Announcements and Updates
What is ActionTrail?
Services that work with ActionTrail
Global services that work with ActionTrail
Audit events of supported cloud services
Differences among a single-account trail, a multi-account trail, and a trail for the Inner-ActionTrail feature
Grant permissions to a RAM user
Manage the service-linked role
Manage the permission policy for event delivery
ActionTrail Event Log Reference
Management event structure
Insight event structure
Auditable events of ActionTrail
Sample Event Logs for Logons
Sample Event Logs for Role Assuming
Sample logs for resource-related events
Examples of common cloud service events
Get started with event queries
Event details query
Event summary query
Advanced event query
Insight Events for Intelligent Analysis
Overview of insight events
Query insight events in the ActionTrail console
Query insight events in the Log Service or OSS console
Enable and configure the event alerting feature
Single-account Trail Management (for Individual Users)
Single-account trail overview
Create a single-account trail
Update a single-account trail
Delete a single-account trail
Disable logging for a single-account trail
Multi-account Trail Management (for Enterprise Users)
Manage a delegated administrator account
Create a multi-account trail
Modify a multi-account trail
Delete a multi-account trail
Disable logging for a multi-account trail
Cross-account Event Delivery
Aggregate events across members in a resource directory
Aggregate events across Alibaba Cloud accounts
Management of Historical Event Delivery Tasks
Create a historical event delivery task
AccessKey Pair Audit
Query the logs of an AccessKey pair
Supported Alibaba Cloud services and events
Create a trail
Modify a trail
Delete a trail
Disable a trail
Fields in Alibaba Cloud-initiated events
API Reference (2020-07-06)
API Reference (2017-12-04) (Not recommended)
Example of using ActionTrail SDK for Java
Guarantee the security of events for auditing
Use RAM to manage ActionTrail permissions
Use ActionTrail to monitor the use of AccessKey pairs
Use ActionTrail to monitor the use of an Alibaba Cloud account
Use DLA to query and analyze events delivered to OSS
Deliver events to specified Alibaba Cloud services
Use Log Service to analyze events
Use ActionTrail to query events
Download ActionTrail events
Use SDKs to create a trail
Use Terraform to create a trail
Use ActionTrail to automatically add tags to resources
Store the required events for a long period
How do I query Alibaba Cloud services that are accessed by using an AccessKey pair and the call records of the AccessKey pair?
What is the maximum number of days that ActionTrail events are retained for query?
What events does ActionTrail record?
Does ActionTrail have a limit on the number of trails that I can create?
Do I need to deliver events to Log Service or OSS?
What is the storage path of an event that is delivered to an OSS bucket?
Can I view global events in every region after I create a trail and specify an OSS bucket for event delivery?
What do I do if the advanced event query and event alerting features of ActionTrail are unavailable?
How do I identify the operator that assumes a RAM role?
How can I use SQL statements to query ActionTrail events delivered to Log Service?