Security Audit provides an alert module for customizing alert notification rules and viewing alert history.
Try in Playground
Alibaba Cloud Playground provides a demo environment where you can experience the main features of Cloud Monitor 2.0.
-
Go to the Playground Demo environment. The default workspace is
o11y-demo-cn-hangzhou. -
Click Log Audit in the navigation bar, or click Log Audit in All Features.
-
In the navigation bar of Log Audit, choose , Alert Rules, Threat Hunting, or Event List to access the alert features.
Alert overview
Log on to the Cloud Monitor 2.0 console and click the target Workspace. In All Features, find and click Log Audit to open the Alert Management module. Security Audit provides the following alert features:
-
Alert history: The Alert History module, located under Log Audit > Alert Management, summarizes all alert information. You can view details of each alert and investigate it.
-
Alert rules: You can create Alert Rules from a template or create custom rules.
-
Threat hunting: This feature analyzes content in the alert event library to provide insights. Threat hunting is supported for alerts in ActionTrail and host scenarios.
-
Event list: Located under Log Audit > Alert Management, stores alert details after a rule is triggered.
Alert history
Alert details
In the Alert History list, you can view the details of triggered alerts. The alert details page shows information such as the Rule NAME/ID, Trigger Time, Alert Level, and Alert status.
Investigation
Only alerts created from a template include the investigation feature. An investigation includes the following:
-
Threat details page: Shows the threatened entities and their detailed information.
-
Source tracing graph: Shows the call topology of the threatened entity, with first-level and second-level topology views.
Alert rules
You can create an alert rule by building a custom rule or using a template. Built-in templates are available for ActionTrail, host audit, and container audit. For more information about parameter configuration, see Alert management.
Only alerts created from a template include the investigation feature.
Threat hunting
When an alert rule is triggered by a scan, the alert event is sent to the alert event library by default. Threat hunting analyzes these events to provide insights, and is supported for ActionTrail and host scenarios.
Prerequisite
You have connected the corresponding resources in the Resource center.
Threat hunting for ActionTrail
Displays the overall alert status for basic ActionTrail scenarios, including the number of triggered alert events, alert rules, and event severity distribution. Also shows alerts for typical ActionTrail scenarios, such as RAM permissions, user activity, security groups, and failed logons.
Threat hunting for host scenarios
Displays the overall alert status for basic host scenarios, including the number of triggered alert events, alert rules, and event severity distribution. Also shows alerts for typical host scenarios, such as brute-force attacks and identity authentication.
Event list
When you connect ActionTrail, Elastic Compute Service (ECS) audit logs, or Virtual Private Cloud (VPC) flow logs, an alert event store is automatically created. When an alert rule is triggered, the alert details are written to the alert event store by default. The log content and field descriptions are as follows:
Application scenarios
Log Audit 2.0 addresses specific security pain points in real-world business. The following sections describe four core application scenarios.
Container runtime: Deep threat awareness inside containers
The data source is container runtime logs collected using eBPF.
In containerized environments, application vulnerabilities such as Remote Code Execution (RCE) can lead to unauthorized commands being executed inside a container. Traditional traffic monitoring has difficulty detecting this type of behavior. For example, versions of Ollama earlier than 0.1.34 expose an unauthenticated local REST API that can be abused to write to any path and overwrite system files.
Enable alert rules: When creating an alert rule, select the built-in container audit template. Enable the "Container: Untrusted process reads sensitive file" rule to monitor write operations to unexpected paths, such as /etc/passwd, /root/.ssh/, and /etc/shadow. This ensures that such events are detected promptly.
Alert investigation: Process chain analysis: When an alert is triggered, process event and host file operation modeling allows administrators to trace the threat from the risky process, find upstream and downstream call relationships, and identify the root cause.
Alert investigation: Full-chain traceability: Threat entity analysis provides entity-level, full-chain traceability. After the risky process is found through the process chain, the container where the process resides is associated with K8s and pod entities. The attack path is reconstructed as "Abnormal Process -> Pod -> K8s", helping quickly locate the vulnerable workload.
Host brute-force attacks: Gain insight into system logon threats
Hosts are core IT assets, and brute-force attacks are a common threat. Log Audit collects host system logs using Loongcollector. By enabling the built-in alert rule for host brute-force attacks, Log Audit can identify and respond to these events effectively.
Global attack and defense posture:
The multi-dimensional Host Hunter dashboard aggregates and displays attack sources, such as country and carrier, along with attack frequency trends, helping administrators understand the overall security posture.
Intrusion impact scope assessment:
When a brute-force attack alert is detected, the system automatically builds an associated view linking the underlying host to the cloud ECS instance and surrounding assets such as VPCs and security groups. This perspective expands from a single point of attack to the wider network, helping O&M engineers quickly determine the risk boundary for lateral movement and develop more precise containment policies.