Updated on 2024-09-25 GMT+08:00

Handling Container Alarms

HSS displays alarm and event statistics and their summary all on one page. You can have a quick overview of alarms, including the numbers of urgent alarms, total alarms, containers with alarms, and handled alarms.

The Events page displays the alarms generated in the last 30 days.

The status of a handled alarm changes from Unhandled to Handled.

Constraints

Servers that are not protected by HSS do not support operations related to alarms and events.

Handling Container Alarms

This section describes how you should handle alarms to enhance server security.

Do not fully rely on alarm handling to defend against attacks, because not every issue can be detected in a timely manner. You are advised to take more measures to prevent threats, such as checking for and fixing vulnerabilities and unsafe settings.

  1. Log in to the management console.
  2. In the upper left corner of the page, select a region, click , and choose Security & Compliance > HSS.
  3. In the navigation pane on the left, choose Detection & Response > Alarms, and click Container Alarms.
  4. Click an alarm name to view the alarm details and suggestions.
  5. Handle alarms.

    Alarms are displayed on the Container Alarms page. Here you can check up to 30 days of historical alarms.

    Check and handle alarms as needed. The status of a handled alarm changes from Unhandled to Handled. HSS will no longer collect its statistics.

    • Handling a single alarm

      In the Operation column of an alarm, click Handle.

    • Handling alarms in batches

      Select all alarms and click Batch Handle above the alarm list.

    • Handling all alarms

      In the Alarms to be Handled area on the left pane of the alarm list, select an alarm type and click Handle All above the alarm list.

      Figure 1 Handling all alarms

  6. In the Handle Event dialog box, select an action. For details about the processing modes, see Table 1.

    When handling a single alarm event or handling alarms in batches, you can select Handle duplicate alarms in batches in the Handle Event dialog box.
    Table 1 Alarm handling methods

    Action

    Description

    Ignore

    Ignore the current alarm. Any new alarms of the same type will still be reported by HSS.

    Mark as handled

    If you have manually handled an event, choose Mark as handled. You can add remarks to record details about event handling.

    Add to Login Whitelist

    Add false alarmed items of the Brute-force attack and Abnormal login types to the Login Whitelist.

    HSS will no longer report alarm on the Login Whitelist. A whitelisted login event will not trigger alarms.

    If the login IP address has been blocked, adding the login alarm event to the Login Whitelist will unblock the login IP address.

    The following alarm events can be added:

    • Brute-force attacks
    • Abnormal logins

    Add to process whitelist

    If you can confirm that a process triggering an alarm can be trusted, you can add it to the process whitelist.

    Add to alarm whitelist

    Add false alarmed items to the login whitelist.

    HSS will no longer report alarm on the whitelisted items. A whitelisted alarm will not trigger alarms.

    After adding an alarm to the alarm whitelist, you can customize a whitelist rule. The custom rule types vary depending on the alarm types, including the file path, process path, process command line, remote IP address, and user name. If a detected alarm event hit the rule you specified, HSS does not generate an alarm.

    For details about events that can be isolated and killed, see Container Alarm Events.

  7. Click OK.

    You check handled alarms. For details, see Historical Records.

Canceling Handled Container Alarms

You can cancel the processing of a handled alarm event.

  1. In the alarm event list, filter handled alarms.
  2. In the Operation column of an alarm, click Handle.
  3. In the Handle Alarm Event dialog box, click OK to cancel the last handling.