---
title: "cloud.alibaba"
canonical: "https://docs.devo.com/space/latest/240680967/cloud.alibaba"
format: markdown
---
> Macro (toc)

## Purpose

Use tags in this category to identify events generated by [Alibaba Cloud.](https://eu.alibabacloud.com/en?utm_key=se_1012200157&utm_content=se_1012200157)

## Send it

Data should be sent using the [Alibaba Cloud collector](https://docs.devo.com/space/latest/250871862/Alibaba+Cloud+collector).

## Secure it

**Monitoring suspicious activity**

An analyst aiming to detect suspicious cloud storage activity should investigate instances where data is accessed from unexpected sources, followed by a user's failed attempts on an object and their subsequent privilege escalation for that same object. Such a sequence could indicate intruders.

```
from cloud.alibaba.actiontrail.events
where responseElements_Success = False
group every 5m by source_ip_address, user_identity__access_key_id
every 5m
select count() as FailAccessCountColumn 
```

## Tags and tables

| **[Tags](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95126204)** | **[Tables](https://devodocs.atlassian.net/wiki/spaces/latest/pages/94764298)** |
| --- | --- |
| `cloud.alibaba.actiontrail.events` | `cloud.alibaba.actiontrail.events` |
| `cloud.alibaba.log_service.events` | `cloud.alibaba.log_service.events` |
| `cloud.alibaba.log_service.access_log` | `cloud.alibaba.log_service.access_log` |
| `cloud.alibaba.log_service.db_log` | `cloud.alibaba.log_service.db_log` |
| `cloud.alibaba.log_service.audit_service_log` | `cloud.alibaba.log_service.audit_service_log` |