↳ GitHub sourceConnector

Alibaba Cloud ActionTrail (via Codeless Connector Framework)

Description

The [Alibaba Cloud ActionTrail](https://www.alibabacloud.com/product/actiontrail) data connector provides the capability to retrieve actiontrail events stored into [Alibaba Cloud Simple Log Service](https://www.alibabacloud.com/product/log-service) and store them into Microsoft Sentinel through the [SLS REST API](https://www.alibabacloud.com/help/sls/developer-reference/api-sls-2020-12-30-getlogs). The connector provides ability to get events which helps to examine potential security risks, analyze your team's use of collaboration, diagnose configuration problems and more.

Declared author / publisher: Microsoft

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Data types

Declared permissions

Read and Write permissions are required.

Workspace

Workspace

SLS REST API Credentials/permissions

**AliCloudAccessKeyId** and **AliCloudAccessKeySecret** are required for making API calls. RAM policy statement with action of atleast `log:GetLogStoreLogs` over resource `acs:log:{#regionId}:{#accountId}:project/{#ProjectName}/logstore/{#LogstoreName}` is needed to grant a RAM user the permissions to call this operation.

Connector instructions

Content published in the repository. Refer to the original file for all parameters.

Configure access to AliCloud SLS API

Before using the API, you need to prepare your identity account and access key pair to effectively access the API. 1. We recommend that you use a Resource Access Management (RAM) user to call API operations. For more information, see [create a RAM user and authorize the RAM user to access Simple Log Service](https://www.alibabacloud.com/help/sls/create-a-ram-user-and-authorize-the-ram-user-to-access-log-service). 2. Obtain the access key pair for the RAM user. For details see [get Access Key pair](https://www.alibabacloud.com/help/ram/user-guide/create-an-accesskey-pair). Note the access key pair details for the next step.

Add ActionTrail Logstore

To enable the Alibaba Cloud ActionTrail connector for Microsoft Sentinel, click upon add ActionTrail Logstore, fill the form with the Alibaba Cloud environment configuration and click Connect.

Add Logstore

Add ActionTrail Logstore

Alibaba Cloud SLS Public Endpoint

Project

Logstore

Access Key ID

Access Key Secret

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/Alibaba Cloud ActionTrail/Data Connectors/AliCloudCloudTrailConnector_CCP/AliCloudActionTrail_DataConnectorDefinition.json ↗
Commit: 7ca9800 ↗
Source identifier: AliCloudActionTrailCCPDefinition

Additional source files 2

Solutions/Alibaba Cloud ActionTrail/Data Connectors/AliCloudCloudTrailConnector_CCP/AliCloudActionTrail_DataConnectorDefinition.jsonsource ↗Solutions/Alibaba Cloud ActionTrail/Data/Solution_Alibaba Cloud ActionTrail.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.