All Products
Search
Document Center

ActionTrail:Audit events of ECD

Last Updated:Mar 20, 2023

Elastic Cloud Desktop (ECD) is integrated with ActionTrail. In the ActionTrail console, you can query the management events that are generated when you manage ECD resources. ActionTrail can deliver management events to Logstores in Log Service or Object Storage Service (OSS) buckets. This way, you can audit the events in real time and locate the causes of issues.

ActionTrail generates management events when you manage cloud resources by using APIs or the Alibaba Cloud Management Console. The following table describes the management events of ECD that you can query in the ActionTrail console. The missing descriptions will be provided in the future.

Event name

Description

ActivateOfficeSite

Activates a workspace.

AddDeviceFromSN

Adds a device by using a serial number.

AddDevicesFromCSV

Adds devices by using a CSV file.

AddLabels

Creates tags.

AddUserToDesktopGroup

Assigns a desktop group to multiple users.

AddUserToSecurityCenterWhiteList

Adds users to the whitelist for the trial of Security Center.

ApplyCoordinationForMonitoring

Applies for coordination monitoring.

AssociateNetworkPackage

Associates Internet access packages with workspaces.

AttachCen

Attaches the secure office network of a workspace to a Cloud Enterprise Network (CEN) instance.

AttachLabels

Adds multiple tags at a time.

BatchSetDesktopManager

Configures multiple desktop administrators at a time.

CancelCoordinationForMonitoring

Cancels coordination monitoring.

CancelCopyImage

Cancels cross-region image copy.

ChangeUserPassword

Changes the user password by an administrator.

CheckUsedProperty

Checks the number of properties that are used.

CheckUsedPropertyValue

Checks the number of property values that are used.

CheckUserInSecurityCenterWhiteList

Checks whether a user is added to the whitelist for the trial of Security Center.

CheckUserTags

Checks instance tags.

ClonePolicyGroup

Clones a policy.

ConfigADConnectorTrust

Configures the trust relationship for an Active Directory (AD) workspace.

ConfigADConnectorUser

Configures the organizational unit (OU) and administrator of an AD workspace.

CopyImage

Copies an image across regions.

Create

Purchases ECD on the buy page.

CreateADConnectorDirectory

Creates an AD directory.

CreateADConnectorOfficeSite

Creates a workspace of the enterprise AD account type.

CreateBandwidthResourcePackages

Creates a bandwidth plan.

CreateBundle

Creates a custom desktop template.

CreateCloudDriveService

Creates a cloud disk.

CreateCloudDriveUsers

Adds end users of a cloud disk.

CreateDesktopGroup

Creates a desktop group.

CreateDesktops

Creates one or more cloud desktops.

CreateDesktopsLite

Quickly creates a desktop.

CreateDiskEncryptionService

Enables disk encryption.

CreateImage

Creates a custom image.

CreateNASFileSystem

Creates an Apsara File Storage NAS (NAS) file system.

CreateNetworkPackage

Creates an Internet access package.

CreateOrderForHardware

Creates a hardware client order.

CreateOrg

Creates an organization.

CreatePolicyGroup

Creates a policy.

CreateProperty

Creates a property.

CreateRAMDirectory

Creates a Resource Access Management (RAM) directory.

CreateScaleStrategy

Creates a scaling policy for a desktop group.

CreateServiceLinkedRole

Creates a service-linked role.

CreateSimpleOfficeSite

Creates a workspace of the convenience account type.

CreateSnapshot

Creates a snapshot for a disk of a cloud desktop.

CreateUsers

Creates a user.

CreateUserTags

Creates a user tag.

DeleteBundles

Deletes one or more custom desktop templates.

DeleteCloudDriveServices

Deletes a cloud disk.

DeleteCloudDriveUsers

Removes end users of a cloud disk.

DeleteDesktopGroup

Creates a desktop group.

DeleteDesktops

Deletes cloud desktops.

DeleteDevices

Deletes devices.

DeleteImages

Deletes one or more custom images.

DeleteLabel

Deletes a tag.

DeleteNASFileSystems

Deletes one or more NAS file systems.

DeleteNetworkPackages

Deletes one or more Internet access packages.

DeleteOfficeSites

Deletes a workspace.

DeletePolicyGroups

Deletes one or more custom policies.

DeleteScaleStrategy

Deletes a scaling policy of a desktop group.

DeleteSnapshot

Deletes one or more snapshots.

DeleteUserPropertyValue

Deletes a custom property value that is configured by a user.

DeleteUserTags

Deletes user tags.

DeleteVirtualMFADevice

Deletes a multi-factor authentication (MFA) device.

DescribeAlarmEventStackInfo

Queries the details of an alert.

DescribeBundles

Queries desktop templates.

DescribeCens

Queries the details of all CEN instances within an Alibaba Cloud account.

DescribeClientEvents

Queries the operation logs of an end user.

DescribeCloudDrivePermissions

Queries the permissions of a cloud disk.

DescribeCloudDriveService

Queries information about a cloud disk.

DescribeCloudDriveUsers

Queries the information about all end users of a cloud disk.

DescribeDesktopGroups

Queries desktop groups.

DescribeDesktopIdsByVulNames

Queries the cloud desktops in which vulnerabilities are detected.

DescribeDesktopsInGroup

Queries cloud desktops in a desktop group.

DescribeDesktopTypes

Queries the details of one or more cloud desktop types.

DescribeDesktopUsers

Queries the information about users that are assigned to a desktop.

DescribeDrives

Queries disks.

DescribeFlowMetric

Modifies the inbound bandwidth and outbound bandwidth.

DescribeFlowStatistic

Queries the traffic that is consumed by cloud desktops in a workspace.

DescribeFotaPendingDesktops

Queries the desktops to be updated in an update task.

DescribeFotaTasks

Queries update tasks.

DescribeFrontVulPatchList

Queries the patches of one or more vulnerabilities before the current vulnerability is fixed.

DescribeGroupedVul

Queries the information about the vulnerabilities that are detected in cloud desktops within a workspace.

DescribeHardwareTerminals

Queries hardware clients.

DescribeImageModifiedRecords

Queries one or more image change records of a cloud desktop.

DescribeImagePermission

Queries Alibaba Cloud accounts to which the current image is shared.

DescribeImages

Queries the information about one or more images.

DescribeInvocations

Queries the execution information and execution status of Cloud Assistant commands.

DescribeKmsKeys

Queries the certificates of Key Management Service (KMS).

DescribeManagerUsers

Queries user administrators.

DescribeMfaDevices

Queries MFA devices.

DescribeModificationPrice

Queries the price for changing a configuration.

DescribeNASFileSystems

Queries the information about NAS file systems.

DescribeNetworkPackages

Queries the details of one or more Internet access packages.

DescribeOfficeSites

Queries the details of one or more workspaces.

DescribeOrgByLayer

Queries subordinate organizations.

DescribeOrgs

Queries organizations.

DescribePolicyGroups

Queries the details of one or more policies.

DescribePostPaidDesktopBills

Queries the bills of pay-as-you-go desktops.

DescribePrice

Queries the price information.

DescribeRecordings

Queries the details of screen recording.

DescribeRegions

Queries the regions in which ECD is available.

DescribeRenewalPrice

Queries the renewal price.

DescribeResourcePackageQuota

Queries the bandwidth plan quota.

DescribeScaleStrategys

Queries the scaling policies of a desktop group.

DescribeScanTaskProgress

Queries the progress of a virus scan task.

DescribeSecurityEventOperations

Queries the operations that can be performed to handle alerts.

DescribeSecurityEventOperationStatus

Queries the handling status of an alert.

DescribeSnapshots

Queries one or more snapshots of a cloud desktop.

DescribeSnLabelCounts

Queries the number of device tags.

DescribeSuspEventOverview

Queries the number of alerts by severity level in a region.

DescribeSuspEventQuaraFiles

Queries the quarantined files in the quarantine panel.

DescribeSuspEvents

Queries exceptions.

DescribeUserConnectionRecords

Queries records when users connect to cloud desktops in a desktop group.

DescribeUsers

Queries users.

DescribeUsersInGroup

Queries authorized users of a desktop group.

DescribeVirtualMFADevices

Queries the MFA devices that are bound to AD users.

DescribeVulDetails

Queries the details of a vulnerability.

DescribeVulList

Queries vulnerabilities.

DescribeVulOverview

Queries the overview information about the vulnerabilities to be fixed.

DescribeZones

Queries supported zones.

DetachCen

Detaches the secure office network of a workspace from a CEN instance.

DetachLabels

Removes tags from multiple resources at a time.

DisableDesktopsInGroup

Disables desktops in a desktop group.

DissociateNetworkPackage

Disassociates Internet access packages from workspaces.

DoCheckResource

Checks resources.

DoLogicalDeleteResource

Deletes a resource in a logical manner.

ExportClientEvents

Exports events that aoccur on a cloud desktop from an Alibaba Cloud Workspace client.

ExportDesktopGroupInfo

Exports desktop groups.

ExportDesktopListInfo

Exports cloud desktops.

FilterUsers

Searches for users by user property.

GetDesktopGroupDetail

Queries the details of a desktop group.

GetDeviceOtaAutoStatus

Queries whether automatic update is enabled.

GetDeviceOtaTaskVersionInfo

Queries the version information about a user task.

GetDirectorySsoStatus

Queries the single sign-on (SSO) status of an AD directory.

GetMntConnectUser

Queries connection management accounts in maintenance mode.

GetOfficeSiteSsoStatus

Queries whether SSO is enabled for a workspace.

GetOssConfig

Queries OSS configurations.

GetSpMetadata

Queries the metadata of Security Assertion Markup Language (SAML) 2.0-based service providers (SPs).

GetUserByToken

Queries user information based on the logon token.

GetUsersCount

Queries the number of users.

HandleSecurityEvents

Handles multiple alerts at a time.

ImportUsers

Imports users.

ListDeviceOtaTaskByTenant

Queries over-the-air (OTA) tasks.

ListDevices

Queries devices.

ListDeviceSeats

Queries device seats.

ListDirectoryUsers

Queries the information about users of an AD directory.

ListLabels

Queries tags.

ListOfficeSiteOverview

Queries the overview information about workspaces.

ListOfficeSiteUsers

Queries the details of AD users in an AD workspace after the workspace is connected to the enterprise AD system.

ListProperty

Queries properties.

ListPropertyValue

Queries property values by property ID.

ListTagResources

Queries the relationships between resources and tags.

ListTenantDeviceOtaInfo

Queries the information about tenant devices to be updated.

ListUserAdOrganizationUnits

Queries OUs in an AD domain.

ListUsers

Queries filtered usernames.

LockMfaDevice

Locks an MFA device.

LockUsers

Locks users.

LockVirtualMFADevice

Locks a virtual MFA device that is in the normal state.

ModifyADConnectorDirectory

Modifies an AD directory.

ModifyADConnectorOfficeSite

Modifies an AD workspace.

ModifyAppImage

Modifies image information.

ModifyBundle

Modifies desktop templates.

ModifyCloudDrivePermission

Modifies the permissions of a cloud disk.

ModifyCloudDriveService

Modifies the settings of a cloud disk.

ModifyCloudDriveUsers

Modifies the attributes of the end users of a cloud disk.

ModifyDesktopChargeType

Changes the billing method of a cloud desktop

ModifyDesktopGroup

Modifies a desktop group.

ModifyDesktopHostName

Changes the hostname of a cloud desktop.

ModifyDesktopName

Changes the name of a cloud desktop.

ModifyDesktopSpec

Modifies the configurations of a cloud desktop.

ModifyDesktopsPolicyGroup

Modifies a desktop policy group.

ModifyDevicesSecureNetworkType

Changes the network access type of a device.

ModifyEntitlement

Reassigns users to a desktop.

ModifyImageAttribute

Modifies the attributes of a custom image.

ModifyImagePermission

Shares or unshares an image.

ModifyNASDefaultMountTarget

Modifies the mount target of a NAS file system.

ModifyNetworkPackage

Modifies the maximum public bandwidth for an Internet access package.

ModifyNetworkPackageBandwidth

Modifies the bandwidth of an Internet access package.

ModifyNetworkPackageEnabled

Restores or disables an Internet access package.

ModifyOfficeSiteAttribute

Modifies the attributes of a workspace.

ModifyOfficeSiteCrossDesktopAccess

Enables cross-desktop access in a workspace.

ModifyOfficeSiteMfaEnabled

Enables or disables MFA for a workspace.

ModifyOperateVul

Handles vulnerabilities that are detected.

ModifyOrg

Modifies an organization.

ModifyPolicyGroup

Modifies a policy.

ModifyScaleStrategy

Modifies a scaling policy.

ModifySecureNetworkType

Modifies network access configurations.

ModifyUser

Modifies a user.

ModifyUserEntitlement

Assigns desktops to convenience users.

ModifyUserRemark

Modifies the description of a user.

ModifyUserToDesktopGroup

Modifies user permissions on a desktop group.

MoveOrg

Modifies the relationship between organizations.

MoveUserOrg

Modifies the relationship between users and organizations.

OperateVuls

Handles multiple vulnerabilities at a time.

QuerySyncStatusByAliUid

Queries user synchronization information.

RebuildDesktops

Recreates a cloud desktop.

Release

Automatically releases resources after expiration.

RemainRefund

Requests to unsubscribe from resources.

RemoveMfaDevice

Deletes an MFA device.

RemoveOrg

Deletes an organization.

RemoveOrgChildren

Deletes an organization and its subordinate organizations.

RemoveProperty

Deletes a property.

RemoveUserFromDesktopGroup

Removes a user from a desktop group.

RemoveUsers

Deletes users.

Renew

Renews resources such as an instance or a resource plan.

RenewDesktopGroup

Renews a desktop group.

RenewDesktops

Updates a desktop.

RenewNetworkPackages

Renews one or more Internet access packages.

ResetDesktops

Resets a cloud desktop.

ResetNASDefaultMountTarget

Resets the mount target of a NAS file system.

ResetSnapshot

Restores the data of a disk from a snapshot.

ResetUserPassword

Resets the passwords of multiple users at a time.

RollbackSuspEventQuaraFile

Restores a quarantined file.

RunCommand

Executes the script on one or more cloud desktops.

SendVerifyCode

Queries the verification code.

SetDesktopMaintenance

Configures the desktop maintenance mode.

SetDeviceOtaAutoStatus

Configures the status of OTA.

SetDeviceOtaTaskStatus

Configures the status of OTA tasks.

SetDirectorySsoStatus

Configures the SSO status of an AD directory.

SetIdpMetadata

Uploads the metadata of SAML 2.0-based SPs.

SetOfficeSiteSsoStatus

Enables or disables SSO for a workspace.

SetUserPropertyValue

Configures a custom property value.

StartDesktops

Starts one or more stopped cloud desktops.

StartVirusScanTask

Manually triggers a virus scan task.

StopDesktops

Stops one or more running cloud desktops.

StopInvocation

Stops a command.

SyncAllEduInfo

Manually synchronizes teacher and student information from DingTalk.

TagResources

Add tags to resources.

UnlockMfaDevice

Unlocks an MFA device.

UnlockUsers

Unlocks users.

UnlockVirtualMFADevice

Unlocks a virtual MFA device.

UntagResources

Removes tags from resources.

UpdateAlias

Changes the alias of a device.

UpdateDeviceBindedEndUser

Changes the end users that are bound to a device at a time.

UpdateDevicesConfig

Modifies device configurations.

UpdateLabel

Modifies a tag.

UpdateProperty

Modifies a property.

UploadImage

Uploads a custom image.

VerifyCen

Verifies a CEN instance.

AuthorizeApp

None.

BatchDeleteApps

None.

BatchDistributeApps

None.

BatchSubscribeApps

None.

ChangeAppshow

None.

CreateAppImage

None.

CreateAppVersion

None.

CreateDesktopSavingPlan

None.

CreateIsvApp

None.

CreateSnatEntries

None.

CreateTenantApp

None.

CreateUserAuditToSls

None.

CreateUserOssPath

None.

DeleteAppImage

None.

DeleteDistributeUser

None.

DeleteSnatEntries

None.

DeleteTenantApp

None.

DescribeConvertQuota

None.

DescribeDesktopMetricData

None.

DescribeDesktopMetricLast

None.

DescribeDesktopMetricTop

None.

DescribeDesktopSessions

None.

DescribeDesktopTimers

None.

DescribeGlobalDesktopGroups

None.

DescribeGlobalDesktops

None.

DescribeGlobalImages

None.

DescribeGuestApplications

None.

DescribeMigrateInfo

None.

DescribeRefundPrice

None.

DescribeSavingPlanPrice

None.

DescribeSnatEntries

None.

DescribeUserAuditSlsInfo

None.

DescribeUserOssPath

None.

DescribeUserSlsProject

None.

DistributeApp

None.

DownloadRecordings

None.

ExportDesktopSessions

None.

GetAdminStsCredential

None.

GetAppshow

None.

GetAppStreamAgreementStatus

None.

GetCertTemplate

None.

GetCoordinateTicket

None.

GetCreateGroupFlag

None.

GetIsvAppUploadCredential

None.

GetIsvCertStatus

None.

GetIsvCopyrightUploadCredential

None.

GetStsCredential

None.

GetTenantApp

None.

ListAdWorkspace

None.

ListAllAppCategory

None.

ListApp

None.

ListAppGroup

None.

ListAppImage

None.

ListAppVersion

None.

ListAuthorizationAllUser

None.

ListAuthorizationApp

None.

ListAuthorizationInfo

None.

ListDistributeAllUser

None.

ListDistributeApp

None.

ListImageApp

None.

ListIsvApp

None.

ListIsvAppAudits

None.

ListSubscribeInfo

None.

ListTenantApp

None.

ListTenantAppCategory

None.

ListUpdateImageApp

None.

ListVersionAppInfo

None.

MigrateDesktopProtocol

None.

MigrateDesktops

None.

MigrateImageProtocol

None.

ModifyDesktopTimer

None.

ModifyNetworkPackageAttributes

None.

QueryAccountLabel

None.

QueryItems

None.

SetAppStreamAgreementStatus

None.

StopGuestApplications

None.

StopPostUserAuditLog

None.

SubscribeApp

None.

UpdateAppVersion

None.

UpdateSilence

None.

UpdateTenantApp

None.

UserList

None.