All Products
Search

This Product

    ActionTrail:Create a custom alert rule

    Document Center

    ActionTrail:Create a custom alert rule

    Last Updated:Jun 16, 2026

    Create custom alert rules to monitor specific events for flexible enterprise security monitoring. ActionTrail generates alerts based on the queries, check frequency, and trigger conditions that you configure, then performs alert denoising and sends notifications based on your alert policies and action policies.

    Background information

    Custom alert rules use Structured Query Language (SQL) syntax to filter events. For more information about the SQL syntax, see Query overview and Query and analysis overview.

    Procedure

    1. Log on to the ActionTrail console.

    2. In the left-side navigation pane, click Event Alerting.

    3. On the Alert Center page, go to the Alert Rules tab and click Create Alert.

    4. In the Create Alert panel, add a query and analysis configuration.

      1. Click Add to the right of Query and Analysis.

      2. In the Query and Analysis dialog box, on the Advanced Settings tab, set Types to Logstore Name and Authorization Method to Default.

        Note

        The Region and Project fields are automatically populated to match the trail where event alerting is enabled.

      3. Select the Logstore to which the trail delivers events. The Logstore name is in the format actiontrail_<trail_name>.

      4. Select whether to enable Dedicated SQL.

        Note

        • Auto: Dedicated SQL is disabled by default. If a query concurrency limit is reached or query results are inaccurate, Simple Log Service automatically retries the query with Dedicated SQL.

        • Enable: Enables Dedicated SQL for all queries and analysis.

        • Close: Disables Dedicated SQL.

        For more information about Dedicated SQL, see High-performance and high-accuracy query and analysis (Dedicated SQL).

      5. Set the Query Time Range, enter a custom query statement in the text box to the right of Query, and then click Preview.

        For more information about custom query statements, see Custom query statements.

      6. Click Confirm.

    5. In the Create Alert panel, configure parameters such as Rule Name, Check Frequency, Group Evaluation, Trigger Condition, Add Tag, Add Annotation, No Data Recovery, Advanced Settings, and Destination.

      For more information about the parameters, see Alert monitoring rule parameters.

    6. Click Confirm.

      After the custom alert rule is created, it appears in the alert rule list. For more information, see Manage alert rules.

    Custom query statements

    Scenario

    Description

    Custom query statement

    Filter by cloud service and event

    Filters events by cloud service and event name.

    • Specify a single event for a single service. For example, specify the instance creation event for ECS.

      event.serviceName: Ecs and event.eventName: RunInstances

    • Specify multiple events for a single service. For example, specify instance release events for ApsaraDB RDS.

      event.serviceName: RDS and (event.eventName: DeleteDBInstance or event.eventName: Release or event.eventName: DestroyDBInstance)

    • Specify multiple events for multiple services. For example, specify permission change events for Resource Management and RAM.

      (event.serviceName: ResourceManager and (event.eventName: AttachPolicy or event.eventName: DetachPolicy )) or (event.serviceName: Ram and (event.eventName: AttachPolicyToUser or event.eventName: AttachPolicyToGroup or event.eventName: AttachPolicyToRole or event.eventName: DetachPolicyFromUser or event.eventName: DetachPolicyFromGroup or event.eventName: DetachPolicyFromRole))

    Get and specify parameters

    Filters events by specific parameter values in the event.requestParameterJson object.

    • Filter for events where the DeletionProtection attribute of an ECS instance is modified to false.

      event.serviceName: Ecs and event.eventName: ModifyInstanceAttribute | SELECT * FROM (SELECT cast(json_extract("event.requestParameterJson", '$.DeletionProtection') as varchar) as deletion_protection FROM log) WHERE deletion_protection = 'false'

    • Filter for events where the whitelist of an ApsaraDB RDS instance is set to 0.0.0.0.

      event.serviceName: Rds and event.eventName: ModifySecurityIps | SELECT * FROM (SELECT cast(json_extract("event.requestParameterJson", '$.SecurityIps') as varchar) as security_ips FROM log) WHERE security_ips like '%0.0.0.0%'

    Get resources

    Filters events by resource name or type.

    For more information about the parameters, see Management event structure.

    Get a single resource. For example, get the ID of the affected instance in an ECS instance release event.

    event.serviceName: Ecs and (event.eventName: DeleteInstances or event.eventName: DeleteInstance or event.eventName: Release) | SELECT resourceArray[num] as instance_id FROM (SELECT split("event.resourceName", ';') as resourceArray, array_position(split("event.resourceType", ';'), 'ACS::ECS::Instance') as num FROM log) where num > 0

    Get identities

    Filters events by the identity that initiated them.

    The identity information (userIdentity) includes parameters such as the identity type (type), identity name (userName), identity ID (principalId), and Alibaba Cloud account ID (accountId). For more information about the parameters, see Management event structure.

    • Get the identity type.

      * | SELECT "event.userIdentity.type" as user_type

    • Get the identity name.

      * | SELECT "event.userIdentity.userName" as user_name

    • Get the identity ID.

      * | SELECT "event.userIdentity.principalId" as principal_id

    • Get the Alibaba Cloud account ID.

      * | SELECT "event.userIdentity.accountId" as account_id

    Count event occurrences

    Counts event occurrences and triggers an alert when a specified threshold is exceeded.

    • Alert on excessive ECS instance restarts. For example, trigger an alert if an ECS instance is restarted more than twice.

      event.serviceName: Ecs and (event.eventName: RebootInstances or event.eventName: RebootInstance) | SELECT account_id, resourceArray[num] as instance_id, count(*) as cnt FROM ( SELECT "event.userIdentity.accountId" as account_id, split("event.resourceName", ';') as resourceArray, array_position(split("event.resourceType", ';'), 'ACS::ECS::Instance') as num FROM log) where num > 0 group by account_id, instance_id

    • Alert on an excessive number of failed logon attempts. For example, trigger an alert if more than two logon attempts fail.

      event.eventName: ConsoleSignin and event.userIdentity.type: ram-user and not event.errorMessage: success | select "event.userIdentity.principalId" as user_id, "event.userIdentity.userName" as user_name, count(1) as cnt group by user_id, user_name

    Custom alert examples

    The arbitrary function returns an arbitrary non-null value from x. The syntax is arbitrary(x). For more information, see the arbitrary function. The following examples use this function.

    • Example 1: Alert on ApsaraDB RDS instance release

      event.serviceName: RDS and (event.eventName: DeleteDBInstance or event.eventName: Release or event.eventName: DestroyDBInstance) | SELECT account_id, resourceArray[num] as instance_id, ram_user_id, user_type, user_name FROM (SELECT "event.userIdentity.accountId" as account_id, "event.userIdentity.principalId" as ram_user_id, split("event.resourceName", ';') as resourceArray, array_position(split("event.resourceType", ';'), 'ACS::RDS::DBInstance') as num, "event.userIdentity.type" as user_type, "event.userIdentity.userName" as user_name FROM log ) where num > 0

    • Example 2: Alert on security group configuration changes

      event.eventName: CreateSecurityGroup OR event.eventName: AuthorizeSecurityGroup OR event.eventName: AuthorizeSecurityGroupEgress OR event.eventName: RevokeSecurityGroup OR event.eventName: RevokeSecurityGroupEgress OR event.eventName: JoinSecurityGroup OR event.eventName: LeaveSecurityGroup OR event.eventName: DeleteSecurityGroup OR event.eventName: ModifySecurityGroupPolicy) | select "event.userIdentity.accountId" as account_id, "event.userIdentity.principalId" as ram_user_id, "event.eventName" as event_name, arbitrary("event.userIdentity.type") as user_type, arbitrary("event.userIdentity.userName") as user_name group by account_id, ram_user_id, event_name

    Related documents