Create Alert for Single-Factor Management Console Logins

Sign in to your Alibaba Cloud account.

Navigate to Simple Log Service (SLS) console available at https://sls.console.aliyun.com/.

In the Log Application section, select the Audit & Security tab, and choose Log Audit Service.

In the left navigation panel, under Access to Cloud Products, choose Global Configurations.

Select the cloud region of the SLS central project from the Region of the Central Project dropdown list. If the Region of the Central Project is already configured, continue the Audit process with the next step.

Ensure that Operations Log is enabled for ActionTrail, and click on the name (link) of the SLS central project, listed next to Central Project. If the name of the central project is not a link (the name is not clickable), there is no SLS central project created for managing log resources, available in the selected region. If the name of the central project is a link, click on the link to access your SLS central project.

Choose Alerts (bell icon) from the left navigation panel and select the Alert rule tab to access your alert monitoring rules.

Select actiontrail_log from the Search Logstore dropdown list to return only the monitoring rules associated with the actiontrail_log logstore.

Choose the active alert monitoring rule that you want examine, and select Edit. A monitoring rule is active when the Status of the rule is Running. If there are no alert monitoring rules listed on this page, there is no SLS alert configured to detect single-factor console logins, otherwise, continue with the next step.

On the Edit Alert configuration panel, click on the query statement next to Query Statistics, and ensure that the following SQL query is present in the Query box: event.eventName: ConsoleSignin and event.additionalEventData.loginAccount: false. If the specified SQL query is not available in the Query box, the selected alert monitoring rule is not configured to detect single-factor Management Console logins. If the specified SQL query is present, return to the Edit Alert panel, choose Simple Log Service Notification for Destination, and ensure that the feature is enabled and has an alert policy configured to send notifications. If the Simple Log Service Notification feature is not enabled and properly configured, the selected SLS alert is not configured to send notifications whenever a single-factor console login attempt is made.

Repeat steps no. 9 and 10 for each alert monitoring rule available in your Alibaba Cloud account.

Sign in to your Alibaba Cloud account.

Navigate to Simple Log Service (SLS) console available at https://sls.console.aliyun.com/.

In the Log Application section, select the Audit & Security tab, and choose Log Audit Service.

In the left navigation panel, under Access to Cloud Products, choose Global Configurations.

Select the cloud region required for your SLS central project from the Region of the Central Project dropdown list. If the Region of the Central Project is already configured and the Central Project is available, continue the Audit process with step 8.

Enable Operations Log for ActionTrail, and set the data retention period of the SLS Logstore in the Storage Method column.

Choose Save to apply the configuration changes. This will create the SLS central project required for managing log resources.

Click on the name (link) of the SLS central project, listed next to Central Project.

Choose Alerts (bell icon) from the left navigation panel and select the Alert rule tab.

Choose Create Alert and perform the following actions:

1. For Rule Name, provide a unique name for your new Simple Log Service (SLS) alert.
2. For Check Frequency, specify a check frequency and a time range based on your requirements on data timeliness and integrity.
3. For Query Statistics, choose Create, and provide the following details:
   1. Select the Advanced Settings tab.
   2. For Type, choose Logstore.
   3. For Authorization, choose Default.
   4. For Logstore, choose actiontrail_log.
   5. For Dedicated SQL, select Disable: Do not use dedicated SQL for query and analysis. Use common SQL for query and analysis.
   6. For Time Range, choose 15 Minutes (Relative).
   7. Paste the following SQL query in the Query box: event.eventName: ConsoleSignin and event.additionalEventData.loginAccount: false. Select Preview to test the query and choose Confirm.
4. For Group Evaluation, choose No Grouping.
5. For Trigger Condition, choose When: Data is returned, and select the appropriate severity level.
6. For Add Annotation, enter Simple Log Service (SLS) alert for detecting single-factor Management Console login attempts for desc and Single-Factor Management Console Login Alert for title.
7. Choose Advanced Settings and set Threshold of Continuous Triggers to 1. For No Data Alert, choose whether to trigger an alert if no data exists.
8. For Destination, choose Simple Log Service Notification, select Enable, and configure the necessary Alert Policy. You can use one of the following options to configure your alert policy: Simple Mode - where a built-in policy manages alerts and automatically creates an action policy, Standard Mode - where a built-in policy manages alerts and you only need to specify an action policy, or Advanced Mode - where you can select a built-in alert policy to merge the alerts of multiple alert monitoring rules. For example, you can set the Alert Policy to Advanced Mode and select the SLS audit built-in alert policy (sls.app.audit.builtin). You can also set a Repeat Interval at this point. If an alert is repeatedly triggered, the alert notification is sent only after the specified Repeat Interval.
9. Choose OK to create your Simple Log Service (SLS) alert for monitoring single-factor Management Console logins.