Create Alert for Root Account Frequent Logins

Sign in to your Alibaba Cloud account.

Navigate to Simple Log Service (SLS) console available at https://sls.console.aliyun.com/.

In the Log Application section, select the Audit & Security tab, and choose Log Audit Service.

In the left navigation panel, under Access to Cloud Products, choose Global Configurations.

Select the cloud region of the SLS central project from the Region of the Central Project dropdown list. If the Region of the Central Project is already configured, continue the Audit process with the next step.

Ensure that Operations Log is enabled for ActionTrail, and click on the name (link) of the SLS central project, listed next to Central Project. If the name of the central project is not a link (the name is not clickable), there is no SLS central project created for managing log resources, available in the selected region. If the name of the central project is a link, click on the link to access your SLS central project.

Choose Alerts (bell icon) from the left navigation panel and select the Alert rule tab to access your alert monitoring rules.

Select actiontrail_log from the Search Logstore dropdown list to return only the monitoring rules associated with the actiontrail_log logstore.

Choose the active alert monitoring rule that you want examine, and select Edit. A monitoring rule is active when the Status of the rule is Running. If there are no alert monitoring rules listed on this page, there is no SLS alert configured to detect root account login attempts, otherwise, continue with the next step.

On the Edit Alert configuration panel, click on the query statement next to Query Statistics, and ensure that the following SQL query is present in the Query box: **topic__: actiontrail_event and event.eventName: ConsoleSignin and event.userIdentity.type: root-account | select "event.userIdentity.accountId" as account_id, count(1) as cnt group by account_id limit 1000. If the specified SQL query is not available in the Query box, the selected alert monitoring rule is not configured to detect root account login attempts. If the specified SQL query is present, return to the Edit Alert panel, choose Simple Log Service Notification for Destination, and ensure that the feature is enabled and has an alert policy configured to send notifications. If the Simple Log Service Notification feature is not enabled and properly configured, the selected SLS alert is not configured to send notifications for root account login attempts.

Repeat steps no. 9 and 10 for each alert monitoring rule available in your Alibaba Cloud account.

Sign in to your Alibaba Cloud account.

Navigate to Simple Log Service (SLS) console available at https://sls.console.aliyun.com/.

In the Log Application section, select the Audit & Security tab, and choose Log Audit Service.

In the left navigation panel, under Access to Cloud Products, choose Global Configurations.

Select the cloud region required for your SLS central project from the Region of the Central Project dropdown list. If the Region of the Central Project is already configured and the Central Project is available, continue the Audit process with step 8.

Enable Operations Log for ActionTrail, and set the data retention period of the SLS Logstore in the Storage Method column.

Choose Save to apply the configuration changes. This will create the SLS central project required for managing log resources.

Click on the name (link) of the SLS central project, listed next to Central Project.

Choose Alerts (bell icon) from the left navigation panel and select the Alert rule tab.

Choose Create Alert and perform the following actions:

1. Select Create from Template, choose All Templates, and select the Root Account Frequent Login Alert built-in monitoring rule.
2. For Rule Name, provide a name for your new Simple Log Service (SLS) alert.
3. For Check Frequency, specify a check frequency and a time range based on your requirements on data timeliness and integrity.
4. Click on Query Statistics and ensure that Logstore is set to actiontrail_log and the following SQL query is present in the Query box: **topic__: actiontrail_event and event.eventName: ConsoleSignin and event.userIdentity.type: root-account | select "event.userIdentity.accountId" as account_id, count(1) as cnt group by account_id limit 1000. Select Preview to test the query and choose Confirm.
5. For Group Evaluation, choose Custom Label and select account_id.
6. For Trigger Condition, choose When: data matches the expression cnt > 2, and select the appropriate severity level.
7. For Add Annotation, enter Account ${account_id} used ROOT user to login ${cnt} times in the past 5 minutes, which is greater than the preset threshold 2 for desc and ROOT Account ${account_id} login too frequently in the past 5 minutes for title.
8. Choose Advanced Settings and set Threshold of Continuous Triggers to 1. For No Data Alert, choose whether to trigger an alert if no data exists.
9. For Destination, choose Simple Log Service Notification, select Enable, and configure the necessary Alert Policy. You can use one of the following options to configure your alert policy: Simple Mode - where a built-in policy manages alerts and automatically creates an action policy, Standard Mode - where a built-in policy manages alerts and you only need to specify an action policy, or Advanced Mode - where you can select a built-in alert policy to merge the alerts of multiple alert monitoring rules. For example, you can set the Alert Policy to Advanced Mode and select the SLS audit built-in alert policy (sls.app.audit.builtin). You can also set a Repeat Interval at this point. If an alert is repeatedly triggered, the alert notification is sent only after the specified Repeat Interval.
10. Choose OK to create your Simple Log Service (SLS) alert for monitoring root account login attempts.