# Alibaba Cloud Security Center API

> Alibaba Cloud Security Center API on Apizie: 91 endpoints (Adds a data source under the bound multi-cloud account, Adds logs, Adds a log ingestion task to import the corresponding log data into Threat Analysis for subsequent alerting…, Binds a multi-cloud account configured in the multi-cloud assets of Security Center to Threat Analysis, …) returned as clean JSON through one API key. Send your own provider key in the x-upstream-key header. Call it over REST at https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/{endpoint} or from Claude, ChatGPT and Cursor through the Apizie MCP server. Free plan: 1,000 requests a month.

- Project key: `cloud:aliyun-cloud-siem`
- Category: Cloud
- Status: byok
- Source: https://api.alibabacloud.com/product/cloud-siem
- Page: https://zieapi.vercel.app/api/cloud/aliyun-cloud-siem
- OpenAPI: https://zieapi.vercel.app/api/cloud/aliyun-cloud-siem/openapi.json

Alibaba Cloud OpenAPI for Security Center (cloud-siem, version 2022-06-16). Calls are signed with ACS3-HMAC-SHA256 using your AccessKey ID and secret.

## Endpoints

### Adds a data source under the bound multi-cloud account
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/add-data-source` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| AccountId | string | no | The cloud account ID |
| DataSourceType | string | no | The data source type. Valid values: obs: Huawei Cloud OBS. wafApi: Tencent Cloud WAF download API. ckafka: Tencent Cloud CKafka |
| DataSourceInstanceName | string | no | The data source name |
| DataSourceInstanceRemark | string | no | The data source remarks |
| DataSourceInstanceParams | string | no | The data source parameters in JSON array format |
| CloudCode | string | yes | The code of the cloud provider |
| RegionId | string | no | The region where the threat analysis data management center is located. Select the management center region based on the region of your… |

### Adds logs
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/add-data-source-log` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| LogCode | string | no | The log code |
| DataSourceInstanceId | string | yes | The ID of the data source instance. You can call the ListBindDataSources operation to query the ID |
| DataSourceInstanceLogs | string | yes | The details of the data source parameters in JSON array format |
| AccountId | string | yes | The cloud account ID |
| CloudCode | string | yes | The multi-cloud code. Valid values: qcloud: Tencent Cloud. hcloud: Huawei Cloud. aliyun: Alibaba Cloud. This value is used only for… |
| RegionId | string | no | The region of the data management center for Threat Analysis. You must select the region of the management center based on the region… |

### Adds a log ingestion task to import the corresponding log data into Threat Analysis for subsequent alerting…
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/add-user-source-log-config` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| SourceProdCode | string | no | The product code |
| SourceLogCode | string | no | The log code |
| SubUserId | integer | yes | The Alibaba Cloud account ID for which logs are to be ingested |
| SourceLogInfo | string | yes | The detailed Simple Log Service (SLS) information for the logs to be ingested, in JSON format |
| DisPlayLine | string | no | The detailed Simple Log Service (SLS) information for the logs to be ingested |
| Deleted | integer | no | Specifies whether to add or delete the ingestion task. Valid values: -1: Deletes the ingestion task. 0: Adds the ingestion task |
| RegionId | string | no | The region where the data management center of Threat Analysis is located. You must select the region of the management center based on… |

### Binds a multi-cloud account configured in the multi-cloud assets of Security Center to Threat Analysis
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/bind-account` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| AccessId | string | yes | The AccessKey ID of the cloud account |
| AccountName | string | yes | The name of the multi-cloud account |
| AccountId | string | yes | The ID of the cloud account |
| CloudCode | string | yes | The code of the multi-cloud provider. Valid values: hcloud: Huawei Cloud qcloud: Tencent Cloud |
| RegionId | string | no | The region of the data management center for Threat Analysis. Select the region of the management center based on the region where your… |
| RoleFor | integer | no | The ID of the user whose perspective the administrator switches to |
| RoleType | integer | no | The view type. Valid values: 0: The view of the current Alibaba Cloud account. 1: The view of all accounts in the enterprise |

### Disables log delivery for an integrated cloud service. After the delivery is disabled, no new logs are…
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/close-delivery` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| ProductCode | string | yes | The code of the cloud service. Valid values: qcloud_waf qlcoud_cfw hcloud_waf hcloud_cfw ddos sas cfw config csk fc rds nas apigateway cdn… |
| LogCode | string | no | The log code of the cloud service, such as the process log in Security Center. For valid values, refer to the response of the ListDelivery… |
| RoleType | integer | no | The view type. Valid values: 0: the view of the current Alibaba Cloud account 1: the view of all accounts in the enterprise |
| RoleFor | integer | no | The ID of the user whose perspective the administrator switches to |
| RegionId | string | no | The region where the data management center of Threat Analysis is located. You must select the region of the management center based on… |

### Deletes the automated response rule with the specified ID
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/delete-automate-response-config` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| Id | integer | no | The ID of the automated response configuration rule |
| RoleType | integer | no | The view type. Valid values: 0: The view of the current Alibaba Cloud account. 1: The view of all accounts in the enterprise |
| RoleFor | integer | no | The ID of the user whose perspective the administrator switches to |
| RegionId | string | no | The region where the data management center for Threat Analysis is located. Select the region of the management center based on the region… |

### Unbinds a multi-cloud (Tencent Cloud or Huawei Cloud) sub-account AccessKey that is bound to the threat…
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/delete-bind-account` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| BindId | integer | no | The binding ID. You can call ListBindAccount… |
| AccountId | string | yes | The cloud account ID |
| AccessId | string | yes | The AccessKey ID of the cloud account |
| CloudCode | string | yes | The code of the multi-cloud provider. Valid values: qcloud: Tencent Cloud. aliyun: Alibaba Cloud. hcloud: Huawei Cloud |
| RegionId | string | no | The region where the threat analysis data management center is located. Select the management center based on the region of your assets.… |
| RoleType | integer | no | The view type. Valid values: 0: The view of the current Alibaba Cloud account. 1: The view of all accounts in the enterprise |
| RoleFor | integer | no | The ID of the member to which the administrator switches the view |

### Deletes a custom rule based on a specified ID
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/delete-customize-rule` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| RuleId | integer | no | The ID of the custom rule |
| RoleType | integer | no | The view type. Valid values: 0: the view of the current Alibaba Cloud account. 1: the view of all accounts in the enterprise |
| RoleFor | integer | no | The ID of the user to whom the administrator switches the view. This parameter allows an administrator to switch to the perspective of a… |
| RegionId | string | no | The region where the service resides |

### Deletes a data source that is no longer in use
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/delete-data-source` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| DataSourceInstanceId | string | yes | The data source ID, which is an MD5 hash generated by threat detection and response based on specific parameters. You can call… |
| AccountId | string | yes | The Alibaba Cloud account ID |
| CloudCode | string | yes | The code of the cloud service provider. Valid values: qcloud: Tencent Cloud. aliyun: Alibaba Cloud. hcloud: Huawei Cloud |
| RegionId | string | no | The region where the threat detection and response data management center is located. Specify the management center based on the region of… |

### Deletes a log
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/delete-data-source-log` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| LogInstanceId | string | yes | The log ID, which is an MD5 hash generated by Cloud Threat Detection and Response (CTDR) based on specific parameters. You can call… |
| DataSourceInstanceId | string | yes | The data source ID, which is an MD5 hash generated by CTDR based on specific parameters. You can call ListDataSourceLogs… |
| AccountId | string | yes | The Alibaba Cloud account ID |
| CloudCode | string | yes | The code of the cloud service provider. Valid values: qcloud: Tencent Cloud. aliyun: Alibaba Cloud. hcloud: Huawei Cloud |
| RegionId | string | no | The region where the CTDR data management center is located. Specify the management center based on the region of your assets. Valid… |

### Deletes the specified alert whitelist rule
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/delete-white-rule-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| Id | integer | yes | The unique ID of the whitelist rule |
| RoleType | integer | no | The view type. Valid values: 0: The view of the current Alibaba Cloud account. 1: The view of all accounts in the enterprise |
| RoleFor | integer | no | The ID of the user whose perspective the administrator switches to |
| RegionId | string | no | The region where the data management center of Threat Analysis is located. Select the region of the management center based on the region… |

### Retrieves the list of aggregate functions supported by custom rules
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/describe-aggregate-function` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| RoleType | integer | no | The view type. Valid values: 0: the view of the current Alibaba Cloud account. 1: the view of all accounts in the enterprise |
| RoleFor | integer | no | The ID of the user whose perspective the administrator switches to |
| RegionId | string | no | The region where the data management center of Threat Analysis is located. Select the region of the management center based on the region… |

### Retrieves the scenarios for alert whitelisting
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/describe-alert-scene` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| RoleType | integer | no | The view type. Valid values: 0: The view of the current Alibaba Cloud account. 1: The view of all accounts in the enterprise |
| RoleFor | integer | no | The ID of the user whose perspective the administrator switches to |
| RegionId | string | no | The region where the data management center of Threat Analysis is located. You must select the region of the management center based on… |

### Retrieves the alert whitelisting scenarios and the list of whitelisting targets
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/describe-alert-scene-by-event` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| IncidentUuid | string | yes | The incident ID |
| RoleType | integer | no | The view type. Valid values: 0: Current Alibaba Cloud account view. 1: View of all accounts in the enterprise |
| RoleFor | integer | no | The ID of the user whose perspective the administrator switches to |
| RegionId | string | no | The region where the data management center of Threat Analysis is located. You must select the region of the management center based on… |

### Retrieves a list of alert data sources
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/describe-alert-source` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| Level | string | no | The threat level. The value is a JSON array. Valid values: serious: High. suspicious: Medium. remind: Low (JSON-encoded) |
| StartTime | integer | no | The start time of the query. Unit: milliseconds |
| EndTime | integer | no | The end time of the query. Unit: milliseconds |
| RoleType | integer | no | The view type. Valid values: 0: The view of the current Alibaba Cloud account. 1: The view of all accounts in the enterprise |
| RoleFor | integer | no | The ID of the user whose perspective the administrator switches to |
| RegionId | string | no | The region where the data management center of Threat Analysis is located. You must select the region of the management center based on… |

### Queries the list of alert data sources associated with an incident
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/describe-alert-source-with-event` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| IncidentUuid | string | no | The globally unique ID of the incident |
| RoleType | integer | no | The view type. Valid values: 0: the view of the current Alibaba Cloud account 1: the view of all accounts in the enterprise |
| RoleFor | integer | no | The ID of the user whose perspective the administrator switches to |
| RegionId | string | no | The region of the data management center for threat analysis. Select the region of the management center based on the region where your… |

### Retrieves the list of available threat types for custom rules
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/describe-alert-type` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| RuleType | string | no | The rule type. Valid values: predefine: Predefined. customize: Custom |
| RoleType | integer | no | The view type. Valid values: 0: The view of the current Alibaba Cloud account. 1: The view of all accounts in the enterprise |
| RoleFor | integer | no | The ID of the user whose perspective the administrator switches to |
| RegionId | string | no | The region where the data management center of Threat Analysis is deployed. Select the region of the management center based on the region… |

### Retrieves the list of alerts for the user
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/describe-alerts` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| AlertUuid | string | no | The ID of the alert associated with the event |
| Level | string | no | The threat level. Format: JSON array. Valid values: serious: High risk. suspicious: Medium risk. remind: Low risk (JSON-encoded) |
| Source | string | no | The source product of the alert associated with the event |
| IsDefend | string | no | Indicates whether the threat is blocked. Valid values: 0: Detected. 1: Blocked |
| AlertTitle | string | no | The title of the alert |
| AlertType | string | no | The alerting type |
| AlertName | string | no | The name of the alert |
| AssetName | string | no | The name of the asset |
| AssetId | string | no | The ID of the asset |
| EntityName | string | no | The name of the entity |
| EntityId | string | no | The ID of the entity |
| SubUserId | string | no | The ID of the Alibaba Cloud account actually associated with the alert |
| LabelType | string | no | The alert query type. Valid values: system: Aggregation analysis alert. custom: Custom analysis alert. cfw: Cloud Firewall. waf: Web… |
| AlertStatus | string | no | The status of the alert (JSON-encoded) |
| StartTime | integer | no | The start time of the query. Unit: milliseconds |
| EndTime | integer | no | The end time of the query. Unit: milliseconds |
| CurrentPage | integer | yes | The current page number of the list. The value must be greater than or equal to 1 |
| PageSize | integer | yes | The number of entries per page. Maximum value: 100 |
| RoleType | integer | no | The view type. Valid values: 0: View of the current Alibaba Cloud account. 1: View of all accounts in the enterprise |
| RoleFor | integer | no | The ID of the user whose perspective the administrator switches to |
| RegionId | string | no | The region where the data management center of Threat Analysis is located. You must select the region of the management center based on… |

### Retrieves the counts of alerts at different severity levels
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/describe-alerts-count` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| QueryType | string | no | The query type |
| StartTime | integer | no | The start time of the query, in milliseconds |
| EndTime | integer | no | The end time of the query, in milliseconds |
| RoleType | integer | no | The view type. Valid values: 0: The view of the current Alibaba Cloud account. 1: The view of all accounts in the enterprise |
| RoleFor | integer | no | The ID of the user whose perspective the administrator switches to |
| RegionId | string | no | The region where the data management center of Threat Analysis is located. Select the region of the management center based on the region… |

### Retrieves the list of alerts associated with an entity
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/describe-alerts-with-entity` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| IncidentUuid | string | no | The globally unique ID of the incident |
| SophonTaskId | string | no | The ID of the SOAR playbook |
| EntityId | integer | no | The ID of the entity |
| EntityUuid | string | no | The ID of the entity |
| StartTime | integer | no | The start time of the query. Unit: milliseconds |
| EndTime | integer | no | The end time of the query. Unit: milliseconds |
| CurrentPage | integer | yes | The page number of the current page. The value must be greater than or equal to 1 |
| PageSize | integer | yes | The number of entries per page. Maximum value: 100 |
| RoleType | integer | no | The view type. Valid values: 0: the view of the current Alibaba Cloud account 1: the view of all accounts in the enterprise |
| RoleFor | integer | no | The ID of the user whose view the administrator switches to |
| RegionId | string | no | The region where the data management center of Threat Analysis is located. You must select the region of the management center based on… |

### Queries the list of alerts associated with an incident
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/describe-alerts-with-event` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| IncidentUuid | string | no | The incident ID |
| Level | string | no | The threat level. The value is a JSON array. Valid values: serious: High. suspicious: Medium. remind: Low (JSON-encoded) |
| AlertTitle | string | no | The alert title |
| AlertType | string | no | The alert type |
| AlertName | string | no | The alert name |
| AssetName | string | no | The asset name |
| AssetId | string | no | The asset ID |
| EntityName | string | no | The entity name |
| EntityId | string | no | The entity ID |
| SubUserId | integer | no | The ID of the account associated with the alert |
| Source | string | no | The data source of the alert |
| IsDefend | string | no | Specifies whether the threat is blocked. Valid values: 0: Detected. 1: Blocked |
| StartTime | integer | no | The start time of the query. Unit: milliseconds |
| EndTime | integer | no | The end time of the query. Unit: milliseconds |
| CurrentPage | integer | yes | The page number of the current page. The value must be greater than or equal to 1 |
| PageSize | integer | yes | The number of entries per page. Maximum value: 100 |
| RoleType | integer | no | The view type. Valid values: 0: The view of the current Alibaba Cloud account. 1: The view of all accounts in the enterprise |
| RoleFor | integer | no | The ID of the member account in the resource directory |
| RegionId | string | no | The region where the data management center of Threat Analysis is located. You must select the region of the management center based on… |

### Checks whether the Alibaba Cloud account has authorized SIEM and created the…
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/describe-auth` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| RegionId | string | no | The region of the data management center for Threat Analysis. Select the management center region based on the region where your assets… |

### Queries the number of automated response rules
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/describe-automate-response-config-counter` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| RoleType | integer | no | The view type. Valid values: 0: the view of the current Alibaba Cloud account 1: the view of all accounts in the enterprise |
| RoleFor | integer | no | The ID of the user whose perspective the administrator switches to |
| RegionId | string | no | The region where the data management center of Threat Analysis is located. Select the region of the management center based on the region… |

### Retrieves the configurable fields and operators for automated rule policies
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/describe-automate-response-config-feature` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| AutoResponseType | string | no | The automated response type. Valid values: event: Event. alert: Alert |
| RoleType | integer | no | The view type. Valid values: 0: The view of the current Alibaba Cloud account. 1: The view of all accounts in the enterprise |
| RoleFor | integer | no | The ID of the user whose perspective the administrator switches to |
| RegionId | string | no | The region where the data management center of Threat Analysis is located. Select the region of the management center based on the region… |

### Retrieves the list of assets associated with an incident
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/describe-cloud-siem-assets` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| IncidentUuid | string | no | The UUID of the incident |
| AssetType | string | no | The asset type. Valid values: ip: IP address domain: domain name url: URL process: process file: file host: host |
| AssetName | string | no | The name of the asset |
| AssetUuid | string | no | The UUID of the asset |
| CurrentPage | integer | yes | The number of the current page. The value must be greater than or equal to 1 |
| PageSize | integer | yes | The number of entries per page. Maximum value: 100 |
| RoleType | integer | no | The type of the view. Valid values: 0: the view of the current Alibaba Cloud account 1: the view of all accounts in the enterprise |
| RoleFor | integer | no | The ID of the user whose perspective the administrator switches to |
| RegionId | string | no | The region where the data management center of Threat Analysis is located. You must select the region of the management center based on… |

### Queries the number of assets of each type that are associated with an event
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/describe-cloud-siem-assets-counter` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| IncidentUuid | string | yes | The UUID of the event |
| RoleType | integer | no | The type of view. 0: The view of the current Alibaba Cloud account. 1: The view of all accounts that belong to the enterprise |
| RoleFor | integer | no | The UID of the member. An administrator can use this parameter to switch to the member's view |
| RegionId | string | no | The region where the data management center of Threat Analysis is deployed. Select a region based on the location of your assets. Valid… |

### Retrieves the details of an incident
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/describe-cloud-siem-event-detail` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| IncidentUuid | string | yes | The UUID of the incident |
| RoleType | integer | no | The view type |
| RoleFor | integer | no | The ID of the user whose perspective the administrator switches to |
| RegionId | string | no | The region where the data management center of Threat Analysis is located. Select the region of the management center based on the region… |

### Retrieves a list of Cloud Threat Detection and Response (CTDR) events
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/describe-cloud-siem-events` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| StartTime | integer | no | The start time for querying events, in milliseconds |
| EndTime | integer | no | The end time for querying events, in milliseconds |
| ThreadLevel | string | no | The threat level of the event, in JSON array format. Valid values: serious: High. suspicious: Medium. remind: Low (JSON-encoded) |
| EventName | string | no | The name of the event |
| IncidentUuid | string | no | The ID of the event |
| AssetId | string | no | The ID of the asset associated with the event |
| EntityUuid | string | no | The UUID of the entity associated with the event |
| Status | integer | no | The status of the event. Valid values: 0: Unhandled. 1: Processing. 5: Failed. 10: Handled |
| OrderField | string | no | The field used to sort the event list. Valid values: GmtModified: Sorts by event generation time (default). ThreatScore: Sorts by event… |
| Order | string | no | The sort order of the event list. Valid values: desc: Descending order. asc: Ascending order |
| CurrentPage | integer | yes | The current page number. The value must be greater than or equal to 1 |
| PageSize | integer | yes | The number of entries per page. Maximum value: 100 |
| RoleType | integer | no | The view type. Valid values: 0: Current Alibaba Cloud account view. 1: View of all accounts in the enterprise |
| RoleFor | integer | no | The ID of the user whose view the administrator switches to |
| RegionId | string | no | The region where the data management center of Cloud Threat Detection and Response (CTDR) is located. Select the region of the management… |

### Retrieves the count of custom rules
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/describe-customize-rule-count` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| RoleType | integer | no | The type of view. Valid values: 0: the view of the current Alibaba Cloud account. 1: the view of all accounts in the enterprise |
| RoleFor | integer | no | The user ID of a member. An administrator can use this ID to switch to the member's perspective |
| RegionId | string | no | The region of the management center for threat analysis. Select a region based on where your assets are located. Valid values:… |

### Retrieves historical simulated data from a test scenario
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/describe-customize-rule-test` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| Id | integer | no | The ID of the custom rule |
| RoleType | integer | no | The view type. 0: The view of the current Alibaba Cloud account. 1: The view of all accounts within the enterprise |
| RoleFor | integer | no | The user ID of the member account to which the administrator switches |
| RegionId | string | no | The region of the Data Management center for Threat Analysis. Select a region based on where your assets are located. Valid values:… |

### Retrieves the chart of test results for a custom rule
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/describe-customize-rule-test-histogram` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| Id | integer | no | The ID of the custom rule |
| RoleType | integer | no | The view type. 0: The view of the current Alibaba Cloud account. 1: The view of all accounts in your enterprise |
| RoleFor | integer | no | The user ID of the member. This parameter is used when an administrator switches to the perspective of a member |
| RegionId | string | no | The region where the Management Hub of threat analysis is located. Select the region of the Management Hub based on the region where your… |

### Queries the details of a data source
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/describe-data-source-instance` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| DataSourceInstanceId | string | yes | The data source ID, which is an MD5 hash generated by Cloud Threat Detection and Response (CTDR) based on specific parameters. You can… |
| AccountId | string | yes | The Alibaba Cloud account ID |
| CloudCode | string | yes | The code of the cloud service provider. Valid values: qcloud: Tencent Cloud. aliyun: Alibaba Cloud. hcloud: Huawei Cloud |
| RegionId | string | no | The region where the CTDR data management center is located. Specify the management center based on the region of your assets. Valid… |

### Retrieves the details of data source parameters
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/describe-data-source-parameters` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| DataSourceType | string | yes | The type of the connected data source. Valid values: ckafka: Tencent Cloud ckafka. obs: Huawei Cloud obs. wafApi: Tencent Cloud WAF attack… |
| CloudCode | string | yes | The multi-cloud code |
| RegionId | string | no | The region where the data management center for threat analysis is located. Select the region of the management center based on the region… |

### Retrieves the list of entities and playbooks to be handled
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/describe-dispose-and-playbook` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| EntityType | string | no | The entity type. Valid values: ip: IP address. process: Process. file: File |
| IncidentUuid | string | no | The incident UUID |
| EntityUuid | string | no | The entity UUID |
| CurrentPage | integer | no | The current page number. The value must be greater than or equal to 1 |
| PageSize | integer | no | The number of entries per page. Maximum value: 100 |
| RoleType | integer | no | The view type. Valid values: 0: Current Alibaba Cloud account view. 1: View of all accounts in the enterprise |
| RoleFor | integer | no | The ID of the user whose view the administrator switches to |
| RegionId | string | no | The region where the data management center of Threat Analysis is located. Select the region based on the region where your assets are… |
| AvailableOnly | string | no | Specifies whether to return only available remediation playbooks |
| EntityUuidList | string | no | The list of entity UUIDs. Separate multiple UUIDs with commas |

### Retrieves the list of playbooks used by a disposal policy
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/describe-dispose-strategy-playbook` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| StartTime | integer | yes | The start time of the query, in milliseconds |
| EndTime | integer | yes | The end time of the query, in milliseconds |
| RoleType | integer | no | The view type. Valid values: 0: the view of the current Alibaba Cloud account. 1: the view of all accounts in the enterprise |
| RoleFor | integer | no | The ID of the user to which the administrator switches the view |
| RegionId | string | no | The region where the data management center of threat detection and response is located. Select the management center based on the region… |

### Retrieves the details of an entity
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/describe-entity-info` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| EntityId | integer | no | The logical ID of the entity |
| EntityIdentity | string | no | The feature value of the entity. You can perform a fuzzy search for the entity |
| IncidentUuid | string | no | The globally unique UUID of the event |
| SophonTaskId | string | no | The ID of the SOAR response policy |
| RoleType | integer | no | The view type. 0: the view of the current Alibaba Cloud account. 1: the view of all accounts that belong to the enterprise |
| RoleFor | integer | no | The user ID of the member. The administrator can use this ID to switch to the view of this member |
| RegionId | string | no | The region of the Data Management center. Select a region based on the region where your assets are located. Valid values: cn-hangzhou:… |

### Retrieves the count of events by type
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/describe-event-count-by-threat-level` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| StartTime | integer | no | The start time of the query, in milliseconds |
| EndTime | integer | no | The end time of the query, in milliseconds |
| RoleType | integer | no | The view type. Valid values: 0: the view of the current Alibaba Cloud account. 1: the view of all accounts in the enterprise |
| RoleFor | integer | no | The ID of the member account in the resource directory |
| RegionId | string | no | The region where the threat analysis data management center resides. Select the management center based on the region of your assets.… |

### Queries the policy handling history for an event
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/describe-event-dispose` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| IncidentUuid | string | no | The globally unique UUID of the event |
| CurrentPage | integer | no | The number of the page to return. The value must be greater than or equal to 1 |
| PageSize | integer | no | The number of entries to return on each page. The maximum value is 500 |
| RoleType | integer | no | The view type. 0: The view of the current Alibaba Cloud account. 1: The view of all accounts that belong to the enterprise |
| RoleFor | integer | no | The user ID of the member. An administrator can use this parameter to switch to the perspective of a member |
| RegionId | string | no | The region where the Data Management center of Threat Analysis is located. Select the region based on the region where your assets are… |

### Queries the number of imported logs
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/describe-imported-log-count` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| RegionId | string | no | The region where the management hub of Threat Analysis is located. Select the region of the management hub based on the region where your… |
| RoleType | string | no | The type of the view. 0: The view of the current Alibaba Cloud account. 1: The view of all accounts that belong to the enterprise |
| RoleFor | string | no | The user ID of the member. An administrator can specify this parameter to switch to the perspective of the member |

### Retrieves the list of configurable fields for custom rules
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/describe-log-fields` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| LogType | string | no | The log source for the rule |
| LogSource | string | no | The log source for the rule |
| RoleType | integer | no | The view type. 0: The view of the current Alibaba Cloud account. 1: The view of all accounts in the enterprise |
| RoleFor | integer | no | The user ID of the member whose view the administrator switches to |
| RegionId | string | no | The region where the threat analysis Management Hub is located. Select the region of the Management Hub based on the region where your… |

### Retrieves a list of configurable log sources for custom rules
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/describe-log-source` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| LogType | string | no | The log type of the rule |
| RoleType | integer | no | The view type. 0: The view of the current Alibaba Cloud account. 1: The view of all accounts within the enterprise |
| RoleFor | integer | no | The user ID of the member. An administrator can use this parameter to switch to the perspective of a member |
| RegionId | string | no | The region where the Data Management center of Threat Analysis is deployed. You must select the region where your assets are located.… |

### Retrieves the log types that can be configured for custom rules
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/describe-log-type` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| RoleType | integer | no | The type of the view. Valid values: 0: The view of the current Alibaba Cloud account. 1: The view of all accounts in an enterprise |
| RoleFor | integer | no | The user ID of the member. An administrator can use this parameter to switch to the perspective of a specific member |
| RegionId | string | no | The region of the Data Management center. Select a region based on where your assets are located. Valid values: cn-hangzhou: for assets in… |

### Retrieves the list of operators for custom rules
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/describe-operators` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| SceneType | string | no | The scenario for the operator. Valid values: If you leave this parameter empty, the default scenario is used. AGGREGATE: The aggregate… |
| RoleType | integer | no | The view type. 0: The view of the current Alibaba Cloud account. 1: The view of all accounts that are managed by your enterprise |
| RoleFor | integer | no | The user ID of the member. An administrator can use this parameter to switch to the perspective of this member |
| RegionId | string | no | The region of the Data Management center for threat analysis. Select a region based on your asset location. Valid values: cn-hangzhou:… |

### Queries the number of Alibaba Cloud, Tencent Cloud, and Huawei Cloud products that can be integrated with…
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/describe-prod-count` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| RoleType | integer | no | The type of the view. 0: the view of the current Alibaba Cloud account. 1: the view of all accounts that belong to the enterprise |
| RoleFor | integer | no | The user ID of a member. This parameter allows an administrator to switch to the perspective of the member |
| RegionId | string | no | The region where the Data Management center of Threat Analysis is located. Select a region for the Management Center based on the region… |

### Retrieves the list of users in the playbook scope
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/describe-scope-users` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| RoleType | integer | no | The view type. 0: The view of the current Alibaba Cloud account. 1: The view of all accounts that belong to the enterprise |
| RoleFor | integer | no | The user ID of the member. This parameter is used when an administrator switches to the view of a member |
| RegionId | string | no | The region of the Data Management center. Select the region based on where your assets are located. Valid values: cn-hangzhou: Assets are… |

### Checks whether a resource directory is authorized for threat analysis
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/describe-service-status` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| RegionId | string | no | The region of the Data Management hub. Select a region based on the location of your assets. Valid values: cn-hangzhou: For assets in the… |

### Checks the status of the storage for the threat analysis feature. The storage is a Logstore in Simple Log…
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/describe-storage` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| RoleType | integer | no | The type of view. Valid values: 0: The view of the current Alibaba Cloud account. 1: The view of all accounts in your enterprise |
| RoleFor | integer | no | The user ID of the member whose view you want to use. This parameter is available only for administrators |
| RegionId | string | no | The region of the Data Management center for threat analysis. Select a region for the center based on the location of your assets. Valid… |

### Checks whether the current Alibaba Cloud account or its associated enterprise organization has purchased…
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/describe-user-buy-status` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| SubUserId | integer | no | The ID of the Alibaba Cloud account |
| RegionId | string | no | The region of the Data Management center for threat analysis. Select a region for the management center based on where your assets are… |

### Queries the purchase status of a user's SIEM
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/describe-user-siem-order-status` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| RoleType | integer | no | The view type. Valid values: 0: the current Alibaba Cloud account view. 1: the view of all accounts in the enterprise |
| RoleFor | integer | no | The user ID that the administrator uses to switch to another member's perspective |
| RegionId | string | no | The region of the data management center for threat detection and response. Select the data management center based on the region where… |

### Retrieves the list of domain names protected by Web Application Firewall (WAF) instances
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/describe-waf-scope` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| EntityId | integer | no | The entity ID |
| RoleType | integer | no | The view type. 0: the view of the current Alibaba Cloud account. 1: the view of all accounts within the enterprise |
| RoleFor | integer | no | The ID of a member. An administrator can use this parameter to assume the permissions of the member |
| RegionId | string | no | The region where the Data Management center of threat analysis is located. Select a region based on the location of your assets. Valid… |

### Queries the rules in the alert whitelist
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/describe-white-rule-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| AlertType | string | no | The alert type |
| AlertName | string | no | The alert name |
| IncidentUuid | string | no | The universally unique identifier (UUID) of the event |
| CurrentPage | integer | yes | The page number. The value must be greater than or equal to 1 |
| PageSize | integer | yes | The number of entries per page. The maximum value is 100 |
| RoleType | integer | no | The view type. 0: the view of the current Alibaba Cloud account. 1: the view of all accounts that are managed by the administrator account |
| RoleFor | integer | no | The ID of the member. This parameter is used in a multi-account management scenario. An administrator can specify this parameter to query… |
| RegionId | string | no | The region where the data management center of Threat Analysis is deployed. You must select the region where your assets are located.… |

### Authorizes the user and creates the threat detection and response service-linked role…
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/enable-access-for-cloud-siem` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| ClientToken | string | no | The idempotency token |
| AutoSubmit | integer | no | Specifies whether to automatically integrate alert logs from Security Center, Web Application Firewall (WAF), and Cloud Firewall. By… |
| RoleType | integer | no | The view type. 0: the view of the current Alibaba Cloud account. 1: the view of all accounts in the enterprise |
| RoleFor | integer | no | The ID of the member account to which the administrator switches the view |
| RegionId | string | no | The region where the threat detection and response data management center resides. Select the management center based on the region of… |

### Enables resource directory authorization for threat analysis. This operation can be called only by a…
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/enable-service-for-cloud-siem` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| RegionId | string | no | The region of the Data Management center for threat analysis. Select a region based on where your assets are located. Valid values:… |

### Retrieves the current billable storage usage and subscription purchase volume for threat analysis. Units are…
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/get-capacity` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| RoleType | integer | no | View type. 0: View for the current Alibaba Cloud account. 1: View for all accounts under your enterprise |
| RoleFor | integer | no | User ID of the member whose view the administrator switches to |
| RegionId | string | no | Region where the Data Management Center for threat analysis is located. Choose a region based on where your assets are located.… |

### Retrieves the details of user data storage on the Log Management page
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/get-data-storage` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| RegionId | string | no | The region where the threat analysis data management center is located. Specify the management center based on the region of your assets.… |
| Lang | string | no | The language of the response. Valid values: zh (default): Chinese. en: English |
| RoleFor | integer | no | The user ID of the member to which the administrator switches the view |

### Queries the entity count
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/get-entitiy-stat` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| IncidentUuid | string | yes | The incident ID |
| EntityType | string | no | The ID of the asset associated with the incident |
| AssetName | string | no | The ID of the asset associated with the incident |
| AssetUuid | string | no | The ID of the asset associated with the incident |
| EntityName | string | no | The ID of the asset associated with the incident |
| EntityUuid | string | no | The ID of the asset associated with the incident |
| IsAsset | string | no | The ID of the asset associated with the incident |
| IsMalwareEntity | string | no | The sort order of the incident list. Valid values: desc: descending order asc: ascending order |
| Tags | string | no | The entity tags. The value is a JSON array string in the following format: "[{"tagKey1":"tagValue1"},{"tagKey2":"tagValue2"}]" |
| RoleType | integer | no | The role type. Valid values: 0: single-account logon 1: global view 2: switched view 3: local view |
| RoleFor | integer | no | The ID of the user whose view the administrator switches to |
| RegionId | string | no | The region where the data management center of Threat Analysis is located. Select the region of the management center based on the region… |
| EntityUuids | string | no | The list of entity UUIDs. Separate multiple UUIDs with commas |

### Retrieves the storage settings created by the Threat Analysis and Response product in your Simple Log…
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/get-storage` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| RoleType | integer | no | The type of the view. Valid values: 0: The view of the current Alibaba Cloud account. 1: The view of all accounts that belong to the… |
| RoleFor | integer | no | The user ID of the member. This parameter is used by an administrator to switch to the perspective of a member |
| RegionId | string | no | The region where the Data Management hub for threat analysis is located. Select a region for the management hub based on the region of… |

### Queries the list of multi-cloud AccessKeyIds that are already bound
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/list-account-access-id` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| CloudCode | string | yes | The code of the multi-cloud provider |
| RegionId | string | no | The location of the data management center for threat detection and response. Select the management center location based on the region of… |
| RoleFor | integer | no | The ID of the member to which the administrator switches the view |
| RoleType | integer | no | The view type. Valid values: 0: the view of the current Alibaba Cloud account. 1: the view of all accounts in the enterprise |

### Queries the list of accounts by log
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/list-accounts-by-log` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| ProdCode | string | yes | The code of the product |
| LogCodes | string | yes | The list of log codes. This parameter is a repeatList array parameter that must be passed in dot-separated expanded form, for example,… |
| CloudCode | string | yes | The code of the cloud provider |
| RoleType | integer | no | The view type. 0: the view of the current Alibaba Cloud account. 1: the view of all accounts in the enterprise |
| RoleFor | integer | no | The ID of the member to which the administrator switches the view |
| RegionId | string | no | The region where the CTDR data management center is located. Select the management center based on the region of your assets. Valid… |

### Queries the list of cloud services that are supported for data ingestion by threat detection and response
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/list-all-prods` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| RoleType | integer | no | The view type. 0: the view of the current Alibaba Cloud account. 1: the view of all accounts in the enterprise |
| RoleFor | integer | no | The ID of the user to which the administrator switches the view |
| RegionId | string | no | The region where the data management center of threat detection and response is located. Specify the management center based on the region… |

### Retrieves a list of automated response rules
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/list-automate-response-configs` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| Id | integer | no | The ID of the automated response rule |
| SubUserId | integer | no | The ID of the user who created the rule |
| PlaybookUuid | string | no | The unique identifier of the playbook |
| RuleName | string | no | The name of the automated response rule |
| AutoResponseType | string | no | The type of the automated response. Valid values: event alert |
| ActionType | string | no | The type of the handling action. Valid values: doPlaybook: executes a playbook. changeEventStatus: changes the status of an event.… |
| Status | integer | no | The status of the rule. Valid values: 0: disabled 100: enabled |
| CurrentPage | integer | yes | The page number. The value must be 1 or greater |
| PageSize | integer | yes | The number of entries per page. The maximum value is 100 |
| RoleType | integer | no | The view type. 0: the view of the current Alibaba Cloud account. 1: the view of all accounts that belong to the enterprise |
| RoleFor | integer | no | The ID of the member to which the administrator switches |
| RegionId | string | no | The region of the Data Management center. Select a region based on the region where your assets are located. Valid values: cn-hangzhou:… |
| ResponseRuleType | string | no | The type of the response rule. preset: predefined custom: custom |

### Lists the multi-cloud accounts that are bound to threat detection and response
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/list-bind-account` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| CloudCode | string | yes | The code of the multi-cloud provider. Valid values: qcloud: Tencent Cloud. hcloud: Huawei Cloud |
| RegionId | string | no | The region where the threat detection and response data management center resides. Specify the management center based on the region where… |
| RoleFor | integer | no | The ID of the member to which the administrator switches the view |
| RoleType | integer | no | The view type. Valid values: 0: the current Alibaba Cloud account view. 1: the view of all accounts in the enterprise |

### Enumerates all data sources
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/list-bind-data-sources` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| AccountId | string | yes | The cloud account ID |
| CloudCode | string | yes | The code of the multi-cloud provider |
| RegionId | string | no | The region where the threat analysis data management center resides. Select the management center region based on the region of your… |

### Retrieves a list of custom rules
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/list-cloud-siem-customize-rules` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| Id | string | no | The ID of the custom rule |
| StartTime | integer | no | The start time of the query. The value is a UNIX timestamp. Unit: milliseconds |
| EndTime | integer | no | The end time of the query. The value is a UNIX timestamp. Unit: milliseconds |
| ThreatLevel | string | no | The threat level. The value is a JSON array. Valid values: serious: high suspicious: medium remind: low (JSON-encoded) |
| AlertType | string | no | The alert type |
| RuleName | string | no | The name of the rule. The name can contain letters, digits, underscores (_), and periods (.) |
| RuleType | string | no | The type of the rule. Valid values: predefine: predefined customize: custom |
| Status | integer | no | The status of the rule. Valid values: 0: initial 10: testing with simulated data 15: testing with business data 20: testing with business… |
| OrderField | string | no | The field that you use to sort the custom rules. Valid values: GmtModified: sorts the rules by modification time. Id: sorts the rules by… |
| Order | string | no | The order in which you want to sort the custom rules. Valid values: desc: descending order asc: ascending order |
| CurrentPage | integer | yes | The page number. Pages start from page 1 |
| PageSize | integer | yes | The number of entries per page. Maximum value: 100 |
| RoleType | integer | no | The view type. 0: the view of the current Alibaba Cloud account. 1: the view of all members in the enterprise |
| RoleFor | integer | no | The user ID that is used to switch the administrator's view to the view of a member |
| RegionId | string | no | The region where the data management center of Threat Analysis is deployed. You must select the region where your assets reside. Valid… |

### Retrieves a list of predefined rules
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/list-cloud-siem-predefined-rules` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| Id | string | no | The rule ID |
| StartTime | integer | no | The start of the time range to query. This value is a UNIX timestamp in milliseconds |
| EndTime | integer | no | The end of the time range to query. This value is a UNIX timestamp in milliseconds |
| ThreatLevel | string | no | The threat level. The value is a JSON array. Valid values: serious: high suspicious: medium remind: low (JSON-encoded) |
| AlertType | string | no | The alert type |
| RuleName | string | no | The rule name. The name can contain only letters, digits, underscores (_), and periods (.) |
| RuleType | string | no | The rule type. Valid values: predefine: predefined customize: custom |
| EventTransferType | string | no | The event generation method. Valid values: default: the default built-in method singleToSingle: An event is generated for each alert.… |
| AttCk | string | no | The ATT\&CK technique |
| LogSource | string | no | The log source |
| Status | integer | no | The rule status. Valid values: 0: initial 10: testing with simulated data 15: testing with production data 20: testing with production… |
| OrderField | string | no | The field to sort the rules by. Valid values: GmtModified: Sorts by modification time. Id: Sorts by rule ID. This is the default value |
| Order | string | no | The sort order. Valid values: desc: descending asc: ascending |
| CurrentPage | integer | yes | The page number. The value must be greater than or equal to 1 |
| PageSize | integer | yes | The number of entries per page. The maximum value is 100 |
| RoleType | integer | no | The view type. 0: the view of the current Alibaba Cloud account. 1: the view of all accounts in the enterprise |
| RoleFor | integer | no | The user ID that the administrator uses to switch to the perspective of a member |
| RegionId | string | no | The region where the Data Management center of the threat analysis feature is located. Select the region where your assets are located.… |

### Queries the list of test results for custom rules
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/list-customize-rule-test-result` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| Id | integer | no | The ID of the custom rule |
| CurrentPage | integer | yes | The current page number. The value must be greater than or equal to 1 |
| PageSize | integer | yes | The number of entries per page. Maximum value: 100 |
| RoleType | integer | no | The view type. Valid values: 0: the view of the current Alibaba Cloud account 1: the view of all accounts in the enterprise |
| RoleFor | integer | no | The ID of the user whose view the administrator switches to |
| RegionId | string | no | The region where the data management center of Threat Analysis is located. Select the region of the management center based on the region… |
| DetectionRuleId | string | no | The ID of the custom rule. You can obtain the rule ID by calling the rule list API operation |
| VerifyType | string | no | The verification result of the accuracy of alert fields based on the alert template. Valid values: true: Passed. Alerts from enabled rules… |
| StartTime | integer | no | The start time. The value is a UNIX timestamp in milliseconds |
| EndTime | integer | no | The end time. The value is a UNIX timestamp in milliseconds |

### Queries the list of logs under a data source
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/list-data-source-logs` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| DataSourceInstanceId | string | yes | The data source ID, which is an MD5 hash generated by Cloud Threat Detection and Response (CTDR) based on specific parameters |
| AccountId | string | yes | The Alibaba Cloud account ID |
| CloudCode | string | yes | The code of the cloud service provider. Valid values: qcloud: Tencent Cloud. aliyun: Alibaba Cloud. hcloud: Huawei Cloud |
| RegionId | string | no | The region in which the data management center of threat detection and response resides. Select the management center based on the region… |

### Enumerates the multi-cloud data source types that are supported by threat analysis
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/list-data-source-types` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| CloudCode | string | yes | The code of the multi-cloud provider |
| RegionId | string | no | The region where the threat analysis data management center resides. Specify the management center based on the region of your assets.… |

### Lists the products and logs that are connected to threat analysis for an enterprise or a member, and the…
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/list-delivery` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| RoleType | integer | no | The type of view. Valid values: 0: The view for the current Alibaba Cloud account. 1: The view for all accounts in the enterprise |
| RoleFor | integer | no | The Alibaba Cloud account ID of a member. An administrator can use this parameter to view data from the perspective of the member |
| RegionId | string | no | The region of the data management center for threat analysis. Select the region based on where your assets are located. Valid values:… |

### Queries the list of system-recommended response policies
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/list-dispose-strategy` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| SophonTaskId | string | no | The ID of the Security Orchestration, Automation, and Response (SOAR) response policy |
| EntityIdentity | string | no | The identity value of the entity. You can use this parameter to perform a fuzzy search for the entity |
| EntityType | string | no | The type of the entity. Valid values: ip: IP address. process: Process. file: File |
| PlaybookName | string | no | The unique name of the playbook |
| PlaybookUuid | string | no | The UUID of the playbook |
| PlaybookTypes | string | no | The type of the playbook. Valid values: system: Manual response. custom: Event-triggered playbook. custom_alert: Alert-triggered playbook.… |
| EffectiveStatus | integer | no | The status of the policy. Valid values: 0: Invalid. 1: Valid |
| OrderField | string | no | The field by which to sort the results. Valid values: GmtModified: Sort by update time. GmtCreate: Sort by creation time. FinishTime: Sort… |
| Order | string | no | The sort order. Valid values: desc: Descending order. asc: Ascending order |
| StartTime | integer | yes | The start time of the query. Unit: milliseconds |
| EndTime | integer | yes | The end time of the query. Unit: milliseconds |
| Status | integer | no | The status of the response policy |
| CurrentPage | integer | yes | The page number of the current page. The value must be greater than or equal to 1 |
| PageSize | integer | yes | The number of entries per page. Maximum value: 100 |
| RoleType | integer | no | The type of the view. Valid values: 0: The view of the current Alibaba Cloud account. 1: The view of all accounts in the enterprise |
| RoleFor | integer | no | The Alibaba Cloud account ID of the member whose view the administrator switches to |
| RegionId | string | no | The region where the data management center of Threat Analysis and Response is located. You must select the region of the management… |
| IncidentUuid | string | no | The ID of the incident |
| QueryMode | string | no | The query mode |
| GroupBy | string | no | The grouping dimension |
| GroupKey | string | no | The grouping key |
| ResponseRuleId | string | no | The ID of the response rule |
| MaxResults | integer | no | The maximum number of records to return for a single query |
| NextToken | string | no | The pagination token for the next page |
| StrategyId | string | no | The ID of the response policy |
| AlertUuid | string | no | The UUID of the alert |
| EntityUuidList | string | no | The list of entity UUIDs (JSON-encoded) |

### Queries a list of entities
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/list-entities` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| IncidentUuid | string | yes | The incident ID |
| EntityType | string | no | The entity type. Valid values: |
| EntityName | string | no | The entity name |
| EntityUuid | string | no | The entity UUID |
| EntityUuids | string | no | The list of entity UUIDs |
| MalwareType | string | no | The malware entity type |
| IsMalwareEntity | string | no | Specifies whether the entity is malicious. Valid values: |
| Tags | string | no | The entity tags. The value is a JSON array string: `"[{"tagKey1":"tagValue1"},{"tagKey2":"tagValue2"}]"` |
| CurrentPage | integer | yes | The current page number, which must be greater than or equal to 1 |
| PageSize | integer | yes | The number of entries per page, up to a maximum of 100 |
| RoleType | integer | no | The view type |
| RoleFor | integer | no | The user ID of the member to which the administrator switches the view |
| RegionId | string | no | The region where the data management center of threat analysis is located. Select the management center based on the region of your… |

### Queries the log onboarding details for a product
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/list-imported-logs-by-prod` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| ProdCode | string | yes | The product code |
| CloudCode | string | yes | The multi-cloud code. Valid values: hcloud: Huawei Cloud. qcloud: Tencent Cloud. aliyun: Alibaba Cloud |
| RoleType | integer | no | The view type. Valid values: 0: View of the current Alibaba Cloud account. 1: View of all accounts in the enterprise |
| RoleFor | integer | no | The ID of the user whose perspective the administrator switches to |
| RegionId | string | no | The region where the data management center of Threat Analysis is located. Select the region of the management center based on the region… |

### Queries projects and Logstores based on the name patterns of the default SLS project and Logstore for an…
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/list-project-log-stores` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| SourceProdCode | string | yes | The code of the product to query |
| SourceLogCode | string | yes | The code of the log to query |
| SubUserId | integer | yes | The ID of the Alibaba Cloud account to query |
| RegionId | string | no | The region of the Data Management center for threat analysis. Specify the region based on where your assets are located. Valid values:… |

### Lists the Alibaba Cloud accounts that are managed by the multi-account control feature of Threat Analysis.…
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/list-rd-users` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| RegionId | string | no | The region where the Data Management center of Threat Analysis is located. Select the region of the Management Center based on the region… |

### Modifies a bound cloud account
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/modify-bind-account` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| AccessId | string | no | The AccessKey ID of the cloud account |
| AccountName | string | no | The name of the multi-cloud account |
| BindId | integer | yes | The ID of the binding record. This is the BindId returned by the ListBindAccount operation |
| AccountId | string | yes | The ID of the cloud account |
| CloudCode | string | yes | The code of the multi-cloud provider. Valid values: hcloud: Huawei Cloud. qcloud: Tencent Cloud |
| RegionId | string | no | The region where the threat detection and response (CTDR) data management center resides. Select the management center based on the region… |
| RoleFor | integer | no | The ID of the member account to which the administrator switches the view |
| RoleType | integer | no | The view type. Valid values: 0: The view of the current Alibaba Cloud account. 1: The view of all accounts in the enterprise |

### Modifies the description of an existing data source
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/modify-data-source` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| AccountId | string | no | The cloud account ID |
| DataSourceType | string | yes | The data source type. Valid values: ckafka: Tencent Cloud CKafka. obs: Huawei Cloud OBS. wafApi: Tencent Cloud WAF attack log download API |
| DataSourceInstanceId | string | yes | The data source ID, which is an MD5 hash generated by threat detection and response based on specific parameters. You can call… |
| DataSourceInstanceName | string | no | The name of the data source |
| DataSourceInstanceRemark | string | no | The remarks of the data source |
| DataSourceInstanceParams | string | no | The data source parameters in JSON array format |
| CloudCode | string | yes | The code of the cloud provider. Valid values: qcloud: Tencent Cloud. aliyun: Alibaba Cloud. hcloud: Huawei Cloud |
| RegionId | string | no | The region where the Cloud Threat Detection and Response (CTDR) data management center is located. Specify the management center based on… |

### Modifies the description of a log added to a data source
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/modify-data-source-log` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| LogCode | string | no | The log code |
| AccountId | string | no | The Alibaba Cloud account ID |
| DataSourceType | string | no | The data source type. Valid values: obs: Huawei Cloud OBS. wafApi: Tencent Cloud WAF download API. ckafka: Tencent Cloud CKafka |
| DataSourceInstanceId | string | yes | The data source ID, which is an MD5 hash generated by Cloud Threat Detection and Response (CTDR) based on specific parameters. You can… |
| DataSourceInstanceLogs | string | yes | The details of the data source parameters, in JSON array format |
| LogInstanceId | string | yes | The log ID, which is an MD5 hash generated by CTDR based on specific parameters. You can call… |
| CloudCode | string | yes | The code of the cloud service provider. Valid values: qcloud: Tencent Cloud. aliyun: Alibaba Cloud. hcloud: Huawei Cloud |
| RegionId | string | no | The region where the CTDR data management center resides. Select the management center based on the region of your assets. Valid values:… |

### Enables log delivery for onboarded cloud services
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/open-delivery` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| ProductCode | string | yes | The code of the cloud service. Valid values: qcloud_waf qlcoud_cfw hcloud_waf hcloud_cfw ddos sas cfw config csk fc rds nas apigateway cdn… |
| LogCode | string | no | The log code of the cloud service, such as the process log in Security Center. This parameter is optional. If you do not specify this… |
| RoleType | integer | no | The view type. Valid values: 0: the view of the current Alibaba Cloud account. 1: the view of all accounts in the enterprise |
| RoleFor | integer | no | The ID of the member whose perspective the administrator switches to |
| RegionId | string | no | The region where the data management center of Threat Analysis is located. You must select the region of the management center based on… |

### Adds or updates an automated response rule
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/post-automate-response-config` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| Id | integer | no | The ID of the automated response rule |
| SubUserId | integer | no | The ID of the user who created the rule |
| RuleName | string | no | The name of the automated response rule |
| AutoResponseType | string | no | The type of the automated response. Valid values: event: event alert: alert |
| ExecutionCondition | string | no | The trigger condition of the automated response rule, in JSON format |
| ActionType | string | no | The type of the action. Separate multiple values with commas. Valid values: doPlaybook: execute playbook changeEventStatus: change event… |
| ActionConfig | string | no | The action configuration of the automated response rule, in JSON array format |
| RoleType | integer | no | The view type. Valid values: 0: The view of the current Alibaba Cloud account. 1: The view of all accounts in the enterprise |
| RoleFor | integer | no | The ID of the user whose perspective the administrator switches to |
| RegionId | string | no | The region where the data management center of Threat Analysis is located. Select the region of the management center based on the region… |

### Adds or updates a custom rule
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/post-customize-rule` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| Id | integer | no | The ID of the custom rule |
| RuleName | string | no | The name of the rule |
| RuleDesc | string | no | The description of the rule |
| ThreatLevel | string | no | The threat level. Valid values: serious: high suspicious: medium remind: low |
| AttCk | string | no | The ATT\&CK technique |
| AlertType | string | no | The threat type |
| AlertTypeMds | string | no | The Medusa code of the threat type |
| LogType | string | no | The log type of the rule |
| LogTypeMds | string | no | The Medusa code of the log type |
| LogSource | string | no | The log source of the rule |
| LogSourceMds | string | no | The Medusa code of the log source |
| RuleCondition | string | no | The query condition of the rule. The value is a JSON string |
| RuleGroup | string | no | The fields that are used to group logs. The value is a JSON array |
| RuleThreshold | string | no | The threshold configuration of the rule. The value is a JSON string |
| QueryCycle | string | no | The length of the rule window |
| EventTransferSwitch | integer | no | Specifies whether to convert alerts into events. Valid values: 0: no 1: yes |
| EventTransferType | string | no | The event generation method. Valid values: default: the default method singleToSingle: An event is generated for each alert. allToSingle:… |
| EventTransferExt | string | no | The extended information for event generation. This parameter is returned only when EventTransferType is set to allToSingle. The value… |
| RoleType | integer | no | The view type. 0: the view of the current Alibaba Cloud account. 1: the view of all accounts that are managed by the administrator |
| RoleFor | integer | no | The user ID that is used to switch the administrator's perspective to a member's perspective |
| RegionId | string | no | The region where the data management center of Threat Analysis is located. Select the region where your assets are located. Valid values:… |

### Submits a custom rule for testing
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/post-customize-rule-test` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| Id | integer | no | The ID of the custom rule |
| TestType | string | no | The test type. Valid values: simulate: tests the rule with simulated data business: tests the rule with business data |
| SimulatedData | string | no | The simulated data for the test. This parameter is required only when TestType is set to simulate |
| RoleType | integer | no | The view type. 0: the view of the current Alibaba Cloud account. 1: the view of all accounts in the enterprise |
| RoleFor | integer | no | The user ID of the member that the administrator wants to impersonate to view data |
| RegionId | string | no | The region where the Data Management center of threat analysis is located. Select the region based on the region where your assets are… |

### Submits incident handling information, updates the incident status, and updates the incident severity level
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/post-event-dispose-and-whiterule-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| ClientToken | string | no | The idempotency token |
| IncidentUuid | string | no | The globally unique UUID of the incident |
| Status | integer | no | The incident status. Valid values: 0: unhandled 1: handling 5: handling failed 10: handled |
| Remark | string | no | The remarks for the incident |
| EventDispose | string | no | The incident handling configuration as a JSON object |
| ReceiverInfo | string | no | The alert recipient configuration as a JSON object |
| RoleType | integer | no | The view type. Valid values: 0: the China account view. 1: the view of all accounts in the enterprise |
| RoleFor | integer | no | The ID of the user for whom the administrator switches to a member view |
| RegionId | string | no | The region where the threat analysis data management center resides. Specify the management center based on the region of your assets.… |
| ThreatLevel | string | no | The threat level. Valid values: serious: high suspicious: medium remind: low |
| Owner | string | no | The account UID of the incident owner |
| ResponseSource | string | no | The source of the handling policy |
| DisposeStrategyIds | string | no | The list of handling policy IDs |
| SyncAlertStatus | string | no | Specifies whether to restore associated handled alerts to unhandled status when reopening the incident |

### Submits alert whitelisting rules
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/post-event-whiterule-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| IncidentUuid | string | no | The globally unique ID of the event |
| WhiteruleList | string | yes | The alert whitelisting rule, which is a JSON object |
| RoleType | integer | no | The account scope to which the rule applies. Valid values: 0: The current Alibaba Cloud account. 1: All accounts within the enterprise |
| RoleFor | integer | no | The ID of a member account. An administrator can use this parameter to switch to the perspective of the member account |
| RegionId | string | no | The region where the threat analysis feature is deployed. Select the region where your assets are located. Valid values: cn-hangzhou: For… |

### Stops the custom rule test
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/post-finish-customize-rule-test` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| Id | integer | no | The ID of the custom rule |
| RoleType | integer | no | The view type. Valid values: 0: the view of the current Alibaba Cloud account 1: the view of all accounts in the enterprise |
| RoleFor | integer | no | The ID of the user whose perspective the administrator switches to |
| RegionId | string | no | The region where the data management center of Threat Analysis is located. Select the region of the management center based on the region… |

### Updates the status of a custom rule
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/post-rule-status-change` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| Ids | string | no | The list of rule IDs in JSON array format |
| RuleType | string | no | The rule type. Valid values: predefine: Predefined. customize: Custom |
| InUse | string | no | The enabling status of the rule. Valid values: true: Enabled. false: Disabled |
| RoleType | integer | no | The view type. Valid values: 0: The view of the current Alibaba Cloud account. 1: The view of all accounts in the enterprise |
| RoleFor | integer | no | The ID of the user whose perspective the administrator switches to |
| RegionId | string | no | The region where the data management center of Threat Analysis is located. Select the region based on the region where your assets are… |

### Releases storage space. This operation is irreversible and causes data loss. Use with caution
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/restore-capacity` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| RoleType | integer | no | The type of view. Valid values: 0: The view for the current Alibaba Cloud account. 1: The view for all accounts that belong to the… |
| RoleFor | integer | no | The user ID of the member. An administrator can use this parameter to switch to the perspective of a specific member |
| RegionId | string | no | The region where the Data Management center is located. Select a region based on the location of your assets. Valid values: cn-hangzhou:… |

### Saves user-configured storage information such as the storage duration and storage region
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/set-storage` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| Ttl | integer | yes | The log storage duration in days. Default value: 180. Minimum value: 30. Maximum value: 3000 |
| Region | string | no | The log storage region. If the data management center is located in cn-hangzhou, the default value of Region is Shanghai (cn-shanghai). If… |
| RoleType | integer | no | The view type. Valid values: 0: the view of the current Alibaba Cloud account. 1: the view of all accounts in the enterprise |
| RoleFor | integer | no | The ID of the user whose perspective the administrator switches to |
| RegionId | string | no | The region of the data management center for Threat Analysis. Select the region of the management center based on the region where your… |

### Submits log collection tasks in batches
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/submit-import-log-tasks` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| ProdCode | string | yes | The code of the product |
| LogCodes | string | no | The list of logs to be collected, in JSON array format |
| Accounts | string | no | The list of accounts to be collected, in JSON array format. Valid values: AccountId: the ID of the account to be collected. Imported:… |
| AutoImported | integer | no | Specifies whether to automatically collect logs from accounts that have the specified log configured. Valid values: 1: Automatically… |
| CloudCode | string | yes | The code of the cloud provider |
| RegionId | string | no | The location of the data management center of threat detection and response. Specify the management center location based on the region of… |
| RoleFor | integer | no | The user ID used when an administrator switches to the perspective of another member |
| RoleType | integer | no | The view type. Valid values: 0: the view of the current Alibaba Cloud account. 1: the view of all accounts in the enterprise |

### Updates the status of automated response rules
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/update-automate-response-config-status` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| Ids | string | no | The IDs of the automated response rules, formatted as a JSON array |
| InUse | string | no | The enabling status of the rule. Valid values: true: Enabled. false: Disabled |
| RoleType | integer | no | The view type. Valid values: 0: the view of the current Alibaba Cloud account. 1: the view of all accounts in the enterprise |
| RoleFor | integer | no | The ID of the user whose perspective the administrator switches to |
| RegionId | string | no | The region where the data management center of Threat Analysis is located. Select the region of the management center based on the region… |

### Adds or updates alert whitelist rules
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/update-white-rule-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| WhiteRuleId | integer | yes | The unique ID of the whitelist rule |
| IncidentUuid | string | no | The global unique ID of the event |
| Expression | string | yes | The alert whitelist rule. This is a JSON object |
| RoleType | integer | no | The view type. 0: The view of the current Alibaba Cloud account. 1: The view of all accounts that belong to the enterprise |
| RoleFor | integer | no | The user ID of the member. This parameter is used when an administrator switches to the perspective of a member |
| RegionId | string | no | The region of the Data Management center for threat analysis. Select a region for the Data Management center based on the region of your… |

### version
`POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/version` (byok)

## Example
```
curl "https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/add-data-source" \
  -H "x-api-key: $APIZIE_KEY" \
  -H "x-upstream-key: $PROVIDER_KEY"
```

## FAQ

### How do I call the Alibaba Cloud Security Center API?
Create a free Apizie key, then send POST https://zieapi.vercel.app/v1/cloud:aliyun-cloud-siem/add-data-source with the header x-api-key. Every endpoint returns { project, data, timestamp }.

### Is the Alibaba Cloud Security Center API free on Apizie?
Yes. The Free plan includes 1,000 requests a month at 100 requests a minute, no credit card. Alibaba Cloud Security Center itself also needs your own key from aliyuncs.com.

### Can AI agents use the Alibaba Cloud Security Center API?
Yes. Add the Apizie MCP server (https://zieapi.vercel.app/mcp) to Claude, ChatGPT, Cursor or VS Code, then ask in plain language. The agent calls run_scraper with project key cloud:aliyun-cloud-siem.

### What is the status of the Alibaba Cloud Security Center API?
Needs your own provider key (bring your own key)