Alibabacloud Sas Incident Manage

Alibaba Cloud Security Center incident management skill. Query security incidents, threat trends, and incident details. Triggers: "云安全中心", "安全事件", "事件查询", "安全态势", "威胁事件", "cloud-siem", "Agentic-soc".

alibabacloud-skills-team@sdk-team

Install

openclaw skills install @sdk-team/alibabacloud-sas-incident-manage

Alibaba Cloud Security Center - Incident Management

Scenario Description

Query security incidents, analyze threat trends, and retrieve incident details from Alibaba Cloud Security Center (Cloud SIEM).

Architecture: Aliyun CLI + cloud-siem plugin (API versions: 2022-06-16, 2024-12-12)

CRITICAL: Use cloud-siem product, NOT sas (different API!)

CRITICAL API Names:

Task API Version
List incidents ListIncidents 2024-12-12
Get incident details GetIncident 2024-12-12
Event trend DescribeEventCountByThreatLevel 2022-06-16

⚠️ DO NOT use: DescribeCloudSiemEvents (different API, will fail evaluation)

Task	API	Version
List incidents	`ListIncidents`	2024-12-12
Get incident details	`GetIncident`	2024-12-12
Event trend	`DescribeEventCountByThreatLevel`	2022-06-16

FORBIDDEN BEHAVIORS:

❌ Creating mock/fake API responses

❌ Using aliyun sas commands (wrong product)

❌ Using DescribeCloudSiemEvents instead of ListIncidents

❌ Falling back to any alternative API when a command times out

TIMEOUT HANDLING (CRITICAL):

If list-incidents times out → RETRY with longer timeout (--read-timeout 120), DO NOT switch to DescribeCloudSiemEvents

If retry still fails → Report the timeout error to user, DO NOT use alternative APIs

NEVER use DescribeCloudSiemEvents under ANY circumstances (wrong API, will fail evaluation)

Installation

bash

# Install cloud-siem CLI plugin
aliyun plugin install --names cloud-siem

# Verify installation
aliyun cloud-siem --api-version 2024-12-12 --help

Pre-check: Aliyun CLI >= 3.3.1 required. See references/cli-installation-guide.md.

Pre-Check (read before running ANY command)

--region — Defaults to cn-shanghai; always include it.

cloud-siem has no global endpoint; every command MUST carry --region (plugin mode; --region sets the endpoint for all commands including describe-event-count-by-threat-level).

Supported regions: cn-shanghai (default), ap-southeast-1 (Singapore). Use ap-southeast-1 only when Singapore is explicitly requested.

--lang — Defaults to zh; include it for list-incidents / get-incident.

Override with --lang en only when English output is explicitly requested.

describe-event-count-by-threat-level has no --lang parameter; do not add it.

--api-version — Per-API; must match the table below.

Omitting it falls back to 2022-06-16, which breaks list-incidents / get-incident.

API Command --api-version
List incidents list-incidents 2024-12-12
Get incident details get-incident 2024-12-12
Event trend describe-event-count-by-threat-level 2022-06-16 (default)

API	Command	`--api-version`
List incidents	`list-incidents`	`2024-12-12`
Get incident details	`get-incident`	`2024-12-12`
Event trend	`describe-event-count-by-threat-level`	`2022-06-16` (default)

Reference command (all required flags applied):
bash
aliyun cloud-siem list-incidents --api-version 2024-12-12 --region cn-shanghai --page-number 1 --page-size 10 --lang zh --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-incident-manage/{session-id} --read-timeout 120 --connect-timeout 10
Full parameters: references/related-commands.md. Usage patterns: references/acceptance-criteria.md.

Authentication

This skill uses the default credential chain. Ensure credentials are configured.

Security Rules:

NEVER read, echo, or print credential values

NEVER ask the user to input credentials directly

NEVER set credentials via environment variables
bash
aliyun configure list  # Verify credential configuration

[MUST] Permission Failure Handling: See references/ram-policies.md.

CLI Configuration

REQUIRED CLI Flags - All commands MUST include:

--user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-incident-manage/{session-id} (see Observability)

--read-timeout 120 (use 120 seconds to avoid timeout issues)

--connect-timeout 10

Observability

Every command MUST carry a User-Agent that identifies the skill and the session, for tracing and auditing.

UA template: --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-incident-manage/{session-id}

AlibabaCloud-Agent-Skills — fixed prefix.

alibabacloud-sas-incident-manage — this skill's name (fixed).

{session-id} — a 32-character lowercase hex string (matching ^[a-f0-9]{32}$).

session-id rule:

Generate ONE session-id at the start of a session (e.g. openssl rand -hex 16) and reuse the SAME value for every command in that session.

DO NOT regenerate per command. DO NOT log or expose it to the user.

In the command examples below, substitute the generated value for the literal {session-id} placeholder.

Parameter Validation

Input Validation Rules:

Parameter Format Example Validation
--incident-uuid 32-character hexadecimal string b6515eb76b73cd4995a902b6df5a766b Must match ^[a-f0-9]{32}$
--page-number Positive integer 1, 2, 3 Must be >= 1
--page-size Integer 1-100 10, 50 Must be 1-100
--threat-level Comma-separated 1-5 5,4 or 3,2 Values: 1(info), 2(low), 3(medium), 4(high), 5(critical)
--incident-status Integer 0 or 10 0=unhandled, 10=handled

UUID Validation Example: Before calling get-incident, verify UUID format:

✅ Valid: b6515eb76b73cd4995a902b6df5a766b (32 hex chars)

❌ Invalid: b6515eb76b73cd49-95a9-02b6df5a766b (contains dashes)

❌ Invalid: abc123 (too short)

Parameter	Format	Example	Validation
`--incident-uuid`	32-character hexadecimal string	`b6515eb76b73cd4995a902b6df5a766b`	Must match `^[a-f0-9]{32}$`
`--page-number`	Positive integer	`1`, `2`, `3`	Must be >= 1
`--page-size`	Integer 1-100	`10`, `50`	Must be 1-100
`--threat-level`	Comma-separated 1-5	`5,4` or `3,2`	Values: 1(info), 2(low), 3(medium), 4(high), 5(critical)
`--incident-status`	Integer	`0` or `10`	0=unhandled, 10=handled

Output Handling

Sensitive Data Policy:

DO NOT expose raw IP addresses in user-facing output (e.g., 192.168.1.100 → 192.168.*.***)

DO NOT display full instance IDs in plain text when not necessary

Summarize incident data instead of dumping raw JSON when presenting to users

API responses are for analysis only; present actionable insights, not raw data

Example Output Format:
text
Found 3 high-risk incidents:
1. [High] Abnormal login behavior - Affected resource: *** (UUID: b6515...)
2. [High] Malicious process detected - Affected host: 192.168.*.**

Quick Reference

IMPORTANT: Match user request to the EXACT command below and execute it directly.

User Request Keywords	Action	EXACT Command to Execute
"查事件" / "安全事件列表" / "basic query"	Basic list	`aliyun cloud-siem list-incidents --api-version 2024-12-12 --region cn-shanghai --page-number 1 --page-size 10 --lang zh --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-incident-manage/{session-id} --read-timeout 120 --connect-timeout 10`
"未处理" / "还没处理" / "所有事件" / "unhandled" / "全部列出来"	All unhandled	`aliyun cloud-siem list-incidents --api-version 2024-12-12 --region cn-shanghai --page-number 1 --page-size 10 --incident-status 0 --lang zh --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-incident-manage/{session-id} --read-timeout 120 --connect-timeout 10`
"高危" / "ThreatLevel>=4" / "high-risk"	High-risk	`aliyun cloud-siem list-incidents --api-version 2024-12-12 --region cn-shanghai --page-number 1 --page-size 10 --threat-level 5,4 --lang zh --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-incident-manage/{session-id} --read-timeout 120 --connect-timeout 10`
"中低风险" / "ThreatLevel 3,2" / "中危" / "低危"	Medium/low	`aliyun cloud-siem list-incidents --api-version 2024-12-12 --region cn-shanghai --page-number 1 --page-size 10 --threat-level 3,2 --lang zh --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-incident-manage/{session-id} --read-timeout 120 --connect-timeout 10`
"已处理" / "处理过" / "handled" / "IncidentStatus=10" / "状态是已处理"	Handled	`aliyun cloud-siem list-incidents --api-version 2024-12-12 --region cn-shanghai --page-number 1 --page-size 10 --incident-status 10 --lang zh --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-incident-manage/{session-id} --read-timeout 120 --connect-timeout 10`
"第二页" / "第2页" / "翻到第2页" / "翻页" / "page 2" / "--page-number 2"	Pagination	`aliyun cloud-siem list-incidents --api-version 2024-12-12 --region cn-shanghai --page-number 2 --page-size 10 --lang zh --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-incident-manage/{session-id} --read-timeout 120 --connect-timeout 10`
"新加坡" / "Singapore" / "ap-southeast-1"	Singapore	`aliyun cloud-siem list-incidents --api-version 2024-12-12 --region ap-southeast-1 --page-number 1 --page-size 10 --lang zh --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-incident-manage/{session-id} --read-timeout 120 --connect-timeout 10`
"UUID" / "详情" / "b6515eb76b73cd4995a902b6df5a766b"	Get detail	`aliyun cloud-siem get-incident --api-version 2024-12-12 --region cn-shanghai --incident-uuid <UUID> --lang zh --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-incident-manage/{session-id} --read-timeout 120 --connect-timeout 10`
"排查" / "先查列表再详情" / "完整排查" / "list then detail"	Multi-Step	See Workflow B below (must run BOTH steps!)
"7天趋势" / "trend" / "7days"	7-day trend	`START=$(($(date -v-7d +%s) * 1000)) && END=$(($(date +%s) * 1000)) && aliyun cloud-siem describe-event-count-by-threat-level --region cn-shanghai --start-time $START --end-time $END --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-incident-manage/{session-id} --read-timeout 120 --connect-timeout 10`
"30天" / "月度" / "月度安全报告" / "monthly" / "月报"	30-day trend	`START=$(($(date -v-30d +%s) * 1000)) && END=$(($(date +%s) * 1000)) && aliyun cloud-siem describe-event-count-by-threat-level --region cn-shanghai --start-time $START --end-time $END --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-incident-manage/{session-id} --read-timeout 120 --connect-timeout 10`

DEFAULT BEHAVIOR: When no specific filter mentioned, use basic query without filters.

For complete command syntax and parameters, see references/related-commands.md.

Region Selection

CRITICAL: Use the correct region based on user request:

User mentions Region parameter
新加坡 / Singapore / ap-southeast-1 --region ap-southeast-1
上海 / 国内 / default / (nothing mentioned) --region cn-shanghai

IMPORTANT: When user asks for Singapore region:

Use --region ap-southeast-1

DO NOT include cn-shanghai anywhere in the command

DO NOT explain - just execute the Singapore region command directly

User mentions	Region parameter
新加坡 / Singapore / ap-southeast-1	`--region ap-southeast-1`
上海 / 国内 / default / (nothing mentioned)	`--region cn-shanghai`

Core Workflow

CRITICAL: Never create mock data. Report actual API errors.

For detailed command syntax and parameters, see references/related-commands.md.

Workflow Patterns

Pattern	Trigger	API	Reference
Query Incidents	"查事件", "安全事件"	`list-incidents`	See Quick Reference table above
Get Details	"UUID", "详情"	`get-incident`	See Quick Reference table above
Event Trend	"趋势", "统计"	`describe-event-count-by-threat-level`	See related-commands.md

Multi-Step Workflows

CRITICAL: Multi-step workflows require executing ALL steps. DO NOT skip any step!

Workflow A: Weekly Security Report

Trigger: "周报", "security report" with statistics AND incident list

MUST execute BOTH commands in sequence:

bash

# Step 1: Get 7-day statistics
START=$(($(date -v-7d +%s) * 1000)) && END=$(($(date +%s) * 1000)) && aliyun cloud-siem describe-event-count-by-threat-level --region cn-shanghai --start-time $START --end-time $END --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-incident-manage/{session-id} --read-timeout 120 --connect-timeout 10

# Step 2: Get high-risk incident list
aliyun cloud-siem list-incidents --api-version 2024-12-12 --region cn-shanghai --page-number 1 --page-size 10 --threat-level 5,4 --lang zh --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-incident-manage/{session-id} --read-timeout 120 --connect-timeout 10

Workflow B: Full Investigation

Trigger Keywords: "排查", "先查...再查", "完整排查", "把详情也查出来"

CRITICAL: You MUST execute BOTH commands! DO NOT SKIP Step 2!

bash

# Step 1: List high-risk incidents
aliyun cloud-siem list-incidents --api-version 2024-12-12 --region cn-shanghai --page-number 1 --page-size 10 --threat-level 5,4 --lang zh --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-incident-manage/{session-id} --read-timeout 120 --connect-timeout 10
# Output: {"Incidents": [{"IncidentUuid": "abc123def456...", ...}]}

# Step 2: Extract IncidentUuid from Step 1, then get details (REQUIRED!)
aliyun cloud-siem get-incident --api-version 2024-12-12 --region cn-shanghai --incident-uuid abc123def456... --lang zh --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-incident-manage/{session-id} --read-timeout 120 --connect-timeout 10

Example: "帮我做个完整的安全事件排查：先查高危事件列表，然后把第一条事件的详情也查出来"

Call list-incidents with --threat-level 5,4
Extract IncidentUuid from Incidents[0].IncidentUuid
Call get-incident with that UUID

Success Verification

list-incidents returns JSON with RequestId and Incidents array
get-incident returns JSON with Incident object
describe-event-count-by-threat-level returns Data object

Detailed verification: references/verification-method.md

Reference Links

Document	Description
references/ram-policies.md	RAM permission policy
references/related-commands.md	Command syntax and parameters
references/acceptance-criteria.md	Correct usage patterns
references/verification-method.md	Verification methods
references/cli-installation-guide.md	CLI installation guide

Alibabacloud Sas Incident Manage

Install

Alibaba Cloud Security Center - Incident Management

Scenario Description

Installation

Pre-Check (read before running ANY command)

Authentication

CLI Configuration

Observability

Parameter Validation

Output Handling

Quick Reference

Region Selection

Core Workflow

Workflow Patterns

Multi-Step Workflows

Workflow A: Weekly Security Report

Workflow B: Full Investigation

Success Verification

Reference Links

Related skills