ActionTrail:Analyze events in SLS

Investigate a leaked AccessKey

If you detect API calls from an unusual IP address or suspect an AccessKey is compromised, analyze the AccessKey's call trace in SLS to identify suspicious activity.

Identify the city of origin for each call. Cities outside your normal business locations indicate a potential compromise.

1. Log on to the Simple Log Service console.

2. On the Projects tab, in the Projects, click the name of the project for the event.

3. Click the Logstore name, then use the time range picker above the query editor to set a time range.

4. In the query editor, enter the following query.

   __topic__: actiontrail_audit_event and event.userIdentity.accessKeyId:<YourAccessKeyId> | SELECT count(1) as pv, city FROM (SELECT "event.sourceIpAddress" AS ip, ip_to_city("event.sourceIpAddress") as city FROM log) WHERE ip_to_domain(ip)!='intranet' GROUP BY city ORDER BY pv DESC

   Note

   • Replace <YourAccessKeyId> with your AccessKey ID.

   • This query counts calls per city for the specified AccessKey. Cities outside your business locations indicate a potential compromise.

5. Click Search & Analyze to view the results.

6. Optional: If an AccessKey is compromised, adjust the permissions of the corresponding RAM user.

   Revoke permissions from a RAM user.

Trace ECS instance deletion

Trace high-risk operations such as ECS instance deletion to identify who performed them.

1. Log on to the Simple Log Service console.

2. On the Projects tab, find the Projects section and click the name of the project associated with the event.

3. Click the Logstore name, then use the time range picker above the query editor to set a time range.

4. In the query editor, enter the following query.

   __topic__: actiontrail_audit_event | SELECT serviceName, eventName, userName, count(1) as pv FROM (SELECT "event.eventName" as eventName, "event.serviceName" as serviceName, "event.userIdentity.userName" as userName FROM log) WHERE (serviceName = <TargetServiceName> and eventName = <TargetEventName>) GROUP BY serviceName, eventName, userName

   Note

   Replace <TargetServiceName> with ECS and <TargetEventName> with DeleteInstances to find who deleted an ECS instance.

5. Click Search & Analyze to view the results.

   The results show which users deleted ECS instances and how many times. To investigate a specific operation, run the following query.

   __topic__: actiontrail_audit_event and event.serviceName:<TargetServiceName> and <TargetResourceId> and event.userIdentity.accessKeyId:<YourAccessKeyId>

Generate a resource usage report

Generate data reports on core resource usage to support capacity planning and risk assessment.

For example, analyze ECS instance creation over the last six months to forecast resource needs for the next six months and optimize costs.

1. Log on to the Simple Log Service console.

2. On the Projects tab, find the Projects and click the name of the project for the event.

3. Click the Logstore name, then use the time range picker above the query editor to set a time range.

4. In the query editor, enter the following query.

   __topic__: actiontrail_audit_event and event.serviceName:<TargetServiceName> and event.eventName:<TargetEventName> | select t, diff[1] as current, diff[2] as last_month, diff[3] as percentage from(select t, compare( pv , 2592000) as diff from (select count(1) as pv, date_format(from_unixtime(__time__), '%m') as t from log group by t) group by t order by t)

   Note

   Replace <TargetServiceName> with ECS and <TargetEventName> with CreateInstance. This query returns the number of ECS instances created each month, showing the month-over-month growth rate.

5. Click Search & Analyze to view the results.

6. At the bottom of the page, click the Chart tab.

7. In the General Configurations area on the right side of the tab, select Chart Types > from the chart type list.

Use similar queries for other operations. Analyzing call patterns helps identify peak times and improve resource utilization.

Configure an anomaly alert

Configure an alert when a service's daily access volume exceeds its 60-day average by a specified percentage. You can also add custom charts for real-time monitoring. Add a chart to a dashboard.

1. Log on to the Simple Log Service console.

2. On the Projects tab, find the Projects, and click the name of the project for the event.

3. Query the average 60-day traffic and the current day's real-time traffic for each cloud service.

   1. Click the Logstore name, then use the time range picker above the query editor.

   2. In the Select Time area, click Custom and set the time range to the last 60 days.

   3. In the query editor, enter the following query.

      __topic__: actiontrail_audit_event |select a.serviceName, a.avg_pv, b.today_pv from (select serviceName, avg(pv) as avg_pv from (select "event.serviceName" as serviceName, count(1) as pv, date_format(from_unixtime(__time__), '%m-%d') as day from log group by serviceName, day) group by serviceName) a join (select "event.serviceName" as serviceName, count(1) as today_pv from log where date_format(from_unixtime(__time__), '%Y-%m-%d')=current_date group by serviceName) b on a.serviceName = b.serviceName

   4. Click Search & Analyze to view the results.

   5. At the bottom of the page, click the Chart tab.

   6. In the General Configurations area on the right side of the tab, select Chart Types > from the chart type list.

      Note

      Add filter conditions to exclude unwanted services or events.

4. Set up the alert.

   1. In the upper-right corner of the chart, click the icon.

   2. In the Alert Monitoring Rule panel, configure the parameters.

      Create an alert.

   3. Configure the trigger condition.

      $0.today_pv > $0.avg_pv && ($0.today_pv - $0.avg_pv)/$0.avg_pv > 0.5

      In this expression, $0 represents the raw chart data from the query, which includes the daily and 60-day average access volumes for each service. $0.avg_pv represents the 60-day average access volume for a service.

   4. Click Confirm.

Related documentation

• Quick start for query and analysis

• FAQ about query and analysis