Cloud Box offers security audits through ActionTrail, O&M audits, and traffic audits. You can periodically audit these records to identify non-compliant operations or abnormal traffic. This helps you promptly detect and respond to security risks, ensuring data security and meeting compliance requirements. This topic describes how to view security audit records for Cloud Box.
Audit overview
The Cloud Box security audit feature offers comprehensive support. It helps you create a secure, transparent, and compliant environment, ensuring that operations in your Cloud Box meet your auditing requirements. Cloud Box provides audit services in the following three dimensions:
| Dimension |
Description |
| User operations |
Records user operations on cloud resources in Cloud Box and displays them as logs in the console.
Note
Cloud Box is integrated with Alibaba Cloud ActionTrail, which provides unified log management for your cloud resources. It records user logins and resource access operations for your cloud account, enabling security analysis, intrusion detection, resource change tracking, and compliance auditing. To query event details, go to the ActionTrail console. For more information, see Event query overview. |
| Alibaba Cloud O&M |
Records release and update operations that Alibaba Cloud engineers perform on Cloud Box resources via Express Connect. |
| Cloud platform traffic |
Audits network traffic on the cloud platform, records network communication data between Express Connect and Cloud Box, and provides traffic audit reports. |
Usage notes
-
To view audit logs for release changes and traffic manifest, you must enable the audit trail feature.
-
By default, Cloud Box retains log data for 90 days. To store records for a longer period, enable the audit trail feature.
For more information about how to enable the audit trail, see Enable trail.
Prerequisites
You have purchased Cloud Box resources and completed the delivery and acceptance process. For more information, see Getting started.
Procedure
-
Go to the Cloud Boxes tab on the Cloud Box page.
Log on to the ECS console.
In the left-side navigation pane, choose .
In the top navigation bar, select a region.
Click the Cloud Boxes tab.
-
Find the target Cloud Box and click its Cloud Box ID to open the details page.
-
On the Cloud Box details page, click the tab.
-
Click the tab for the audit records you want to view.
Operation records
NoteThe Cloud Box console provides an overview of user operations. To view detailed operation records, go to the ActionTrail console to perform queries.
-
(Optional) In the Event Records section, set filter conditions and then click the
icon to filter user operation records.The following table describes the filter conditions.
Filter
Description
Dimension
You can filter by Instance, Object Storage Service, and vSwitch.
Time Range
Select a time range to retrieve records from that period.
-
View the corresponding operation records in the list. Each record includes the following information:
Parameter
Description
Occurred At
The time when the event occurred, in UTC.
Operator
The user or entity that performed the operation. Examples include a RAM Role, an Alibaba Cloud Service, or an Alibaba Cloud account.
Event Name
The API call involved in the event.
Associated Resources
The resource associated with the operation event.
Release changes
In the Basic Data section, view the trend chart for the total number of recorded Alibaba Cloud O&M operation events.
In the Communication History section, view the event details. Each record includes Occurred At, Cloud Products, Target Cloud Box, Target Rack, and Scope.
Traffic manifest
Cloud Box allows you to query access records from the initiator to the public cloud and to Cloud Box. You can query communication records based on information such as time range, IP, and port.
-
(Optional) In the Communication History section, set filter conditions and then click the
icon to filter communication records.The following table describes the filter conditions.
Filter
Description
Dimension
You can filter by Source IP, Source Port, Destination IP, Destination Port, Protocol, and Traffic manifest association item.
Time Range
Specify a time range to retrieve traffic records from a specific period.
-
View the target communication records in the list. Each record includes the following information:
Parameter
Description
Time
The time when the communication occurred.
Direction
The communication direction. Inbound is traffic from the initiator to the public cloud, and outbound is traffic from the initiator to Cloud Box.
Five-tuple
Includes source IP, source port, destination IP, destination port, and protocol.
Traffic manifest association item
Click the corresponding entry in the Traffic manifest association item column to view details of all communication operations in the Express Connect traffic, including Communication Name and Communication Service Description.
NoteFor further queries and analysis, click Query Details in the upper-right corner. This action redirects you to the corresponding Logstore.
-
Related documents
For operations on ECS instances in Cloud Box, such as instance configuration changes, you can also view operation records on the instance details page. For more information, see View operation records of an ECS instance.