Alibaba ActionTrail - multiple unauthorized action attempts detected by a user

This alert will trigger in an event where multiple attempts of unauthorized actions were detected in the Alibaba ActionTrail account

Module:

Platform Analytics

Data source:

alibaba_action_trail_raw

Category:

Execution

Content pack:

Alibaba Action Trail

datamodel dataset = alibaba_action_trail_raw 
|filter xdm.event.type="ApiCall"
|filter xdm.event.outcome in ("This API is not authorized for caller.","no permission","The user has no permission","caller has no permission")
|comp count() as TotalCount by xdm.source.user.username, xdm.source.ipv4, xdm.source.user.user_type
|filter TotalCount > 5