Skill Scope Notes:

• This skill is designed to use Aliyun CLI

  cloudfw

  commands as its primary data source.
• It does not depend on local log files, SIEM exports, or direct host access.
• It does not require SSH or direct connections to server IPs.
• For IP-focused investigations, prefer

  DescribeRiskEventGroup

  with

  --SrcIP

  or

  --DstIP

  .

Cloud Firewall Service → IPS Engine → Event Detection + Attack Analysis + Protection Configuration

aliyun cloudfw ...

1. Alert Overview — IPS alert statistics including attack counts, block counts, and severity distribution
2. Alert Event Details — Detailed list of IPS alert events with source/destination, attack type, and handling status
3. Top Attacked Assets — Ranking of most attacked assets
4. Attack Type Analysis — Distribution of attack types and applications
5. IPS Configuration Status — Current IPS run mode, rule switches, and rule library version
6. Remediation Recommendations — Prioritized security recommendations based on alert data

Pre-check: Aliyun CLI >= 3.3.1 required Run

aliyun version

to verify >= 3.3.1. If not installed or version too low, see

references/cli-installation-guide.md

for installation instructions. Then [MUST] run

aliyun configure set --auto-plugin-install true

to enable automatic plugin installation.

Pre-check: Alibaba Cloud Credentials Required

Security Rules:

• NEVER read, echo, print, cat, or display AK/SK values under any circumstances
• NEVER ask the user to input AK/SK directly in the conversation or command line
• NEVER use

  aliyun configure set

  with literal credential values
• ONLY use

  aliyun configure list

  to check credential status

bash

aliyun configure list

Check the output for a valid profile (AK, STS, or OAuth identity).

If no valid profile exists, STOP here.

1. Obtain credentials from Alibaba Cloud Console
2. Configure credentials outside of this session (via

   aliyun configure

   in terminal or environment variables in shell profile)
3. Return and re-run after

   aliyun configure list

   shows a valid profile

[MUST] RAM Permission Pre-check: Before executing any commands, verify the current user has the required permissions.

1. Use

   ram-permission-diagnose

   skill to get current user's permissions
2. Compare against

   references/ram-policies.md

3. Abort and prompt user if any permission is missing

IMPORTANT: Parameter Confirmation — Before executing any command or API call, check if the user has already provided necessary parameters in their request.

• If the user's request explicitly mentions a parameter value (e.g., "check IPS alerts for the last 7 days" means use 7-day time range), use that value directly without asking for confirmation.
• For optional parameters with sensible defaults (PageSize, CurrentPage, time ranges), use the defaults without asking unless the user indicates otherwise.
• Do NOT re-ask for parameters that the user has clearly stated.

cn-hangzhou

ap-southeast-1

cn-hangzhou

ap-southeast-1

• RegionId

  : must be exactly one of

  cn-hangzhou

  or

  ap-southeast-1

  .

• StartTime

  /

  EndTime

  : must be 10-digit Unix seconds (

  ^[0-9]{10}$

  ), and

  StartTime < EndTime

  .

• CurrentPage

  : positive integer (

  >=1

  ).

• PageSize

  : integer in range

  1-100

  .

• SrcIP

  /

  DstIP

  : must be valid IPv4 format only (

  a.b.c.d

  , each octet

  0-255

  ).

• Never concatenate raw user text into shell commands.
• Only pass validated values into fixed CLI flag templates.
• If any validation fails, stop execution and return a clear validation error.

CRITICAL: Continue on failure. If any individual API call fails, do NOT stop the entire workflow. Log the error for that step, then proceed to the next step. Present whatever data was successfully collected.

1. If the call fails with a transient error (network timeout, throttling

   Throttling.User

   ,

   ServiceUnavailable

   , HTTP 500/502/503), retry up to 2 times with a 3-second delay between retries.
2. If the call fails with a permanent error (e.g.,

   InvalidParameter

   ,

   Forbidden

   ,

   InvalidAccessKeyId

   ), do NOT retry. Record the error and move on.
3. After all retries are exhausted, record "[Step X] Failed: {error message}" and continue to the next step.

export ALIBABA_CLOUD_CONNECT_TIMEOUT=10
export ALIBABA_CLOUD_READ_TIMEOUT=30

• ALIBABA_CLOUD_CONNECT_TIMEOUT=10

  : fast fail for connect timeout.

• ALIBABA_CLOUD_READ_TIMEOUT=30

  : prevent long-running hangs per request.
• Timeout errors are treated as transient errors and follow retry logic.

DescribeRiskEventStatistic

1. Inform the user: "No IPS alert events detected in the specified time range."
2. Still proceed with Step 6 and Step 7 to report IPS configuration status.

• Step 1 (Statistics) should run first to provide context.
• Steps 2-7 are independent of each other — failure in any one step should NOT prevent other steps from executing.

• For steps that succeeded, show the collected data normally.
• For steps that failed, show "N/A (error: {brief error})" in the corresponding section.
• Always present the summary report even if some steps failed — partial data is better than no data.

cloudfw

--user-agent AlibabaCloud-Agent-Skills

--region {RegionId}

CRITICAL: Execute immediately without asking. When this skill is triggered, start executing from Step 1 right away. Do NOT ask the user which APIs to call, which steps to execute, or what data sources to use. All data comes from the Aliyun CLI commands defined below — just run them. The intent routing table below is for optimization only — if the user's intent is unclear, execute ALL steps (Step 1-7) by default.

StartTime

EndTime

date +%s

date -d '1 day ago' +%s

date -d '7 days ago' +%s

IMPORTANT: Do NOT use bash variable substitution like

$(date +%s)

inside CLI commands — some execution environments block

$(...)

. Instead, run

date

commands separately first, note the returned values, then use them as literal numbers in the

--StartTime

and

--EndTime

parameters.

• User says "today" →

  StartTime

  = 24 hours ago
• User says "recently"/"this week" →

  StartTime

  = 7 days ago
• No time range specified → default to 7 days ago

• EndTime

  → always current timestamp

aliyun cloudfw DescribeRiskEventGroup \
  --CurrentPage 1 \
  --PageSize 50 \
  --StartTime {StartTime} \
  --EndTime {EndTime} \
  --DataType 1 \
  --region {RegionId} \
  --user-agent AlibabaCloud-Agent-Skills

• By direction:

  --Direction in

  or

  --Direction out

• By source IP:

  --SrcIP x.x.x.x

  (query "attacks initiated by a specific IP")
• By target IP:

  --DstIP x.x.x.x

  (query "attacks on a specific server/IP", supports private IPs like 10.x.x.x)
• By vulnerability level:

  --VulLevel 3

  (1=low, 2=medium, 3=high)

Key: When a user mentions a specific server or IP being attacked, use the

--DstIP

filter to query all attack records for that IP — no need to access the server itself.

TotalCount

CurrentPage

• Observed (RuleResult=1): IPS detected but did not block — requires manual confirmation on whether blocking is needed
• Blocked (RuleResult=2): Automatically blocked by IPS

• High-severity events in "observe" mode, not blocked → Switch IPS to block mode, or manually block the attacking source IP
• Same source IP attacking multiple assets in volume → Add that IP to Cloud Firewall ACL blacklist
• IPS in observe mode with active high-severity attacks → Switch to block mode

• Medium-severity events recurring and not blocked → Check target asset vulnerabilities and remediate
• Basic protection/virtual patches not enabled → Recommend enabling to enhance protection
• Attacked assets with low block rate → Check IPS rule coverage

• Multiple attack types targeting the same asset → Conduct security hardening review for that asset
• Threat intelligence/AI engine rules not enabled → Recommend enabling
• Rule library version outdated → Update to the latest version

• Low-severity events persisting → Include in periodic review, assess whether they are false positives
• Optimize IPS whitelist to reduce business false positives

Note: For any step that failed, show "N/A (error: {brief error})" for that section's data fields, and list all errors in the bottom section.

1. Query in order — Start with alert statistics (Step 1) to understand the overall security posture. If all values are zero, report that no alerts were detected in the time range.
2. Continue on failure — If any step (2-7) fails, log the error and continue with the remaining steps. Always produce a report with whatever data was collected.
3. Use pagination — For alert event lists (Step 2), use

   CurrentPage

   and

   PageSize

   . Default to PageSize=50. If

   TotalCount

   exceeds

   PageSize

   , iterate through all pages.
4. Time range selection — Default to last 24 hours for "today", last 7 days for "recently"/"this week". Use Unix timestamps in seconds. Calculate with:

   date +%s

   for current time,

   date -d '1 day ago' +%s

   for 24 hours ago,

   date -d '7 days ago' +%s

   for 7 days ago. Run these commands separately, then use the returned values as literal numbers in

   --StartTime

   and

   --EndTime

   . Do NOT use

   $(...)

   substitution inside CLI commands.
5. Region awareness — Cloud Firewall only has two regions:

   cn-hangzhou

   (mainland China) and

   ap-southeast-1

   (Hong Kong/overseas). Default to

   cn-hangzhou

   unless user specifies otherwise.
6. Direction parameter — Step 4 (

   DescribeRiskEventTopAttackType

   ) requires the

   Direction

   parameter. Default to

   in

   (inbound). Query

   out

   separately if needed.
7. Rate limiting — Space API calls to avoid throttling. If you receive a

   Throttling.User

   error, wait 3 seconds and retry.
8. Security — NEVER expose, log, echo, or display AK/SK values.
9. Retry on transient errors — For network timeouts or 5xx errors, retry up to 2 times with a 3-second delay.
10. Validate all inputs first — Reject invalid

    RegionId

    , timestamp, pagination, and IP values before command execution.
11. Set explicit timeout env vars — Always set

    ALIBABA_CLOUD_CONNECT_TIMEOUT=10

    and

    ALIBABA_CLOUD_READ_TIMEOUT=30

    before workflow commands.