--region cn-shanghai
--region cn-beijing
--region us-east-1

6. Time Parameters

CORRECT - Unix timestamp in seconds:

--StartTime 1711324800 --EndTime 1711411200

INCORRECT:

# WRONG: Millisecond timestamps
--StartTime 1711324800000 --EndTime 1711411200000

# WRONG: Date strings
--StartTime "2024-03-25" --EndTime "2024-03-26"

# WRONG: ISO format
--StartTime "2024-03-25T00:00:00Z"

API Analysis - IPS Alert Event Analysis

Product: Cloud Firewall API Version: 2017-12-07 Product Code: cloudfw

---

1. Alert Statistics

DescribeRiskEventStatistic

Description: Query IPS alert statistics for a specified time range, including total attack counts, block counts, severity distribution, and untreated event counts. This provides an overview of the current security posture.

Parameters:

Key Response Fields:

{
  "RequestId": String,              // Request ID
  "TotalAttackCnt": Integer,        // Total attack event count
  "TotalDropCnt": Integer,          // Total blocked/dropped count
  "TotalWarnCnt": Integer,          // Total warning count
  "TotalMonitorCnt": Integer,       // Total monitor/observe count
  "TotalHighCnt": Integer,          // Total high-severity event count
  "TotalMediumCnt": Integer,        // Total medium-severity event count
  "TotalLowCnt": Integer,           // Total low-severity event count
  "TotalUntreatedCnt": Integer      // Total untreated event count
}

---

2. Alert Events

DescribeRiskEventGroup

Description: Query detailed IPS alert event list with grouping, filtering, and pagination support. This is the core API for alert event analysis, providing comprehensive event details including source/destination, attack type, handling status, and geo-location information.

Parameters:

Key Response Fields:

{
  "RequestId": String,              // Request ID
  "TotalCount": Integer,            // Total number of matching events (for pagination)
  "DataList": [                     // Array of alert event groups
    {
      "EventName": String,          // Event name/title
      "EventCount": Integer,        // Number of occurrences of this event
      "Description": String,        // Event description
      "SrcIP": String,              // Source IP address
      "DstIP": String,              // Destination IP address
      "AttackType": Integer,        // Attack type numeric ID
      "AttackTypeName": String,     // Attack type name (may not always be present)
      "AttackApp": String,          // Attack application name
      "Direction": String,          // Traffic direction ("in" or "out")
      "VulLevel": Integer,          // Vulnerability level: 1=low, 2=medium, 3=high
      "RuleResult": Integer,        // Handling result: 1=observe, 2=block
      "RuleSource": String,         // Rule source identifier
      "FirstTime": Long,            // First occurrence time (Unix timestamp in seconds)
      "LastTime": Long,             // Last occurrence time (Unix timestamp in seconds)
      "IPLocationInfo": {           // Geo-location of source IP
        "CountryName": String,      // Country name
        "CityName": String          // City name
      },
      "ResourcePrivateIPList": [    // Array of targeted private resources
        {
          "ResourceInstanceName": String,  // Resource instance name
          "ResourcePrivateIP": String,     // Private IP address
          "ResourceInstanceId": String,    // Resource instance ID
          "RegionNo": String               // Region ID
        }
      ],
      "ResourceType": String,       // Resource type of the target
      "Tag": String                 // Tag information
    }
  ]
}

Pagination: When TotalCount exceeds PageSize, increment CurrentPage to fetch additional pages.

---

3. Attack Rankings

DescribeRiskEventTopAttackAsset

Description: Query the ranking of most attacked assets, showing which resources received the most attack attempts and how many were blocked.

Parameters:

Key Response Fields:

{
  "RequestId": String,              // Request ID
  "Assets": [                       // Array of top attacked assets
    {
      "Ip": String,                 // Asset IP address
      "ResourceInstanceName": String, // Resource instance name
      "ResourceInstanceId": String,   // Resource instance ID
      "ResourceType": String,         // Resource type (e.g., "EcsEIP")
      "RegionNo": String,             // Region ID
      "AttackCnt": Integer,           // Total attack count
      "DropCnt": Integer              // Blocked/dropped count
    }
  ]
}

---

DescribeRiskEventTopAttackType

Description: Query the ranking of attack types by frequency, showing the distribution of different attack categories (e.g., Web attacks, command execution, DoS). Requires the Direction parameter.

Parameters:

Key Response Fields:

{
  "RequestId": String,              // Request ID
  "TotalAttackCnt": Integer,        // Summary: total attack count across all types
  "TotalProtectCnt": Integer,       // Summary: total protected/blocked count across all types
  "TopAttackTypeList": [            // Array of top attack types (NOTE: not "TypeList")
    {
      "AttackType": Integer,        // Attack type numeric ID
      "AttackCnt": Integer,         // Attack count for this type
      "ProtectCnt": Integer         // Protected/blocked count (NOTE: not "DropCnt")
    }
  ]
}

Attack Type ID Mapping:

---

DescribeRiskEventTopAttackApp

Description: Query the ranking of attacked applications, showing which application-layer targets received the most attacks.

Parameters:

Key Response Fields:

{
  "RequestId": String,              // Request ID
  "AttackApps": [                   // Array of top attacked apps (NOTE: not "AppList")
    {
      "App": String,                // Application name (NOTE: not "AttackApp")
      "AttackCnt": Integer,         // Attack count
      "DropCnt": Integer            // Blocked/dropped count
    }
  ]
}

---

4. IPS Configuration

DescribeDefaultIPSConfig

Description: Query the current IPS protection configuration, including run mode (observe/block), rule switches for basic rules, virtual patches, threat intelligence, and AI engine.

Parameters:

Key Response Fields:

{
  "RequestId": String,              // Request ID
  "RunMode": Integer,               // IPS run mode: 0=observe mode, 1=block mode
  "BasicRules": Integer,            // Basic protection rules: 0=disabled, 1=enabled
  "PatchRules": Integer,            // Virtual patch rules: 0=disabled, 1=enabled
  "CtiRules": Integer,              // Threat intelligence rules: 0=disabled, 1=enabled
  "AiRules": Integer,               // AI engine rules: 0=disabled, 1=enabled
  "RuleClass": Integer,             // Rule class mode
  "MaxSdl": Integer                 // Maximum SDL configuration value
}

Run Mode Values:

• 0 — Observe mode: IPS detects and logs threats but does NOT block them
• 1 — Block mode: IPS actively blocks detected threats

---

DescribeSignatureLibVersion

Description: Query the IPS rule library version information, including the IPS rule library and threat intelligence library versions and their last update times.

Parameters:

Key Response Fields:

{
  "RequestId": String,              // Request ID
  "TotalCount": Integer,            // Total number of rule libraries
  "Version": [                      // Array of rule library versions (NOTE: this is an array, not an object)
    {
      "Type": String,               // Library type: "ips" (IPS rule library) or "intelligence" (threat intelligence library)
      "Version": String,            // Version identifier (e.g., "IPS-2603-01")
      "UpdateTime": Long            // Last update time (Unix timestamp in seconds)
    }
  ]
}

Aliyun CLI Installation & Configuration Guide

Complete guide for installing and configuring Aliyun CLI.

Aliyun CLI 3.3.3+: Supports installing and using all published Alibaba Cloud product plugins. Make sure to upgrade to 3.3.3 or later for full plugin ecosystem coverage.

Installation

macOS

Using Homebrew (Recommended)

brew install aliyun-cli
# Upgrade to latest
brew upgrade aliyun-cli

# Verify version (>= 3.3.1)
aliyun version

Using Binary

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-macosx-latest-amd64.tgz

# Extract
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Linux

Debian/Ubuntu

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

CentOS/RHEL

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

ARM64 Architecture

# Download ARM64 version
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-arm64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-arm64.tgz
sudo mv aliyun /usr/local/bin/

Windows

Using Binary 1. Download from: https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip 2. Extract the ZIP file 3. Add the directory to your PATH environment variable 4. Open new Command Prompt or PowerShell 5. Verify: aliyun version

Using PowerShell

# Download
Invoke-WebRequest -Uri "https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip" -OutFile "aliyun-cli.zip"

# Extract
Expand-Archive -Path aliyun-cli.zip -DestinationPath C:\aliyun-cli

# Add to PATH (requires admin privileges)
$env:Path += ";C:\aliyun-cli"
[Environment]::SetEnvironmentVariable("Path", $env:Path, [System.EnvironmentVariableTarget]::Machine)

# Verify
aliyun version

Configuration

Quick Start

aliyun configure set \
  --mode AK \
  --access-key-id <your-access-key-id> \
  --access-key-secret <your-access-key-secret> \
  --region cn-hangzhou

All aliyun configure commands support non-interactive flags, which is the recommended approach — it works in scripts, CI/CD pipelines, and agent-driven automation without hanging on stdin prompts.

Where to Get Access Keys

1. Log in to Aliyun Console: https://ram.console.aliyun.com/ 2. Navigate to: AccessKey Management 3. Create a new AccessKey pair 4. Save the secret immediately — it's only shown once

Configuration Modes

Aliyun CLI supports 6 authentication modes. All examples below use non-interactive flags.

1. AK Mode (Access Key)

Most common mode for personal accounts and scripts.

aliyun configure set \
  --mode AK \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --region cn-hangzhou

Configuration is stored in ~/.aliyun/config.json:

{
  "current": "default",
  "profiles": [
    {
      "name": "default",
      "mode": "AK",
      "access_key_id": "LTAI5tXXXXXXXX",
      "access_key_secret": "8dXXXXXXXXXXXXXXXXXXXXXXXX",
      "region_id": "cn-hangzhou",
      "output_format": "json",
      "language": "en"
    }
  ]
}

2. StsToken Mode (Temporary Credentials)

For short-lived access (tokens expire in 1-12 hours).

aliyun configure set \
  --mode StsToken \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --sts-token v1.0:XXXXXXXXXXXXXXXX \
  --region cn-hangzhou

Use cases: CI/CD pipelines, temporary access for external contractors, cross-account access.

3. RamRoleArn Mode (Assume RAM Role)

Assume a RAM role for elevated or cross-account access.

aliyun configure set \
  --mode RamRoleArn \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --ram-role-arn acs:ram::123456789012:role/AdminRole \
  --role-session-name my-session \
  --region cn-hangzhou

Use cases: cross-account resource access, temporary elevated privileges, role-based access control.

4. EcsRamRole Mode (ECS Instance RAM Role)

Use the RAM role attached to an ECS instance — no credentials needed.

aliyun configure set \
  --mode EcsRamRole \
  --ram-role-name MyEcsRole \
  --region cn-hangzhou

Requirements: must be running on an ECS instance with a RAM role attached.

Use cases: scripts and automation running on ECS instances.

5. RsaKeyPair Mode (RSA Key Pair)

Use RSA key pair for authentication (generate key pair in Aliyun Console first).

aliyun configure set \
  --mode RsaKeyPair \
  --private-key /path/to/private-key.pem \
  --key-pair-name my-key-pair \
  --region cn-hangzhou

6. RamRoleArnWithEcs Mode (ECS + RAM Role)

Combine ECS instance role with RAM role assumption for cross-account access from ECS.

aliyun configure set \
  --mode RamRoleArnWithEcs \
  --ram-role-name MyEcsRole \
  --ram-role-arn acs:ram::123456789012:role/TargetRole \
  --role-session-name my-session \
  --region cn-hangzhou

Environment Variables

Highest priority - overrides config file

Access Key Mode

export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret
export ALIBABA_CLOUD_REGION_ID=cn-hangzhou

STS Token Mode

export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret
export ALIBABA_CLOUD_SECURITY_TOKEN=your_sts_token
export ALIBABA_CLOUD_REGION_ID=cn-hangzhou

ECS RAM Role Mode

export ALIBABA_CLOUD_ECS_METADATA=role_name

Use Case:

• CI/CD pipelines
• Docker containers
• Temporary credential override

Managing Multiple Profiles

Create Named Profiles

aliyun configure set --profile projectA \
  --mode AK \
  --access-key-id LTAI5tAAAAAAAA \
  --access-key-secret 8dAAAAAAAAAAAAAAAAAAAAAAAA \
  --region cn-hangzhou

aliyun configure set --profile projectB \
  --mode AK \
  --access-key-id LTAI5tBBBBBBBB \
  --access-key-secret 8dBBBBBBBBBBBBBBBBBBBBBBBB \
  --region cn-shanghai

Use Specific Profile

aliyun ecs describe-instances --profile projectA

export ALIBABA_CLOUD_PROFILE=projectA
aliyun ecs describe-instances   # Uses projectA

List and Switch Profiles

aliyun configure list                      # List all profiles
aliyun configure set --current projectA    # Switch default profile

Credential Priority

Credentials are loaded in this order (first found wins):

1. Command-line flag: --profile <name> 2. Environment variable: ALIBABA_CLOUD_PROFILE 3. Environment credentials: ALIBABA_CLOUD_ACCESS_KEY_ID, etc. 4. Configuration file: ~/.aliyun/config.json (current profile) 5. ECS Instance RAM Role: If running on ECS with attached role

Verification

Test Authentication

# Basic test - list regions
aliyun ecs describe-regions

# Expected output: JSON array of regions

If successful, you'll see:

{
  "Regions": {
    "Region": [
      {
        "RegionId": "cn-hangzhou",
        "RegionEndpoint": "ecs.cn-hangzhou.aliyuncs.com",
        "LocalName": "华东 1（杭州）"
      },
      ...
    ]
  },
  "RequestId": "..."
}

If failed, you'll see error messages:

• InvalidAccessKeyId.NotFound - Wrong Access Key ID
• SignatureDoesNotMatch - Wrong Access Key Secret
• InvalidSecurityToken.Expired - STS token expired (for StsToken mode)
• Forbidden.RAM - Insufficient permissions

Debug Configuration

# Show current configuration
aliyun configure get

# Test with debug logging
aliyun ecs describe-regions --log-level=debug

# Check credential provider
aliyun configure get mode

Security Best Practices

1. Use RAM Users (Not Root Account)

❌ Don't: Use Aliyun root account credentials ✅ Do: Create RAM users with specific permissions

# Create RAM user in console
# Attach only necessary policies
# Use RAM user's access keys

2. Principle of Least Privilege

Grant only the minimum permissions needed:

# Example: Read-only ECS access
# Attach policy: AliyunECSReadOnlyAccess

3. Rotate Access Keys Regularly

# Create new access key in RAM Console, then update configuration
aliyun configure set --access-key-id NEW_KEY --access-key-secret NEW_SECRET
# Delete old access key from console

4. Use STS Tokens for Temporary Access

aliyun configure set --mode StsToken \
  --access-key-id XXXX --access-key-secret XXXX \
  --sts-token XXXX --region cn-hangzhou

5. Use ECS RAM Roles When Possible

aliyun configure set --mode EcsRamRole --ram-role-name MyRole --region cn-hangzhou

6. Never Commit Credentials

# Add to .gitignore
echo "~/.aliyun/config.json" >> .gitignore

# Use environment variables in CI/CD instead

7. Secure Config File

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Issue: Command Not Found

# Check installation
which aliyun

# Check PATH
echo $PATH

# Reinstall or add to PATH

Issue: Authentication Failed

# Verify configuration
aliyun configure get

# Test with debug
aliyun ecs describe-regions --log-level=debug

# Check credentials in console
# Verify access key is active

Issue: Permission Denied

# Error: Forbidden.RAM

# Check RAM user permissions
# Attach necessary policies in RAM console
# Example: AliyunECSFullAccess for ECS operations

Issue: STS Token Expired

# Error: InvalidSecurityToken.Expired

# Reconfigure with new token
aliyun configure set --mode StsToken \
  --access-key-id XXXX --access-key-secret XXXX \
  --sts-token NEW_TOKEN --region cn-hangzhou

Issue: Wrong Region

# Some resources may not exist in the specified region

# Check available regions
aliyun ecs describe-regions

# Update default region
aliyun configure set region cn-shanghai

Advanced Configuration

Custom Endpoint

# Use custom or private endpoint
export ALIBABA_CLOUD_ECS_ENDPOINT=ecs-vpc.cn-hangzhou.aliyuncs.com

Proxy Settings

# HTTP proxy
export HTTP_PROXY=http://proxy.example.com:8080
export HTTPS_PROXY=http://proxy.example.com:8080

# No proxy for specific domains
export NO_PROXY=localhost,127.0.0.1,.aliyuncs.com

Timeout Settings

# Connection timeout (default: 10s)
export ALIBABA_CLOUD_CONNECT_TIMEOUT=30

# Read timeout (default: 10s)
export ALIBABA_CLOUD_READ_TIMEOUT=30

Next Steps

After installation and configuration:

1. Install plugins for services you need (v3.3.1+ supports all published product plugins):

   aliyun plugin install --names ecs vpc rds

   # List all available plugins
   aliyun plugin list-remote

2. Explore commands:

   aliyun ecs --help
   aliyun fc --help

3. Read documentation:

• Command Syntax Guide
• Global Flags Reference
• Common Scenarios

References

• Official Documentation: https://help.aliyun.com/zh/cli/
• RAM Console: https://ram.console.aliyun.com/
• Access Key Management: https://ram.console.aliyun.com/manage/ak
• Plugin Repository: https://github.com/aliyun/aliyun-cli

RAM Policies - IPS Alert Event Analysis

Required Permissions

Minimum RAM Policy

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "yundun-cloudfirewall:DescribeRiskEventStatistic",
        "yundun-cloudfirewall:DescribeRiskEventGroup",
        "yundun-cloudfirewall:DescribeRiskEventTopAttackAsset",
        "yundun-cloudfirewall:DescribeRiskEventTopAttackType",
        "yundun-cloudfirewall:DescribeRiskEventTopAttackApp",
        "yundun-cloudfirewall:DescribeDefaultIPSConfig",
        "yundun-cloudfirewall:DescribeSignatureLibVersion"
      ],
      "Resource": "*"
    }
  ]
}

System Policy Alternative

Instead of creating a custom policy, you can attach the system policy:

AliyunYundunCloudFirewallReadOnlyAccess

This system policy grants read-only access to all Cloud Firewall resources, which includes all the permissions required by this skill.

Related APIs - IPS Alert Event Analysis

APIs Used in This Skill

Product: Cloud Firewall API Version: 2017-12-07 Product Code: cloudfw

All commands must include --user-agent AlibabaCloud-Agent-Skills and --region {RegionId}.

Verification Method - IPS Alert Event Analysis

Authentication Pre-check

Before executing skill commands, verify that the Aliyun CLI has a valid profile available in the default credential chain:

# 1. Check CLI version (must be >= 3.3.3)
aliyun version

# 2. Check credential profile status (do not display raw credentials)
aliyun configure list

Expected: aliyun configure list shows at least one valid profile (AK, STS, or OAuth identity). If failed: Configure credentials outside this session via local aliyun configure, then re-run this check.

---

How to Verify Skill Execution Success

Step 1: Verify DescribeRiskEventStatistic

START_TS=$(date -d "1 day ago" +%s)
NOW_TS=$(date +%s)

aliyun cloudfw describe-risk-event-statistic \
  --StartTime ${START_TS} \
  --EndTime ${NOW_TS} \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-ips-event

Expected Response Structure:

{
  "RequestId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "TotalAttackCnt": 100,
  "TotalDropCnt": 80,
  "TotalWarnCnt": 15,
  "TotalMonitorCnt": 5,
  "TotalHighCnt": 10,
  "TotalMediumCnt": 30,
  "TotalLowCnt": 60,
  "TotalUntreatedCnt": 20
}

Success Criteria: Response contains RequestId and all Total*Cnt fields with numeric values (including zero).

Step 2: Verify DescribeRiskEventGroup

aliyun cloudfw describe-risk-event-group \
  --CurrentPage 1 \
  --PageSize 10 \
  --StartTime ${START_TS} \
  --EndTime ${NOW_TS} \
  --DataType 1 \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-ips-event

Expected Response Structure:

{
  "RequestId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "TotalCount": 5,
  "DataList": [
    {
      "EventName": "...",
      "EventCount": 10,
      "SrcIP": "x.x.x.x",
      "DstIP": "y.y.y.y",
      "VulLevel": 3,
      "RuleResult": 2,
      "Direction": "in",
      "AttackType": 7,
      "FirstTime": 1711324800,
      "LastTime": 1711411200
    }
  ]
}

Success Criteria: Response contains RequestId, TotalCount, and DataList array (may be empty if no events in the time range).

Step 3: Verify DescribeRiskEventTopAttackAsset

aliyun cloudfw describe-risk-event-top-attack-asset \
  --StartTime ${START_TS} \
  --EndTime ${NOW_TS} \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-ips-event

Expected Response Structure:

{
  "RequestId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "Assets": [
    {
      "Ip": "x.x.x.x",
      "ResourceInstanceName": "instance-name",
      "ResourceInstanceId": "i-xxxxx",
      "ResourceType": "EcsEIP",
      "RegionNo": "cn-hangzhou",
      "AttackCnt": 50,
      "DropCnt": 40
    }
  ]
}

Success Criteria: Response contains RequestId and Assets array.

Step 4: Verify DescribeDefaultIPSConfig

aliyun cloudfw describe-default-ipsconfig \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-ips-event

Expected Response Structure:

{
  "RequestId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "RunMode": 1,
  "BasicRules": 1,
  "PatchRules": 1,
  "CtiRules": 1,
  "AiRules": 1,
  "RuleClass": 1,
  "MaxSdl": 4
}

Success Criteria: Response contains RequestId and RunMode field with value 0 or 1.

Step 5: Verify DescribeSignatureLibVersion

aliyun cloudfw describe-signature-lib-version \
  --region cn-hangzhou \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-cfw-ips-event

Expected Response Structure:

{
  "RequestId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "TotalCount": 2,
  "Version": [
    {
      "Type": "ips",
      "Version": "IPS-2603-01",
      "UpdateTime": 1711324800
    },
    {
      "Type": "intelligence",
      "Version": "INT-2603-01",
      "UpdateTime": 1711324800
    }
  ]
}

Success Criteria: Response contains RequestId, TotalCount, and Version array with at least one entry.

---

Common Errors