ActionTrail supports Insights events to help you detect unusual activity in your management events. After you enable this feature, ActionTrail analyzes your management events to identify potentially risky activity related to API calls, API errors, IP addresses, AccessKey pairs, permission changes, password changes, and trail concealment. It then generates Insights events, which give you visibility into management risks and help you take timely action.
Differences between Insights events and management events
Event type | Description | References |
management event | A log of a management operation performed on a cloud resource by an identity within your Alibaba Cloud account. | |
Insights event | Based on your recorded management events, ActionTrail uses mathematical models to analyze and identify potentially risky activities. This analysis generates several types of Insights events, including Insights event on API call rate ( |
Insights events are generated by analyzing management events only. The Insights feature does not analyze data events, even if you have enabled data event logging for your trail.
Features
The Insights feature in ActionTrail analyzes all management events in your Alibaba Cloud account over a historical period to generate the following types of events: Insights event on API call rate (ApiCallRateInsight), Insights event on API error rate (ApiErrorRateInsight), Insights event on IP address (IpInsight), Insights event on AccessKey pair call rate (AkInsight), Insights event on permission change (PolicyChangeInsight), Insights event on password change (PasswordChangeInsight), and Insights event on trail concealment (TrailConcealmentInsight). Each Insights event includes a start event and an end event, marking the beginning and end of the detected activity.
Insights event on API call rate (
ApiCallRateInsight): Analyzes write operations in your account. It uses mathematical models to compare the current API call rate for an operation against its historical baseline. If the rate deviates significantly, ActionTrail generates an Insights event.Insights event on API error rate (
ApiErrorRateInsight): Analyzes all management events related to API call errors. It uses mathematical models to compare the current API error rate against its historical baseline. If the rate deviates significantly, ActionTrail generates an Insights event.Insights event on IP address (
IpInsight): Builds a model of normal IP address activity for your account. It continuously scans for and identifies new or anomalous source IP addresses and generates an Insights event for any suspicious activity.Insights event on AccessKey pair call rate (
AkInsight): Analyzes the usage of all AccessKey IDs in your account. It uses mathematical models to compare the call rate for a specific AccessKey pair against its historical baseline. If the rate deviates significantly, ActionTrail generates an Insights event.Insights event on permission change (
PolicyChangeInsight): Analyzes permission changes across cloud services such as RAM, OSS, and Resource Management. It uses machine learning to filter out routine changes made by frequent operators and generates an Insights event for changes made by an infrequent or unusual operator.Insights event on password change (
PasswordChangeInsight): Analyzes password changes across cloud services such as KMS, AasCustomer (Alibaba Cloud account logon service), and AasSub (RAM user logon service). It uses machine learning to filter out routine changes made by frequent operators and generates an Insights event for changes made by an infrequent or unusual operator.Insights event on trail concealment (
TrailConcealmentInsight): Analyzes actions that stop or delete a trail in ActionTrail. It uses machine learning to filter out routine trail configuration changes and generates an Insights event when an infrequent or unusual operator performs these actions.
How it works
Generation conditions: After you enable the Insights feature, it takes at least 24 hours to generate the first Insights event. ActionTrail creates Insights events only when it detects potentially risky or anomalous activity in your Alibaba Cloud account.
Scope: ActionTrail analyzes management events on a per-region basis, so an Insights event is always generated in the same region as the management events that triggered it.
Detection rules:
Insights event on API call rate (
ApiCallRateInsight): Analyzes API call rates for anomalies. It uses mathematical models to detect significant differences between current and historical API calling behavior. If a significant difference is found, ActionTrail generates an Insights event for that API.NoteThis event type is more sensitive to write events.
Insights event on API error rate (
ApiErrorRateInsight): Analyzes API error rates for anomalies. It uses mathematical models to detect significant differences between current and historical API error patterns. If a significant difference is found, ActionTrail generates an Insights event for that API error.NoteThis event type is equally sensitive to read and write events.
Insights event on IP address (
IpInsight): Identifies access from risky IP addresses. It uses IP correlation algorithms to detect suspicious activity. This process may occasionally flag a new, legitimate IP address as risky. ActionTrail generates only one Insights event per day for a specific suspicious IP address, corresponding to its first detected access.Insights event on AccessKey pair call rate (
AkInsight): Analyzes AccessKey call rates for anomalies. It uses mathematical models to detect significant differences between current and historical calling behavior for an AccessKey. If a significant difference is found, ActionTrail generates an Insights event for that AccessKey.NoteThis event type is more sensitive to write events.
Insights event on permission change (
PolicyChangeInsight): Analyzes permission changes made by infrequent operators. It uses machine learning algorithms to generate frequent itemsets and association rules, filtering out actions from regular operators and generating events for anomalous behavior.Insights event on password change (
PasswordChangeInsight): Analyzes password changes made by infrequent operators. It uses machine learning algorithms to generate frequent itemsets and association rules, filtering out actions from regular operators and generating events for anomalous behavior.Insights event on trail concealment (
TrailConcealmentInsight): Analyzes actions by infrequent operators to stop or delete a trail. It uses machine learning algorithms to generate frequent itemsets and association rules, filtering out trail configuration actions from regular operators and generating events for anomalous behavior.
Usage
Insights events are not available in the following regions:
China (Heyuan)
China (Nanjing - Local Region) Closing Down
China (Guangzhou)
China (Fuzhou - Local Region) Closing Down
China (Wuhan - Local Region)
South Korea (Seoul)
Philippines (Manila)
UAE (Dubai)
NoteFor the full list of regions where ActionTrail is available, see Supported regions. Insights events are supported in all of those regions except for the ones listed above.
The Insights feature is currently available for a free trial. For information about future charges, see Billing.
After you enable the Insights feature, ActionTrail continuously analyzes all subsequent management events in supported regions.
It takes at least 24 hours to generate the first Insights event after you enable the feature. ActionTrail generates an Insights event only when it detects unusual activity in your account.
Query Insights events
After you enable the Insights feature, you can query Insights events from the past month in the current region on the ActionTrail console. For detailed instructions, see Query Insights events on the ActionTrail console.