Viewing Container Alarms

Constraints

Servers that are not protected by HSS do not support operations related to alarms and events.

Viewing Container Alarms

1. Log in to the management console.
2. In the upper left corner of the page, select a region, click , and choose Security & Compliance > HSS.
3. In the navigation pane, choose Detection & Response > Alarms and click the Container Alarms tab to view container alarms and events.
   Figure 1 Container alarms
   

   Table 1 Container alarm statistics

   Parameter	Description
   Urgent Alarms	Number of alarms that need to be handled immediately. You can click a value to view the corresponding alarm events.
   Total Alarms	Total number of alarms reported on your assets. You can click the number to view all alarms.
   Containers with Alarms	Number of containers for which alarms are generated.
   Handled Alarms	Number of handled alarms

   • Viewing the alarms of a certain type or ATT&CK phase

     In the Alarms to Be Handled area, select an alarm type or att&ck phase. For details, see ATT&CK attack phase description.

     

     Adversarial Tactics, Techniques and Common Knowledge (ATT&CK) is a framework that helps organizations understand the cyber adversary tactics and techniques used by threat actors across the entire attack lifecycle.

     Table 2 ATT&CK phases

     ATT&CK Phase	Description
     Reconnaissance	Attackers seek vulnerabilities in your system or network.
     Initial Access	Attacker try to enter your system or network.
     Execution	Attackers try to run malicious code.
     Persistence	Attackers try to maintain their foothold.
     Privilege Escalation	Attackers try to obtain higher permissions.
     Defense Evasion	Attackers try to avoid being detected.
     Credential Access	Attackers try to steal account names and passwords.
     Command and Control	Attackers try to communicate with compromised machines to control them.
     Impact	Attackers try to manipulate, interrupt, or destroy your system or data.

   • Viewing details about container alarms and events

     Click an alarm name to go to its details page. You can view the alarm description, handling suggestion, alarm path and address in HSS forensics, and the handling history of similar alarms. Table 3 describes the details of alarm information.

     

     For some HSS alarms that have been determined as malware alarms, the alarm source files are saved in the cloud center and you can download them. You can download the alarm source files to your local PC for analysis. The password for decompressing the files is unlock.

     For unacknowledged malware alarms, alarm source files cannot be downloaded. Check the actual service conditions and determine whether the files are malicious files.

     Table 3 Alarm detail parameters

     Parameter	Description
     Intelligence Engine	Detection engines used by HSS, including the virus detection engine, AI detection engine, and malicious intelligence detection engine.
     Attack Status	Status of the current threat.
     First Occurred	Time when an attack alarm was first generated
     Alarm ID	Unique ID of an alarm
     ATT&CK Phase	For details about the attack technology models used by attackers in each phase, see Table 2.
     Last Occurred	Time when an attack alarm was last generated
     Alarm Information	Detailed information about an alarm, including the alarm description, alarm summary, affected assets, and handling suggestions.
     Forensics	HSS investigates information such as the attack triggering path or virus type based on the alarm type, helping you quickly trace and locate the attack source. Process Tree: If an alarm event contains process information, you can check the process ID, process file path, process command line, process startup time, and process file hash on the Forensics tab page. You can locate malicious processes based on such information. File Forensics: If an alarm event contains file information, you can check the file path and file hash on the Forensics tab page. You can locate the file change based on the such information. Network Forensics: If an alarm event contains network-related information, you can check the local IP address, local port, remote IP address, remote port, and protocol on the Forensics tab. You can determine whether a user is unauthorized based on such information. User Forensics: If an alarm event contains user-related information, you can check the user name, login IP address, login service type, login service port, last login event, and number of login failures on the Forensics tab. You can determine whether the access is unauthorized based on such information. Registry Forensics: If an alarm event contains registry information, you can check the registry keys and values on the Forensics tab page. You can locate registry risks based on such information. Abnormal Login Forensics: If an alarm event contains abnormal login information, you can check the login IP address and port number on the Forensics tab page. You can determine whether the login is trusted based on such information. Malware Forensics: If an alarm event contains malware information, you can check the malware family, virus name, virus type, and confidence level on the Forensics tab page. Auto-started Item Forensics: If an alarm event contains self-startup item information, you can check the user, command, self-startup item information, and process file command line information on the Forensics tab page. You can locate the auto-started items based on such information. Kernel Forensics: If an alarm event contains kernel information, you can check system functions and kernel functions on the Forensics tab page. You can locate kernel risks based on the information. Container Forensics: If an alarm event contains container information, you can check the container name and image ID on the Forensics tab page. You can locate container risks based on such information.
     Similar Alarms	Alarm whose server and event type are the same as those of this alarm. You can handle the alarm according to the handling method of the similar alarms.

   • Viewing the pod details of an container alarm event

     Click the pod name of the target alarm event to view the pod details, including the node IP address, namespace, pod IP address, pod label, and container list.