ActionTrail:Announcement: Update of the event query feature in the ActionTrail console

Update description

• The method that you can use to query events in the ActionTrail console is updated.

  Previously, the ActionTrail console allows you to query events based on the following conditions: read/write type, username (RAM user), service name, resource type, resource name, AccessKey ID, and sensitive operation. As the amount of data increases, the original query method negatively affects the query efficiency and user experience. After the update, you can query events based on only one condition.

• Specific shortcut keys are added to facilitate time range setting.
• Descriptions of important event information are added. The important event information includes the event name, resource, and user.
• ActionTrail allows you to query event summaries.

  ActionTrail generates event summaries based on the basic information about events that occur during a 2-hour time window. An event summary includes the following information:

  • when: the time window during which the operation recorded in the event was performed. ActionTrail generates event summaries based on the basic information about events that occur during a 2-hour time window. You can query event summaries in real time.
  • who: the user who performed the operation recorded in the event. You can view the information about the Alibaba Cloud account, RAM user, RAM role, and AccessKey pair.
  • what: the operation that is recorded in the event, such as CreateInstance or DeleteInstance.
  • which: the resource on which the operation recorded in the event was performed.
  • where: the region of the resource and the IP address from which the operation recorded in the event was performed.

Impacts

The update affects only your event query operations in the ActionTrail console.

We apologize for the inconvenience caused by the update. We will speed up the update to provide you with more stable and robust audit services.