Cloud Security Center CWPP Alert Handling Skill

Scenario Description

This skill helps users query and handle CWPP host security alerts from Alibaba Cloud Security Center (SAS/Aegis).

Core Capabilities:

• - Query security alert list
• Analyze alert details and recommend handling methods
• Execute alert handling operations (ignore, whitelist, block, quarantine, etc.)
• Query handling status and summarize results

Architecture: Alibaba Cloud Security Center (SAS) + RAM Permissions + CLI Tools

---

Installation Requirements

Pre-check: Aliyun CLI >= 3.3.1
Run aliyun version to verify version >= 3.3.1. If not installed or version is too low,
see references/cli-installation-guide.md for installation instructions.
Then [MUST] run aliyun configure set --auto-plugin-install true to enable automatic plugin installation.

CODEBLOCK0

---

Authentication Configuration

Pre-check: Alibaba Cloud Credentials Required
Security Rules:

• - NEVER read, output, or print AK/SK values
• NEVER ask users to input AK/SK directly
• ONLY use aliyun configure list to check credential status

> aliyun configure list
> 

Check the output for a valid profile. If no valid profile exists, STOP here.

---

RAM Permission Requirements

Permission Name	Description
INLINECODE5	Query alert list
INLINECODE6

Query available operations | | yundun-sas:HandleSecurityEvents | Handle alerts | | yundun-sas:DescribeSecurityEventOperationStatus | Query handling status |

For detailed policies, see references/ram-policies.md

[MUST] Permission Failure Handling: When permission errors occur:

1. 1. Read references/ram-policies.md for required permissions
2. Use ram-permission-diagnose skill to guide user
3. Wait until user confirms permissions granted

---

Core Workflow

Step 0: Identify Query Scenario (Critical)

⚠️ IMPORTANT: Choose the correct API based on user input

Scenario	User Input Example	Correct Approach
User specified alert ID	"Query alert 702173474"	Directly call INLINECODE11
User did not specify alert ID

"View my alerts" | Execute Step 1 to query alert list |

Scenario A: User specified alert ID → Verify alert exists:

aliyun sas DescribeSecurityEventOperations \
  --SecurityEventId {AlertID} \
  --Lang zh \
  --user-agent AlibabaCloud-Agent-Skills

• - Success → Alert exists, proceed to Step 5
• Failure (SecurityEventNotExists) → See references/error-handling.md

Scenario B: User did not specify alert ID → Proceed to Step 1

---

Step 1: Query Alert List

CODEBLOCK3

Key Response Fields:

Field	Description
Id	Alert event ID (core field)
AlarmEventNameDisplay

Alert name |
| AlarmEventType | Alert type |
| Level | Severity (serious/suspicious/remind) |
| EventStatus | 1=pending, 2=ignored, 8=false positive, 32=completed |

---

Step 2: Display Alert Information and Recommendations

Display Format:
CODEBLOCK4

For operateCode mappings and recommendation rules, see references/operation-codes.md

---

Step 3: Determine Handling Intent

Case A: User specified handling method → Proceed to Step 4

Case B: User did not specify → Must ask user:

Please confirm how to handle these alerts:

1. ✅ Handle all using recommended methods
2. 🔧 Custom handling method
3. ❌ Cancel

Please select (enter number):

---

Step 4: Query Available Handling Operations

⚠️ Strict Constraint: Each alert's available operations must be queried individually

• - NEVER assume one alert's operations apply to another
• MUST call DescribeSecurityEventOperations for each alert

CODEBLOCK6

⚠️ Critical: Only execute operations where UserCanOperate=true

---

Step 5: Build Parameters and Execute

Quick Reference - Common Operations:

OperationCode	OperationParams	Notes
blockip	INLINECODE15	expireTime = current + duration (ms)
killand_quara

{"subOperation":"killAndQuaraFileByMd5andPath"} | |
| virus_quara | {"subOperation":"quaraFileByMd5andPath"} | |
| quara | {} | |
| ignore | {} | |
| manual_handled | {} | |
| advancemarkmis_info | {} + MarkMissParam | See workflow-details.md |

Example - ignore:
CODEBLOCK7

Example - killandquara:
CODEBLOCK8

Example - block_ip (7 days):
CODEBLOCK9

Example - advancemarkmis_info:
CODEBLOCK10

⚠️ For advanced whitelist (advancemarkmis_info):

• - Must ask user about whitelist rules and scope
• Must preserve existing MarkField rules
• See references/workflow-details.md for detailed process

For complete CLI examples and parameter details, see references/workflow-details.md

---

Step 6: Query Handling Status

⚠️ CLI Requirement: Must pass both TaskId and SecurityEventIds

CODEBLOCK11

Polling Logic:

1. 1. TaskStatus=Processing → Wait 2s, retry (max 5 times)
2. After 10s still not complete → Mark as failed
3. INLINECODE23 → Handling successful
4. INLINECODE24 → Check ErrorCode

---

Step 7: Loop to Handle Other Alerts

If there are other alerts, repeat Steps 3-6. Maximum 20 alerts per batch.

---

Step 8: Results Summary

CODEBLOCK12

For detailed format, see references/error-handling.md

---

operateCode Quick Reference

operateCode	Description	Additional Params
blockip	Block IP	expireTime (required)
killand_quara

Kill and Quarantine | subOperation (required) |
| virus_quara | Quarantine File | subOperation (required) |
| quara | Quarantine | None |
| advancemarkmis_info | Advanced Whitelist | MarkMissParam |
| ignore | Ignore | None |
| manual_handled | Mark as Handled | None |
| kill_process | Kill Process | None |

For complete operateCode categories and details, see references/operation-codes.md

---

Error Handling

Error Scenario	Handling Method
UserCanOperate=false	Operation not supported, version limitation
Timeout (>10s)

Mark as failed, continue next |
| *.AgentOffline | Client offline, cannot handle |
| *.ProcessNotExist | Suggest using virusquarabin |
| NoPermission | Contact admin for authorization |
| SecurityEventNotExists | Search in handled alerts first |

For detailed error handling procedures, see references/error-handling.md

---

Best Practices

1. 1. Query before handling: Call DescribeSecurityEventOperations first
2. Batch limit: Maximum 20 alerts per batch
3. Preserve existing rules: When using advanced whitelist, merge existing MarkField rules
4. Timeout handling: Polling over 10 seconds = failed
5. User confirmation: Must confirm intent before handling
6. Logging: Record all operations for auditing

---

Reference Documents

Document	Description
references/workflow-details.md	Detailed workflow, CLI examples, advanced whitelist
references/operation-codes.md

Complete operateCode reference | | references/error-handling.md | Error handling procedures | | references/related-apis.md | API parameter details | | references/ram-policies.md | RAM permission policies | | references/verification-method.md | Verification methods | | references/cli-installation-guide.md | CLI installation guide |