Alibaba ActionTrail - multiple unauthorized action attempts detected by a user

This alert will trigger in an event where multiple attempts of unauthorized actions were detected in the Alibaba ActionTrail account

Alibaba Action Trail MEDIUM EXECUTION

Details

IDbb268634-30a7-4989-90b6-cb833b5591cf
From Version6.10.0
Execution ModeSCHEDULED
Crontab*/10 * * * *
Search Window10 minutes
Datasetalerts

XQL Query

datamodel dataset = alibaba_action_trail_raw 
|filter xdm.event.type="ApiCall"
|filter xdm.event.outcome in ("This API is not authorized for caller.","no permission","The user has no permission","caller has no permission")
|comp count() as TotalCount by xdm.source.user.username, xdm.source.ipv4, xdm.source.user.user_type
|filter TotalCount > 5