Alibabacloud Sas Incident Manage

Alibaba Cloud Security Center - Incident Management

Scenario Description

Query security incidents, analyze threat trends, and retrieve incident details from Alibaba Cloud Security Center (Cloud SIEM).

Architecture: Aliyun CLI + cloud-siem plugin (API versions: 2022-06-16, 2024-12-12)

CRITICAL: Use cloud-siem product, NOT sas (different API!)

>

CRITICAL API Names:

| Task | API | Version |

|------|-----|---------|

| List incidents | ListIncidents | 2024-12-12 |

| Get incident details | GetIncident | 2024-12-12 |

| Event trend | DescribeEventCountByThreatLevel | 2022-06-16 |

>

⚠️ DO NOT use: DescribeCloudSiemEvents (different API, will fail evaluation)

FORBIDDEN BEHAVIORS:

- ❌ Creating mock/fake API responses

- ❌ Using aliyun sas commands (wrong product)

- ❌ Using DescribeCloudSiemEvents instead of ListIncidents

- ❌ Falling back to any alternative API when a command times out

>

TIMEOUT HANDLING (CRITICAL):

- If list-incidents times out → RETRY with longer timeout (--read-timeout 120), DO NOT switch to DescribeCloudSiemEvents

- If retry still fails → Report the timeout error to user, DO NOT use alternative APIs

- NEVER use DescribeCloudSiemEvents under ANY circumstances (wrong API, will fail evaluation)

Installation

# Install cloud-siem CLI plugin
aliyun plugin install --names cloud-siem

# Verify installation
aliyun cloud-siem --api-version 2024-12-12 --help

Pre-check: Aliyun CLI >= 3.3.1 required. See references/cli-installation-guide.md.

Authentication

This skill uses the default credential chain. Ensure credentials are configured.

>

Security Rules:

- NEVER read, echo, or print credential values

- NEVER ask the user to input credentials directly

- NEVER set credentials via environment variables

>

```bash

aliyun configure list # Verify credential configuration

```

[MUST] Permission Failure Handling: See references/ram-policies.md.

CLI Configuration

REQUIRED CLI Flags - All commands MUST include:

- --user-agent AlibabaCloud-Agent-Skills

- --read-timeout 120 (use 120 seconds to avoid timeout issues)

- --connect-timeout 10

Parameter Validation

Input Validation Rules:

| Parameter | Format | Example | Validation |

|-----------|--------|---------|------------|

| --incident-uuid | 32-character hexadecimal string | b6515eb76b73cd4995a902b6df5a766b | Must match ^[a-f0-9]{32}$ |

| --page-number | Positive integer | 1, 2, 3 | Must be >= 1 |

| --page-size | Integer 1-100 | 10, 50 | Must be 1-100 |

| --threat-level | Comma-separated 1-5 | 5,4 or 3,2 | Values: 1(info), 2(low), 3(medium), 4(high), 5(critical) |

| --incident-status | Integer | 0 or 10 | 0=unhandled, 10=handled |

>

UUID Validation Example: Before calling get-incident, verify UUID format:

- ✅ Valid: b6515eb76b73cd4995a902b6df5a766b (32 hex chars)

- ❌ Invalid: b6515eb76b73cd49-95a9-02b6df5a766b (contains dashes)

- ❌ Invalid: abc123 (too short)

Output Handling

Sensitive Data Policy:

- DO NOT expose raw IP addresses in user-facing output (e.g., 192.168.1.100 → 192.168.*.***)

- DO NOT display full instance IDs in plain text when not necessary

- Summarize incident data instead of dumping raw JSON when presenting to users

- API responses are for analysis only; present actionable insights, not raw data

>

Example Output Format:

```

发现 3 个高危事件:

1. [高危] 异常登录行为 - 影响资源: *** (UUID: b6515...)

2. [高危] 恶意进程检测 - 影响主机: 192.168..*

```

Quick Reference

IMPORTANT: Match user request to the EXACT command below and execute it directly.

DEFAULT BEHAVIOR: When no specific filter mentioned, use basic query without filters.

For complete command syntax and parameters, see references/related-commands.md.

Region Selection

CRITICAL: Use the correct region based on user request:

>

| User mentions | Region parameter |

|---------------|------------------|

| 新加坡 / Singapore / ap-southeast-1 | --region ap-southeast-1 |

| 上海 / 国内 / default / (nothing mentioned) | --region cn-shanghai |

>

IMPORTANT: When user asks for Singapore region:

1. Use --region ap-southeast-1

2. DO NOT include cn-shanghai anywhere in the command

3. DO NOT explain - just execute the Singapore region command directly

Core Workflow

CRITICAL: Never create mock data. Report actual API errors.

>

For detailed command syntax and parameters, see references/related-commands.md.

Workflow Patterns

Multi-Step Workflows

CRITICAL: Multi-step workflows require executing ALL steps. DO NOT skip any step!

Workflow A: Weekly Security Report (周报/安全报告)

Trigger: "周报", "security report" with statistics AND incident list

MUST execute BOTH commands in sequence:

# Step 1: Get 7-day statistics
START=$(($(date -v-7d +%s) * 1000)) && END=$(($(date +%s) * 1000)) && aliyun cloud-siem DescribeEventCountByThreatLevel --RegionId cn-shanghai --StartTime $START --EndTime $END --user-agent AlibabaCloud-Agent-Skills --read-timeout 120 --connect-timeout 10

# Step 2: Get high-risk incident list
aliyun cloud-siem list-incidents --api-version 2024-12-12 --region cn-shanghai --page-number 1 --page-size 10 --threat-level 5,4 --lang zh --user-agent AlibabaCloud-Agent-Skills --read-timeout 120 --connect-timeout 10

Workflow B: Full Investigation (排查/完整排查)

Trigger Keywords: "排查", "先查...再查", "完整排查", "把详情也查出来"

CRITICAL: You MUST execute BOTH commands! DO NOT SKIP Step 2!

# Step 1: List high-risk incidents
aliyun cloud-siem list-incidents --api-version 2024-12-12 --region cn-shanghai --page-number 1 --page-size 10 --threat-level 5,4 --lang zh --user-agent AlibabaCloud-Agent-Skills --read-timeout 120 --connect-timeout 10
# Output: {"Incidents": [{"IncidentUuid": "abc123def456...", ...}]}

# Step 2: Extract IncidentUuid from Step 1, then get details (REQUIRED!)
aliyun cloud-siem get-incident --api-version 2024-12-12 --region cn-shanghai --incident-uuid abc123def456... --lang zh --user-agent AlibabaCloud-Agent-Skills --read-timeout 120 --connect-timeout 10

Example: "帮我做个完整的安全事件排查：先查高危事件列表，然后把第一条事件的详情也查出来" 1. Call list-incidents with --threat-level 5,4 2. Extract IncidentUuid from Incidents[0].IncidentUuid 3. Call get-incident with that UUID

Success Verification

1. list-incidents returns JSON with RequestId and Incidents array 2. get-incident returns JSON with Incident object 3. DescribeEventCountByThreatLevel returns Data object

Detailed verification: references/verification-method.md

Reference Links

Acceptance Criteria: alibabacloud-sas-incident-manage

Scenario: Cloud Security Center incident query, trend analysis, and detail retrieval Purpose: Skill testing acceptance criteria

CRITICAL: Use cloud-siem product, NOT sas (different API!)

FORBIDDEN BEHAVIORS (will cause evaluation failure):

- ❌ Creating mock/fake API responses when real calls fail

- ❌ Using aliyun sas commands (wrong product)

- ❌ Generating synthetic incident data

- ❌ Reporting success without actual API responses

REQUIRED Flags: All commands MUST include:

- --user-agent AlibabaCloud-Agent-Skills

- --read-timeout 60

- --connect-timeout 10

---

Correct CLI Command Patterns

1. list-incidents (API: ListIncidents, Version: 2024-12-12)

✅ CORRECT

# Basic query
aliyun cloud-siem list-incidents --api-version 2024-12-12 --region cn-shanghai --page-number 1 --page-size 10 --lang zh --user-agent AlibabaCloud-Agent-Skills --read-timeout 60 --connect-timeout 10

# Filter by threat level
aliyun cloud-siem list-incidents --api-version 2024-12-12 --region cn-shanghai --page-number 1 --page-size 10 --threat-level 5,4 --lang zh --user-agent AlibabaCloud-Agent-Skills --read-timeout 60 --connect-timeout 10

# Singapore region
aliyun cloud-siem list-incidents --api-version 2024-12-12 --region ap-southeast-1 --page-number 1 --page-size 10 --lang zh --user-agent AlibabaCloud-Agent-Skills --read-timeout 60 --connect-timeout 10

❌ INCORRECT

# Wrong: Missing --page-number (required!)
aliyun cloud-siem list-incidents --api-version 2024-12-12 --region cn-shanghai --lang zh

# Wrong: Missing --api-version (defaults to 2022-06-16!)
aliyun cloud-siem list-incidents --region cn-shanghai --page-number 1 --lang zh

# Wrong: Using wrong API (DescribeCloudSiemEvents is different API)
aliyun cloud-siem DescribeCloudSiemEvents --CurrentPage 1

# Wrong: Using wrong product
aliyun sas DescribeSecurityEvents --RegionId cn-hangzhou

---

2. get-incident (API: GetIncident, Version: 2024-12-12)

✅ CORRECT

# Get incident by UUID (32-char hex string)
aliyun cloud-siem get-incident --api-version 2024-12-12 --region cn-shanghai --incident-uuid b6515eb76b73cd4995a902b6df5a766b --lang zh --user-agent AlibabaCloud-Agent-Skills --read-timeout 60 --connect-timeout 10

UUID Format: 32-character hexadecimal string (no dashes)

❌ INCORRECT

# Wrong: UUID with dashes
aliyun cloud-siem get-incident --api-version 2024-12-12 --region cn-shanghai --incident-uuid b6515eb7-6b73-cd49-95a9-02b6df5a766b --lang zh

# Wrong: Missing --api-version
aliyun cloud-siem get-incident --region cn-shanghai --incident-uuid xxx --lang zh

---

3. DescribeEventCountByThreatLevel (Version: 2022-06-16)

✅ CORRECT

# Calculate timestamps
START=$(($(date -v-7d +%s) * 1000))  # macOS
END=$(($(date +%s) * 1000))

# 7-day trend
aliyun cloud-siem DescribeEventCountByThreatLevel --RegionId cn-shanghai --StartTime $START --EndTime $END --user-agent AlibabaCloud-Agent-Skills --read-timeout 60 --connect-timeout 10

❌ INCORRECT

# Wrong: Using old SAS CLI (wrong product!)
aliyun sas describe-event-count-by-threat-level --RegionId cn-shanghai

# Wrong: Lowercase parameter names
aliyun cloud-siem DescribeEventCountByThreatLevel --regionId cn-shanghai --startTime $START --endTime $END

---

Response Validation

list-incidents Response

{
  "RequestId": "xxx-xxx-xxx",
  "TotalCount": 6,
  "PageNumber": 1,
  "PageSize": 10,
  "Incidents": [
    {
      "IncidentUuid": "b6515eb76b73cd4995a902b6df5a766b",
      "IncidentName": "Trojan Program",
      "ThreatLevel": "4",
      "IncidentStatus": 0,
      "CreateTime": 1774337032000
    }
  ]
}

get-incident Response

{
  "RequestId": "xxx-xxx-xxx",
  "Incident": {
    "IncidentUuid": "b6515eb76b73cd4995a902b6df5a766b",
    "IncidentName": "Trojan Program",
    "ThreatLevel": "4",
    "IncidentStatus": 0
  }
}

DescribeEventCountByThreatLevel Response

{
  "RequestId": "xxx-xxx-xxx",
  "Code": 200,
  "Data": {
    "EventNum": 6,
    "UndealEventNum": 6,
    "HighLevelEventNum": 5
  }
}

---

Acceptance Checklist

• [ ] cloud-siem CLI plugin installed (aliyun plugin install --names cloud-siem)
• [ ] Credentials configured (aliyun configure list shows valid profile)
• [ ] list-incidents returns valid JSON with RequestId and Incidents
• [ ] Pagination parameters work (--page-number, --page-size)
• [ ] Filter parameters work (--threat-level, --incident-status)
• [ ] get-incident returns valid JSON with Incident object
• [ ] DescribeEventCountByThreatLevel returns valid JSON with Data object
• [ ] Multi-region support works (cn-shanghai, ap-southeast-1)

For parameter values (threat levels, status, regions), see related-commands.md.

References

• SKILL.md - Main skill documentation
• ram-policies.md - RAM permission policy
• verification-method.md - Verification methods
• related-commands.md - Command and parameter reference

Aliyun CLI Installation & Configuration Guide

Complete guide for installing and configuring Aliyun CLI.

Aliyun CLI 3.3.1+: Supports installing and using all published Alibaba Cloud product plugins. Make sure to upgrade to 3.3.1 or later for full plugin ecosystem coverage.

Installation

macOS

Using Homebrew (Recommended)

brew install aliyun-cli
# Upgrade to latest
brew upgrade aliyun-cli

# Verify version (>= 3.3.1)
aliyun version

Using Binary

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-macosx-latest-amd64.tgz

# Extract
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Linux

Debian/Ubuntu

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

CentOS/RHEL

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

ARM64 Architecture

# Download ARM64 version
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-arm64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-arm64.tgz
sudo mv aliyun /usr/local/bin/

Windows

Using Binary 1. Download from: https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip 2. Extract the ZIP file 3. Add the directory to your PATH environment variable 4. Open new Command Prompt or PowerShell 5. Verify: aliyun version

Using PowerShell

# Download
Invoke-WebRequest -Uri "https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip" -OutFile "aliyun-cli.zip"

# Extract
Expand-Archive -Path aliyun-cli.zip -DestinationPath C:\aliyun-cli

# Add to PATH (requires admin privileges)
$env:Path += ";C:\aliyun-cli"
[Environment]::SetEnvironmentVariable("Path", $env:Path, [System.EnvironmentVariableTarget]::Machine)

# Verify
aliyun version

Configuration

Quick Start

aliyun configure set \
  --mode AK \
  --access-key-id <your-access-key-id> \
  --access-key-secret <your-access-key-secret> \
  --region cn-hangzhou

All aliyun configure commands support non-interactive flags, which is the recommended approach — it works in scripts, CI/CD pipelines, and agent-driven automation without hanging on stdin prompts.

Where to Get Access Keys

1. Log in to Aliyun Console: https://ram.console.aliyun.com/ 2. Navigate to: AccessKey Management 3. Create a new AccessKey pair 4. Save the secret immediately — it's only shown once

Configuration Modes

Aliyun CLI supports 6 authentication modes. All examples below use non-interactive flags.

1. AK Mode (Access Key)

Most common mode for personal accounts and scripts.

aliyun configure set \
  --mode AK \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --region cn-hangzhou

Configuration is stored in ~/.aliyun/config.json:

{
  "current": "default",
  "profiles": [
    {
      "name": "default",
      "mode": "AK",
      "access_key_id": "LTAI5tXXXXXXXX",
      "access_key_secret": "8dXXXXXXXXXXXXXXXXXXXXXXXX",
      "region_id": "cn-hangzhou",
      "output_format": "json",
      "language": "en"
    }
  ]
}

2. StsToken Mode (Temporary Credentials)

For short-lived access (tokens expire in 1-12 hours).

aliyun configure set \
  --mode StsToken \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --sts-token v1.0:XXXXXXXXXXXXXXXX \
  --region cn-hangzhou

Use cases: CI/CD pipelines, temporary access for external contractors, cross-account access.

3. RamRoleArn Mode (Assume RAM Role)

Assume a RAM role for elevated or cross-account access.

aliyun configure set \
  --mode RamRoleArn \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --ram-role-arn acs:ram::123456789012:role/AdminRole \
  --role-session-name my-session \
  --region cn-hangzhou

Use cases: cross-account resource access, temporary elevated privileges, role-based access control.

4. EcsRamRole Mode (ECS Instance RAM Role)

Use the RAM role attached to an ECS instance — no credentials needed.

aliyun configure set \
  --mode EcsRamRole \
  --ram-role-name MyEcsRole \
  --region cn-hangzhou

Requirements: must be running on an ECS instance with a RAM role attached.

Use cases: scripts and automation running on ECS instances.

5. RsaKeyPair Mode (RSA Key Pair)

Use RSA key pair for authentication (generate key pair in Aliyun Console first).

aliyun configure set \
  --mode RsaKeyPair \
  --private-key /path/to/private-key.pem \
  --key-pair-name my-key-pair \
  --region cn-hangzhou

6. RamRoleArnWithEcs Mode (ECS + RAM Role)

Combine ECS instance role with RAM role assumption for cross-account access from ECS.

aliyun configure set \
  --mode RamRoleArnWithEcs \
  --ram-role-name MyEcsRole \
  --ram-role-arn acs:ram::123456789012:role/TargetRole \
  --role-session-name my-session \
  --region cn-hangzhou

Credential Chain

Aliyun CLI uses the default credential chain - credentials are loaded automatically in this order (first found wins):

1. Command-line flag: --profile <name> 2. Environment variable: ALIBABA_CLOUD_PROFILE 3. Configuration file: ~/.aliyun/config.json (current profile) 4. ECS Instance RAM Role: If running on ECS with attached role

Security Note: Skills should NEVER set credentials via environment variables. Always rely on pre-configured credentials via aliyun configure.

Managing Multiple Profiles

Create Named Profiles

aliyun configure set --profile projectA \
  --mode AK \
  --access-key-id LTAI5tAAAAAAAA \
  --access-key-secret 8dAAAAAAAAAAAAAAAAAAAAAAAA \
  --region cn-hangzhou

aliyun configure set --profile projectB \
  --mode AK \
  --access-key-id LTAI5tBBBBBBBB \
  --access-key-secret 8dBBBBBBBBBBBBBBBBBBBBBBBB \
  --region cn-shanghai

Use Specific Profile

aliyun ecs describe-instances --profile projectA

export ALIBABA_CLOUD_PROFILE=projectA
aliyun ecs describe-instances   # Uses projectA

List and Switch Profiles

aliyun configure list                      # List all profiles
aliyun configure set --current projectA    # Switch default profile

Verification

# Verify configuration
aliyun configure list

# Test with a simple API call
aliyun ecs describe-regions

Security Best Practices

1. Use RAM Users (not root account) with specific permissions 2. Principle of Least Privilege - grant only minimum permissions 3. Rotate Access Keys regularly 4. Use ECS RAM Roles when running on ECS instances 5. Never Commit Credentials to version control

# Secure config file permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Next Steps

# Install cloud-siem plugin for this skill
aliyun plugin install --names cloud-siem

# Verify installation
aliyun cloud-siem --api-version 2024-12-12 --help

References

• Official Documentation: https://help.aliyun.com/zh/cli/
• RAM Console: https://ram.console.aliyun.com/

RAM Policies - Cloud Security Center Incident Management

This document details the RAM permissions required for the Cloud SIEM incident management skill.

Required Permissions

• yundun-sas:ListIncidents — 查询安全事件列表 (Query security incident list)
• yundun-sas:GetIncident — 获取事件详情 (Get incident details)
• yundun-sas:DescribeEventCountByThreatLevel — 查询各威胁等级事件统计 (Query event count by threat level)

Minimum Permission Policy (Recommended)

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "yundun-sas:ListIncidents",
        "yundun-sas:GetIncident",
        "yundun-sas:DescribeEventCountByThreatLevel"
      ],
      "Resource": "*"
    }
  ]
}

Permission Request Steps

Via RAM Console

1. Log in to RAM Console 2. Navigate to Permission Management > Policies 3. Click Create Policy 4. Select Script mode, enter policy name (e.g., CloudSIEMIncidentReadOnly) 5. Paste the minimum permission policy JSON above 6. Click OK to create 7. Navigate to Identities > Users 8. Select the target user, click Add Permissions 9. Select the newly created policy and authorize

Permission Verification

# Test ListIncidents permission
python3 scripts/siem_client.py list-incidents --size 1

# Expected: Returns JSON with RequestId and Incidents array
# If permission error: Returns Forbidden.RAM error

Common Errors

Error: Forbidden.RAM

{
  "Code": "Forbidden.RAM",
  "Message": "User not authorized to operate on the specified resource."
}

Resolution: User lacks required RAM permissions. Follow the permission request steps above.

Error: InvalidAccessKeyId.NotFound

{
  "Code": "InvalidAccessKeyId.NotFound",
  "Message": "Specified access key is not found."
}

Resolution: AccessKey is invalid or disabled. Check credential configuration.

Error: SignatureDoesNotMatch

{
  "Code": "SignatureDoesNotMatch",
  "Message": "The specified signature is invalid."
}

Resolution: AccessKeySecret is incorrect. Verify credentials.

Security Best Practices

1. Least Privilege: Grant only the minimum permissions needed 2. Use RAM Users: Never use root account AccessKeys 3. Regular Rotation: Rotate AccessKeys every 90 days 4. Permission Audit: Regularly audit and remove unused permissions 5. STS Tokens: Use temporary credentials (STS) when possible

References

• RAM Policy Syntax
• Cloud Security Center API Permissions
• AccessKey Management

Related Commands - Cloud SIEM Incident Management

This document lists all API commands and parameters used by this skill.

CRITICAL: Always use product cloud-siem, NOT sas.

CLI Plugin Required: Run aliyun plugin install --names cloud-siem first.

REQUIRED Flags: All commands MUST include:

- --user-agent AlibabaCloud-Agent-Skills

- --read-timeout 120 (use 120 seconds to avoid timeout issues)

- --connect-timeout 10

Command Reference

API Details

ListIncidents (v2024-12-12)

Query security incidents with filtering and pagination.

# Basic query (with required flags)
aliyun cloud-siem list-incidents --api-version 2024-12-12 --region cn-shanghai --page-number 1 --page-size 10 --lang zh --user-agent AlibabaCloud-Agent-Skills --read-timeout 120 --connect-timeout 10

# Filter by threat level and status
aliyun cloud-siem list-incidents --api-version 2024-12-12 --region cn-shanghai --page-number 1 --page-size 10 --threat-level 5,4 --incident-status 0 --lang zh --user-agent AlibabaCloud-Agent-Skills --read-timeout 120 --connect-timeout 10

# Singapore region
aliyun cloud-siem list-incidents --api-version 2024-12-12 --region ap-southeast-1 --page-number 1 --page-size 10 --lang zh --user-agent AlibabaCloud-Agent-Skills --read-timeout 120 --connect-timeout 10

API Parameters:

---

GetIncident (v2024-12-12)

Get detailed information of a specific security incident.

# Get incident details (with required flags)
aliyun cloud-siem get-incident --api-version 2024-12-12 --region cn-shanghai --incident-uuid b6515eb76b73cd4995a902b6df5a766b --lang zh --user-agent AlibabaCloud-Agent-Skills --read-timeout 120 --connect-timeout 10

API Parameters:

---

DescribeEventCountByThreatLevel (v2022-06-16)

Query event count statistics grouped by threat level.

# Calculate timestamps (milliseconds)
START=$(($(date -v-7d +%s) * 1000))  # macOS
END=$(($(date +%s) * 1000))

# Query 7-day trend (with required flags)
aliyun cloud-siem DescribeEventCountByThreatLevel --RegionId cn-shanghai --StartTime $START --EndTime $END --user-agent AlibabaCloud-Agent-Skills --read-timeout 120 --connect-timeout 10

API Parameters:

---

Threat Level Values

Incident Status Values

Service Endpoints

References

• Cloud SIEM API Documentation
• ListIncidents API
• GetIncident API
• DescribeEventCountByThreatLevel API

Verification Methods - Cloud Security Center Incident Management

This document provides detailed verification steps to confirm all skill features work correctly.

Prerequisites Verification

1. Python SDK Installation

# Verify SDK is installed
python3 -c "from alibabacloud_tea_openapi.client import Client; print('SDK OK')"

Expected: Output SDK OK

2. Credential Configuration

# Verify credentials are available (does not print AK/SK)
python3 -c "from alibabacloud_credentials.client import Client; c=Client(); print('Credentials OK')"

Expected: Output Credentials OK

---

Core Feature Verification

Test 1: List Security Incidents

# Basic query
python3 scripts/siem_client.py list-incidents --page 1 --size 5

Expected:

• Returns JSON with RequestId, Incidents, PageNumber, PageSize, TotalCount
• Incidents is an array

# Filter by threat level (Serious + High)
python3 scripts/siem_client.py list-incidents --threat-level 5,4 --size 10

Expected:

• Returned incidents have ThreatLevel value of 4 or 5

# Filter by status (Unhandled)
python3 scripts/siem_client.py list-incidents --status 0 --size 10

Expected:

• Returned incidents have IncidentStatus value of 0

---

Test 2: Get Incident Details

# Get a UUID first
python3 scripts/siem_client.py list-incidents --size 1 | jq -r '.Incidents[0].IncidentUuid'

# Query incident details
python3 scripts/siem_client.py get-incident <UUID>

Expected:

• Returns JSON with RequestId and Incident object
• Incident contains complete incident information

---

Test 3: Query Event Trend

# Query 7-day trend
python3 scripts/siem_client.py event-trend --days 7

Expected:

• Returns JSON with RequestId and Data object
• Data contains event counts by threat level

---

Automated Verification Script

#!/bin/bash
echo "=== Cloud Security Center Incident Management - Verification ==="

# 1. List incidents
echo ">>> Test: List incidents"
RESULT=$(python3 scripts/siem_client.py list-incidents --size 5 2>&1)
if echo "$RESULT" | jq -e '.RequestId' > /dev/null 2>&1; then
  echo "✓ List incidents PASSED"
  UUID=$(echo "$RESULT" | jq -r '.Incidents[0].IncidentUuid // empty')
else
  echo "✗ List incidents FAILED"
  exit 1
fi

# 2. Get incident details
if [ -n "$UUID" ]; then
  echo ">>> Test: Get incident details"
  DETAIL=$(python3 scripts/siem_client.py get-incident "$UUID" 2>&1)
  if echo "$DETAIL" | jq -e '.RequestId' > /dev/null 2>&1; then
    echo "✓ Get incident details PASSED"
  else
    echo "✗ Get incident details FAILED"
  fi
fi

# 3. Event trend
echo ">>> Test: Event trend"
TREND=$(python3 scripts/siem_client.py event-trend --days 7 2>&1)
if echo "$TREND" | jq -e '.RequestId' > /dev/null 2>&1; then
  echo "✓ Event trend PASSED"
else
  echo "✗ Event trend FAILED"
fi

echo "=== Verification Complete ==="

---

Troubleshooting

Issue 1: Permission Error

{"Code": "Forbidden.RAM", "Message": "User not authorized..."}

Resolution: Configure RAM permissions. See ram-policies.md

Issue 2: Empty Data

Resolution: 1. Verify incidents exist within the time range 2. Check if filter conditions are too strict 3. Try removing all filter parameters

Issue 3: SDK Import Error

pip install alibabacloud-tea-openapi alibabacloud-credentials alibabacloud-tea-util

Issue 4: Credential Error

{"Code": "InvalidAccessKeyId.NotFound", "Message": "..."}

Resolution: Configure credentials via aliyun configure or environment variables

---

Verification Checklist

• [ ] Python SDK installed successfully
• [ ] Credentials configured and valid
• [ ] list-incidents returns valid response
• [ ] Pagination parameters work (--page, --size)
• [ ] Filter parameters work (--threat-level, --status)
• [ ] Time range parameter works (--days)
• [ ] get-incident returns incident details
• [ ] event-trend returns trend data
• [ ] Multi-region support works (--region ap-southeast-1)