Create Alert for Unauthorized API Calls

Sign in to your Alibaba Cloud account.

Navigate to Simple Log Service (SLS) console available at https://sls.console.aliyun.com/.

In the Log Application section, select the Audit & Security tab, and choose Log Audit Service.

In the left navigation panel, under Access to Cloud Products, choose Global Configurations.

Select the cloud region of the SLS central project from the Region of the Central Project dropdown list. If the Region of the Central Project is already configured, continue the Audit process with the next step.

Ensure that Operations Log is enabled for ActionTrail, and click on the name (link) of the SLS central project, listed next to Central Project. If the name of the central project is not a link (the name is not clickable), there is no SLS central project created for managing log resources, available in the selected region. If the name of the central project is a link, click on the link to access your SLS central project.

Choose Alerts (bell icon) from the left navigation panel and select the Alert rule tab to access your alert monitoring rules.

Select actiontrail_log from the Search Logstore dropdown list to return only the monitoring rules associated with the actiontrail_log logstore.

Choose the active alert monitoring rule that you want examine, and select Edit. A monitoring rule is active when the Status of the rule is Running. If there are no alert monitoring rules listed on this page, there is no SLS alert configured to detect unauthorized API calls, otherwise, continue with the next step.

On the Edit Alert configuration panel, click on the query statement next to Query Statistics, and ensure that the following SQL query is present in the Query box: event.eventType: ApiCall and (event.errorCode: NoPermission or event.errorCode: NoPermission. or event.errorCode: Forbidden or event.errorCode: Forbbiden or event.errorCode: Forbidden. or event.errorCode: InvalidAccessKeyId or event.errorCode: InvalidAccessKeyId.or event.errorCode: InvalidSecurityToken or event.errorCode: InvalidSecurityToken. or event.errorCode: SignatureDoesNotMatch or event.errorCode: InvalidAuthorization or event.errorCode: AccessForbidden or event.errorCode: NotAuthorized) | select "event.userIdentity.accountId" as account_id, "event.serviceName" as service_name, "event.sourceIpAddress" as source_ip,count(1) as cnt group by account_id, service_name,source_ip order by cnt desc limit 1000. If the specified SQL query is not available in the Query box, the selected alert monitoring rule is not configured to detect unauthorized API calls. If the specified SQL query is present, return to the Edit Alert panel, choose Simple Log Service Notification for Destination, and ensure that the feature is enabled and has an alert policy configured to send notifications. If the Simple Log Service Notification feature is not enabled and properly configured, the selected SLS alert is not configured to send notifications whenever an unauthorized API call occurs.

Repeat steps no. 9 and 10 for each alert monitoring rule available in your Alibaba Cloud account.

Sign in to your Alibaba Cloud account.

Navigate to Simple Log Service (SLS) console available at https://sls.console.aliyun.com/.

In the Log Application section, select the Audit & Security tab, and choose Log Audit Service.

In the left navigation panel, under Access to Cloud Products, choose Global Configurations.

Select the cloud region required for your SLS central project from the Region of the Central Project dropdown list. If the Region of the Central Project is already configured and the Central Project is available, continue the Audit process with step 8.

Enable Operations Log for ActionTrail, and set the data retention period of the SLS Logstore in the Storage Method column.

Choose Save to apply the configuration changes. This will create the SLS central project required for managing log resources.

Click on the name (link) of the SLS central project, listed next to Central Project.

Choose Alerts (bell icon) from the left navigation panel and select the Alert rule tab.

Choose Create Alert and perform the following actions:

1. Select Create from Template, choose All Templates, and select the Unauthorized API Call Alert built-in monitoring rule.
2. For Rule Name, provide a name for your new Simple Log Service (SLS) alert.
3. For Check Frequency, specify a check frequency and a time range based on your requirements on data timeliness and integrity.
4. Click on Query Statistics and ensure that Logstore is set to actiontrail_log and the following SQL query is present in the Query box: event.eventType: ApiCall and (event.errorCode: NoPermission or event.errorCode: NoPermission. or event.errorCode: Forbidden or event.errorCode: Forbidden or event.errorCode: Forbidden. or event.errorCode: InvalidAccessKeyId or event.errorCode: InvalidAccessKeyId.or event.errorCode: InvalidSecurityToken or event.errorCode: InvalidSecurityToken. or event.errorCode: SignatureDoesNotMatch or event.errorCode: InvalidAuthorization or event.errorCode: AccessForbidden or event.errorCode: NotAuthorized) | select "event.userIdentity.accountId" as account_id, "event.serviceName" as service_name, "event.sourceIpAddress" as source_ip,count(1) as cnt group by account_id, service_name,source_ip order by cnt desc limit 1000. Select Preview to test the query and choose Confirm.
5. For Group Evaluation, choose Custom Label, and select account_id, service_name, and source_ip.
6. For Trigger Condition, choose When: data matches the expression cnt > 5, and select the appropriate severity level.
7. For Add Annotation, enter Source IP ${source_ip} makes too many unauthorized API calls (${cnt} times) to service ${service_name} under account ${account_id} in the past 2 minutes. for desc and Too many unauthorized API calls in the past 2 minutes. for title.
8. Choose Advanced Settings and set Threshold of Continuous Triggers to 1. For No Data Alert, choose whether to trigger an alert if no data exists.
9. For Destination, choose Simple Log Service Notification, select Enable, and configure the necessary Alert Policy. You can use one of the following options to configure your alert policy: Simple Mode - where a built-in policy manages alerts and automatically creates an action policy, Standard Mode - where a built-in policy manages alerts and you only need to specify an action policy, or Advanced Mode - where you can select a built-in alert policy to merge the alerts of multiple alert monitoring rules. For example, you can set the Alert Policy to Advanced Mode and select the SLS audit built-in alert policy (sls.app.audit.builtin). You can also set a Repeat Interval at this point. If an alert is repeatedly triggered, the alert notification is sent only after the specified Repeat Interval.
10. Choose OK to create your Simple Log Service (SLS) alert for monitoring unauthorized API calls.