Alibaba Cloud ActionTrail (via Codeless Connector Framework)
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
| Attribute | Value |
|---|---|
| Connector ID | AliCloudActionTrailCCPDefinition |
| Publisher | Microsoft |
| Used in Solutions | Alibaba Cloud ActionTrail |
| Collection Method | CCF |
| Connector Definition Files | AliCloudActionTrail_DataConnectorDefinition.json |
| DCR Definition Files | AliCloudActionTrail_DCR.json |
| CCF Configuration | AliCloudActionTrail_PollingConfig.json |
| CCF Capabilities | AliCloudSlsV1, Paging |
| Microsoft Learn | View on Learn |
The Alibaba Cloud ActionTrail data connector provides the capability to retrieve actiontrail events stored into Alibaba Cloud Simple Log Service and store them into Microsoft Sentinel through the SLS REST API. The connector provides ability to get events which helps to examine potential security risks, analyze your team's use of collaboration, diagnose configuration problems and more.
Tables Ingested
This connector ingests data into the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
AliCloudActionTrailLogs_CL |
✓ | ✓ | ✓ |
💡 Tip: Tables with Ingestion API support allow data ingestion via the Azure Monitor Data Collector API, which also enables custom transformations during ingestion.
Permissions
Resource Provider Permissions:
- Workspace (Workspace): Read and Write permissions are required.
Custom Permissions:
- SLS REST API Credentials/permissions: AliCloudAccessKeyId and AliCloudAccessKeySecret are required for making API calls. RAM policy statement with action of atleast
log:GetLogStoreLogsover resourceacs:log:{#regionId}:{#accountId}:project/{#ProjectName}/logstore/{#LogstoreName}is needed to grant a RAM user the permissions to call this operation.
Setup Instructions
⚠️ Note: These instructions were automatically generated from the connector's user interface definition file using AI and may not be fully accurate. Please verify all configuration steps in the Microsoft Sentinel portal.
1. Configure access to AliCloud SLS API
Before using the API, you need to prepare your identity account and access key pair to effectively access the API.
- We recommend that you use a Resource Access Management (RAM) user to call API operations. For more information, see create a RAM user and authorize the RAM user to access Simple Log Service.
- Obtain the access key pair for the RAM user. For details see get Access Key pair.
Note the access key pair details for the next step.
2. Add ActionTrail Logstore
To enable the Alibaba Cloud ActionTrail connector for Microsoft Sentinel, click upon add ActionTrail Logstore, fill the form with the Alibaba Cloud environment configuration and click Connect. Connector Management Interface
This section is an interactive interface in the Microsoft Sentinel portal that allows you to manage your data collectors.
📊 View Existing Collectors: A management table displays all currently configured data collectors with the following information:
- AliCloud SLS Logstore Endpoint URL
➕ Add New Collector: Click the "Add new collector" button to configure a new data collector (see configuration form below).
🔧 Manage Collectors: Use the actions menu to delete or modify existing collectors.
💡 Portal-Only Feature: This configuration interface is only available when viewing the connector in the Microsoft Sentinel portal. You cannot configure data collectors through this static documentation.
Add ActionTrail Logstore
Add SLS Logstore linked to Alibaba Cloud ActionTrail
When you click the "Add Logstore" button in the portal, a configuration form will open. You'll need to provide:
- Alibaba Cloud SLS Public Endpoint (optional):
.log.aliyuncs.com - Project (optional):
- Logstore (optional):
- Access Key ID (optional): Access Key ID
- Access Key Secret (optional): Access Key Secret
💡 Portal-Only Feature: This configuration form is only available in the Microsoft Sentinel portal.
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊