All Products
Search

This Product

    STAROps:STAROps Audit

    Document Center

    STAROps:STAROps Audit

    Last Updated:Jun 23, 2026

    ActionTrail automatically captures all control-plane operations on STAROps resources as auditable events. Use these events for security analysis, resource change tracking, and compliance auditing under frameworks such as Multi-Level Protection Scheme (MLPS) 2.0.

    Security and compliance value

    Security compliance frameworks such as MLPS 2.0 require complete, tamper-evident records of all operational activity. As an AI-driven autonomous operations platform, STAROps generates control-plane events that are particularly valuable for security teams:

    • Operator identity: Every audit event records the requester's identity (username and account ID), source IP address, cloud credential ID (RAM user, STS token, or API key), and the full set of request parameters.

    • Resource change traceability: Create, update, and delete operations on Digital Employees, Skills, MCP Tools, Conversations, and Long-term Tasks are all captured, providing a complete audit trail of platform changes over time.

    Audit coverage

    STAROps integrates with ActionTrail out of the box. All control-plane operations are automatically collected as audit events without additional configuration. The following resource types are covered:

    Resource type

    Service name in ActionTrail

    Audited operations

    Digital Employee

    DigitalEmployee

    Create, Update, Delete, Query

    Skills

    DigitalEmployeeSkill

    Create, Update, Delete, Query

    MCP Tools

    DigitalEmployeeTools

    Create, Update, Delete, Query

    Conversations

    Thread

    Create, Delete

    Long-term Tasks

    Mission

    Create, Update, Delete, Query
    Note

    STAROps audit events are routed through the CloudMonitor (CMS) service in ActionTrail. When filtering by service name, select CMS rather than a STAROps-specific entry. Results include both CloudMonitor and STAROps events; use Advanced Query or Log Service to isolate STAROps events.

    Prerequisites

    • ActionTrail is enabled for your Alibaba Cloud account.

    • Your account or RAM user has the required ActionTrail read permissions, including actiontrail:LookupEvents and related query permissions.

    View audit events

    ActionTrail provides three ways to query STAROps audit events. Advanced Query is recommended for its flexible filtering and precise results.

    Method 1: Advanced Query (recommended)

    Advanced Query lets you write custom filter expressions against a Log Service trail. Before you begin, create a trail in ActionTrail and configure it to deliver events to Log Service.

    1. Log in to the ActionTrail console.

    2. In the left navigation pane, click Advanced Query.

    3. From the trail selector, choose the trail that delivers events to Log Service.

    4. Set the time range for your query.

    5. Optional: Enter an event name (for example, CreateDigitalEmployee) or a username to narrow results.

    6. Click Run.

    7. In the results list, click an event to expand its full details.

    Method 2: Standard Query

    Standard Query provides a form-based interface for common filters such as service name, event type, and time range. Because STAROps events are routed through CMS, select CMS as the service name.

    1. Log in to the ActionTrail console.

    2. In the left navigation pane, click Event Query.

    3. In the Service Name filter, select CMS.

    4. Select the read/write event type as needed.

    5. Set the time range and click Search.

    6. In the results, identify STAROps events by their event names. STAROps event names begin with prefixes such as CreateDigitalEmployee, CreateThread, and CreateMission.

    Note

    Standard Query returns all CMS events, including both CloudMonitor and STAROps results. To isolate STAROps events, use Advanced Query or Log Service instead.

    Method 3: Log Service

    When a trail delivers events to Log Service, you can run SQL-level queries directly in the Log Service console. This method is best suited for complex filtering, high-volume analysis, or automated audit pipelines.

    1. Log in to the Log Service console.

    2. Locate the target Logstore. The Logstore name typically starts with actiontrail_.

    3. On the Query & Analysis page, enter your query statement and click Search & Analyze.

    Common query examples

    The following examples use Log Service query syntax. All STAROps events share the base filter event.serviceName: Cms. Combine this filter with additional conditions to target specific operations.

    Query a specific user's operations on Digital Employees

    The following query returns all create, update, and delete operations on Digital Employees by the user ops-admin:

    event.serviceName: Cms and event.userIdentity.userName: "ops-admin" and (event.eventName: CreateDigitalEmployee or event.eventName: UpdateDigitalEmployee or event.eventName: DeleteDigitalEmployee)

    Query conversation creation records within a time range

    Set the time range in the Log Service query panel, then run the following query to return all conversation (Thread) creation events:

    event.serviceName: Cms and event.eventName: CreateThread

    Query operations from a specific IP address

    Run the following query to investigate activity from an IP address outside your known corporate ranges:

    event.serviceName: Cms and event.sourceIpAddress: "203.0.113.xx"

    Best practices

    Enable long-term log storage

    ActionTrail retains events for 90 days by default. If your compliance requirements mandate longer retention (180 days or more), create a trail to deliver events to Log Service or OSS.

    • Log Service: Supports flexible query analysis, dashboards, and alert rules. Recommended for ongoing audit analysis and operational monitoring.

    • OSS: Provides low-cost, long-term archiving. Suitable for cold-storage compliance scenarios where interactive querying is not required.

    Set up event alerts

    ActionTrail event alerts help you monitor unusual operations on the STAROps platform in real time. When a configured alert rule detects a potential security threat or non-compliant operation, the system sends notifications through SMS, email, DingTalk, or other channels. You can use built-in alert templates to quickly create alert rules, or define custom rules.

    Recommended alert scenarios for STAROps:

    Alert scenario

    Monitored events

    Description

    Digital Employee deleted unexpectedly

    DeleteDigitalEmployee

    Alert immediately when a core resource is deleted to prevent accidental or malicious deletion.

    Skill configuration modified

    UpdateDigitalEmployeeSkill

    Skill configuration changes can affect Digital Employee behavior boundaries and should be monitored.

    Write operations outside business hours

    All Write-level events

    Control-plane operations outside business hours may pose a security risk.

    Operations from unknown IP addresses

    All events

    Operations from unfamiliar IP addresses may indicate unauthorized login.

    Consecutive failed operations

    All events containing errorCode

    A burst of failures in a short period may indicate a malicious attempt.

    Use Insights for anomaly detection

    Insights is an intelligent analysis tool provided by ActionTrail. It uses mathematical models to analyze call patterns of control-plane events and automatically identifies behaviors that deviate from the historical baseline, such as a sudden spike in API call rates or operations from an unfamiliar IP address, and generates Insights events for investigation.

    Anomaly types that Insights can identify include:

    • Risky API call events

    • API error events

    • Requests from abnormal IP addresses

    • AccessKey call events

    • Permission change events

    Insights must be enabled before use. For details, see the ActionTrail Insights documentation.