How Do I Add High-risk Command Execution Alarms to the Whitelist?

If you run commands related to normal services on the server, HSS generates high-risk command execution alarms. You can add a whitelist to prevent the alarm.

To add a command alarm whitelist, perform the following steps:

1. Log in to the HSS console.Log in to the management console.
2. Click in the upper left corner and select a region or project.
3. In the navigation pane, choose Security Operations > Policies.
4. Locate the policy group of the protected edition corresponding to the server and click the policy group name.
5. Click Real-time Process.
6. Add a command whitelist. The parameters are as follows:
   • Full path or program name of a process: Enter the full path or program name of the process, for example, /usr/bin/sleep or sleep.
   • Regular expression in CLI: Enter the regular expression of the command to be added to the whitelist, for example, ^[A-Za-z0-9[:space:]\\*\\.\\\":_'\\(>=-]+$.
   Figure 1 Adding a whitelist
   
7. Click OK to save the change.