Viewing Protection Information Using the Policy Assistant

Viewing Protection Information Using the Policy Assistant

1. Log in to the management console.
2. Click in the upper left corner of the management console and select a region or project.
3. In the navigation pane on the left, click and choose Security & Compliance > Cloud Firewall. The Dashboard page will be displayed.
4. (Optional) If the current account has only one firewall instance, the firewall details page is displayed. If there are multiple firewall instances, click View in the Operation column of a firewall to go to its details page.
5. In the navigation pane, choose Access Control > Policy Assistant.
6. View statistics about the protection rules of a firewall instance.
   • Policy Dashboard: Number of accesses that hit policies (protection rules, blacklist, and whitelist), numbers of allowed and blocked accesses, and the allow and block policies that were frequently hit within a specified time range.
   • Policy Hits: Hits of a rule within a specified time range.
   • Visualizations: Top 5 items ranked by certain parameters regarding blocked attacks within a specified time range. For more information, see Table 1. You can click a record to view policy matching details. For more information, see Table 2.

     Table 1 Policy assistant statistics parameters

     Parameter	Description
     Top Policies By Hits	Policies that match and block traffic.
     Top Blocked Outbound IP Addresses	Blocked outbound IP addresses. You can click Source or Destination to view the source or destination IP addresses.
     Top Blocked Inbound IP Addresses	Blocked inbound IP addresses. You can click Source or Destination to view the source or destination IP addresses.
     Top Blocked Destination Ports	Blocked destination ports. You can click Outbound or Inbound to view ports in the corresponding direction.
     Top Blocked IP Address Regions	Regions of blocked IP addresses. You can click Destination of outbound access or Source of inbound access to check IP addresses.

   • Inactive Policies: Policies that have not been hit or enabled for more than a week, a month, three months, or six months. You are advised to modify or delete the policies in a timely manner.