huawei-cloud-hss-query

Huawei Cloud HSS Host Security Skill

Overview

This skill provides AI Agent capabilities for Huawei Cloud HSS (Host Security Service / 主机安全服务), covering daily security inspection, risk diagnosis, and alert handling. It supports querying host assets, vulnerabilities, security baselines, intrusion alerts (trojans, brute-force attacks), and login audit logs, plus updating alert handling status — all via hcloud CLI.

Scope boundaries:

• ✅ Query: host assets, vulnerabilities, baselines, intrusion alerts, login audit logs
• ✅ Diagnose: risk scoring, high-risk vulnerability analysis, abnormal login analysis
• ✅ Manage: update alert handling status (mark as handled, ignored, etc.)
• ❌ Does NOT create or delete host resources
• ❌ Does NOT execute isolation, antivirus, or other high-risk actions
• ❌ Does NOT perform real-time blocking or kill processes

Prerequisites

1. hcloud CLI installed and authenticated with valid AK/SK credentials.
   • Installation guide: see references/cli-installation-guide.md
   • Verify: hcloud configure list shows a valid profile
2. HSS agent deployed on target ECS instances (HSS must be enabled in the console)
3. IAM permissions: HSS read permissions for query operations, HSS write permissions for alert handling.
   • See references/iam-policies.md for least-privilege policy
4. Region: HSS is region-specific. Use --cli-region to specify the target region (e.g., {your-region})

Workflow

1. Identify target → region, project_id, optional host_id filter
2. Query phase → list assets / vulnerabilities / baselines / alerts / login logs
3. Diagnose phase → risk score, high-risk items, abnormal login patterns
4. Handle phase → update alert handling status (requires user confirmation)
5. Output → structured JSON risk list + readable summary report

Core Commands

1. Host Assets (主机资产)

List all protected hosts with agent status, OS type, and risk flags:

hcloud HSS ListHostStatus --cli-region={region} --project_id={project_id} \
  [--host_id={host_id}] [--host_name={host_name}] [--os_type={linux|windows}] \
  [--agent_status={installed|not_installed|online|offline}] \
  [--has_vul=true] [--has_intrusion=true] [--has_baseline=true] \
  [--asset_value={important|common|test}] [--limit=10] [--offset=0]