Skill: sdk-team/alibabacloud-sas-alert-handler (version 0.0.2)

--- name: alibabacloud-sas-alert-handler description: | Alibaba Cloud Security Center (SAS) CWPP host security alert handling skill. Used for querying, analyzing, and handling security alerts from Cloud Security Center. Triggers: "security alert", "alert handling", "CWPP alert", "Cloud Security Center alert", "SAS alert", "Aegis alert", "view alerts", "handle alerts" --- # Cloud Security Center CWPP Alert Handling Skill ## Scenario Description This skill helps users query and handle CWPP host security alerts from Alibaba Cloud Security Center (SAS/Aegis). **Core Capabilities:** - Query security alert list - Analyze alert details and recommend handling methods - Execute alert handling operations (ignore, whitelist, block, quarantine, etc.) - Query handling status and summarize results **Architecture:** `Alibaba Cloud Security Center (SAS) + RAM Permissions + CLI Tools` --- ## Installation Requirements **Pre-check: Aliyun CLI >= 3.3.3 required** > Run `aliyun version` to verify >= 3.3.3. If not installed or version too low, > run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to update, > or see `references/cli-installation-guide.md` for installation instructions. **Pre-check: Aliyun CLI plugin update required** > [MUST] run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation. > [MUST] run `aliyun plugin update` to ensure that any existing plugins are always up-to-date. **[MUST] CLI User-Agent** — Every `aliyun` CLI command invocation must include: `--user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-alert-handler` At the **start** of the Core Workflow (before any CLI invocation): **[MUST] Enable AI-Mode** — AI-mode is required for Agent Skill execution. Run the following commands before any CLI invocation: ```bash aliyun configure ai-mode enable aliyun configure ai-mode set-user-agent --user-agent [REDACTED_SECRET] ``` **[MUST] Disable AI-Mode at EVERY exit point** — Before delivering the final response for ANY reason, always disable AI-mode first. This applies to ALL exit paths: workflow success, workflow failure, error/exception, user cancellation, session end, or any other scenario where no further CLI commands will be executed. AI-mode is only used for Agent Skill invocation scenarios and MUST NOT remain enabled after the skill stops running. ```bash aliyun configure ai-mode disable ``` --- ## Authentication Configuration > **Pre-check: Alibaba Cloud Credentials Required** > > **Security Rules:** > - **NEVER** read, output, or print AK/SK values > - **NEVER** ask users to input AK/SK directly > - **ONLY** use `aliyun configure list` to check credential status > > ```bash > aliyun configure list > ``` > Check the output for a valid profile. **If no valid profile exists, STOP here.** --- ## RAM Permission Requirements | Permission Name | Description | |-----------------|-------------| | `yundun-sas:DescribeSuspEvents` | Query alert list | | `yundun-sas:DescribeSecurityEventOperations` | Query available operations | | `yundun-sas:HandleSecurityEvents` | Handle alerts | | `yundun-sas:DescribeSecurityEventOperationStatus` | Query handling status | For detailed policies, see [references/ram-policies.md](references/ram-policies.md) > **[MUST] Permission Failure Handling:** When permission errors occur: > 1. Read `references/ram-policies.md` for required permissions > 2. Use `ram-permission-diagnose` skill to guide user > 3. Wait until user confirms permissions granted --- ## Core Workflow ### Step 0: Identify Query Scenario (Critical) > **⚠️ IMPORTANT: Choose the correct API based on user input** | Scenario | User Input Example | Correct Approach | |----------|-------------------|------------------| | **User specified alert ID** | "Query alert 702173474" | **Directly call** `DescribeSecurityEventOperations --SecurityEventId {ID}` | | **User did not specify alert ID** | "View my alerts" | Execute Step 1 to query alert list | **Scenario A: User specified alert ID** → Verify alert exists: ```bash aliyun sas DescribeSecurityEventOperations \ --SecurityEventId {AlertID} \ --Lang zh \ --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-alert-handler ``` - **Success** → Alert exists, proceed to Step 5 - **Failure** (`SecurityEventNotExists`) → See [references/error-handling.md](references/error-handling.md) **Scenario B: User did not specify alert ID** → Proceed to Step 1 --- ### Step 1: Query Alert List ```bash aliyun sas DescribeSuspEvents \ --Lang zh \ --From sas \ --CurrentPage 1 \ --PageSize 10 \ --Levels "serious,suspicious,remind" \ --Dealed N \ --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-alert-handler 2>/dev/null | jq '.SuspEvents[] | {Id, Name: .AlarmEventNameDisplay, AlarmEventType, Level, InternetIp, IntranetIp, LastTime, EventStatus, Uuid}' ``` **Key Response Fields:** | Field | Description | |-------|-------------| | Id | Alert event ID (core field) | | AlarmEventNameDisplay | Alert name | | AlarmEventType | Alert type | | Level | Severity (serious/suspicious/remind) | | EventStatus | 1=pending, 2=ignored, 8=false positive, 32=completed | --- ### Step 2: Display Alert Information and Recommendations **Display Format:** ``` Alert List (Total X items): [Alert 1] ID: 7009607xx - Name: ECS login from unusual location - Type: Unusual Login - Severity: suspicious - Asset: 47.xxx.xxx.xxx / 10.xxx.xxx.xxx - Status: Pending - Time: 2026-03-19 14:11:05 - Recommended Action: Block IP - Reason: Unusual login behavior detected ``` For operateCode mappings and recommendation rules, see [references/operation-codes.md](references/operation-codes.md) --- ### Step 3: Determine Handling Intent **Case A: User specified handling method** → Proceed to Step 4 **Case B: User did not specify** → **Must ask user:** ``` Please confirm how to handle these alerts: 1. ✅ Handle all using recommended methods 2. 🔧 Custom handling method 3. ❌ Cancel Please select (enter number): ``` --- ### Step 4: Query Available Handling Operations > **⚠️ Strict Constraint: Each alert's available operations must be queried individually** > - **NEVER** assume one alert's operations apply to another > - **MUST** call `DescribeSecurityEventOperations` for each alert ```bash aliyun sas DescribeSecurityEventOperations \ --SecurityEventId {AlertID} \ --Lang zh \ --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-alert-handler ``` **⚠️ Critical: Only execute operations where `UserCanOperate=true`** --- ### Step 5: Build Parameters and Execute **Quick Reference - Common Operations:** | OperationCode | OperationParams | Notes | |---------------|-----------------|-------| | block_ip | `{"expireTime":1773991205392}` | expireTime = current + duration (ms) | | kill_and_quara | `{"subOperation":"killAndQuaraFileByMd5andPath"}` | | | virus_quara | `{"subOperation":"quaraFileByMd5andPath"}` | | | quara | `{}` | | | ignore | `{}` | | | manual_handled | `{}` | | | advance_mark_mis_info | `{}` + MarkMissParam | See workflow-details.md | **Example - ignore:** ```bash aliyun sas HandleSecurityEvents \ --SecurityEventIds.1 7009586xx \ --OperationCode ignore \ --OperationParams '{}' \ --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-alert-handler ``` **Example - kill_and_quara:** ```bash aliyun sas HandleSecurityEvents \ --SecurityEventIds.1 7008619xx \ --OperationCode kill_and_quara \ --OperationParams '{"subOperation":"killAndQuaraFileByMd5andPath"}' \ --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-alert-handler ``` **Example - block_ip (7 days):** ```bash # Calculate: current_timestamp_ms + 7*24*60*60*1000 aliyun sas HandleSecurityEvents \ --SecurityEventIds.1 7009607xx \ --OperationCode block_ip \ --OperationParams '{"expireTime":1773991205392}' \ --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-alert-handler ``` **Example - advance_mark_mis_info:** ```bash aliyun sas HandleSecurityEvents \ --SecurityEventIds.1 7009586xx \ --OperationCode advance_mark_mis_info \ --OperationParams '{}' \ --MarkMissParam '[{"uuid":"ALL","field":"loginSourceIp","operate":"strEqual","fieldValue":"59.82.xx.xx"}]' \ --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-alert-handler ``` > **⚠️ For advanced whitelist (advance_mark_mis_info):** > - Must ask user about whitelist rules and scope > - Must preserve existing MarkField rules > - See [references/workflow-details.md](references/workflow-details.md) for detailed process For complete CLI examples and parameter details, see [references/workflow-details.md](references/workflow-details.md) --- ### Step 6: Query Handling Status > **⚠️ CLI Requirement: Must pass both TaskId and SecurityEventIds** ```bash aliyun sas DescribeSecurityEventOperationStatus \ --TaskId 290511xx \ --SecurityEventIds.1 7009607xx \ --user-agent AlibabaCloud-Agent-Skills/alibabacloud-sas-alert-handler ``` **Polling Logic:** 1. `TaskStatus=Processing` → Wait 2s, retry (max 5 times) 2. After 10s still not complete → Mark as failed 3. `TaskStatus=Success` → Handling successful 4. `TaskStatus=Failure` → Check ErrorCode --- ### Step 7: Loop to Handle Other Alerts If there are other alerts, repeat Steps 3-6. Maximum 20 alerts per batch. --- ### Step 8: Results Summary ``` ========== Handling Results Summary ========== ✅ Successfully Handled: 3 items [Alert 7009607xx] Block IP - Success ❌ Handling Failed: 1 item [Alert 7008557xx] Kill and Quarantine - Failed (AgentOffline) Total: 4 items, Success 3, Failed 1 ``` For detailed format, see [references/error-handling.md](references/error-handling.md) --- ## operateCode Quick Reference | operateCode | Description | Additional Params | |-------------|-------------|-------------------| | block_ip | Block IP | expireTime (required) | | kill_and_quara | Kill and Quarantine | subOperation (required) | | virus_quara | Quarantine File | subOperation (required) | | quara | Quarantine | None | | advance_mark_mis_info | Advanced Whitelist | MarkMissParam | | ignore | Ignore | None | | manual_handled | Mark as Handled | None | | kill_process | Kill Process | None | For complete operateCode categories and details, see [references/operation-codes.md](references/operation-codes.md) --- ## Error Handling | Error Scenario | Handling Method | |----------------|------------------| | UserCanOperate=false | Operation not supported, version limitation | | Timeout (>10s) | Mark as failed, continue next | | *.AgentOffline | Client offline, cannot handle | | *.ProcessNotExist | Suggest using virus_quara_bin | | NoPermission | Contact admin for authorization | | SecurityEventNotExists | Search in handled alerts first | For detailed error handling procedures, see [references/error-handling.md](references/error-handling.md) --- ## Best Practices 1. **Query before handling**: Call `DescribeSecurityEventOperations` first 2. **Batch limit**: Maximum 20 alerts per batch 3. **Preserve existing rules**: When using advanced whitelist, merge existing MarkField rules 4. **Timeout handling**: Polling over 10 seconds = failed 5. **User confirmation**: Must confirm intent before handling 6. **Logging**: Record all operations for auditing --- ## Reference Documents | Document | Description | |----------|-------------| | [references/workflow-details.md](references/workflow-details.md) | Detailed workflow, CLI examples, advanced whitelist | | [references/operation-codes.md](references/operation-codes.md) | Complete operateCode reference | | [references/error-handling.md](references/error-handling.md) | Error handling procedures | | [references/related-apis.md](references/related-apis.md) | API parameter details | | [references/ram-policies.md](references/ram-policies.md) | RAM permission policies | | [references/verification-method.md](references/verification-method.md) | Verification methods | | [references/cli-installation-guide.md](references/cli-installation-guide.md) | CLI installation guide |


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)