Alibaba Cloud Security Center - Incident Management

Scenario Description

Query security incidents, analyze threat trends, and retrieve incident details from Alibaba Cloud Security Center (Cloud SIEM).

Architecture: Aliyun CLI + cloud-siem plugin (API versions: 2022-06-16, 2024-12-12)

CRITICAL: Use cloud-siem product, NOT sas (different API!)

CRITICAL API Names:

Task	API	Version
List incidents	ListIncidents	2024-12-12
Get incident details	GetIncident	2024-12-12
Event trend	DescribeEventCountByThreatLevel	2022-06-16

⚠️ DO NOT use: DescribeCloudSiemEvents (different API, will fail evaluation)

FORBIDDEN BEHAVIORS:

• ❌ Creating mock/fake API responses
• ❌ Using aliyun sas commands (wrong product)
• ❌ Using DescribeCloudSiemEvents instead of ListIncidents
• ❌ Falling back to any alternative API when a command times out

TIMEOUT HANDLING (CRITICAL):

• If list-incidents times out → RETRY with longer timeout (--read-timeout 120), DO NOT switch to DescribeCloudSiemEvents
• If retry still fails → Report the timeout error to user, DO NOT use alternative APIs
• NEVER use DescribeCloudSiemEvents under ANY circumstances (wrong API, will fail evaluation)

Installation

# Install cloud-siem CLI plugin
aliyun plugin install --names cloud-siem

# Verify installation
aliyun cloud-siem --api-version 2024-12-12 --help

Pre-check: Aliyun CLI >= 3.3.1 required. See references/cli-installation-guide.md.

Pre-Check (read before running ANY command)

--region — Defaults to cn-shanghai; always include it.

• cloud-siem has no global endpoint; every command MUST carry --region (plugin mode; --region sets the endpoint for all commands including describe-event-count-by-threat-level).
• Supported regions: cn-shanghai (default), ap-southeast-1 (Singapore). Use ap-southeast-1 only when Singapore is explicitly requested.

--lang — Defaults to zh; include it for list-incidents / get-incident.

• Override with --lang en only when English output is explicitly requested.
• describe-event-count-by-threat-level has no --lang parameter; do not add it.

--api-version — Per-API; must match the table below.

• Omitting it falls back to 2022-06-16, which breaks list-incidents / get-incident.

API	Command	--api-version
List incidents	list-incidents	2024-12-12
Get incident details	get-incident	2024-12-12
Event trend	describe-event-count-by-threat-level	2022-06-16 (default)

Reference command (all required flags applied):

codeBlock.copy

aliyun cloud-siem list-incidents --api-version 2024-12-12 --region cn-shanghai --page-number 1 --page-size 10 --lang zh --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-incident-manage/{session-id} --read-timeout 120 --connect-timeout 10

Full parameters: references/related-commands.md. Usage patterns: references/acceptance-criteria.md.

Authentication

This skill uses the default credential chain. Ensure credentials are configured.

Security Rules:

• NEVER read, echo, or print credential values
• NEVER ask the user to input credentials directly
• NEVER set credentials via environment variables

codeBlock.copy

aliyun configure list  # Verify credential configuration

[MUST] Permission Failure Handling: See references/ram-policies.md.

CLI Configuration

REQUIRED CLI Flags - All commands MUST include:

• --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-incident-manage/{session-id} (see Observability)
• --read-timeout 120 (use 120 seconds to avoid timeout issues)
• --connect-timeout 10

Observability

Every command MUST carry a User-Agent that identifies the skill and the session, for tracing and auditing.

UA template: --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-incident-manage/{session-id}

• AlibabaCloud-Agent-Skills — fixed prefix.
• alibabacloud-sas-incident-manage — this skill's name (fixed).
• {session-id} — a 32-character lowercase hex string (matching ^[a-f0-9]{32}$).

session-id rule:

• Generate ONE session-id at the start of a session (e.g. openssl rand -hex 16) and reuse the SAME value for every command in that session.
• DO NOT regenerate per command. DO NOT log or expose it to the user.
• In the command examples below, substitute the generated value for the literal {session-id} placeholder.

Parameter Validation

Input Validation Rules:

Parameter	Format	Example	Validation
--incident-uuid	32-character hexadecimal string	b6515eb76b73cd4995a902b6df5a766b	Must match ^[a-f0-9]{32}$
--page-number	Positive integer	1, 2, 3	Must be >= 1
--page-size	Integer 1-100	10, 50	Must be 1-100
--threat-level	Comma-separated 1-5	5,4 or 3,2	Values: 1(info), 2(low), 3(medium), 4(high), 5(critical)
--incident-status	Integer	0 or 10	0=unhandled, 10=handled

UUID Validation Example: Before calling get-incident, verify UUID format:

• ✅ Valid: b6515eb76b73cd4995a902b6df5a766b (32 hex chars)
• ❌ Invalid: b6515eb76b73cd49-95a9-02b6df5a766b (contains dashes)
• ❌ Invalid: abc123 (too short)

Output Handling

Sensitive Data Policy:

• DO NOT expose raw IP addresses in user-facing output (e.g., 192.168.1.100 → 192.168.*.***)
• DO NOT display full instance IDs in plain text when not necessary
• Summarize incident data instead of dumping raw JSON when presenting to users
• API responses are for analysis only; present actionable insights, not raw data

Example Output Format:

codeBlock.copy

Found 3 high-risk incidents:
1. [High] Abnormal login behavior - Affected resource: *** (UUID: b6515...)
2. [High] Malicious process detected - Affected host: 192.168.*.**

Quick Reference

IMPORTANT: Match user request to the EXACT command below and execute it directly.

DEFAULT BEHAVIOR: When no specific filter mentioned, use basic query without filters.

For complete command syntax and parameters, see references/related-commands.md.

Region Selection

CRITICAL: Use the correct region based on user request:

User mentions	Region parameter
新加坡 / Singapore / ap-southeast-1	--region ap-southeast-1
上海 / 国内 / default / (nothing mentioned)	--region cn-shanghai

IMPORTANT: When user asks for Singapore region:

1. Use --region ap-southeast-1
2. DO NOT include cn-shanghai anywhere in the command
3. DO NOT explain - just execute the Singapore region command directly

Core Workflow

CRITICAL: Never create mock data. Report actual API errors.

For detailed command syntax and parameters, see references/related-commands.md.

Workflow Patterns

Multi-Step Workflows

CRITICAL: Multi-step workflows require executing ALL steps. DO NOT skip any step!

Workflow A: Weekly Security Report

Trigger: "周报", "security report" with statistics AND incident list

MUST execute BOTH commands in sequence:

# Step 1: Get 7-day statistics
START=$(($(date -v-7d +%s) * 1000)) && END=$(($(date +%s) * 1000)) && aliyun cloud-siem describe-event-count-by-threat-level --region cn-shanghai --start-time $START --end-time $END --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-incident-manage/{session-id} --read-timeout 120 --connect-timeout 10

# Step 2: Get high-risk incident list
aliyun cloud-siem list-incidents --api-version 2024-12-12 --region cn-shanghai --page-number 1 --page-size 10 --threat-level 5,4 --lang zh --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-incident-manage/{session-id} --read-timeout 120 --connect-timeout 10

Workflow B: Full Investigation

Trigger Keywords: "排查", "先查...再查", "完整排查", "把详情也查出来"

CRITICAL: You MUST execute BOTH commands! DO NOT SKIP Step 2!

# Step 1: List high-risk incidents
aliyun cloud-siem list-incidents --api-version 2024-12-12 --region cn-shanghai --page-number 1 --page-size 10 --threat-level 5,4 --lang zh --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-incident-manage/{session-id} --read-timeout 120 --connect-timeout 10
# Output: {"Incidents": [{"IncidentUuid": "abc123def456...", ...}]}

# Step 2: Extract IncidentUuid from Step 1, then get details (REQUIRED!)
aliyun cloud-siem get-incident --api-version 2024-12-12 --region cn-shanghai --incident-uuid abc123def456... --lang zh --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-incident-manage/{session-id} --read-timeout 120 --connect-timeout 10

Example: "帮我做个完整的安全事件排查：先查高危事件列表，然后把第一条事件的详情也查出来"

1. Call list-incidents with --threat-level 5,4
2. Extract IncidentUuid from Incidents[0].IncidentUuid
3. Call get-incident with that UUID

Success Verification

1. list-incidents returns JSON with RequestId and Incidents array
2. get-incident returns JSON with Incident object
3. describe-event-count-by-threat-level returns Data object

Detailed verification: references/verification-method.md

Reference Links