Handling Events

Scenarios

You can view alarms, audit logs, and trace data sources for post-event tracing and leakage locating. This ensures enterprise API data interaction security compliance.

Viewing Audit Logs

Once asset protection is enabled for application data assets, the system audits each application asset operation. You can view audit logs to obtain detailed information, facilitating application data asset management and post-event backtracking.

1. Log in to the API data security protection web console as user sysadmin.
2. In the navigation pane on the left, choose Log Management > Retrieval.
3. On the Retrieval page, view the audit log list.
   Figure 1 Audit log statistics
   

4. (Optional) In the audit log list, click Details in a row to view details about the log.
5. (Optional) To download audit logs to the local PC, click Export.

Viewing Alarm Details

Once asset protection is enabled for application data assets, alarm logs are generated for any risky access. You can view these logs to promptly detect application data asset risks.

1. Log in to the API data security protection web console as user sysadmin.
2. In the navigation pane, choose Log Center > Alerts.
3. On the Alerts page, view the alert statistics, as shown in Figure 2. For details about the parameters, see Table 1.
   Figure 2 Alert statistics
   

   Table 1 Alert statistics

   Area	Description
   Risk type statistics	Displays the alert statistics of the illegal, high-risk, medium-risk, and low-risk levels in a ring chart.
   Review statistics	Displays the number of reviewed and unreviewed alerts in a ring chart.
   Search criteria	You can search for alerts based on search criteria. Default search criteria and advanced search are supported.
   Alert list	Detailed alert information shown in a list.

4. (Optional) In the alert list, click Details to view details about an alert log.
5. (Optional) To download alert logs to the local PC, click Export.

Performing Watermark Tracing

If data assets with data watermarks or dot matrix watermarks enabled are leaked without authorization, you can use watermark source tracing to trace the personnel information involved in data leakage.

1. Log in to the API data security protection web console as user sysadmin.
2. In the navigation pane on the left, choose Security Policies > Watermarks, and click the Trace management tab.
3. To trace Data Watermarks, perform the following steps:
   1. On the Trace management page, click the Data watermark tab.
   2. To directly trace the leaked data, copy the trace content to the dialog box on the watermark tracing page and click Trace.
      Figure 3 Copying the trace content
      
      Figure 4 Pasting the trace content to the tracing dialog box
      
      

      Data watermarks are highly transparent and covert. When you configure a data watermark, the trace content copied into the dialog box will carry a trace ID. However, this ID remains invisible within the dialog box.

4. To trace an implicit file watermark, perform the following steps:
   1. On the Trace management page, select Implicit file watermark.
   2. Click .
   3. On the import page, click Click or drag files here to upload, upload a file with invisible watermarks from the local PC, and click Trace.

5. To trace a dot matrix watermark, perform the following steps:
   1. On the Trace management page, click the Dot matrix watermark tab.
   2. Based on the obtained dot matrix watermark shape, sequentially select dot matrices in the vector encoding comparison table from left to right and top to bottom.
      

      Among the nine dot matrices of the dot matrix watermark, the first dot matrix serves as the start character, while the remaining eight dot matrices correspond to different pieces of information. After the operation is complete, a string of eight characters is generated in the text box.

   3. Click Trace.

6. On the Traceability result page, view tracing information.
   Figure 5 Trace result
   

7. (Optional) On the Traceability result page, click Details to view details about the trace result.