huawei-cloud-hss-query · diff

git:20260903.6bf6e5d to git:20261031.95657b4

11 added, 1 removed. Audit A to A.

---

name: huawei-cloud-hss-query

description: >-

Query and manage Huawei Cloud HSS (Host Security Service) for daily security inspection and incident response.

Covers host assets, vulnerabilities, security baselines, intrusion alerts (trojan/brute-force), login audit logs,

risk scoring, and alert handling status updates. Read-only queries plus alert status marking — no isolation or

antivirus actions. Use this skill when the user needs to inspect host security risks, investigate suspected

intrusion, review vulnerability/baseline reports, or handle security alerts.

Triggers include: 主机安全, HSS, Host Security Service, 安全巡检, 漏洞查询, 安全基线,

入侵告警, 木马检测, 暴力破解, 登录审计, 告警处置, 风险诊断, host security inspection,

vulnerability scan, baseline check, intrusion alert, trojan detection, brute force,

tags: [huawei-cloud hss security inspection vulnerability baseline intrusion]

---

# Huawei Cloud HSS Host Security Skill

## Overview

This skill provides AI Agent capabilities for Huawei Cloud HSS (Host Security Service / 主机安全服务),

covering daily security inspection, risk diagnosis, and alert handling. It supports querying host assets,

vulnerabilities, security baselines, intrusion alerts (trojans, brute-force attacks), and login audit logs,

plus updating alert handling status — all via hcloud CLI.

**Scope boundaries:**

- ✅ Query: host assets, vulnerabilities, baselines, intrusion alerts, login audit logs

- ✅ Diagnose: risk scoring, high-risk vulnerability analysis, abnormal login analysis

- ✅ Manage: update alert handling status (mark as handled, ignored, etc.)

- ❌ Does NOT create or delete host resources

- ❌ Does NOT execute isolation, antivirus, or other high-risk actions

- ❌ Does NOT perform real-time blocking or kill processes

+ - ❌ Does NOT manage HSS quotas or billing (不涉及配额/计费管理)

## Prerequisites

1. **hcloud CLI** installed and authenticated with valid AK/SK credentials.

- Installation guide: see `references/cli-installation-guide.md`

- Verify: `hcloud configure list` shows a valid profile

2. **HSS agent** deployed on target ECS instances (HSS must be enabled in the console)

3. **IAM permissions**: HSS read permissions for query operations, HSS write permissions for alert handling.

- See `references/iam-policies.md` for least-privilege policy

4. **Region**: HSS is region-specific. Use `--cli-region` to specify the target region (e.g., `{your-region}`)

## Workflow

```

1. Identify target → region, project_id, optional host_id filter

2. Query phase → list assets / vulnerabilities / baselines / alerts / login logs

3. Diagnose phase → risk score, high-risk items, abnormal login patterns

4. Handle phase → update alert handling status (requires user confirmation)

5. Output → structured JSON risk list + readable summary report

```

## Core Commands

### 1. Host Assets (主机资产)

List all protected hosts with agent status, OS type, and risk flags:

```bash

hcloud HSS ListHostStatus --cli-region={region} --project_id={project_id} \

[--host_id={host_id}] [--host_name={host_name}] [--os_type={linux|windows}] \

[--agent_status={installed|not_installed|online|offline}] \

[--has_vul=true] [--has_intrusion=true] [--has_baseline=true] \

[--asset_value={important|common|test}] [--limit=10] [--offset=0]

```

Show host statistics (total hosts, protected count, risk distribution):

```bash

hcloud HSS ShowHostsStatistics --cli-region={region} --project_id={project_id}

```

Query risk status for specific hosts:

```bash

hcloud HSS ListHostsRisk --cli-region={region} --project_id={project_id} \

--host_id_list.1={host_id_1} [--host_id_list.2={host_id_2}]

```

### 2. Vulnerabilities (漏洞)

List all vulnerabilities with filtering by type, status, severity:

```bash

hcloud HSS ListVulnerabilities --cli-region={region} --project_id={project_id} \

[--vul_id={vul_id}] [--vul_name={vul_name}] [--cve_id={cve_id}] \

[--type={linux_vul|windows_vul|web_cms|app_vul|urgent_vul}] \

[--status={vul_status}] [--handle_status={handle_status}] \

[--repair_priority={critical|high|medium|low}] \

[--asset_value={important|common|test}] [--limit=10] [--offset=0]

```

List vulnerabilities on a specific host:

```bash

hcloud HSS ListHostVuls --cli-region={region} --project_id={project_id} \

--host_id={host_id} [--type={linux_vul|windows_vul|web_cms|app_vul|urgent_vul}] \

[--limit=10] [--offset=0]

```

List hosts affected by a specific vulnerability:

```bash

hcloud HSS ListVulHosts --cli-region={region} --project_id={project_id} \

--type={linux_vul|windows_vul|web_cms|app_vul|urgent_vul} --vul_id={vul_id} \

[--limit=10] [--offset=0]

```

Show vulnerability details (choose by type):

```bash

# Linux vulnerability

hcloud HSS ShowLinuxVulDetail --cli-region={region} --project_id={project_id} \

--vul_id={vul_id} --limit=10 --offset=0

# Windows vulnerability

hcloud HSS ShowWindowsVulDetail --cli-region={region} --project_id={project_id} \

--vul_id={vul_id} --limit=10 --offset=0

# Web-CMS vulnerability

hcloud HSS ShowCmsVulDetail --cli-region={region} --project_id={project_id} \

--vul_id={vul_id} --limit=10 --offset=0

```

+ > ⚠️ 漏洞详情接口（ShowLinuxVulDetail/ShowWindowsVulDetail/ShowCmsVulDetail）对不存在的 ID 返回空列表（`total_num=0`、`data_list=[]`）而非报错，应解读为无此数据，不得虚构详情。

Show vulnerability statistics:

```bash

hcloud HSS ShowVulStatics --cli-region={region} --project_id={project_id}

```

### 3. Security Baselines (安全基线)

Show baseline check overview (last check time, check stats, pass rate, top risks):

```bash

hcloud HSS ShowBaselineOverview --cli-region={region} --project_id={project_id}

```

Show baseline statistics:

```bash

hcloud HSS ShowBaselineStatistic --cli-region={region} --project_id={project_id}

```

List hosts affected by a specific baseline check rule:

```bash

hcloud HSS ListHostCheckRules --cli-region={region} --project_id={project_id} \

--check_name={check_name} --standard={cn_standard|hw_standard} --host_id={host_id} \

[--check_rule_name={rule_name}] [--limit=10] [--offset=0]

```

> ⚠️ `--standard` 为必填参数。

+ > ⚠️ `--check_name` 为 URL 路径参数，hcloud CLI 对中文值存在签名问题（`APIGW.0301 verify ak sk signature failed`）。中文检查项名（如 `身份鉴别`、`访问控制`）建议通过 HSS API/SDK 调用，或使用英文标准名（如 `identity`）。

Show security check report for a specific host:

```bash

hcloud HSS ShowSecurityCheckHostReport --cli-region={region} --project_id={project_id} \

--host_id={host_id} --scan_time={scan_time_ms}

```

> ⚠️ `--scan_time` 为必填参数（毫秒级时间戳）。

+ > ⚠️ 该 API 依赖服务端基线扫描数据完整性，可能返回 `HSS.0004 Database operation failed`。若出现该错误：1) 确认 `scan_time` 为该主机最近的基线扫描时间；2) 稍后重试；3) 到 HSS 控制台确认该主机的基线扫描记录是否正常生成。

Show risk configuration detail:

```bash

hcloud HSS ShowRiskConfigDetail --cli-region={region} --project_id={project_id} \

--check_name={check_name} --standard={cn_standard|hw_standard} \

[--host_id={host_id}]

```

> ⚠️ `--standard` 为必填参数（`cn_standard`=等保合规标准，`hw_standard`=云安全实践标准）。

+ > ⚠️ `--check_name` 为 URL 路径参数，hcloud CLI 对中文值存在签名问题（`APIGW.0301 verify ak sk signature failed`）。中文检查项名（如 `身份鉴别`）建议通过 HSS API/SDK 调用，或使用英文标准名。

### 4. Intrusion Alerts — Trojan & Malware (木马/恶意软件告警)

Query alert event history with filtering by event type, severity, handling status:

```bash

hcloud HSS ListEventHandleHistory --cli-region={region} --project_id={project_id} \

[--event_type={event_type}] [--event_class_ids.1={event_class_id}] \

[--severity={critical|high|medium|low}] [--handle_status={handled|unhandled}] \

[--host_ip={ip}] [--host_name={name}] [--attack_tag={tag}] \

[--asset_value={important|common|test}] [--limit=10] [--offset=0]

```

**Common event_class_ids for malware:**

| event_class_id | Description |

|----------------|-------------|

| `av_1002` | Virus (病毒) |

| `av_1003` | Worm (蠕虫) |

| `av_1004` | Trojan (木马) |

| `av_1005` | Botnet (僵尸网络) |

| `av_1006` | Backdoor (后门) |

| `av_1010` | Rootkit |

| `av_1011` | Ransomware (勒索软件) |

| `av_1015` | Webshell |

| `av_1016` | Mining software (挖矿软件) |

List host protection history:

```bash

hcloud HSS ListHostProtectHistoryInfo --cli-region={region} --project_id={project_id} \

--start_time={start_time_ms} --end_time={end_time_ms} [--limit=10] [--offset=0] \

[--host_id={host_id}] [--file_path={path}]

```

> ⚠️ **`--start_time` / `--end_time` 为必填参数**（毫秒级时间戳，相差不超过 30 天）；`--host_id` 可选。

List antivirus-protected hosts:

```bash

# List antivirus-protected hosts (scan_type: quick/full; start_type: now/period)

hcloud HSS ListAntiVirusHost --cli-region={region} --project_id={project_id} \

--limit=10 --offset=0 --scan_type={quick|full} --start_type={now|period} \

[--host_id={host_id}] [--policy_id={policy_id}]

```

> ⚠️ **`--limit` / `--offset` / `--scan_type` / `--start_type` 为必填参数**。

- > `--scan_type` 枚举：`quick`（快速扫描）/ `full`（全盘扫描）；`--start_type` 枚举：`now`（立即启动）/ `period`（周期启动）。其他值（如 `all`/`manual`/`auto`）会被 API 静默忽略并返回空结果。

+ > `--scan_type` 枚举：`quick`（快速扫描）/ `full`（全盘扫描）；`--start_type` 枚举：`now`（立即启动）/ `period`（周期启动）。⚠️ API 对未限定枚举值不校验，实测传入 `all` 等值会返回全量主机数据而非空结果，请严格使用 `quick`/`full`。

### 5. Intrusion Alerts — Brute Force (暴力破解告警)

Query brute-force attack events (login_0001 = attempt, login_0002 = success):

```bash

hcloud HSS ListEventHandleHistory --cli-region={region} --project_id={project_id} \

--event_class_ids.1=login_0001 --event_class_ids.2=login_0002 \

[--severity={critical|high|medium|low}] [--handle_status={handled|unhandled}] \

[--host_ip={ip}] [--limit=10] [--offset=0]

```

List weak password detection results:

```bash

hcloud HSS ListWeakPasswordUsers --cli-region={region} --project_id={project_id} \

[--host_id={host_id}] [--limit=10] [--offset=0]

```

### 6. Login Audit Logs (登录审计日志)

Query common login IPs:

```bash

hcloud HSS ListLoginCommonIp --cli-region={region} --project_id={project_id} \

[--ip_addr={ip}]

```

Query common login locations:

```bash

hcloud HSS ListLoginCommonLocation --cli-region={region} --project_id={project_id} \

[--area_code={area_code}]

```

> ⚠️ 这两个操作仅支持 `--ip_addr` / `--area_code` 过滤器（实测 `--host_id`/`--limit`/`--offset` 不支持），不可加分页参数。

### 7. Risk Diagnosis (风险诊断)

Query overall risk score:

```bash

hcloud HSS ShowRiskScore --cli-region={region} --project_id={project_id}

```

Query risk status for specific hosts:

```bash

hcloud HSS ListHostsRisk --cli-region={region} --project_id={project_id} \

--host_id_list.1={host_id_1}

```

+ > ⚠️ ListHostsRisk 对不存在/无效的 host_id 返回全 0 数据（`total_num=1`、各风险值均为 0）而非报错，建议先用 ListHostStatus 核验主机存在性后再判断风险，避免误报"主机健康"。

### 8. Update Alert Handling Status (告警处置) — ⚠️ Mutating, Requires Confirmation

Handle alert events (mark as handled, ignored, etc.):

```bash

hcloud HSS ChangeEvent --cli-region={region} --project_id={project_id} \

--operate_event_list.1.event_class_id={event_class_id} \

--operate_event_list.1.event_id={event_id} \

--operate_event_list.1.event_type={event_type} \

--operate_event_list.1.occur_time={occur_time_ms} \

--operate_type={operate_type}

```

> ⚠️ `--operate_type` 是**顶层参数**（不属于 operate_event_list 数组内）；数组中 `event_class_id`/`event_id`/`event_type`/`occur_time` 均必填。

+ > ⚠️ 实测 `ListEventHandleHistory` 返回的告警条目**不含独立 `event_id` 字段**（仅有 event_class_id/occur_time 等），请先核实 event_id 的正确取值来源（或按 event_class_id + occur_time 定位具体告警）再执行处置。

+ > ⚠️ 执行 ChangeEvent 前需先明确具体的告警对象（event_class_id/event_id/发生时间），信息不完整时应先向用户确认"处置哪条告警"，不得臆造参数执行。

**operate_type values for ChangeEvent:**

- `mark_as_handled` — Mark as handled (标记已处理)

- `ignore` — Ignore (忽略)

- `add_to_alarm_whitelist` — Add to alarm whitelist (加入告警白名单)

- `add_to_login_whitelist` — Add to login whitelist (加入登录白名单)

- `unhandle` — Restore to unhandled (恢复未处理)

- `do_not_ignore` — Cancel ignore (取消忽略)

- `remove_from_alarm_whitelist` — Remove from alarm whitelist (删除告警白名单)

- `remove_from_login_whitelist` — Remove from login whitelist (删除登录白名单)

> ⚠️ ⛔ `isolate_and_kill`（隔离查杀）、`do_not_isolate_or_kill` 虽为 API 支持值，但**本技能明确不执行隔离/杀毒等高危动作**，AI 不得使用。

Update vulnerability handling status:

```bash

hcloud HSS ChangeVulStatus --cli-region={region} --project_id={project_id} \

--operate_type={ignore|not_ignore|immediate_repair|manual_repair|verify|add_to_whitelist} \

--data_list.1.vul_id={vul_id} --host_data_list.1.host_id={host_id}

```

> ⚠️ 漏洞与主机通过 `--data_list.[N].vul_id` + `--host_data_list.[N].host_id` 关联传递（**没有顶层 `--vul_id`/`--host_id` 参数**）。

**⚠️ Both ChangeEvent and ChangeVulStatus are mutating operations. Always prompt the user for confirmation before executing.**

## Parameter Confirmation

|-----------|----------|-------------|---------|

| `--cli-region` | Yes | Target region | `{your-region}` |

| `--limit` | No | Page size (default 10) | `10` |

| `--offset` | No | Page offset (default 0) | `0` |

## Output Format

All commands return JSON by default. For inspection reports, the skill aggregates multiple query results into a structured risk summary:

```json

{

"inspection_time": "2026-08-28T10:00:00Z",

"region": "{region}",

"host_summary": { "total": 10, "protected": 8, "at_risk": 3 },

"vulnerabilities": { "critical": 2, "high": 5, "medium": 12, "low": 8 },

"baselines": { "pass_rate": "85%", "failed_rules": 7 },

"alerts": { "unhandled_trojan": 1, "unhandled_brute_force": 3 },

"risk_score": 72,

"recommendations": ["Fix 2 critical vulnerabilities on host xxx", "Handle 1 unhandled trojan alert"]

}

```

## Reference Documents

- `references/cli-installation-guide.md` — hcloud CLI installation and authentication

- `references/iam-policies.md` — Least-privilege IAM policies for HSS

- `references/verification-method.md` — Verification and testing methods

- `references/dataflow-diagram.md` — Data flow diagram

- `references/acceptance-criteria.md` — Acceptance criteria

- `references/hss-event-class-reference.md` — HSS event class ID reference

## KooCLI Command Format Standard

```bash

hcloud HSS ListHostStatus --cli-region={region} --project_id={project_id} [--key=value ...]

```

| Feature | Description | Example |

|---------|-------------|---------|

| Service name | `HSS` (exact KooCLI service name) | `HSS` |

| Operation name | PascalCase | `ListHostStatus`, `ShowVulStatics`, `ChangeEvent` |

| Region parameter | `--cli-region=<value>` | `--cli-region={region}` |

| Simple parameter | `--key=value` | `--host_id=xxx` |

| Indexed parameter | `--key.1=value1` | `--host_id_list.1=xxx` |