by 运行时依赖
安装命令
点击复制技能文档
Alibaba Cloud Security Center - Incident Management Scenario Description
查询 security incidents, analyze threat trends, and retrieve incident detAIls from Alibaba Cloud Security Center (Cloud SIEM).
Architecture: Aliyun 命令行工具 + cloud-siem 插件 (API versions: 2022-06-16, 2024-12-12)
CRITICAL: Use cloud-siem product, NOT sas (different API!)
CRITICAL API Names:
Task API Version 列出 incidents 列出Incidents 2024-12-12 获取 incident detAIls 获取Incident 2024-12-12 Event trend DescribeEventCountByThreatLevel 2022-06-16
⚠️ DO NOT use: DescribeCloudSiem事件 (different API, will fAIl evaluation)
FORBIDDEN BEHAVIORS:
❌ Creating mock/fake API 响应s ❌ Using aliyun sas commands (wrong product) ❌ Using DescribeCloudSiem事件 instead of 列出Incidents ❌ Falling back to any alternative API when a command times out
TIMEOUT HANDLING (CRITICAL):
If 列出-incidents times out → RETRY with longer timeout (--read-timeout 120), DO NOT switch to DescribeCloudSiem事件 If retry still fAIls → 报告 the timeout error to user, DO NOT use alternative APIs NEVER use DescribeCloudSiem事件 under ANY circumstances (wrong API, will fAIl evaluation) 安装ation # 安装 cloud-siem 命令行工具 插件 aliyun 插件 安装 --names cloud-siem
# 验证 安装ation aliyun cloud-siem --API-version 2024-12-12 --help
Pre-检查: Aliyun 命令行工具 >= 3.3.1 required. See references/命令行工具-安装ation-图形界面de.md.
Authentication
This 技能 uses the default 凭证 chAIn. Ensure 凭证s are 配置d.
Security Rules:
NEVER read, echo, or print 凭证 values NEVER ask the user to 输入 凭证s directly NEVER 设置 凭证s via 环境 variables aliyun 配置 列出 # 验证 凭证 configuration
[MUST] 权限 失败 Handling: See references/ram-policies.md.
命令行工具 Configuration
REQUIRED 命令行工具 Flags - All commands MUST include:
--user-代理 AlibabaCloud-代理-技能s --read-timeout 120 (use 120 seconds to avoid timeout issues) --connect-timeout 10 Parameter 验证
输入 验证 Rules:
Parameter 格式化 Example 验证 --incident-uuid 32-character hexadecimal string b6515eb76b73cd4995a902b6df5a766b Must match ^[a-f0-9]{32}$ --page-number Positive integer 1, 2, 3 Must be >= 1 --page-size Integer 1-100 10, 50 Must be 1-100 --threat-level Comma-separated 1-5 5,4 or 3,2 Values: 1(信息), 2(low), 3(medium), 4(high), 5(critical) --incident-状态 Integer 0 or 10 0=unhandled, 10=handled
UUID 验证 Example: Before calling 获取-incident, 验证 UUID 格式化:
✅ Valid: b6515eb76b73cd4995a902b6df5a766b (32 hex chars) ❌ Invalid: b6515eb76b73cd49-95a9-02b6df5a766b (contAIns dashes) ❌ Invalid: abc123 (too short) 输出 Handling
Sensitive Data Policy:
DO NOT expose raw IP 添加resses in user-facing 输出 (e.g., 192.168.1.100 → 192.168..) DO NOT display full instance IDs in plAIn text when not necessary Summarize incident data instead of dumping raw JSON when presenting to users API 响应s are for analysis only; present actionable insights, not raw data
Example 输出 格式化:
发现 3 个高危事件:
- [高危] 异常登录行为 - 影响资源: (UUID: b6515...)
- [高危] 恶意进程检测 - 影响主机: 192.168..**
Quick Reference
导入ANT: Match user 请求 to the EXACT command below and 执行 it directly.
User 请求 Keywords Action EXACT Command to 执行 "查事件" / "安全事件列表" / "basic 查询" Basic 列出 aliyun cloud-siem 列出-incidents --API-version 2024-12-12 --region cn-shanghAI --page-number 1 --page-size 10 --lang zh --user-代理 AlibabaCloud-代理-技能s --read-timeout 120 --connect-timeout 10 "未处理" / "还没处理" / "所有事件" / "unhandled" / "全部列出来" All unhandled aliyun cloud-siem 列出-incidents --API-version 2024-12-12 --region cn-shanghAI --page-number 1 --page-size 10 --incident-状态 0 --lang zh --user-代理 AlibabaCloud-代理-技能s --read-timeout 120 --connect-timeout 10 "高危" / "ThreatLevel>=4" / "high-risk" High-risk aliyun cloud-siem 列出-incidents --API-version 2024-12-12 --region cn-shanghAI --page-number 1 --page-size 10 --threat-level 5,4 --lang zh --user-代理 AlibabaCloud-代理-技能s --read-timeout 120 --connect-timeout 10 "中低风险" / "ThreatLevel 3,2" / "中危" / "低危" Medium/low aliyun cloud-siem 列出-incidents --API-version 2024-12-12 --region cn-shanghAI --page-number 1 --page-size 10 --threat-level 3,2 --lang zh --user-代理 AlibabaCloud-代理-技能s --read-timeout 120 --connect-timeout 10 "已处理" / "处理过" / "handled" / "Incident状态=10" / "状态是已处理" Handled aliyun cloud-siem 列出-incidents --API-version 2024-12-12 --region cn-shanghAI --page-number 1 --page-size 10 --incident-状态 10 --lang zh --user-代理 AlibabaCloud-代理-技能s --read-timeout 120 --connect-timeout 10 "第二页" / "第2页" / "翻到第2页" / "翻页" / "page 2" / "--page-number 2" Pagination aliyun cloud-siem 列出-incidents --API-version 2024-12-12 --region cn-shanghAI --page-number 2 --page-size 10 --lang zh --user-代理 AlibabaCloud-代理-技能s --read-timeout 120 --connect-timeout 10 "新加坡" / "Singapore" / "ap-southeast-1" Singapore aliyun cloud-siem 列出-incidents --API-version 2024-12-12