SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillsbyted-antiddospro-hostops

byted-antiddospro-hostops

Security & auditing

View repository

Updated 10-15 17:30

About this skill

AntiDDoSPro HostOps

This skill is used for read-only inspection, analysis, and troubleshooting of Volcengine AntiDDoSPro protected domains.

Most suitable scenarios:

  • Domain health inspection
  • Recent attack investigation
  • Protection policy check
  • Intelligent protection / AI protection status verification
  • Read-only queries of CCAI assets, events, and recommendations
  • Traffic and response anomaly analysis
  • Resolution of domain to Anti-DDoS instance IP

When the task clearly revolves around a specific AntiDDoSPro protected domain or Host, and the goal is to view, analyze, and explain the current state rather than modify configuration, this skill should be used first, rather than a general troubleshooting or general reporting skill.

Compatibility

Expected environment:

  • Python 3
  • requests
  • Via the environment variable VOLC_ACCESS_KEY / VOLC_SECRET_KEY provide Volcengine credentials

When actual API calls need to be made, use the client capability included with this skill.

Do not pass AK/SK in conversations, prompts, or tool parameters.

Boundaries

This skill is read-only.

Do not:

  • Modify protection policies
  • Add or delete blacklist/whitelist rules
  • Modify region blocking configuration
  • Call any write interface

If the user requests configuration changes, clearly state that this skill only supports viewing, analysis, and troubleshooting, and is not responsible for issuing changes.

Required inputs

Collect as much as possible:

  • host: protected domain or Host
  • begin_time / end_time: if the user explicitly provides a time range

If the user does not provide a time range:

  • For attack and traffic analysis, default to viewing the last 1 hour

If the user does not provide a host:

  • First ask for the protected domain or Host, then continue

Default workflow

1. First determine the user's goal

Determine whether the user wants:

  • A complete inspection
  • View protection policies
  • Verify intelligent protection / AI protection status
  • Investigate attack events
  • View CCAI assets, events, or remediation recommendations
  • Analyze traffic or report anomalies
  • Resolve the Anti-DDoS instance IP corresponding to the domain

If the user's expression is relatively vague, default to performing a complete inspection first.

2. Choose the appropriate entry point

  • Protection policy check → query_antiddospro_policy_overview
  • Intelligent protection / AI protection status verification → query_antiddospro_policy_overview, and combine with CCAI asset queries when necessary
  • Attack event investigation → query_antiddospro_attack_events; if the user is explicitly looking at CCAI events, prioritize the CCAI event query
  • CCAI asset, event, and recommendation queries → query_antiddospro_ccai_overview; when further expansion is needed, then call ListAssets、ListEvents、DescribeEvent、ListRecommendations、DescribeRecommendation
  • Traffic or report analysis → query_antiddospro_flow_traffic
  • Domain to instance IP resolution → resolve_antiddospro_instance_ips
  • Requirements are broad or unclear → query_antiddospro_host_healthcheck, and supplement with CCAI read-only information as needed

3. Stay conservative when interpreting results

  • Clearly distinguish between "no data observed" and "confirmed no risk"
  • When an upstream API errors, directly state the real reason
  • When troubleshooting is needed, retain the request ID
  • If the domain cannot be resolved to an instance IP, clearly state that the Layer 4 DDoS view may be incomplete
  • The intelligent protection switch is based only on the response of DescSmartCCConf ;GetHostDefStatus in SmartEnable is not the smart protection switch semantics, and no conclusion can be drawn from it
  • DescSmartCCConf 's query parameter is Domain, not Host
  • DescribeAttackEvent uses 2023-03-08, and the request body passes InstanceIps[]
  • DescribeBizFlowAndConnCount uses 2023-03-08, and the request body passes InstanceIps[]
  • DDoS attack source-related APIs are queried by a single InstanceIp do not pass the InstanceIps array directly to DescribeTopAttackSrcIp、DescribeTopAttackSrcArea、DescribeTopAttackSrcInfo、DescribeAttackDistribution
  • Do not guess parameter positions based on experience; prioritize calling according to the request form currently available for the API

4. Summarize conclusions for the user

Give the conclusion first, then the observation scope, key findings, risk points, and next-step recommendations.

Output format

Unless the user explicitly requests another format, output in the following order:

Inspection conclusion

Use a short paragraph to first explain the overall judgment: whether it currently looks normal, suspicious, or clearly abnormal. If the data is incomplete, also explain that here first.

Observation scope

  • Inspection target: which Host or domain
  • Time range: the time specified by the user, or the default most recent 1 hour
  • Data completeness: which views are complete, and which are incomplete due to API errors or instance IP resolution failures

Policy status

  • Protection switch status
  • Smart protection switch status (must be based on the response of DescSmartCCConf do not treat the GetHostDefStatus returned by SmartEnable as the smart protection switch)
  • CCAI / AI protection asset status (if the user explicitly asks about AI protection status, you may additionally read CCAI ListAssets 's AiDefenseStatus）
  • CC rule status
  • WAF blacklist and whitelist status
  • Region blocking status

Attack observation

  • Whether an attack was observed within the specified time window
  • When available, list key information such as source IPs, source regions, and Top URLs
  • If the user explicitly focuses on CCAI events, you may additionally supplement ListEvents and DescribeEvent results
  • If only layer-7 data can be seen or only partial data can be seen, state this clearly

Traffic observation

  • Whether there are anomalies in BPS, PPS, QPS, response codes, etc.
  • Whether traffic changes look more like normal fluctuations or abnormal fluctuations

Risks and next-step recommendations

  • The risk points most worth paying attention to currently
  • What to check next as recommended
  • Which conclusions cannot be confirmed for now, and why

Keep the answer concise, prioritize refined conclusions, and do not directly dump the raw payload. Unless the observation data is sufficient to support it, do not easily draw conclusions such as "domain healthy."

Error handling

Do not hide errors when an API fails.

Explain the problem in a way the user can understand, but retain necessary technical details. For common pitfalls, see references/troubleshooting.md。

References

Read as needed:

  • references/api-surface.md: API name, version, request method, main parameters
  • references/troubleshooting.md: common API pitfalls and troubleshooting methods
  • references/examples.md: typical requests, recommended entry points, and unsupported scenarios

Implementation notes

If you need to actually initiate a query, you can use the invocation capability included with this skill.