# Alibaba Cloud Agentic NDR API

> Alibaba Cloud Agentic NDR API on Apizie: 56 endpoints (Creates a blocking task for a specified IPv4 address or domain name, Creates access configurations for up to 100 specified public assets. You can locate assets by asset ID list…, Creates access configurations in batches for public assets that have not been accessed under the current…, Creates a private traffic diversion configuration for a specified VPC and selects the elastic network…, …) returned as clean JSON through one API key. Send your own provider key in the x-upstream-key header. Call it over REST at https://apizie.tech/v1/cloud:aliyun-ndr/{endpoint} or from Claude, ChatGPT and Cursor through the Apizie MCP server. Free plan: 1,000 requests a month.

- Project key: `cloud:aliyun-ndr`
- Category: Cloud
- Status: byok
- Source: https://api.alibabacloud.com/product/ndr
- Page: https://apizie.tech/api/cloud/aliyun-ndr
- OpenAPI: https://apizie.tech/api/cloud/aliyun-ndr/openapi.json

Alibaba Cloud OpenAPI for Agentic NDR (ndr, version 2024-01-24). Calls are signed with ACS3-HMAC-SHA256 using your AccessKey ID and secret.

## Endpoints

### Creates a blocking task for a specified IPv4 address or domain name
`POST https://apizie.tech/v1/cloud:aliyun-ndr/create-blocking-policy` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| BlockingType | string | yes | Required. The object type to block. Only ip (IPv4 address) and domain (domain name) are supported |
| BlockingEntity | string | yes | Required. The object to block. For the ip type, the value must be a single IPv4 address. IPv6 addresses, CIDR blocks, and 0.0.0.0 are not… |
| BlockingDirection | string | yes | Required. The direction of the blocking task. in indicates inbound, out indicates outbound, and bidirectional indicates both directions.… |
| BlockingReason | string | no | The description of the blocking reason. This parameter is optional |
| IncidentId | string | no | The ID of the associated security event. This parameter is optional and is not used to locate the blocking policy |
| BlockingExpireTime | integer | no | The expiration time of the blocking task. The value is a UNIX timestamp in milliseconds. If this parameter is omitted or set to 0, the… |
| Lang | string | no | The language parameter for compatibility. This parameter does not affect the business results or error messages of this API operation and… |

### Creates access configurations for up to 100 specified public assets. You can locate assets by asset ID list…
`POST https://apizie.tech/v1/cloud:aliyun-ndr/create-idc-traction` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| AssetId | string | no | The list of public assets IDs to be accessed. Specify at least one of AssetId or IpList. You can specify up to 100 assets. If both are… |
| IpList | string | no | The list of public IP addresses to be accessed. Specify at least one of AssetId or IpList. You can specify up to 100 IP addresses. If both… |

### Creates access configurations in batches for public assets that have not been accessed under the current…
`POST https://apizie.tech/v1/cloud:aliyun-ndr/create-idc-traction-for-all-asset` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| WithAutoAccess | string | no | Specifies whether to enable automatic access at the same time. If this parameter is set to true, access is enabled for current public… |

### Creates a private traffic diversion configuration for a specified VPC and selects the elastic network…
`POST https://apizie.tech/v1/cloud:aliyun-ndr/create-private-traction` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| VpcInstanceId | string | yes | The VPC instance ID |
| GwlbeVswInfoList | string | yes | The list of vSwitch configurations used by the Gateway Load Balancer endpoint (GWLBe). The list must contain one to two entries in… |
| MaxBandwidth | integer | yes | The private traffic diversion bandwidth, in Gbit/s. Valid values: 10 to 50. The value must be a multiple of 10 |
| MaxTraffic | integer | yes | The upper limit of private traffic diversion, in GB. A value of -1 indicates no limit |
| TimeConfig | string | yes | The traffic diversion time configuration. Supports fixed start and end times, or periodic schedules based on start time, end time, day of… |
| AutoAccess | string | no | Specifies whether to automatically access new ENIs subsequently added to the VPC |
| EniInstanceIdList | string | yes | The list of elastic network interface (ENI) instance IDs (JSON-encoded) |
| FilterRule | string | no | The filter rule snapshot used by new mirror sessions. If not specified, all traffic is collected. This does not replace the filter rules… |
| ClientToken | string | no | The idempotency token |

### Creates a private network traffic mirroring filter rule. You can configure both inbound and outbound…
`POST https://apizie.tech/v1/cloud:aliyun-ndr/create-private-traction-filter-rule` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| RuleName | string | yes | The filter rule name. The name must be fewer than 128 characters and cannot start with http:// or https:// |
| RuleDescription | string | no | The filter rule description. The description must be fewer than 256 characters and cannot start with http:// or https:// |
| IngressSubRules | string | no | The list of inbound filter sub-rules (JSON-encoded) |
| EgressSubRules | string | no | The list of outbound filter sub-rules (JSON-encoded) |
| RegionNo | string | no | The region ID |
| MemberUid | integer | no | The UID of one of the member accounts. If this parameter is not specified, the current account is used |

### Creates an inbound or outbound sub-rule in a specified filter rule
`POST https://apizie.tech/v1/cloud:aliyun-ndr/create-private-traction-filter-sub-rule` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| RuleId | string | yes | The ID of the filter rule |
| Direction | string | yes | The direction of the sub-rule. Ingress indicates the inbound direction. Egress indicates the outbound direction |
| Priority | integer | yes | The priority of the sub-rule. Valid values: 1 to 16777216. A smaller value indicates a higher priority. The priority must be unique within… |
| SubRuleAction | string | yes | The action to take on matched traffic. accept indicates that the traffic is collected. drop indicates that the traffic is not collected |
| Protocol | string | yes | The network protocol to match. ALL indicates all protocols. ICMP, TCP, and UDP indicate the corresponding protocols |
| SourceCidrBlock | string | yes | The source CIDR block in CIDR notation. 0.0.0.0/0 indicates all IPv4 addresses |
| SourcePortRange | string | yes | The source port range in the format of start port/end port, such as 80/443. -1/-1 indicates all ports. This parameter is required for the… |
| DestinationCidrBlock | string | yes | The destination CIDR block in CIDR notation. 0.0.0.0/0 indicates all IPv4 addresses |
| DestinationPortRange | string | yes | The destination port range in the format of start port/end port, such as 80/443. -1/-1 indicates all ports. This parameter is required for… |
| RegionNo | string | no | The region ID |
| MemberUid | integer | no | The UID of one of the member accounts. If this parameter is not specified, the current account is used |

### Synchronously deletes inactive blocking policies for specified entities
`POST https://apizie.tech/v1/cloud:aliyun-ndr/delete-blocking-policy` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| Entities | string | yes | The array of entities to operate on. The array must contain 1 to 100 items. Do not submit duplicate combinations of the same type and… |

### Cancels the access configuration of specified public assets. You can locate assets by asset ID list or…
`POST https://apizie.tech/v1/cloud:aliyun-ndr/delete-idc-asset-traction` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| AssetId | string | no | The list of public assets IDs for which you want to cancel access. Specify at least one of AssetId or IpList. If both are provided,… |
| IpList | string | no | The list of public IP addresses for which you want to cancel access. Specify at least one of AssetId or IpList. If both are provided,… |

### Disables private network traffic mirroring for a specified VPC. The operation is asynchronous and returns a…
`POST https://apizie.tech/v1/cloud:aliyun-ndr/delete-private-traction` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| VpcInstanceId | string | yes | The VPC instance ID |

### Deletes a specified private network traffic mirroring filter rule. Before deleting, ensure that the rule is…
`POST https://apizie.tech/v1/cloud:aliyun-ndr/delete-private-traction-filter-rule` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| RuleId | string | yes | The ID of the filter rule |
| RegionNo | string | no | The region ID |
| MemberUid | integer | no | The UID of the member accounts. If not specified, the current account is used |

### Deletes a sub-rule from a specified filtering rule
`POST https://apizie.tech/v1/cloud:aliyun-ndr/delete-private-traction-filter-sub-rule` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| RuleId | string | yes | The filtering rule ID |
| SubRuleId | string | yes | The filtering sub-rule ID |
| RegionNo | string | no | The region ID |
| MemberUid | integer | no | The UID of the member accounts. If this parameter is not specified, the current account is used |

### Queries statistics of alerting records associated with a specified event, grouped by rule, attack…
`POST https://apizie.tech/v1/cloud:aliyun-ndr/describe-alert-agg-ana-ip-item-group-with-incident` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| Page | integer | no | The page number. Pages start from 1. Default value: 1 |
| PageSize | integer | no | The number of entries per page. Default value: 10. Maximum value: 100 |
| IncidentUuid | string | yes | The ID of the security event. You can call ListIncidents to obtain this value |
| AttackResult | string | no | The list of attack results. Valid values: 1: attempted attack. 2: successful attack. 3: compromised (JSON-encoded) |
| RuleUuid | string | no | The ID of the alert rule. You can obtain this value from the AlertRuleId field in alert aggregation records |
| Ip | string | no | The IP address of the attacker or victim. Exact match is used |
| Domain | string | no | The filter condition for the associated domain of the alerting record |
| GroupBy | string | yes | The grouping dimension. Valid values: RULE_UUID: rule. CATEGORY_ID: attack categorization. MEMBER_UID: member accounts |
| Lang | string | no | The language of the response content. Valid values: zh: Chinese. en: English. Default value: zh |
| RiskLevel | string | no | The list of alert risk levels. Valid values: 1: low-risk alert. 2: medium-risk alert. 3: high-risk alert (JSON-encoded) |

### Queries aggregated alert records for a specified entity within a given time range by paging. Records are…
`POST https://apizie.tech/v1/cloud:aliyun-ndr/describe-alert-agg-ana-ip-item-with-entity` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| Page | integer | no | The page number. Pages start from 1. Default value: 1 |
| PageSize | integer | no | The number of records per page. Default value: 10. Maximum value: 100 |
| EntityUuid | string | yes | The entity ID. You can obtain this value from ListEntities |
| FromTime | integer | yes | The start time of the query. This value is a UNIX timestamp in milliseconds. Use this parameter together with ToTime |
| ToTime | integer | yes | The end time of the query. This value is a UNIX timestamp in milliseconds. The value cannot be earlier than FromTime |
| AttackResult | string | no | The list of attack results. Valid values: 1: attack attempt. 2: attack succeeded. 3: compromised (JSON-encoded) |
| RuleUuid | string | no | The alert rule ID. You can obtain this value from the AlertRuleId field in aggregated alert records |
| Ip | string | no | The attacker or victim IP address. Exact match is used |
| Domain | string | no | The filter condition for the associated domain of the alerting record |
| MemberUid | integer | no | The Alibaba Cloud account ID of the member accounts |
| CategoryId | string | no | The list of alert category IDs. You can query these IDs by calling DescribeAlertCategoryList (JSON-encoded) |
| OrderBy | integer | no | The sort order. Valid values: 1: risk level in descending order. 2: latest alert time in descending order. 3: alert count in descending… |
| Lang | string | no | The language of the response content. Valid values: zh: Chinese. en: English. Default value: zh |
| RiskLevel | string | no | The list of alert risk levels. Valid values: 1: low. 2: medium. 3: high (JSON-encoded) |

### Queries alert aggregation records for a specified event by paging. You can filter records by topology edge,…
`POST https://apizie.tech/v1/cloud:aliyun-ndr/describe-alert-agg-ana-ip-item-with-incident` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| Page | integer | no | The page number. Pages start from 1. Default value: 1 |
| PageSize | integer | no | The number of records per page. Default value: 10. Maximum value: 500 |
| IncidentUuid | string | yes | The security incident ID. You can obtain this value from ListIncidents |
| IncidentEdgeUuid | string | no | The incident topology edge ID. You can use the Edges.Id value returned by DescribeIncidentTopologyGraph |
| AttackResult | string | no | The list of attack results. Valid values: 1: Attack attempt. 2: Attack succeeded. 3: Compromised (JSON-encoded) |
| RuleUuid | string | no | The alert rule ID. You can obtain this value from the AlertRuleId field in the alert aggregation record |
| Ip | string | no | The attacker or victim IP address. Exact match is used |
| Domain | string | no | The filter condition for the associated domain of the alerting record |
| MemberUid | integer | no | The Alibaba Cloud account ID of the member accounts |
| CategoryId | string | no | The list of alert category IDs. You can query these IDs by calling DescribeAlertCategoryList (JSON-encoded) |
| OrderBy | integer | no | The sort order. Valid values: 1: Descending order by risk level. 2: Descending order by latest alert time. 3: Descending order by alert… |
| Lang | string | no | The language of the response content. Valid values: zh: Chinese. en: English. Default value: zh |
| RiskLevel | string | no | The list of alert risk levels. Valid values: 1: low-risk alert. 2: medium-risk alert. 3: high-risk alert (JSON-encoded) |

### Queries raw alert records within a specified time range for a given rule by paging, including attacker and…
`POST https://apizie.tech/v1/cloud:aliyun-ndr/describe-alert-logs` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| FromTime | integer | yes | The start time of the query. This value is a UNIX timestamp in milliseconds. Use this parameter together with ToTime |
| ToTime | integer | yes | The end time of the query. This value is a UNIX timestamp in milliseconds. The value must not be earlier than FromTime |
| Page | integer | no | The page number. Pages start from 1. Default value: 1 |
| PageSize | integer | no | The number of records per page. Default value: 10. Maximum value: 100 |
| AlertRuleId | string | no | The alert rule ID. You can obtain this value from alert query results or by calling DescribeAlertRuleBaseMeta |
| AttackResult | string | no | The list of attack results. Valid values: 1: attack attempt. 2: successful attack. 3: compromised (JSON-encoded) |
| OffenderIp | string | no | The list of attacker IP addresses (JSON-encoded) |
| VictimIp | string | no | The list of victim IP addresses (JSON-encoded) |
| NetType | integer | no | The network type of the alert traffic. Valid values: 0: public network. 1: private network. If you do not specify this parameter, no… |
| OffenderVpcInstanceId | string | no | The VPC instance ID of the attacker |
| VictimVpcInstanceId | string | no | The VPC instance ID of the victim |
| FlowDecrypted | integer | no | The traffic decryption detection flag. Valid values: 0: not decrypted. 1: decrypted. If you do not specify this parameter, no filter is… |

### Queries blocking policies retained by the current account with paging, including their effective status,…
`POST https://apizie.tech/v1/cloud:aliyun-ndr/describe-blocking-policies` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| Page | integer | no | The page number, starting from 1. Default value: 1 |
| PageSize | integer | no | The number of records per page. Default value: 10. Values less than or equal to 0 are treated as 10, and values greater than 100 are… |
| BlockingType | string | no | The blocking type filter. ip indicates an IPv4 address, and domain indicates a domain name. If not specified, no type-based filtering is… |
| BlockingEntity | string | no | The blocking entity keyword. Performs a contains match against IPv4 addresses or domain names. If not specified, no entity-based filtering… |
| BlockingDirection | string | no | The direction filter. Performs an exact match against in, out, or bidirectional. If not specified, no direction-based filtering is… |
| BlockingStatus | integer | no | The blocking status of the policy. 0 indicates not effective, and 1 indicates effective. To check whether a task is still running, query… |
| StartTime | integer | no | The lower bound of the blocking time query range, as a Unix timestamp in milliseconds. The boundary is inclusive. If not specified, no… |
| EndTime | integer | no | The upper bound of the blocking time query range, as a Unix timestamp in milliseconds. The boundary is inclusive. If not specified, no… |
| SortField | string | no | The sort field. blocking_time sorts by the blocking time of the policy (default). blocking_count sorts by the total number of successful… |
| SortOrder | string | no | The sort direction. asc indicates ascending order, and desc indicates descending order. Default value: desc |
| MaxResults | integer | no | A reserved parameter for compatibility. This parameter does not control the number of returned records. Use PageSize to set the number of… |
| NextToken | string | no | A reserved parameter for compatibility. This operation does not support cursor-based pagination. Omit this parameter and use Page and… |

### Performs a paging query to retrieve task records and execution results for blocking, unblocking, policy…
`POST https://apizie.tech/v1/cloud:aliyun-ndr/describe-blocking-records` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| Page | integer | no | The page number. Pages start from 1. Default value: 1 |
| PageSize | integer | no | The number of entries per page. Default value: 10. If the value is less than or equal to 0, the value 10 is used. If the value is greater… |
| BlockingType | string | no | The blocking type filter. Valid values: ip: IPv4 addresses. domain: domain names. If this parameter is not specified, the results are not… |
| BlockingEntity | string | no | The keyword of the blocking entity. This parameter supports fuzzy match for IPv4 addresses or domain names. If this parameter is not… |
| BlockingDirection | string | no | The blocking direction filter. This parameter supports exact match. Valid values: in: inbound. out: outbound. bidirectional:… |
| TaskType | integer | no | The task type. Valid values: 0: manual blocking. 1: system blocking. 2: manual unblocking. 3: system unblocking. 4: configuration… |
| TaskStatus | integer | no | The task execution status. Valid values: 0: pending. 1: running. 2: successful. 3: failed. If this parameter is not specified, the results… |
| StartTime | integer | no | The lower bound of the task creation time. The value is a UNIX timestamp in milliseconds. The bound is inclusive. If this parameter is not… |
| EndTime | integer | no | The upper bound of the task creation time. The value is a UNIX timestamp in milliseconds. The bound is inclusive. If this parameter is not… |
| SortField | string | no | The field used to sort the results. Valid values: task_time: sorts the results by task creation time. This is the default value.… |
| SortOrder | string | no | The sort order. Valid values: asc: ascending order. desc: descending order. This is the default value |
| MaxResults | integer | no | A reserved parameter for compatibility. This parameter is not used to control the number of returned entries. Use PageSize to specify the… |
| NextToken | string | no | A reserved parameter for compatibility. This operation does not support cursor-based pagination. Do not specify this parameter. Use Page… |
| Lang | string | no | The language of the description. Valid values: zh: Chinese. en: English. If this parameter is not specified or is an empty string, Chinese… |

### Queries whether the blocking feature has data anomalies or disabled associated policies
`POST https://apizie.tech/v1/cloud:aliyun-ndr/describe-blocking-status` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |

### Queries the execute status and failed types of blocking-related tasks by task UUID with paging
`POST https://apizie.tech/v1/cloud:aliyun-ndr/describe-blocking-task-status` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| TaskUuids | string | no | The array of task UUIDs to query. A maximum of 100 items are supported. If you omit this parameter or pass an empty array, all tasks under… |
| Page | integer | no | The page number, starting from 1. Default value: 1 |
| PageSize | integer | no | The number of records per page. Default value: 10. If the value is less than or equal to 0, the value 10 is used. If the value is greater… |
| NextToken | string | no | A reserved parameter for compatibility. This operation does not support cursor-based pagination. Do not specify this parameter. Use Page… |
| MaxResults | integer | no | A reserved parameter for compatibility. This parameter does not control the number of returned records. Use PageSize to set the number of… |

### Queries the log storage version, delivery mode, storage quota, site-specific destinations, and the status of…
`POST https://apizie.tech/v1/cloud:aliyun-ndr/describe-delivery-destination` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |

### Queries the automatic onboarding master switch and the enablement status of each region and resource type
`POST https://apizie.tech/v1/cloud:aliyun-ndr/describe-idc-asset-auto-traction-config` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |

### Queries the recommended disposition status, action, summary, and detailed report for a specified entity
`POST https://apizie.tech/v1/cloud:aliyun-ndr/describe-incident-disposal-recommendation` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| EntityUuid | string | yes | The entity ID. You can obtain this ID from ListEntities |
| Lang | string | no | The language of the returned content. A value of zh indicates Chinese, and a value of en indicates English. Default value: zh |

### Queries the body, summary, conclusion status, and analysis time of a specified AI analysis report
`POST https://apizie.tech/v1/cloud:aliyun-ndr/describe-incident-investigation` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| IncidentInvestigationId | string | yes | The ID of the AI analysis report. You can obtain this value from [ListIncidentInvestigations](~~ListIncidentInvestigations~~) |
| Lang | string | no | The language of the returned content. Valid values: zh: Chinese. en: English. Default value: zh |

### Queries the entity nodes and attack associations of a specified security event
`POST https://apizie.tech/v1/cloud:aliyun-ndr/describe-incident-topology-graph` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| IncidentUuid | string | yes | The security event ID. You can call ListIncidents to obtain this value |
| Lang | string | no | The language of the response content. Valid values: zh: Chinese. en: English. Default value: zh |

### Queries a log delivery configuration change task for the current account by task ID. Returns the operation…
`POST https://apizie.tech/v1/cloud:aliyun-ndr/describe-log-delivery-task` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| TaskId | integer | yes | The log delivery task ID. The value must be no less than 1. Use the TaskId value returned by UpdateDeliveryDestination |

### Queries elastic network interfaces (ENIs) and their associated instances, private IP addresses, and accessed…
`POST https://apizie.tech/v1/cloud:aliyun-ndr/describe-private-asset-enis` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| VpcInstanceId | string | no | The VPC instance ID |
| VswInstanceIdList | string | no | The list of vSwitch instance IDs. If this parameter is not specified, results are not filtered by vSwitch (JSON-encoded) |
| TractionStatus | string | no | The accessed state of the elastic network interfaces (ENIs). A network interface controller (NIC) can be in one of the following states.… |
| EniInstanceIdList | string | no | The list of elastic network interfaces (ENIs) instance IDs. Each ID identifies a network interface controller (NIC) (JSON-encoded) |
| EniInstanceName | string | no | The name of the elastic network interfaces (ENIs). Specifies the network interface controller (NIC) name to filter by |
| EniType | string | no | The type of the elastic network interfaces (ENIs). Valid values: Primary: primary network interface controller (NIC). Secondary: secondary… |
| AssociatedInstanceIdList | string | no | The list of instance IDs associated with the network interface controllers (NICs) (JSON-encoded) |
| AssociatedInstanceName | string | no | The name of the instance associated with the elastic network interfaces (ENIs). Specifies the instance name bound to a network interface… |
| Page | integer | no | The page number. The value starts from 1 |
| PageSize | integer | no | The number of entries per page |
| RegionNo | string | no | The region ID |
| MemberUid | integer | no | The UID of a member accounts. If this parameter is not specified, the current account is used |
| PrivateIpAddress | string | no | The private IP address |

### Queries the private network assets in a specified VPC by page, including their accessed state, network…
`POST https://apizie.tech/v1/cloud:aliyun-ndr/describe-private-assets` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| VpcInstanceId | string | no | The VPC instance ID |
| VswInstanceIdList | string | no | The vSwitch instance IDs. If you do not specify this parameter, the query is not filtered by vSwitch (JSON-encoded) |
| TractionStatus | string | no | The accessed state of the private network asset. A value of 0 indicates that the asset is not accessed. A value of 1 indicates that some… |
| InstanceIdList | string | no | The instance IDs (JSON-encoded) |
| InstanceName | string | no | The instance name |
| Page | integer | no | The page number. Pages start from 1 |
| PageSize | integer | no | The number of entries to return on each page |
| RegionNo | string | no | The region ID |
| MemberUid | integer | no | The UID of the member account. If you do not specify this parameter, the current account is used |
| PrivateIpAddress | string | no | The private IP address |
| CloudType | string | no | Filters assets by asset type. Valid values: ecs, eci, and acs. If you do not specify this parameter or specify an empty string, all asset… |

### Queries the current private network traffic diversion configuration, used traffic, bandwidth, and execution…
`POST https://apizie.tech/v1/cloud:aliyun-ndr/describe-private-traction` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| VpcInstanceId | string | yes | The VPC instance ID |

### Queries private network traffic redirection filtering rules and their inbound and outbound sub-rules by paging
`POST https://apizie.tech/v1/cloud:aliyun-ndr/describe-private-traction-filter-rules` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| RuleName | string | no | The name of the filtering rule. The name must be fewer than 128 characters in length and cannot start with http:// or https:// |
| RuleId | string | no | The ID of the filtering rule |
| NextToken | string | no | The pagination token for the next page. An empty value indicates that no more results exist |
| MaxResults | integer | no | The maximum number of records per page. Valid values: 1 to 100. Default value: 10 |
| RegionNo | string | no | The region ID |
| MemberUid | integer | no | The UID of the member accounts. If this parameter is not specified, the current account is used |

### Queries the regions and zones supported by private network traffic redirection
`POST https://apizie.tech/v1/cloud:aliyun-ndr/describe-private-traction-support-zones` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| Lang | string | no | The language of the returned names. zh indicates Chinese, and en indicates English |

### Queries the status, type, execution steps, and asset processing results of a private network traffic…
`POST https://apizie.tech/v1/cloud:aliyun-ndr/describe-private-traction-task-detail` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| PrivateTractionTaskId | integer | yes | The ID of the private network traffic redirection asynchronous task |

### Queries the log delivery switches for protocol logs and attack logs across sites. The delivery switch and…
`POST https://apizie.tech/v1/cloud:aliyun-ndr/describe-proto-log-delivery-status` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| DeliveryType | string | yes | The delivery type. Set this parameter to sls, which indicates delivery to SLS |

### Groups protocol logs by a specified field and counts the number of log entries for each field value. Returns…
`POST https://apizie.tech/v1/cloud:aliyun-ndr/describe-proto-log-field-statistics` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| LogFilter | string | no | The log filter conditions in a JSON string. logicOp specifies the logical operator and can be set to and or or. logFilterItems specifies… |
| FromTime | integer | no | The beginning of the query time range. This value is a UNIX timestamp in milliseconds. If this parameter is not specified or is set to 0,… |
| ToTime | integer | no | The end of the query time range. This value is a UNIX timestamp in milliseconds. If this parameter is not specified or is set to 0, the… |
| LogField | string | yes | The name of the log field for group statistics. This parameter is required. Use a field returned by ListProtoLogSupportIndex whose… |
| MaxResults | integer | yes | The maximum number of groups to return. Valid values: 1 to 100. This parameter is required |
| OrderByCountAsc | string | no | Specifies whether to sort the results by log count in ascending order. Valid values: true: Ascending order. false: Descending order.… |
| Site | string | no | The site for log query. You can obtain valid values from the Sites parameter returned by DescribeDeliveryDestination. In multi-site… |

### Counts protocol logs within each time interval of a specified time range, suitable for rendering quantity…
`POST https://apizie.tech/v1/cloud:aliyun-ndr/describe-proto-log-histograms` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| LogFilter | string | no | The log filter condition, specified as a JSON string. logicOp is set to and or or. logFilterItems is an array of conditions, where each… |
| FromTime | integer | no | The start time of the query. This value is a UNIX timestamp in milliseconds. If this parameter is not specified or is set to 0, the time… |
| ToTime | integer | no | The end time of the query. This value is a UNIX timestamp in milliseconds. If this parameter is not specified or is set to 0, the current… |
| Interval | integer | no | The bucket width for statistics, in milliseconds. If specified, the value must be greater than or equal to 60000. In the legacy log… |
| Site | string | no | The log query site. You can obtain valid values from the Sites field returned by the DescribeDeliveryDestination operation. In multi-site… |

### Counts protocol log entries within a specified time range, site, and filter conditions. This operation can…
`POST https://apizie.tech/v1/cloud:aliyun-ndr/describe-proto-log-total-count` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| LogFilter | string | no | The log filter conditions in a JSON string. logicOp specifies and or or. logFilterItems is an array of conditions, each containing… |
| FromTime | integer | no | The start time of the query. This value is a UNIX timestamp in milliseconds. If this parameter is not specified or is set to 0, the time… |
| ToTime | integer | no | The end time of the query. This value is a UNIX timestamp in milliseconds. If this parameter is not specified or is set to 0, the current… |
| Site | string | no | The site for the log query. You can obtain valid values from the Sites field returned by DescribeDeliveryDestination. In multi-site… |

### Queries protocol logs by time range, site, and filter conditions with paged query. The log fields in the…
`POST https://apizie.tech/v1/cloud:aliyun-ndr/describe-proto-logs` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| LogFilter | string | no | The log filter conditions in a JSON string. logicOp specifies and or or. logFilterItems is an array of conditions, each containing… |
| FromTime | integer | no | The start time of the query. Specify a UNIX timestamp in milliseconds. If this parameter is not specified or is set to 0, the time 30… |
| ToTime | integer | no | The end time of the query. Specify a UNIX timestamp in milliseconds. If this parameter is not specified or is set to 0, the current time… |
| Page | integer | no | The page number, starting from 1. If this parameter is not specified or is set to 0, page 1 is used |
| PageSize | integer | no | The number of entries per page. Valid values: 1 to 100. Default value: 10 |
| Lang | string | no | The language of the log display values. Valid values: zh: Chinese. en: English. Default value: zh |
| Site | string | no | The site for the log query. You can obtain available sites from the Sites field returned by DescribeDeliveryDestination. In multi-site… |

### Creates unblocking tasks in batches for specified entities while retaining existing blocking policies
`POST https://apizie.tech/v1/cloud:aliyun-ndr/disable-blocking` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| Entities | string | yes | The array of entities to be operated on. The array must contain 1 to 100 items. Do not submit duplicate combinations of type and entity… |

### Queries the list of assets under the current account by paged query. Supports filtering by service…
`POST https://apizie.tech/v1/cloud:aliyun-ndr/list-asset-with-service-info` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| ServiceCategoryIdList | string | no | Filters assets by service category ID. If this parameter is not specified or an empty list is passed, no service category restriction is… |
| RiskStatus | integer | no | Filters assets by risk status. A value of 0 indicates no risk detected. A value of 1 indicates risk exists. If this parameter is not… |
| CloudType | string | no | The cloud resource type. Filters by exact type value, such as ecs. This is not the cloud provider name. If this parameter is not… |
| OsType | string | no | The operating system type. Filters by the exact type value in the asset record. If this parameter is not specified, no restriction is… |
| SearchType | string | no | The search type. Must be used together with SearchValue. A value of instanceId indicates exact match by asset instance ID. A value of… |
| SearchValue | string | no | The search value. Used together with SearchType. Instance names and IP addresses are matched by containment. Instance IDs are matched by… |
| Page | integer | no | The page number, starting from 1. If this parameter is not specified or set to 0, page 1 is used |
| PageSize | integer | no | The number of entries per page. If the value is less than or equal to 0, the default value 10 is used. If the value is greater than 100,… |
| VpcInstanceId | string | no | The instance ID of the VPC to which the asset belongs. Filters by exact value. If this parameter is not specified, no VPC restriction is… |
| TractionStatus | integer | no | Filters assets by traffic redirection configuration status. A value of 0 indicates that neither public nor private network traffic… |
| RegionNo | string | no | The region ID of the asset. Filters by exact value. If this parameter is not specified, no region restriction is applied |

### Performs a paging query on event-associated or global entities, and returns entity property, association…
`POST https://apizie.tech/v1/cloud:aliyun-ndr/list-entities` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| Page | integer | no | The page number. Pages start from 1. Default value: 1 |
| PageSize | integer | no | The number of entries per page. Default value: 10. Maximum value: 100 |
| IncidentUuid | string | no | The ID of the security event. If this parameter is not specified, the global entity list is queried |
| EntityUuid | string | no | The ID of the entity. You can obtain the ID from ListEntities |
| EntityKey | string | no | The business value of the entity, such as an IP address, domain name, or cloud instance ID. Fuzzy match is supported |
| EntityType | string | no | The list of entity types. A value of 1 indicates an IP address, 2 indicates a cloud instance, 3 indicates a host account, 4 indicates a… |
| IsExternal | string | no | Specifies whether the entity is an external entity. A value of true indicates that only external entities are queried. A value of false… |
| HideBlocked | string | no | Specifies whether to hide entities that have been blocked. Default value: false |
| RecommendStatus | integer | no | The reserved parameter. This parameter is not used for query filtering. Do not specify this parameter. For the recommended action status,… |
| RecommendAction | string | no | The recommended action filter. A value of block indicates blocking, observe indicates observing, allow indicates allowing, and none… |
| OrderBy | string | no | The sort field. A value of LastSeenTime indicates the time when the entity was last discovered, and EntityKey indicates the entity value |
| SortOrder | string | no | The sort order. A value of asc indicates ascending order, and desc indicates descending order. The default value is desc for LastSeenTime… |
| Lang | string | no | The language of the response. A value of zh indicates Chinese, and en indicates English. Default value: zh |

### Performs a paging query of public assets. You can filter public assets by conditions such as resource type,…
`POST https://apizie.tech/v1/cloud:aliyun-ndr/list-idc-asset` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| TractionStatus | integer | no | The access configuration status. Valid values: 0: Not accessed. 1: Accessed |
| SearchType | string | no | The search field. Valid values: ip, instanceId, and instanceName. Use this parameter together with SearchValue |
| SearchValue | string | no | The search keyword. Use this parameter together with SearchType. This parameter supports fuzzy match |
| Page | integer | no | The page number. The starting value is 1 |
| PageSize | integer | no | The number of entries per page |
| SourceFrom | integer | no | The asset source. A value of 1 queries manually added offline assets. Other values query cloud assets |
| EngineTractionStatus | integer | no | The collection status. Valid values: 0: Pending collection. 1: Collecting. 2: Stopped due to timeout. 3: Stopped because the traffic limit… |
| CloudType | string | no | The cloud service type. Examples: ecs and eip |
| RegionNo | string | no | The region ID |
| MemberUid | integer | no | The UID of the member accounts |
| ResourceType | string | no | The public resource type. Example: EcsEIP |
| HasAgent | string | no | Specifies whether the public IP address has an agent installed or bound |
| Protocol | string | no | The collection protocol. Valid values: tcp, udp, and any |
| OrderBy | string | no | The sort field. Valid values: tractionStatus and currentTraffic |
| OrderType | string | no | The sort direction. Valid values: asc and desc |

### Queries the summary, conclusion status, and analysis time of AI analysis reports for a specified event by…
`POST https://apizie.tech/v1/cloud:aliyun-ndr/list-incident-investigations` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| Page | integer | no | The page number. Pages start from 1. Default value: 1 |
| PageSize | integer | no | The number of entries per page. Default value: 10. Maximum value: 100 |
| IncidentUuid | string | yes | The ID of the security event. You can obtain the ID by calling ListIncidents |
| Lang | string | no | The language of the returned content. Valid values: zh: Chinese. en: English. Default value: zh |

### Performs a paging query of security events. You can filter the results by event name, ID, threat level,…
`POST https://apizie.tech/v1/cloud:aliyun-ndr/list-incidents` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| FromTime | integer | no | The start time of the query. The value is a UNIX timestamp in milliseconds. This parameter filters events by their most recent occurrence… |
| ToTime | integer | no | The end time of the query. The value is a UNIX timestamp in milliseconds. This parameter must be provided together with FromTime or… |
| Page | integer | no | The page number. Pages start from 1. Default value: 1 |
| PageSize | integer | no | The number of entries per page. Default value: 10. Maximum value: 100 |
| IncidentName | string | no | The name of the security event. Fuzzy match is supported |
| IncidentUuid | string | no | The ID of the security event. You can obtain the ID from ListIncidents |
| ThreatLevel | string | no | The list of threat levels for the events. Valid values: 0: Information. 1: Low. 2: Medium. 3: High. 4: Critical (JSON-encoded) |
| HandleStatus | string | no | The list of handling status identifiers for the security events (JSON-encoded) |
| AIAnalysisResult | string | no | The list of AI analysis results. Valid values: real_attack: Real attack. attempt_attack: Attack attempt (JSON-encoded) |
| AttackerIp | string | no | The filter condition for the attacker IP address. Fuzzy match is supported |
| EntityUuid | string | no | The ID of the entity. You can obtain the ID from ListEntities. This parameter queries events associated with the entity. If both… |
| EntityKey | string | no | The business value of the entity, such as an IP address, domain name, or cloud instance ID. Exact match is used. This parameter takes… |
| Lang | string | no | The language of the returned content. Valid values: zh: Chinese. en: English. Default value: zh |
| SortBy | string | no | The field used for sorting. Valid values: threat_level: Threat level. first_time: First occurrence time. last_time: Most recent occurrence… |
| SortOrder | string | no | The sort order. Valid values: asc: Ascending order. desc: Descending order. Default value: desc when SortBy is specified |

### Queries the public index fields, filter operators, and group-by statistics capabilities supported by the…
`POST https://apizie.tech/v1/cloud:aliyun-ndr/list-proto-log-support-index` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| Site | string | no | The log query site. You can obtain the value from the Sites parameter returned by DescribeDeliveryDestination. In multi-site scenarios,… |

### Retrieves the list of regions supported by NDR
`POST https://apizie.tech/v1/cloud:aliyun-ndr/list-region` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| Lang | string | no | The language in which error messages are returned. Valid values: zh: Chinese. en: English. Default value: en |

### Modifies the automatic access configuration for resource types in a specified region. If no region is…
`POST https://apizie.tech/v1/cloud:aliyun-ndr/modify-idc-asset-auto-traction-config` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| Region | string | no | The region ID. If this parameter is not specified or an empty string is passed, the same configuration is applied to all regions |
| Config | string | yes | The automatic access configuration for resource types. The key is a supported resource type, and the value specifies whether automatic… |

### Modifies the blocking direction, expiration time, or reason of an existing blocking policy. Calling this…
`POST https://apizie.tech/v1/cloud:aliyun-ndr/update-blocking-policy` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| BlockingType | string | yes | Required. The object type of the blocking target. Valid values: ip (IPv4) and domain (domain name) |
| BlockingEntity | string | yes | Required. The blocking target. For the ip type, specify a single IPv4 address. IPv6, CIDR blocks, and 0.0.0.0 are not supported. For the… |
| BlockingDirection | string | no | Required. The blocking direction. Valid values: in: inbound. out: outbound. bidirectional: both directions. The domain type supports only… |
| BlockingReason | string | no | The updated blocking reason. If you omit this parameter, the existing reason is cleared. To retain the original reason, pass the original… |
| BlockingExpireTime | integer | no | The blocking expiration time, in UNIX millisecond timestamp. If you omit this parameter or set it to 0, the policy never expires. A… |
| IncidentId | string | no | The ID of the associated security event. This parameter is optional and is not used to locate the blocking policy. Modifying only this… |

### Updates an enabled log delivery destination of the new version, including the target site set, region,…
`POST https://apizie.tech/v1/cloud:aliyun-ndr/update-delivery-destination` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| Sites | string | no | The complete list of target site configurations after the update. This parameter cannot be empty. In single-site mode, pass only global.… |

### Modifies the handling status of one or more security events
`POST https://apizie.tech/v1/cloud:aliyun-ndr/update-incident-handle-status` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| IncidentUuidList | string | yes | The list of security event IDs to modify. The list must contain at least one ID (JSON-encoded) |
| HandleStatus | string | yes | The handling status identifier of the security event |

### Modifies the traffic mirror filter rule used by a specified private network asset
`POST https://apizie.tech/v1/cloud:aliyun-ndr/update-private-asset-filter-rule` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| VpcInstanceId | string | yes | The VPC instance ID |
| InstanceId | string | yes | The instance ID |
| PrivateTractionFilterRuleId | string | yes | The ID of the filter rule currently used by the private network asset |

### Adds or removes elastic network interfaces (ENIs) that participate in private network traffic diversion for…
`POST https://apizie.tech/v1/cloud:aliyun-ndr/update-private-traction-assets` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| VpcInstanceId | string | yes | The ID of the VPC instance |
| AddedEniInstanceIdList | string | no | The list of IDs of the elastic network interfaces (ENIs) (network interface controller (NIC)) instances to increase to private network… |
| RemovedEniInstanceIdList | string | no | The list of IDs of the elastic network interfaces (ENIs) (network interface controller (NIC)) instances to remove from private network… |
| FilterRule | string | no | The snapshot of the filter rule used for creating a traffic mirror session. If this parameter is not specified, all traffic is captured.… |

### Modifies the traffic limit and execution time configuration of a specified VPC
`POST https://apizie.tech/v1/cloud:aliyun-ndr/update-private-traction-attributes` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| VpcInstanceId | string | yes | The VPC instance ID |
| MaxTraffic | integer | no | The upper limit of private network traffic mirroring, in GB. A value of -1 indicates no limit |
| TimeConfig | string | no | The traffic mirroring time configuration. You can specify a fixed start time and end time, or configure a recurring schedule by start… |
| AutoAccess | string | no | Specifies whether to automatically include new ENIs subsequently added to this VPC |

### Modifies the name and description of a specified private network traffic mirroring filter rule
`POST https://apizie.tech/v1/cloud:aliyun-ndr/update-private-traction-filter-rule-attribute` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| RuleId | string | yes | The filter rule ID |
| RuleName | string | no | The filter rule name. The name must be fewer than 128 characters in length and cannot start with http:// or https:// |
| RuleDescription | string | no | The filter rule description. The description must be fewer than 256 characters in length and cannot start with http:// or https:// |
| RegionNo | string | no | The region ID |
| MemberUid | integer | no | The UID of the member account in member accounts. If this parameter is not specified, the current account is used |

### Modifies the priority, action, protocol, CIDR block, and port range of a specified filter sub-rule
`POST https://apizie.tech/v1/cloud:aliyun-ndr/update-private-traction-filter-sub-rule` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| SubRuleId | string | yes | The ID of the filter sub-rule |
| Priority | integer | yes | The priority of the sub-rule. Valid values: 1 to 16777216. A smaller value indicates a higher priority. Priorities must be unique within… |
| SubRuleAction | string | yes | The action to perform on matched traffic. A value of accept indicates that traffic is collected. A value of drop indicates that traffic is… |
| Protocol | string | yes | The network protocol to match. A value of ALL indicates all protocols. ICMP, TCP, and UDP indicate the corresponding protocols |
| SourceCidrBlock | string | yes | The source CIDR block. Use the CIDR format. 0.0.0.0/0 specifies all IPv4 addresses |
| SourcePortRange | string | yes | The source port range. Format: start port/end port, such as 80/443. -1/-1 specifies all ports. This parameter is required when the… |
| DestinationCidrBlock | string | yes | The destination CIDR block. Use the CIDR format. 0.0.0.0/0 specifies all IPv4 addresses |
| DestinationPortRange | string | yes | The destination port range. Format: start port/end port, such as 80/443. -1/-1 specifies all ports. This parameter is required when the… |
| RegionNo | string | no | The region ID |
| MemberUid | integer | no | The UID of the member accounts. If you do not specify this parameter, the current account is used |

### Modifies the private network traffic redirection bandwidth of a specified VPC. The operation is executed…
`POST https://apizie.tech/v1/cloud:aliyun-ndr/update-private-traction-max-bandwidth` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| VpcInstanceId | string | yes | The ID of the VPC-connected instance |
| MaxBandwidth | integer | yes | The private network traffic redirection bandwidth. Unit: Gbps. Valid values: 10 to 50. The value must be a multiple of 10 |

### Updates the protocol log and attack log delivery switches for specified sites in a batch. You must pass a…
`POST https://apizie.tech/v1/cloud:aliyun-ndr/update-proto-log-delivery-status` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |
| DeliveryType | string | no | A compatibility parameter. Set this parameter to sls. The actual update uses the DeliveryType value specified in each item of StatusList.… |
| StatusList | string | no | The list of switch configurations for the sites to update. This parameter cannot be empty. Each item must explicitly include DeliveryType,… |

### version
`POST https://apizie.tech/v1/cloud:aliyun-ndr/version` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://ndr.ap-southeast-1.aliyuncs.com |

## Example
```
curl "https://apizie.tech/v1/cloud:aliyun-ndr/create-blocking-policy" \
  -H "x-api-key: $APIZIE_KEY" \
  -H "x-upstream-key: $PROVIDER_KEY"
```

## FAQ

### How do I call the Alibaba Cloud Agentic NDR API?
Create a free Apizie key, then send POST https://apizie.tech/v1/cloud:aliyun-ndr/create-blocking-policy with the header x-api-key. Every endpoint returns { project, data, timestamp }.

### Is the Alibaba Cloud Agentic NDR API free on Apizie?
Yes. The Free plan includes 1,000 requests a month at 100 requests a minute, no credit card. Alibaba Cloud Agentic NDR itself also needs your own key from aliyuncs.com.

### Can AI agents use the Alibaba Cloud Agentic NDR API?
Yes. Add the Apizie MCP server (https://apizie.tech/mcp) to Claude, ChatGPT, Cursor or VS Code, then ask in plain language. The agent calls run_scraper with project key cloud:aliyun-ndr.

### What is the status of the Alibaba Cloud Agentic NDR API?
Needs your own provider key (bring your own key)