Overview of insight events

Differences between insight events and management events

Benefits

• Automatic generation: ActionTrail determines the usual IP addresses based on historical management events and summarizes the usage pattern of these usual IP addresses. When you use Alibaba Cloud, ActionTrail constantly analyzes the unfamiliar IP addresses involved and identifies unusual IP addresses to generate insight events.
• Quick event query: ActionTrail allows you to query the following information about an insight event that was generated in the last 90 days in the console: the source IP address, start time, end time, and total number of operations performed from the unusual IP address recorded by the insight event. You can also query the code of the insight event.
• Long-term storage: ActionTrail delivers insight events to the specified Log Service Logstore or OSS bucket for long-term storage and further analysis.

How an insight event works

• Generation conditions: When you enable the insight event feature for a trail for the first time, ActionTrail analyzes at least 10,000 historical management events recorded by the trail to generate an insight event. Therefore, no insight event is generated if the number of existing management events does not meet the requirement. An insight event helps you gain an insight into the operations that are performed from unusual IP addresses. If all operations performed within your Alibaba Cloud account are considered normal, no insight event is generated.
• Applicable scope: Insight events are generated by region. An insight event analyzes the IP addresses recorded in the management events that reside in the same region. For global events, ActionTrail generates insight events based only on the global events that are generated in the region where you created the associated trail. If you disable the associated trail, insight events are no longer generated.
• Measurement: Only IPInsight events are supported, which allow you to gain an insight into the operations that are performed from unusual IP addresses. An IPInsight event calculates the correlation between an unfamiliar IP address and the usage pattern of usual IP addresses. An unfamiliar IP address may be considered unusual and an IPInsight event may be generated when the IP address is recorded for the first time. In the next seven days, if the IP address is used to access cloud resources in more than two days, the IP address is considered usual. Otherwise, an IPInsight event is generated and delivered to the specified Log Service Logstore or OSS bucket on the eighth day after the first operation performed from the IP address.

Usage notes

• To obtain the permissions to manage insight events, submit a ticket.
• Insight events cannot be generated or querired in the China (Heyuan), China (Guangzhou), and UAE (Dubai) regions. For information about regions supported by insight events, see Supported regions.
• You can use the insight event feature free of charge in the trial period. For information about the subsequent billing policy, see Billing.
• You need to create a single-account trail that delivers events of all types in all regions and enable the insight event feature for the trail. For global events, ActionTrail generates insight events based only on the global events that are generated in the region where you created the associated trail.
• You may enable the insight event feature for only one trail and you disable the feature. In this case, insight events can be generated on the next day after you enable the feature again.
• After an event occurs within your Alibaba Cloud account, you must wait 10 minutes before you can query the details of the associated insight event in the ActionTrail console.

Query insight events

• Query insight events in the ActionTrail console

  You can log on to the ActionTrail console and query the insight events that were generated in the last 90 days in the region where you created the associated single-account trail . For information about how to query the details of insight events, see Query details of an insight event.

• Query insight events in the Log Service or OSS console

  If you want to query the insight events that were generated more than 90 days ago, use the Log Service or OSS console.

Query details of an insight event

You can query the details of an insight event in the ActionTrail console. The following figure and table show the information that can be displayed in the console.

{
  "eventId": "DFB8EB15-8F65-1B88-8F9E-6D8A5865****",
  "eventVersion": 1,
  "eventSource": "actiontrail.cn-hangzhou.aliyuncs.com",
  "requestParameters": { // The input parameters of the API request.
    "AcsProduct": "Actiontrail",
    "EndTime": "2021-08-03T07:35:00Z",
    "NextToken": "eyJhY2NvdW50IjoiMTU5NDk4NjkzODI2ODg5OCIsImV2ZW50SWQiOiIwRDMwMjYxNS03NDJFLTEyRjQtODM1Ri0xNDMzNUUyM0RFRDkiLCJpcCI6IjQyLjEyMC43NS4xNTQiLCJsb2dJZCI6IjYyLTE1OTQ5ODY5MzgyNjg4OTgiLCJ0aW1lIjoxNjI3OTc1ODQwMD****",
    "MaxResults": 20,
    "StartTime": "2021-08-03T07:30:00Z",
    "AcceptLanguage": "zh-CN"
    "Region": "cn-hangzhou",
    "LookupAttribute. 1.Value": "42.120.XX.XX",
    "RegionId": "cn-hangzhou",
    "LookupAttribute. 1.Key": "SourceIpAddress"
  },
  "sourceIpAddress": "42.120.XX.XX", // The source IP address that is recorded in the management event.
  "userAgent": "actiontrail.console.aliyun.com",
  "eventType": "ApiCall",
  "userIdentity": { // The information about the identity of the requester.
    "sessionContext": {
      "attributes": {
        "mfaAuthenticated": "false"
      }
    },
    "accountId": "159498693826****", // The ID of the Alibaba Cloud account.
    "principalId": "159498693826****", // The ID of the requester.
    "type": "root-account" ,// Indicates an Alibaba Cloud account.
    "userName": "root"
  },
  "serviceName": "Actiontrail", // The name of the Alibaba Cloud service associated with the management event.
  "apiVersion": "2020-07-06",
  "requestId": "DFB8EB15-8F65-1B88-8F9E-6D8A586580A7",
  "eventTime": "2021-08-03T07:58:56Z", // The time when the management event was generated, in UTC.
  "isGlobal": false,
  "acsRegion": "cn-hangzhou", //The ID of the region.
  "eventName": "LookupEvents" // The management event name.
}

{
  "event": {
    "eventVersion": "1",
    "eventTime": "2021-03-10T21:00:00Z",
    "acsRegion": "cn-hangzhou",
    "eventID": "F23A3DD5-7842-4EF9-9DA1-3776396A****",
    "eventType": "ActionTrailInsight",
    "recipient": "116214297662****",
    "insightDetails": {
      "sourceIpAddress": "42.120.XX.XX",
      "insightType": "IpInsight",
      "insightContext": {
        "statistics": {
          "baseline": {
            "threshold": 0.6
          },
          "insight": {
            "predict": 0.12
          },
          "insightDuration": 300,
          "insightCount": 10
        }
      }
    },
    "userIdentity": {
      "accountId": "112432432434****",
      "principalId": "231321312321****"
    },
    "eventCategory": "Insight"
  }
}