Alibabacloud Sas Alert Handler

Cloud Security Center CWPP Alert Handling Skill

Scenario Description

This skill helps users query and handle CWPP host security alerts from Alibaba Cloud Security Center (SAS/Aegis).

Core Capabilities:

• Query security alert list
• Analyze alert details and recommend handling methods
• Execute alert handling operations (ignore, whitelist, block, quarantine, etc.)
• Query handling status and summarize results

Architecture: Alibaba Cloud Security Center (SAS) + RAM Permissions + CLI Tools

---

Installation Requirements

Pre-check: Aliyun CLI >= 3.3.3 required

Run aliyun version to verify >= 3.3.3. If not installed or version too low,

run curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash to update,

or see references/cli-installation-guide.md for installation instructions.

Pre-check: Aliyun CLI plugin update required

[MUST] run aliyun configure set --auto-plugin-install true to enable automatic plugin installation.

[MUST] run aliyun plugin update to ensure that any existing plugins are always up-to-date.

[MUST] CLI User-Agent — Every aliyun CLI command invocation must include: --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-alert-handler

At the start of the Core Workflow (before any CLI invocation): [MUST] Enable AI-Mode — AI-mode is required for Agent Skill execution. Run the following commands before any CLI invocation:

aliyun configure ai-mode enable
aliyun configure ai-mode set-user-agent --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-sas-alert-handler"

[MUST] Disable AI-Mode at EVERY exit point — Before delivering the final response for ANY reason, always disable AI-mode first. This applies to ALL exit paths: workflow success, workflow failure, error/exception, user cancellation, session end, or any other scenario where no further CLI commands will be executed. AI-mode is only used for Agent Skill invocation scenarios and MUST NOT remain enabled after the skill stops running.

aliyun configure ai-mode disable

---

Authentication Configuration

Pre-check: Alibaba Cloud Credentials Required

>

Security Rules:

- NEVER read, output, or print AK/SK values

- NEVER ask users to input AK/SK directly

- ONLY use aliyun configure list to check credential status

>

```bash

aliyun configure list

```

Check the output for a valid profile. If no valid profile exists, STOP here.

---

RAM Permission Requirements

For detailed policies, see references/ram-policies.md

[MUST] Permission Failure Handling: When permission errors occur:

1. Read references/ram-policies.md for required permissions

2. Use ram-permission-diagnose skill to guide user

3. Wait until user confirms permissions granted

---

Core Workflow

Step 0: Identify Query Scenario (Critical)

⚠️ IMPORTANT: Choose the correct API based on user input

Scenario A: User specified alert ID → Verify alert exists:

aliyun sas DescribeSecurityEventOperations \
  --SecurityEventId {AlertID} \
  --Lang zh \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-alert-handler

• Success → Alert exists, proceed to Step 5
• Failure (SecurityEventNotExists) → See references/error-handling.md

Scenario B: User did not specify alert ID → Proceed to Step 1

---

Step 1: Query Alert List

aliyun sas DescribeSuspEvents \
  --Lang zh \
  --From sas \
  --CurrentPage 1 \
  --PageSize 10 \
  --Levels "serious,suspicious,remind" \
  --Dealed N \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-alert-handler 2>/dev/null | jq '.SuspEvents[] | {Id, Name: .AlarmEventNameDisplay, AlarmEventType, Level, InternetIp, IntranetIp, LastTime, EventStatus, Uuid}'

Key Response Fields:

---

Step 2: Display Alert Information and Recommendations

Display Format:

Alert List (Total X items):

[Alert 1] ID: 7009607xx
- Name: ECS login from unusual location
- Type: Unusual Login
- Severity: suspicious
- Asset: 47.xxx.xxx.xxx / 10.xxx.xxx.xxx
- Status: Pending
- Time: 2026-03-19 14:11:05
- Recommended Action: Block IP
- Reason: Unusual login behavior detected

For operateCode mappings and recommendation rules, see references/operation-codes.md

---

Step 3: Determine Handling Intent

Case A: User specified handling method → Proceed to Step 4

Case B: User did not specify → Must ask user:

Please confirm how to handle these alerts:

1. ✅ Handle all using recommended methods
2. 🔧 Custom handling method
3. ❌ Cancel

Please select (enter number):

---

Step 4: Query Available Handling Operations

⚠️ Strict Constraint: Each alert's available operations must be queried individually

- NEVER assume one alert's operations apply to another

- MUST call DescribeSecurityEventOperations for each alert

aliyun sas DescribeSecurityEventOperations \
  --SecurityEventId {AlertID} \
  --Lang zh \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-alert-handler

⚠️ Critical: Only execute operations where `UserCanOperate=true`

---

Step 5: Build Parameters and Execute

Quick Reference - Common Operations:

Example - ignore:

aliyun sas HandleSecurityEvents \
  --SecurityEventIds.1 7009586xx \
  --OperationCode ignore \
  --OperationParams '{}' \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-alert-handler

Example - kill_and_quara:

aliyun sas HandleSecurityEvents \
  --SecurityEventIds.1 7008619xx \
  --OperationCode kill_and_quara \
  --OperationParams '{"subOperation":"killAndQuaraFileByMd5andPath"}' \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-alert-handler

Example - block_ip (7 days):

# Calculate: current_timestamp_ms + 7*24*60*60*1000
aliyun sas HandleSecurityEvents \
  --SecurityEventIds.1 7009607xx \
  --OperationCode block_ip \
  --OperationParams '{"expireTime":1773991205392}' \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-alert-handler

Example - advance_mark_mis_info:

aliyun sas HandleSecurityEvents \
  --SecurityEventIds.1 7009586xx \
  --OperationCode advance_mark_mis_info \
  --OperationParams '{}' \
  --MarkMissParam '[{"uuid":"ALL","field":"loginSourceIp","operate":"strEqual","fieldValue":"59.82.xx.xx"}]' \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-alert-handler

⚠️ For advanced whitelist (advance_mark_mis_info):

- Must ask user about whitelist rules and scope

- Must preserve existing MarkField rules

- See references/workflow-details.md for detailed process

For complete CLI examples and parameter details, see references/workflow-details.md

---

Step 6: Query Handling Status

⚠️ CLI Requirement: Must pass both TaskId and SecurityEventIds

aliyun sas DescribeSecurityEventOperationStatus \
  --TaskId 290511xx \
  --SecurityEventIds.1 7009607xx \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-alert-handler

Polling Logic: 1. TaskStatus=Processing → Wait 2s, retry (max 5 times) 2. After 10s still not complete → Mark as failed 3. TaskStatus=Success → Handling successful 4. TaskStatus=Failure → Check ErrorCode

---

Step 7: Loop to Handle Other Alerts

If there are other alerts, repeat Steps 3-6. Maximum 20 alerts per batch.

---

Step 8: Results Summary

========== Handling Results Summary ==========

✅ Successfully Handled: 3 items
  [Alert 7009607xx] Block IP - Success

❌ Handling Failed: 1 item
  [Alert 7008557xx] Kill and Quarantine - Failed (AgentOffline)

Total: 4 items, Success 3, Failed 1

For detailed format, see references/error-handling.md

---

operateCode Quick Reference

For complete operateCode categories and details, see references/operation-codes.md

---

Error Handling

For detailed error handling procedures, see references/error-handling.md

---

Best Practices

1. Query before handling: Call DescribeSecurityEventOperations first 2. Batch limit: Maximum 20 alerts per batch 3. Preserve existing rules: When using advanced whitelist, merge existing MarkField rules 4. Timeout handling: Polling over 10 seconds = failed 5. User confirmation: Must confirm intent before handling 6. Logging: Record all operations for auditing

---

Reference Documents

Acceptance Criteria: alibabacloud-sas-alert-handler

Scenario: Cloud Security Center CWPP Alert Handling Purpose: Skill Testing Acceptance Criteria

---

Correct CLI Command Patterns

1. Product — Verify Product Name Exists

✅ CORRECT

aliyun sas DescribeSuspEvents ...

❌ INCORRECT

aliyun security DescribeSuspEvents ...  # Wrong product name
aliyun SAS DescribeSuspEvents ...       # Case error

2. Command — Verify Command Exists

✅ CORRECT

aliyun sas DescribeSuspEvents
aliyun sas DescribeSecurityEventOperations
aliyun sas HandleSecurityEvents
aliyun sas DescribeSecurityEventOperationStatus

❌ INCORRECT

aliyun sas describe-susp-events           # Wrong format (SAS uses PascalCase)
aliyun sas DescribeSuspEvent              # Singular/plural error
aliyun sas HandleSecurityEvent            # Singular/plural error

3. Parameters — Verify Parameter Names Exist

DescribeSuspEvents

✅ CORRECT

aliyun sas DescribeSuspEvents \
  --Lang zh \
  --From sas \
  --CurrentPage 1 \
  --PageSize 10 \
  --Levels "serious,suspicious,remind" \
  --Dealed N \
  --user-agent AlibabaCloud-Agent-Skills

❌ INCORRECT

aliyun sas DescribeSuspEvents \
  --lang zh \                    # Lowercase error, should be --Lang
  --from sas \                   # Lowercase error, should be --From
  --current-page 1 \             # Format error, should be --CurrentPage
  --page-size 10 \               # Format error, should be --PageSize
  --levels "serious" \           # Lowercase error, should be --Levels
  --dealed N                     # Lowercase error, should be --Dealed

HandleSecurityEvents

✅ CORRECT

aliyun sas HandleSecurityEvents \
  --SecurityEventIds.1 7009607xx \
  --OperationCode block_ip \
  --OperationParams '{"expireTime":1773991205392}' \
  --user-agent AlibabaCloud-Agent-Skills

❌ INCORRECT

aliyun sas HandleSecurityEvents \
  --SecurityEventIds 7009607xx \           # Missing .1 index
  --security-event-ids.1 7009607xx \       # Format error
  --operation-code block_ip \              # Format error, should be --OperationCode
  --operation-params '{"expireTime":1773991205392}'  # Format error

4. Enum Values — Verify Enum Values Are Valid

OperationCode Values

✅ CORRECT

--OperationCode block_ip
--OperationCode advance_mark_mis_info
--OperationCode ignore
--OperationCode manual_handled
--OperationCode kill_and_quara
--OperationCode virus_quara
--OperationCode virus_quara_bin
--OperationCode kill_process
--OperationCode cleanup
--OperationCode quara
--OperationCode rm_mark_mis_info
--OperationCode disable_malicious_defense

❌ INCORRECT

--OperationCode blockip                    # Format error, should have underscore
--OperationCode BLOCK_IP                   # Case error
--OperationCode block-ip                   # Format error, should use underscore
--OperationCode advance-mark-mis-info      # Format error

Levels Values

✅ CORRECT

--Levels "serious"
--Levels "suspicious"
--Levels "remind"
--Levels "serious,suspicious,remind"

❌ INCORRECT

--Levels "critical"         # Non-existent level
--Levels "high"             # Non-existent level
--Levels "serious suspicious"  # Separator error, should use comma

Dealed Values

✅ CORRECT

--Dealed N    # Unhandled
--Dealed Y    # Handled

❌ INCORRECT

--Dealed n          # Lowercase error
--Dealed yes        # Format error
--Dealed no         # Format error
--Dealed false      # Format error

5. Parameter Value Formats — Verify Parameter Value Formats

RepeatList Format (Array Parameters)

✅ CORRECT

# Single value
--SecurityEventIds.1 7009607xx

# Multiple values
--SecurityEventIds.1 7009607xx \
--SecurityEventIds.2 7008557xx \
--SecurityEventIds.3 7008619xx

❌ INCORRECT

--SecurityEventIds 7009607xx              # Missing index
--SecurityEventIds "[7009607xx]"          # Wrong array format
--SecurityEventIds "7009607xx,7008557xx"  # Wrong separator format

JSON String Parameters

✅ CORRECT

--OperationParams '{"expireTime":1773991205392}'
--MarkMissParam '[{"uuid":"ALL","field":"loginSourceIp","operate":"strEqual","fieldValue":"59.82.xx.xx"}]'

❌ INCORRECT

--OperationParams {"expireTime":1773991205392}    # Missing quotes
--OperationParams "{'expireTime':1773991205392}"  # Single quotes inside
--MarkMissParam "[{uuid:ALL}]"                    # JSON keys missing quotes

6. user-agent Flag — Verify Must Be Included

✅ CORRECT — Every command includes --user-agent

aliyun sas DescribeSuspEvents ... --user-agent AlibabaCloud-Agent-Skills
aliyun sas HandleSecurityEvents ... --user-agent AlibabaCloud-Agent-Skills

❌ INCORRECT — Missing --user-agent

aliyun sas DescribeSuspEvents --Lang zh --From sas

---

Business Logic Validation

1. block_ip Must Include expireTime

✅ CORRECT

aliyun sas HandleSecurityEvents \
  --SecurityEventIds.1 7009607xx \
  --OperationCode block_ip \
  --OperationParams '{"expireTime":1773991205392}' \
  --user-agent AlibabaCloud-Agent-Skills

❌ INCORRECT

# Missing expireTime
aliyun sas HandleSecurityEvents \
  --SecurityEventIds.1 7009607xx \
  --OperationCode block_ip \
  --OperationParams '{}' \
  --user-agent AlibabaCloud-Agent-Skills

2. kill_and_quara Must Include subOperation

✅ CORRECT

aliyun sas HandleSecurityEvents \
  --SecurityEventIds.1 7008619xx \
  --OperationCode kill_and_quara \
  --OperationParams '{"subOperation":"killAndQuaraFileByMd5andPath"}' \
  --user-agent AlibabaCloud-Agent-Skills

❌ INCORRECT

# Missing subOperation
aliyun sas HandleSecurityEvents \
  --SecurityEventIds.1 7008619xx \
  --OperationCode kill_and_quara \
  --OperationParams '{}' \
  --user-agent AlibabaCloud-Agent-Skills

3. subOperation Value Validation

4. MarkMissParam Structure Validation

✅ CORRECT

[
  {
    "uuid": "ALL",           // or "part"
    "field": "loginSourceIp", // from MarkFieldsSource.FiledName
    "operate": "strEqual",    // from SupportedMisType
    "fieldValue": "59.82.xx.xx"
  }
]

❌ INCORRECT

// uuid value error
[{"uuid": "all", "field": "loginSourceIp", "operate": "strEqual", "fieldValue": "59.82.xx.xx"}]

// operate value error
[{"uuid": "ALL", "field": "loginSourceIp", "operate": "equals", "fieldValue": "59.82.xx.xx"}]

5. DescribeSecurityEventOperationStatus Must Pass Both Parameters

✅ CORRECT — Pass both TaskId and SecurityEventIds

aliyun sas DescribeSecurityEventOperationStatus \
  --TaskId 290511xx \
  --SecurityEventIds.1 7009607xx \
  --user-agent AlibabaCloud-Agent-Skills

❌ INCORRECT — Only pass one of them

# Only pass TaskId (CLI will error)
aliyun sas DescribeSecurityEventOperationStatus \
  --TaskId 290511xx \
  --user-agent AlibabaCloud-Agent-Skills

# Only pass SecurityEventIds (CLI will error)
aliyun sas DescribeSecurityEventOperationStatus \
  --SecurityEventIds.1 7009607xx \
  --user-agent AlibabaCloud-Agent-Skills

---

Process Validation

1. Must Query UserCanOperate Before Handling

Correct Process: 1. Call DescribeSecurityEventOperations to get available operations 2. Check if target operation's UserCanOperate is true 3. Only execute operations where UserCanOperate=true

2. Advanced Whitelist Must Preserve Existing Rules

Correct Process: 1. Call DescribeSecurityEventOperations to get MarkField (existing rules) 2. Build new rules 3. Merge existing rules + new rules and pass to MarkMissParam

3. Poll Status Until Complete

Correct Process: 1. Call HandleSecurityEvents to get TaskId 2. Call DescribeSecurityEventOperationStatus to query status 3. If TaskStatus=Processing, wait 2 seconds and retry 4. Maximum 5 retries (10 second timeout) 5. End when TaskStatus=Success or Failure

---

CLI Unsupported Operations

---

Acceptance Checklist

• [ ] All CLI commands use correct product name sas
• [ ] All CLI commands use PascalCase format (e.g., DescribeSuspEvents)
• [ ] All parameter names use PascalCase format (e.g., --SecurityEventIds.1)
• [ ] All enum values use correct format (e.g., block_ip, serious)
• [ ] Array parameters use .N suffix format (e.g., --SecurityEventIds.1)
• [ ] JSON parameters wrapped with single quotes
• [ ] Every command includes --user-agent AlibabaCloud-Agent-Skills
• [ ] block_ip operation includes expireTime parameter
• [ ] kill_and_quara/virus_quara/virus_quara_bin includes subOperation parameter
• [ ] Advanced whitelist operation preserves existing rules
• [ ] DescribeSecurityEventOperationStatus passes both TaskId and SecurityEventIds

Aliyun CLI Installation & Configuration Guide

Complete guide for installing and configuring Aliyun CLI.

Aliyun CLI 3.3.3+: Supports installing and using all published Alibaba Cloud product plugins. Make sure to upgrade to 3.3.3 or later for full plugin ecosystem coverage.

Installation

macOS

Using Homebrew (Recommended)

brew install aliyun-cli
# Upgrade to latest
brew upgrade aliyun-cli

# Verify version (>= 3.3.3)
aliyun version

Using Binary

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-macosx-latest-amd64.tgz

# Extract
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Linux

Debian/Ubuntu

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

CentOS/RHEL

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

ARM64 Architecture

# Download ARM64 version
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-arm64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-arm64.tgz
sudo mv aliyun /usr/local/bin/

Windows

Using Binary 1. Download from: https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip 2. Extract the ZIP file 3. Add the directory to your PATH environment variable 4. Open new Command Prompt or PowerShell 5. Verify: aliyun version

Using PowerShell

# Download
Invoke-WebRequest -Uri "https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip" -OutFile "aliyun-cli.zip"

# Extract
Expand-Archive -Path aliyun-cli.zip -DestinationPath C:\aliyun-cli

# Add to PATH (requires admin privileges)
$env:Path += ";C:\aliyun-cli"
[Environment]::SetEnvironmentVariable("Path", $env:Path, [System.EnvironmentVariableTarget]::Machine)

# Verify
aliyun version

Configuration

Quick Start

aliyun configure set \
  --mode AK \
  --access-key-id <your-access-key-id> \
  --access-key-secret <your-access-key-secret> \
  --region cn-hangzhou

All aliyun configure commands support non-interactive flags, which is the recommended approach — it works in scripts, CI/CD pipelines, and agent-driven automation without hanging on stdin prompts.

Where to Get Access Keys

1. Log in to Aliyun Console: https://ram.console.aliyun.com/ 2. Navigate to: AccessKey Management 3. Create a new AccessKey pair 4. Save the secret immediately — it's only shown once

Configuration Modes

Aliyun CLI supports 6 authentication modes. All examples below use non-interactive flags.

1. AK Mode (Access Key)

Most common mode for personal accounts and scripts.

aliyun configure set \
  --mode AK \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --region cn-hangzhou

Configuration is stored in ~/.aliyun/config.json:

{
  "current": "default",
  "profiles": [
    {
      "name": "default",
      "mode": "AK",
      "access_key_id": "LTAI5tXXXXXXXX",
      "access_key_secret": "8dXXXXXXXXXXXXXXXXXXXXXXXX",
      "region_id": "cn-hangzhou",
      "output_format": "json",
      "language": "en"
    }
  ]
}

2. StsToken Mode (Temporary Credentials)

For short-lived access (tokens expire in 1-12 hours).

aliyun configure set \
  --mode StsToken \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --sts-token v1.0:XXXXXXXXXXXXXXXX \
  --region cn-hangzhou

Use cases: CI/CD pipelines, temporary access for external contractors, cross-account access.

3. RamRoleArn Mode (Assume RAM Role)

Assume a RAM role for elevated or cross-account access.

aliyun configure set \
  --mode RamRoleArn \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --ram-role-arn acs:ram::123456789012:role/AdminRole \
  --role-session-name my-session \
  --region cn-hangzhou

Use cases: cross-account resource access, temporary elevated privileges, role-based access control.

4. EcsRamRole Mode (ECS Instance RAM Role)

Use the RAM role attached to an ECS instance — no credentials needed.

aliyun configure set \
  --mode EcsRamRole \
  --ram-role-name MyEcsRole \
  --region cn-hangzhou

Requirements: must be running on an ECS instance with a RAM role attached.

Use cases: scripts and automation running on ECS instances.

5. RsaKeyPair Mode (RSA Key Pair)

Use RSA key pair for authentication (generate key pair in Aliyun Console first).

aliyun configure set \
  --mode RsaKeyPair \
  --private-key /path/to/private-key.pem \
  --key-pair-name my-key-pair \
  --region cn-hangzhou

6. RamRoleArnWithEcs Mode (ECS + RAM Role)

Combine ECS instance role with RAM role assumption for cross-account access from ECS.

aliyun configure set \
  --mode RamRoleArnWithEcs \
  --ram-role-name MyEcsRole \
  --ram-role-arn acs:ram::123456789012:role/TargetRole \
  --role-session-name my-session \
  --region cn-hangzhou

Environment Variables

Highest priority - overrides config file

Access Key Mode

export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret
export ALIBABA_CLOUD_REGION_ID=cn-hangzhou

STS Token Mode

export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret
export ALIBABA_CLOUD_SECURITY_TOKEN=your_sts_token
export ALIBABA_CLOUD_REGION_ID=cn-hangzhou

ECS RAM Role Mode

export ALIBABA_CLOUD_ECS_METADATA=role_name

Use Case:

• CI/CD pipelines
• Docker containers
• Temporary credential override

Managing Multiple Profiles

Create Named Profiles

aliyun configure set --profile projectA \
  --mode AK \
  --access-key-id LTAI5tAAAAAAAA \
  --access-key-secret 8dAAAAAAAAAAAAAAAAAAAAAAAA \
  --region cn-hangzhou

aliyun configure set --profile projectB \
  --mode AK \
  --access-key-id LTAI5tBBBBBBBB \
  --access-key-secret 8dBBBBBBBBBBBBBBBBBBBBBBBB \
  --region cn-shanghai

Use Specific Profile

aliyun ecs describe-instances --profile projectA

export ALIBABA_CLOUD_PROFILE=projectA
aliyun ecs describe-instances   # Uses projectA

List and Switch Profiles

aliyun configure list                      # List all profiles
aliyun configure set --current projectA    # Switch default profile

Credential Priority

Credentials are loaded in this order (first found wins):

1. Command-line flag: --profile <name> 2. Environment variable: ALIBABA_CLOUD_PROFILE 3. Environment credentials: ALIBABA_CLOUD_ACCESS_KEY_ID, etc. 4. Configuration file: ~/.aliyun/config.json (current profile) 5. ECS Instance RAM Role: If running on ECS with attached role

Verification

Test Authentication

# Basic test - list regions
aliyun ecs describe-regions

# Expected output: JSON array of regions

If successful, you'll see:

{
  "Regions": {
    "Region": [
      {
        "RegionId": "cn-hangzhou",
        "RegionEndpoint": "ecs.cn-hangzhou.aliyuncs.com",
        "LocalName": "华东 1（杭州）"
      },
      ...
    ]
  },
  "RequestId": "..."
}

If failed, you'll see error messages:

• InvalidAccessKeyId.NotFound - Wrong Access Key ID
• SignatureDoesNotMatch - Wrong Access Key Secret
• InvalidSecurityToken.Expired - STS token expired (for StsToken mode)
• Forbidden.RAM - Insufficient permissions

Debug Configuration

# Show current configuration
aliyun configure get

# Test with debug logging
aliyun ecs describe-regions --log-level=debug

# Check credential provider
aliyun configure get mode

Security Best Practices

1. Use RAM Users (Not Root Account)

❌ Don't: Use Aliyun root account credentials ✅ Do: Create RAM users with specific permissions

# Create RAM user in console
# Attach only necessary policies
# Use RAM user's access keys

2. Principle of Least Privilege

Grant only the minimum permissions needed:

# Example: Read-only ECS access
# Attach policy: AliyunECSReadOnlyAccess

3. Rotate Access Keys Regularly

# Create new access key in RAM Console, then update configuration
aliyun configure set --access-key-id NEW_KEY --access-key-secret NEW_SECRET
# Delete old access key from console

4. Use STS Tokens for Temporary Access

aliyun configure set --mode StsToken \
  --access-key-id XXXX --access-key-secret XXXX \
  --sts-token XXXX --region cn-hangzhou

5. Use ECS RAM Roles When Possible

aliyun configure set --mode EcsRamRole --ram-role-name MyRole --region cn-hangzhou

6. Never Commit Credentials

# Add to .gitignore
echo "~/.aliyun/config.json" >> .gitignore

# Use environment variables in CI/CD instead

7. Secure Config File

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Issue: Command Not Found

# Check installation
which aliyun

# Check PATH
echo $PATH

# Reinstall or add to PATH

Issue: Authentication Failed

# Verify configuration
aliyun configure get

# Test with debug
aliyun ecs describe-regions --log-level=debug

# Check credentials in console
# Verify access key is active

Issue: Permission Denied

# Error: Forbidden.RAM

# Check RAM user permissions
# Attach necessary policies in RAM console
# Example: AliyunECSFullAccess for ECS operations

Issue: STS Token Expired

# Error: InvalidSecurityToken.Expired

# Reconfigure with new token
aliyun configure set --mode StsToken \
  --access-key-id XXXX --access-key-secret XXXX \
  --sts-token NEW_TOKEN --region cn-hangzhou

Issue: Wrong Region

# Some resources may not exist in the specified region

# Check available regions
aliyun ecs describe-regions

# Update default region
aliyun configure set region cn-shanghai

Advanced Configuration

Custom Endpoint

# Use custom or private endpoint
export ALIBABA_CLOUD_ECS_ENDPOINT=ecs-vpc.cn-hangzhou.aliyuncs.com

Proxy Settings

# HTTP proxy
export HTTP_PROXY=http://proxy.example.com:8080
export HTTPS_PROXY=http://proxy.example.com:8080

# No proxy for specific domains
export NO_PROXY=localhost,127.0.0.1,.aliyuncs.com

Timeout Settings

# Connection timeout (default: 10s)
export ALIBABA_CLOUD_CONNECT_TIMEOUT=30

# Read timeout (default: 10s)
export ALIBABA_CLOUD_READ_TIMEOUT=30

Next Steps

After installation and configuration:

1. Install plugins for services you need (v3.3.3+ supports all published product plugins):

   aliyun plugin install --names ecs vpc rds

   # List all available plugins
   aliyun plugin list-remote

2. Explore commands:

   aliyun ecs --help
   aliyun fc --help

3. Read documentation:

• Command Syntax Guide
• Global Flags Reference
• Common Scenarios

References

• Official Documentation: https://help.aliyun.com/zh/cli/
• RAM Console: https://ram.console.aliyun.com/
• Access Key Management: https://ram.console.aliyun.com/manage/ak
• Plugin Repository: https://github.com/aliyun/aliyun-cli

Error Handling Guide

This document contains detailed error handling procedures for alert operations.

---

Common Error Scenarios

---

Alert Not Found Handling Process

When the user-provided alert ID returns no data (DescribeSecurityEventOperations returns SecurityEventNotExists), follow this process:

Step 1: Search in handled alerts for the specified ID (Required)

⚠️ IMPORTANT: When user specifies an alert ID, must first search in handled alerts

# Search for specified ID in handled alerts
aliyun sas DescribeSuspEvents \
  --Lang zh \
  --From sas \
  --CurrentPage 1 \
  --PageSize 100 \
  --Dealed Y \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-alert-handler 2>/dev/null | grep -A 20 -B 5 "{AlertID}"

Step 2: Result Determination

Handled Alert Display Format

Alert {ID} has been handled, details:

[Alert] ID: 702173474
- Name: ECS unusual account login
- Type: Unusual Login
- Severity: suspicious
- Status: Marked as false positive (EventStatus: 8)
- Handling Time: 2026-03-24 10:30:15
- Handling Result: advance_mark_mis_info.User.Success
- Whitelist Rule: Login Source IP equals 124.115.231.154

This alert has already been handled, no repeated action needed.

Step 3: Inform alert does not exist

If also not found in handled alerts, inform user the alert does not exist:

Alert {AlertID} does not exist. Possible reasons:

1. Alert ID entered incorrectly
2. Alert has been deleted
3. Alert has expired

Please confirm the alert ID is correct.

Step 4: Display current pending alerts list

Proactively query and display current pending alerts to help user find the correct alert:

aliyun sas DescribeSuspEvents \
  --Lang zh \
  --From sas \
  --CurrentPage 1 \
  --PageSize 10 \
  --Dealed N \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-alert-handler 2>/dev/null | jq '.SuspEvents[] | {Id, Name: .AlarmEventNameDisplay, Level, InternetIp, EventStatus, LastTime}'

Display format:

Current pending alerts list:

| ID | Name | Severity | Asset IP | Status | Time |
|----|------|----------|----------|--------|------|
| 7019098xx | ECS login from unusual location | suspicious | 47.110.xxx.xxx | Pending | 2026-03-23 16:26:23 |
| 6712310xx | Scorpion Virus | serious | 121.43.xxx.xxx | Pending | 2026-03-23 00:49:04 |

Step 5: Guide user selection

Please confirm:
1. Is the alert ID correct?
2. If you need to handle an alert from the list above, please tell me the alert ID

---

Handling Status ErrorCode Reference

TaskStatus Values

Common ErrorCode Patterns

Success Examples:

• ignore.Success
• kill_and_quara.Success
• advance_mark_mis_info.Success
• block_ip.Success

Failure Examples:

• kill_and_quara.ProcessNotExist - Process does not exist
• kill_and_quara.AgentOffline - Client offline
• block_ip.Failure - Block failed

---

Polling Logic for Status Query

1. If TaskStatus=Processing: Wait 2 seconds and retry, maximum 5 retries 2. If still not complete after 10 seconds → Mark as failed 3. TaskStatus=Success and Status=Success → Handling successful 4. TaskStatus=Failure or Status=Failed → Handling failed

# Status query command
aliyun sas DescribeSecurityEventOperationStatus \
  --TaskId {TaskID} \
  --SecurityEventIds.1 {AlertID} \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-alert-handler

---

Results Summary Format

After handling is complete, display detailed results for each alert:

========== Handling Results Summary ==========

✅ Successfully Handled: 3 items

  [Alert 7009607xx]
  - Name: ECS login from unusual location
  - Action: Block IP
  - Result: Success
  - Details: Blocked IP 140.205.xx.xx, valid for 7 days

  [Alert 7008619xx]
  - Name: Trojan Program
  - Action: Kill and Quarantine Virus
  - Result: Success

❌ Handling Failed: 1 item

  [Alert 7008557xx]
  - Name: Virus Program
  - Action: Kill and Quarantine Virus
  - Result: Failed
  - Reason: AgentOffline (client offline)
  - Suggestion: Wait for client to come online and retry

==========================================

Total: Handled 4 items, Success 3 items, Failed 1 item

Operation Codes Reference

This document contains detailed information about all available operation codes (operateCode) for alert handling.

---

operateCode User Language Mapping

---

Default Handling Recommendation Rules

---

Category 1: Threat Handling (Active Threat Response)

---

Category 2: Whitelist Operations

Whitelist Operation Comparison

---

Category 3: Ignore Operations

---

Category 4: Manual Handling Operations

---

Alert Status Code Reference

---

DescribeSecurityEventOperations Response Fields

⚠️ Critical Check: Only execute operations where `UserCanOperate=true`

RAM Policies

Permission Requirements

The following RAM permissions are required to execute this skill:

---

Complete Permission Policies

Read-Only Permissions (Query Alerts Only)

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "yundun-sas:DescribeSuspEvents",
        "yundun-sas:DescribeSecurityEventOperations",
        "yundun-sas:DescribeSecurityEventOperationStatus"
      ],
      "Resource": "*"
    }
  ]
}

Full Permissions (Query + Handle Alerts)

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "yundun-sas:DescribeSuspEvents",
        "yundun-sas:DescribeSecurityEventOperations",
        "yundun-sas:HandleSecurityEvents",
        "yundun-sas:DescribeSecurityEventOperationStatus"
      ],
      "Resource": "*"
    }
  ]
}

---

System Policies

If you prefer not to create custom policies, you can use the following system policies:

Recommendation: Following the principle of least privilege, it is recommended to use the custom policies above rather than full access permissions.

---

Permission Verification

Verify whether the current user has the required permissions:

# Test query permission
aliyun sas DescribeSuspEvents --PageSize 1 --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-alert-handler

# If "NoPermission" error is returned, it indicates missing permissions

---

Common Permission Errors

---

Authorization Steps

1. Log in to RAM Console 2. Create a custom policy or select a system policy 3. Attach the policy to the target user/role 4. Verify permissions are effective

---

Important Notes

1. Version Limitation: Some handling operations (e.g., kill_and_quara) require Cloud Security Center Advanced Edition or higher 2. Resource Limitation: Some operations may be restricted by resource ownership, only able to handle alerts for assets under the current account 3. Audit Logging: All handling operations are recorded in the operation audit logs

Related APIs

API and CLI Command List

All APIs and CLI commands involved in this skill:

---

DescribeSuspEvents Parameter Details

Query security alert list

Request Parameters

Response Parameters

CLI Example

aliyun sas DescribeSuspEvents \
  --Lang zh \
  --From sas \
  --CurrentPage 1 \
  --PageSize 20 \
  --Levels "serious,suspicious,remind" \
  --Dealed N \
  --user-agent AlibabaCloud-Agent-Skills 2>/dev/null | jq '.SuspEvents[] | {Id, Name: .AlarmEventNameDisplay, AlarmEventType, Level, InternetIp, IntranetIp, LastTime, EventStatus}'

---

DescribeSecurityEventOperations Parameter Details

Query available handling operations for alerts

Request Parameters

Response Parameters

MarkFieldsSource Structure

SupportedMisType Values

CLI Example

aliyun sas DescribeSecurityEventOperations \
  --SecurityEventId 7009607xx \
  --Lang zh \
  --user-agent AlibabaCloud-Agent-Skills

---

HandleSecurityEvents Parameter Details

Execute alert handling operations

Request Parameters

OperationCode Values

OperationParams Format

block_ip:

{"expireTime":1773991205392}

• expireTime: Millisecond timestamp, indicating when the IP block expires

kill_and_quara:

{"subOperation":"killAndQuaraFileByMd5andPath"}

• subOperation options: killByMd5andPath, killAndQuaraFileByMd5andPath

virus_quara / virus_quara_bin:

{"subOperation":"quaraFileByMd5andPath"}

• subOperation fixed value: quaraFileByMd5andPath

MarkMissParam Format

[
  {
    "uuid": "ALL",
    "field": "loginSourceIp",
    "operate": "strEqual",
    "fieldValue": "59.82.xx.xx"
  }
]

Response Parameters

CLI Examples

Block IP:

aliyun sas HandleSecurityEvents \
  --SecurityEventIds.1 7009607xx \
  --OperationCode block_ip \
  --OperationParams '{"expireTime":1773991205392}' \
  --user-agent AlibabaCloud-Agent-Skills

Kill and Quarantine Virus:

aliyun sas HandleSecurityEvents \
  --SecurityEventIds.1 7008619xx \
  --OperationCode kill_and_quara \
  --OperationParams '{"subOperation":"killAndQuaraFileByMd5andPath"}' \
  --user-agent AlibabaCloud-Agent-Skills

Advanced Whitelist (with rules):

aliyun sas HandleSecurityEvents \
  --SecurityEventIds.1 7009586xx \
  --OperationCode advance_mark_mis_info \
  --OperationParams '{}' \
  --MarkMissParam '[{"uuid":"ALL","field":"loginSourceIp","operate":"strEqual","fieldValue":"59.82.xx.xx"}]' \
  --user-agent AlibabaCloud-Agent-Skills

Ignore:

aliyun sas HandleSecurityEvents \
  --SecurityEventIds.1 7009586xx \
  --OperationCode ignore \
  --OperationParams '{}' \
  --user-agent AlibabaCloud-Agent-Skills

---

DescribeSecurityEventOperationStatus Parameter Details

Query handling status

Request Parameters

⚠️ CLI Special Requirement: Must pass both TaskId and SecurityEventIds

Response Parameters

TaskStatus Values

Status Values

ErrorCode Format

Format: {OperationType}.{ResultCode}

Success Examples:

• ignore.Success
• kill_and_quara.Success
• advance_mark_mis_info.Success
• block_ip.Success

Failure Examples:

• kill_and_quara.ProcessNotExist - Process does not exist
• kill_and_quara.AgentOffline - Client offline
• block_ip.Failure - Block failed

CLI Example

aliyun sas DescribeSecurityEventOperationStatus \
  --TaskId 290511xx \
  --SecurityEventIds.1 7009607xx \
  --user-agent AlibabaCloud-Agent-Skills

---

Parameter Flow Diagram

DescribeSuspEvents
    │ Id → SecurityEventId
    ▼
DescribeSecurityEventOperations
    │ OperationCode, MarkFieldsSource, MarkField → MarkMissParam
    ▼
HandleSecurityEvents
    │ TaskId + SecurityEventIds
    ▼
DescribeSecurityEventOperationStatus

Verification Method

Success Verification Methods

This document describes how to verify whether each step has been executed successfully.

---

Step 1: Query Alert List Verification

Verification Command

aliyun sas DescribeSuspEvents \
  --Lang zh \
  --From sas \
  --CurrentPage 1 \
  --PageSize 5 \
  --Levels "serious,suspicious,remind" \
  --Dealed N \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-alert-handler 2>/dev/null | jq '.Count, .TotalCount'

Success Indicators

• Returns JSON formatted data
• Contains SuspEvents array
• Count field shows number of items on current page
• TotalCount field shows total number of items

Failure Handling

---

Step 2: Query Available Handling Operations Verification

Verification Command

aliyun sas DescribeSecurityEventOperations \
  --SecurityEventId {AlertID} \
  --Lang zh \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-alert-handler 2>/dev/null | jq '.SecurityEventOperationsResponse[] | {OperationCode, UserCanOperate}'

Success Indicators

• Returns SecurityEventOperationsResponse array
• Each element contains OperationCode and UserCanOperate
• Operations with UserCanOperate=true can be executed

Failure Handling

---

Step 3: Handling Operation Verification

Verification Command

# Check return after handling
aliyun sas HandleSecurityEvents \
  --SecurityEventIds.1 {AlertID} \
  --OperationCode {OperationCode} \
  --OperationParams '{}' \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-alert-handler 2>/dev/null | jq '.HandleSecurityEventsResponse.TaskId'

Success Indicators

• Returns TaskId (non-empty number)
• No error messages

Failure Handling

---

Step 4: Query Handling Status Verification

Verification Command

aliyun sas DescribeSecurityEventOperationStatus \
  --TaskId {TaskID} \
  --SecurityEventIds.1 {AlertID} \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-alert-handler 2>/dev/null | jq '.SecurityEventOperationStatusResponse'

Success Indicators

• TaskStatus is Success
• SecurityEventOperationStatuses[].Status is Success
• ErrorCode format is {Operation}.Success

Processing Status

If TaskStatus=Processing:

# Retry after 2 seconds
sleep 2
aliyun sas DescribeSecurityEventOperationStatus \
  --TaskId {TaskID} \
  --SecurityEventIds.1 {AlertID} \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-alert-handler

Polling Logic

#!/bin/bash
TASK_ID="290511xx"
EVENT_ID="7009607xx"
MAX_RETRY=5
RETRY=0

while [ $RETRY -lt $MAX_RETRY ]; do
  RESULT=$(aliyun sas DescribeSecurityEventOperationStatus \
    --TaskId $TASK_ID \
    --SecurityEventIds.1 $EVENT_ID \
    --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-alert-handler 2>/dev/null)
  
  STATUS=$(echo $RESULT | jq -r '.SecurityEventOperationStatusResponse.TaskStatus')
  
  if [ "$STATUS" = "Success" ] || [ "$STATUS" = "Failure" ]; then
    echo "Final status: $STATUS"
    echo $RESULT | jq '.SecurityEventOperationStatusResponse'
    break
  fi
  
  echo "Status: $STATUS, retrying in 2s..."
  sleep 2
  RETRY=$((RETRY + 1))
done

if [ $RETRY -eq $MAX_RETRY ]; then
  echo "Timeout: status still processing after ${MAX_RETRY} retries"
fi

---

Handling Result Verification

Verify Alert Status Change

After successful handling, re-query the alert to confirm status change:

aliyun sas DescribeSuspEvents \
  --Id {AlertID} \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-alert-handler 2>/dev/null | jq '.SuspEvents[0] | {Id, EventStatus, Dealed: (.Dealed // "unknown")}'

Status Reference Table

---

Common Error Codes Summary

---

End-to-End Verification Script

#!/bin/bash
# End-to-end verification script

echo "=== Step 1: Query Alert List ==="
EVENTS=$(aliyun sas DescribeSuspEvents \
  --Lang zh --From sas --PageSize 5 --Dealed N \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-alert-handler 2>/dev/null)

COUNT=$(echo $EVENTS | jq '.Count')
echo "Found $COUNT pending alerts"

if [ "$COUNT" -eq 0 ]; then
  echo "No pending alerts, exiting"
  exit 0
fi

# Get the first alert ID
EVENT_ID=$(echo $EVENTS | jq -r '.SuspEvents[0].Id')
echo "Selected alert ID: $EVENT_ID"

echo ""
echo "=== Step 2: Query Available Operations ==="
OPS=$(aliyun sas DescribeSecurityEventOperations \
  --SecurityEventId $EVENT_ID --Lang zh \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-alert-handler 2>/dev/null)

echo "Available operations:"
echo $OPS | jq '.SecurityEventOperationsResponse[] | select(.UserCanOperate==true) | .OperationCode'

echo ""
echo "Verification complete! To execute handling, please manually run the HandleSecurityEvents command"

Workflow Details

This document contains detailed workflow instructions for alert handling operations.

---

Step 5: Build Handling Parameters - Detailed Guide

5.1 OperationParams Format Requirements

⚠️ Strict Format Requirement: `OperationParams` must be a valid JSON string

>

Correct Format:

```json

{"subOperation":"killAndQuaraFileByMd5andPath"}

```

>

Incorrect Format (common errors):

```

subOperation:killAndQuaraFileByMd5andPath ❌ Not JSON

{subOperation:killAndQuaraFileByMd5andPath} ❌ Missing quotes

```

>

For CLI calls, wrap with single quotes: --OperationParams '{"subOperation":"killAndQuaraFileByMd5andPath"}'

>

For API/SDK calls, ensure a JSON string is passed, not key-value text.

5.2 Parameter Requirements by OperationCode

5.3 subOperation Mapping Table

5.4 expireTime Calculation Rules

import time

# Block duration options (milliseconds)
DURATION_MAP = {
    "6 hours": 6 * 60 * 60 * 1000,
    "1 day": 24 * 60 * 60 * 1000,
    "7 days": 7 * 24 * 60 * 60 * 1000,
    "30 days": 30 * 24 * 60 * 60 * 1000
}

# Calculate expireTime (millisecond timestamp)
expire_time = int(time.time() * 1000) + DURATION_MAP["7 days"]

---

Advanced Whitelist Operation Process (advance_mark_mis_info)

⚠️ IMPORTANT: Advanced whitelist requires asking user whether to deploy whitelist rules

Step 1: Display existing rules, available fields, and whitelist scope

You selected [Advanced Whitelist], please confirm the following configuration:

⚠️ Existing Whitelist Rules (from MarkField):
| Field | Match Rule | Value | Scope |
|-------|------------|-------|-------|
| Rule Link | Contains | fyfhchcg | All Machines |

[Whitelist Fields]
Available whitelist fields (from MarkFieldsSource):
| # | Field Name | Current Value |
|---|------------|---------------|
| 1 | Login Source IP | 140.205.xx.xx |
| 2 | Login Account | root |

Recommended fields: Login Source IP, Login Account

1. ✅ Use recommended fields
2. 🔧 Custom fields (specify field numbers to whitelist, separate with commas)
3. ⏭️ Don't add rules (only whitelist this alert)

[Whitelist Scope]
1. ALL - All machines (future alerts matching rules on all machines will be auto-whitelisted)
2. part - Current machine only

Please select fields and scope (e.g., "Use recommended fields, scope 1")

Step 2: Build MarkMissParam

⚠️ IMPORTANT: Whitelist rules are full replacement, must preserve existing rules!

// Final MarkMissParam = Existing rules + New rules
[
  {"uuid":"ALL","field":"ruleLinkUrl","operate":"contains","fieldValue":"fyfhchcg"},
  {"uuid":"ALL","field":"repoName","operate":"strEqual","fieldValue":"o11y-addon-controller"}
]

Conversion Rules:

• FiledName → field
• MarkMisValue → fieldValue
• SupportedMisType[i] → operate (default strEqual)
• uuid: ALL (all machines) or part (current machine only)

Match Rule Description

---

CLI Call Examples - Complete Reference

block_ip (Block IP)

aliyun sas HandleSecurityEvents \
  --SecurityEventIds.1 7009607xx \
  --OperationCode block_ip \
  --OperationParams '{"expireTime":1773991205392}' \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-alert-handler

kill_and_quara (Kill and Quarantine Virus)

aliyun sas HandleSecurityEvents \
  --SecurityEventIds.1 7008619xx \
  --OperationCode kill_and_quara \
  --OperationParams '{"subOperation":"killAndQuaraFileByMd5andPath"}' \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-alert-handler

advance_mark_mis_info (Advanced Whitelist + Rules)

aliyun sas HandleSecurityEvents \
  --SecurityEventIds.1 7009586xx \
  --OperationCode advance_mark_mis_info \
  --OperationParams '{}' \
  --MarkMissParam '[{"uuid":"ALL","field":"loginSourceIp","operate":"strEqual","fieldValue":"59.82.xx.xx"}]' \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-alert-handler

ignore (Ignore)

aliyun sas HandleSecurityEvents \
  --SecurityEventIds.1 7009586xx \
  --OperationCode ignore \
  --OperationParams '{}' \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-alert-handler

manual_handled (Mark as Handled)

aliyun sas HandleSecurityEvents \
  --SecurityEventIds.1 7009586xx \
  --OperationCode manual_handled \
  --OperationParams '{}' \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-alert-handler

virus_quara (Quarantine File)

aliyun sas HandleSecurityEvents \
  --SecurityEventIds.1 7008619xx \
  --OperationCode virus_quara \
  --OperationParams '{"subOperation":"quaraFileByMd5andPath"}' \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-alert-handler

quara (Quarantine)

aliyun sas HandleSecurityEvents \
  --SecurityEventIds.1 7008619xx \
  --OperationCode quara \
  --OperationParams '{}' \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-alert-handler

---

CLI Call Notes

Array Parameter Format

# Single alert
--SecurityEventIds.1 7009607xx

# Multiple alerts
--SecurityEventIds.1 7009607xx \
--SecurityEventIds.2 7008557xx \
--SecurityEventIds.3 7008619xx

JSON String Parameters

⚠️ Key Reminder: `OperationParams` and `MarkMissParam` must be valid JSON strings

>

Common Errors:

- subOperation:killAndQuaraFileByMd5andPath ❌ Wrong, this is not JSON

- {subOperation:killAndQuaraFileByMd5andPath} ❌ Wrong, missing quotes

>

Correct Format:

- '{"subOperation":"killAndQuaraFileByMd5andPath"}' ✅ Correct

# OperationParams must be valid JSON, wrapped with single quotes
--OperationParams '{"expireTime":1773991205392}'
--OperationParams '{"subOperation":"killAndQuaraFileByMd5andPath"}'

# MarkMissParam must also be a JSON array
--MarkMissParam '[{"uuid":"ALL","field":"loginSourceIp","operate":"strEqual","fieldValue":"59.82.xx.xx"}]'

# Other operations pass empty JSON object
--OperationParams '{}'

---

CLI Unsupported Operations

The following operations cannot be performed via CLI and require the Alibaba Cloud Console:

---

Batch Processing Notes

• Maximum 20 alerts per batch
• client_problem_check (Problem Investigation) is NOT supported via CLI
• Save the returned TaskId for querying status in the next step