huawei-cloud-hss-query

Huawei Cloud HSS Host Security Skill

Overview

This skill provides AI Agent capabilities for Huawei Cloud HSS (Host Security Service), covering daily security inspection, risk diagnosis, and alert handling. It supports querying host assets, vulnerabilities, security baselines, intrusion alerts (trojans, brute-force attacks), and login audit logs, plus updating alert handling status — all via hcloud CLI.

Scope boundaries:

✅ Query: host assets, vulnerabilities, baselines, intrusion alerts, login audit logs
✅ Diagnose: risk scoring, high-risk vulnerability analysis, abnormal login analysis
✅ Manage: update alert handling status (mark as handled, ignored, etc.)
❌ Does NOT create or delete host resources
❌ Does NOT execute isolation, antivirus, or other high-risk actions
❌ Does NOT perform real-time blocking or kill processes

Prerequisites

hcloud CLI installed and authenticated with valid AK/SK credentials.
- Installation guide: see references/cli-installation-guide.md
- Verify: hcloud configure list shows a valid profile
HSS agent deployed on target ECS instances (HSS must be enabled in the console)
IAM permissions: HSS read permissions for query operations, HSS write permissions for alert handling.
- See references/iam-policies.md for least-privilege policy
Region: HSS is region-specific. Use --cli-region to specify the target region (e.g., {your-region})

Workflow

1. Identify target → region, project_id, optional host_id filter
2. Query phase → list assets / vulnerabilities / baselines / alerts / login logs
3. Diagnose phase → risk score, high-risk items, abnormal login patterns
4. Handle phase → update alert handling status (requires user confirmation)
5. Output → structured JSON risk list + readable summary report

Core Commands

1. Host Assets

List all protected hosts with agent status, OS type, and risk flags:

hcloud HSS ListHostStatus --cli-region={region} --project_id={project_id} \
  [--host_id={host_id}] [--host_name={host_name}] [--os_type={linux|windows}] \
  [--agent_status={installed|not_installed|online|offline}] \
  [--has_vul=true] [--has_intrusion=true] [--has_baseline=true] \
  [--asset_value={important|common|test}] [--limit=10] [--offset=0]

Show host statistics (total hosts, protected count, risk distribution):

hcloud HSS ShowHostsStatistics --cli-region={region} --project_id={project_id}

Query risk status for specific hosts:

hcloud HSS ListHostsRisk --cli-region={region} --project_id={project_id} \
  --host_id_list.1={host_id_1} [--host_id_list.2={host_id_2}]

2. Vulnerabilities

List all vulnerabilities with filtering by type, status, severity:

hcloud HSS ListVulnerabilities --cli-region={region} --project_id={project_id} \
  [--vul_id={vul_id}] [--vul_name={vul_name}] [--cve_id={cve_id}] \
  [--type={linux_vul|windows_vul|web_cms|app_vul|urgent_vul}] \
  [--status={vul_status}] [--handle_status={handle_status}] \
  [--repair_priority={critical|high|medium|low}] \
  [--asset_value={important|common|test}] [--limit=10] [--offset=0]

List vulnerabilities on a specific host:

hcloud HSS ListHostVuls --cli-region={region} --project_id={project_id} \
  --host_id={host_id} [--type={linux_vul|windows_vul|web_cms|app_vul|urgent_vul}] \
  [--limit=10] [--offset=0]

List hosts affected by a specific vulnerability:

hcloud HSS ListVulHosts --cli-region={region} --project_id={project_id} \
  --type={linux_vul|windows_vul|web_cms|app_vul|urgent_vul} --vul_id={vul_id} \
  [--limit=10] [--offset=0]

Show vulnerability details (choose by type):

# Linux vulnerability
hcloud HSS ShowLinuxVulDetail --cli-region={region} --project_id={project_id} \
  --vul_id={vul_id} --limit=10 --offset=0

# Windows vulnerability
hcloud HSS ShowWindowsVulDetail --cli-region={region} --project_id={project_id} \
  --vul_id={vul_id} --limit=10 --offset=0

# Web-CMS vulnerability
hcloud HSS ShowCmsVulDetail --cli-region={region} --project_id={project_id} \
  --vul_id={vul_id} --limit=10 --offset=0

Show vulnerability statistics:

hcloud HSS ShowVulStatics --cli-region={region} --project_id={project_id}

3. Security Baselines

Show baseline check overview (last check time, check stats, pass rate, top risks):

hcloud HSS ShowBaselineOverview --cli-region={region} --project_id={project_id}

Show baseline statistics:

hcloud HSS ShowBaselineStatistic --cli-region={region} --project_id={project_id}

List hosts affected by a specific baseline check rule:

hcloud HSS ListHostCheckRules --cli-region={region} --project_id={project_id} \
  --check_name={check_name} --standard={cn_standard|hw_standard} --host_id={host_id} \
  [--check_rule_name={rule_name}] [--limit=10] [--offset=0]

⚠️ --standard is a required parameter.

Show security check report for a specific host:

hcloud HSS ShowSecurityCheckHostReport --cli-region={region} --project_id={project_id} \
  --host_id={host_id} --scan_time={scan_time_ms}

⚠️ --scan_time is a required parameter (millisecond-level timestamp).

Show risk configuration detail:

hcloud HSS ShowRiskConfigDetail --cli-region={region} --project_id={project_id} \
  --check_name={check_name} --standard={cn_standard|hw_standard} \
  [--host_id={host_id}]

⚠️ --standard is a required parameter (cn_standard=Classified Protection Compliance Standard,hw_standard=Cloud Security Practice Standard).

4. Intrusion Alerts — Trojan & Malware (Trojan/Malware Alerts)

Query alert event history with filtering by event type, severity, handling status:

hcloud HSS ListEventHandleHistory --cli-region={region} --project_id={project_id} \
  [--event_type={event_type}] [--event_class_ids.1={event_class_id}] \
  [--severity={critical|high|medium|low}] [--handle_status={handled|unhandled}] \
  [--host_ip={ip}] [--host_name={name}] [--attack_tag={tag}] \
  [--asset_value={important|common|test}] [--limit=10] [--offset=0]

Common event_class_ids for malware:

event_class_id	Description
`av_1002`	Virus
`av_1003`	Worm
`av_1004`	Trojan
`av_1005`	Botnet
`av_1006`	Backdoor
`av_1010`	Rootkit
`av_1011`	Ransomware
`av_1015`	Webshell
`av_1016`	Mining software

List host protection history:

hcloud HSS ListHostProtectHistoryInfo --cli-region={region} --project_id={project_id} \
  --start_time={start_time_ms} --end_time={end_time_ms} [--limit=10] [--offset=0] \
  [--host_id={host_id}] [--file_path={path}]

⚠️ --start_time / --end_time is a required parameter(millisecond-level timestamp, difference not exceeding 30 days);--host_id is optional.

List antivirus-protected hosts:

# List antivirus-protected hosts (scan_type: quick/full; start_type: now/period)
hcloud HSS ListAntiVirusHost --cli-region={region} --project_id={project_id} \
  --limit=10 --offset=0 --scan_type={quick|full} --start_type={now|period} \
  [--host_id={host_id}] [--policy_id={policy_id}]

⚠️ --limit / --offset / --scan_type / --start_type is a required parameter。 --scan_type enum:quick(quick scan) / full(full scan);--start_type enum:now(start immediately) / period(start periodically). Other values (such as all/manual/auto) will be silently ignored by the API and return empty results.

5. Intrusion Alerts — Brute Force (Brute Force Alerts)

Query brute-force attack events (login_0001 = attempt, login_0002 = success):

hcloud HSS ListEventHandleHistory --cli-region={region} --project_id={project_id} \
  --event_class_ids.1=login_0001 --event_class_ids.2=login_0002 \
  [--severity={critical|high|medium|low}] [--handle_status={handled|unhandled}] \
  [--host_ip={ip}] [--limit=10] [--offset=0]

List weak password detection results:

hcloud HSS ListWeakPasswordUsers --cli-region={region} --project_id={project_id} \
  [--host_id={host_id}] [--limit=10] [--offset=0]

6. Login Audit Logs

Query common login IPs:

hcloud HSS ListLoginCommonIp --cli-region={region} --project_id={project_id} \
  [--ip_addr={ip}]

Query common login locations:

hcloud HSS ListLoginCommonLocation --cli-region={region} --project_id={project_id} \
  [--area_code={area_code}]

⚠️ These two operations only support the --ip_addr / --area_code filter (tested that --host_id/--limit/--offset is not supported), and pagination parameters cannot be added.

7. Risk Diagnosis

Query overall risk score:

hcloud HSS ShowRiskScore --cli-region={region} --project_id={project_id}

Query risk status for specific hosts:

hcloud HSS ListHostsRisk --cli-region={region} --project_id={project_id} \
  --host_id_list.1={host_id_1}

8. Update Alert Handling Status — ⚠️ Mutating, Requires Confirmation

Handle alert events (mark as handled, ignored, etc.):

hcloud HSS ChangeEvent --cli-region={region} --project_id={project_id} \
  --operate_event_list.1.event_class_id={event_class_id} \
  --operate_event_list.1.event_id={event_id} \
  --operate_event_list.1.event_type={event_type} \
  --operate_event_list.1.occur_time={occur_time_ms} \
  --operate_type={operate_type}

⚠️ --operate_type is atop-level parameter(not belonging to the operate_event_list array); in the array, event_class_id/event_id/event_type/occur_time are all required.

operate_type values for ChangeEvent:

mark_as_handled — Mark as handled
ignore — Ignore
add_to_alarm_whitelist — Add to alarm whitelist
add_to_login_whitelist — Add to login whitelist
unhandle — Restore to unhandled
do_not_ignore — Cancel ignore
remove_from_alarm_whitelist — Remove from alarm whitelist
remove_from_login_whitelist — Remove from login whitelist

⚠️ ⛔ isolate_and_kill(isolate and kill),do_not_isolate_or_kill although it is an API-supported value,this skill explicitly does not perform high-risk actions such as isolation/antivirus, and AI must not use it.

Update vulnerability handling status:

hcloud HSS ChangeVulStatus --cli-region={region} --project_id={project_id} \
  --operate_type={ignore|not_ignore|immediate_repair|manual_repair|verify|add_to_whitelist} \
  --data_list.1.vul_id={vul_id} --host_data_list.1.host_id={host_id}

⚠️ Vulnerabilities and hosts are associated and passed through --data_list.[N].vul_id + --host_data_list.[N].host_id (there is no top-level --vul_id/--host_id parameter）。

⚠️ Both ChangeEvent and ChangeVulStatus are mutating operations. Always prompt the user for confirmation before executing.

Parameter Confirmation

Parameter	Required	Description	Example
`--cli-region`	Yes	Target region	`{your-region}`
`--project_id`	Yes	Project ID (auto-detected if omitted)	Auto from CLI profile
`--host_id`	No	Filter by host ID	`xxxxxxxx-xxxx-xxxx`
`--severity`	No	Risk severity filter	`critical`, `high`, `medium`, `low`
`--type`	No	Vulnerability type	`linux_vul`, `windows_vul`, `web_cms`
`--repair_priority`	No	Vulnerability repair priority	`critical`, `high`, `medium`, `low`
`--handle_status`	No	Alert handling status filter	`handled`, `unhandled`
`--event_class_ids.N`	No	Event class ID filter (indexed)	`av_1004` (trojan)
`--limit`	No	Page size (default 10)	`10`
`--offset`	No	Page offset (default 0)	`0`
`--enterprise_project_id`	No	Enterprise project filter	`0` for default
`--asset_value`	No	Asset importance filter	`important`, `common`, `test`

Output Format

All commands return JSON by default. For inspection reports, the skill aggregates multiple query results into a structured risk summary:

{
  "inspection_time": "2026-08-28T10:00:00Z",
  "region": "{region}",
  "host_summary": { "total": 10, "protected": 8, "at_risk": 3 },
  "vulnerabilities": { "critical": 2, "high": 5, "medium": 12, "low": 8 },
  "baselines": { "pass_rate": "85%", "failed_rules": 7 },
  "alerts": { "unhandled_trojan": 1, "unhandled_brute_force": 3 },
  "risk_score": 72,
  "recommendations": ["Fix 2 critical vulnerabilities on host xxx", "Handle 1 unhandled trojan alert"]
}

Reference Documents

references/cli-installation-guide.md — hcloud CLI installation and authentication
references/iam-policies.md — Least-privilege IAM policies for HSS
references/verification-method.md — Verification and testing methods
references/dataflow-diagram.md — Data flow diagram
references/acceptance-criteria.md — Acceptance criteria
references/hss-event-class-reference.md — HSS event class ID reference

KooCLI Command Format Standard

hcloud HSS ListHostStatus --cli-region={region} --project_id={project_id} [--key=value ...]

Feature	Description	Example
Service name	`HSS` (exact KooCLI service name)	`HSS`
Operation name	PascalCase	`ListHostStatus`, `ShowVulStatics`, `ChangeEvent`
Region parameter	`--cli-region=<value>`	`--cli-region={region}`
Simple parameter	`--key=value`	`--host_id=xxx`
Indexed parameter	`--key.1=value1`	`--host_id_list.1=xxx`