Alibaba ActionTrail - multiple unauthorized action attempts detected by a user
This alert will trigger in an event where multiple attempts of unauthorized actions were detected in the Alibaba ActionTrail account
Alibaba Action Trail MEDIUM EXECUTION
Details
| ID | bb268634-30a7-4989-90b6-cb833b5591cf |
|---|---|
| From Version | 6.10.0 |
| Execution Mode | SCHEDULED |
| Crontab | */10 * * * * |
| Search Window | 10 minutes |
| Dataset | alerts |
XQL Query
datamodel dataset = alibaba_action_trail_raw
|filter xdm.event.type="ApiCall"
|filter xdm.event.outcome in ("This API is not authorized for caller.","no permission","The user has no permission","caller has no permission")
|comp count() as TotalCount by xdm.source.user.username, xdm.source.ipv4, xdm.source.user.user_type
|filter TotalCount > 5