Security Auditing

Scenario

You can query operation records matching specified conditions and check whether operations have been performed by authorized users for security analysis.

Prerequisites

You have enabled CTS and trackers are running properly.

Procedure (for Old Console)

The following takes the records of EVS disk creation and deletion in the last two weeks as an example.

1. Log in to the management console as a CTS administrator.
2. Click in the upper left corner to select the desired region and project.
3. Click in the upper left corner and choose Management & Deployment > Cloud Trace Service. The CTS console is displayed.
4. Choose Trace List in the left navigation pane.
5. Set the time range to Last 1 week, set filters in sequence, and click Query.
   

   Select Management for Trace Type, evs for Trace Source, evs for Resource Type, Trace name for Search By, select createVolume or deleteVolume, and click Query. By default, all EVS disk creation or deletion operations performed in the last hour are queried. You can also set the time range to query all EVS creation or deletion operations performed in the last seven days at most.

6. To obtain the operation records of the last week, query them in the OBS bucket. Choose Tracker List in the navigation pane on the left.
   

   To store operation records for more than seven days, you must configure the management tracker to transfer them to an OBS bucket. Otherwise, you cannot query the operation records generated seven days ago.

7. Download traces older than seven days or all traces by following the instructions in Querying Archived Traces.
8. In the trace files, search traces using keywords createVolume or deleteVolume.
9. Check the traces obtained from steps 5 and 8 to see whether there are any unauthorized operations or operations that do not conform to security rules.