DescribeDdosEvents

Description

queries the DDoS event list according to the specified criteria.

Request Method

POST

Request Path

/apsara/route/Ddosprivate/DescribeDdosEvents

Request Parameters Common Parameters

Name	Location	Type	Required	Sample value	Description
PageSize	BODY	integer	No	No sample value for this parameter.	specifies the maximum number of records displayed on the page.
CurrentPage	BODY	integer	No	No sample value for this parameter.	specifies the current page number returned.
regionId	BODY	string	Yes	No sample value for this parameter.	region id
VmIP	BODY	string	No	No sample value for this parameter.	IP attacked.
SelectStatus	BODY	string	No	No sample value for this parameter.	The status of DDoS events, including: cleaning end of cleaning
Distribution	BODY	string	No	No sample value for this parameter.	area ID. For example, DXJF represents the Daxing computer room area.
EndDay	BODY	long	No	No sample value for this parameter.	the end time of the query range.
SearchReason	BODY	string	No	No sample value for this parameter.	The cause of the DDoS event, including bps, pps, qps. supports simultaneous queries for events caused by multiple trigger causes. For example, "bps,pps" indicates queries for DDoS events triggered by exceeding the flow rate or packet speed threshold.
StartDay	BODY	long	No	No sample value for this parameter.	the start time of the query range.
version	BODY	string	No	2016-01-01	version of api
StartRow	BODY	integer	No	No sample value for this parameter.	specifies the sequence number of the first record returned by the current page.

Return data

Name	Type	Sample value	Description
Category	integer	no demo value	security event category number.
PageSize	integer	no demo value	page displays the maximum number of records.
DdosEvents	array	no demo value	DDoS event list information. For specific sub-item descriptions, see the following parameter descriptions.
Bps	long	no demo value	warning flow rate (unit: Mbps).
EndTime	long	no demo value	attack end time.
GmtModified	long	no demo value	event update time.
Reason	string	no demo value	cause of event reporting.
Pps	long	no demo value	early warning packet speed (unit: pps).
Qps	long	no demo value	alert HTTP request rate (unit: QPS).
LocationAdd	string	no demo value	where the event was added. Description Invalid return parameters in the proprietary cloud environment.
Aliuid	long	no demo value	Aliuid, the user to which the asset belongs.
NewConn	integer	no demo value	new connection threshold. Description The return parameter has been deprecated.
Status	integer	no demo value	The status of the IP where the DDoS event occurred: 0: indicates unexpired 1: indicates expired
LocationDel	string	no demo value	the place where the event was canceled. Description Invalid return parameters in the proprietary cloud environment.
RequestId	string	no demo value	request ID.
AttackType	string	no demo value	attack type. description the current version only returns defense values.
Conn	integer	no demo value	threshold for concurrent connections. Description The return parameter has been deprecated.
Code	string	no demo value	The cleaning status of the event, including: cleaning end of cleaning
Successful	integer	no demo value	Whether the attack was successful: 0: indicates unsuccessful 1: indicates success
DistributionDisplay	string	no demo value	the name of the region to which it belongs.
OccurrenceTime	long	no demo value	the time when the event occurred.
TotalCount	integer	no demo value	returns the total number of pages.
GmtCreate	long	no demo value	event creation time.
CurrentPage	integer	no demo value	currently returns page number.
Caller	string	no demo value	the name of the business party that called the interface. description currently returns beaver_dj, that is, the caller is traffic security monitoring (Beaver).
VmIp	string	no demo value	IP attacked.
Distribution	string	no demo value	area code.
CategoryName	string	no demo value	security event category name.
Id	long	no demo value	event ID.
IsFinished	boolean	no demo value	Whether the attack is over: true: indicates ended false: indicates not finished
NeedIgnore	integer	no demo value	Does this event need to be ignored: 0: indicates no 1: indicates that the event is reported repeatedly and needs to be ignored

Example

Successful Response example

{
 "Category":"no demo value",
 "PageSize":"no demo value",
 "DdosEvents":"no demo value",
 "Bps":"no demo value",
 "EndTime":"no demo value",
 "GmtModified":"no demo value",
 "Reason":"no demo value",
 "Pps":"no demo value",
 "Qps":"no demo value",
 "LocationAdd":"no demo value",
 "Aliuid":"no demo value",
 "NewConn":"no demo value",
 "Status":"no demo value",
 "LocationDel":"no demo value",
 "RequestId":"no demo value",
 "AttackType":"no demo value",
 "Conn":"no demo value",
 "Code":"no demo value",
 "Successful":"no demo value",
 "DistributionDisplay":"no demo value",
 "OccurrenceTime":"no demo value",
 "TotalCount":"no demo value",
 "GmtCreate":"no demo value",
 "CurrentPage":"no demo value",
 "Caller":"no demo value",
 "VmIp":"no demo value",
 "Distribution":"no demo value",
 "CategoryName":"no demo value",
 "Id":"no demo value",
 "IsFinished":"no demo value",
 "NeedIgnore":"no demo value"
}

Failed Response example

{
 "errorSample":
 {
  "resultCode":-1,
  "resultMsg":"system error",
  "result":null
 }

}