Compute
Elastic Cloud Server
Huawei Cloud Flexus
Bare Metal Server
Auto Scaling
Image Management Service
Dedicated Host
FunctionGraph
Cloud Phone Host
Huawei Cloud EulerOS
Networking
Virtual Private Cloud
Elastic IP
Elastic Load Balance
NAT Gateway
Direct Connect
Virtual Private Network
VPC Endpoint
Cloud Connect
Enterprise Router
Enterprise Switch
Global Accelerator
Management & Governance
Cloud Eye
Identity and Access Management
Cloud Trace Service
Resource Formation Service
Tag Management Service
Log Tank Service
Config
OneAccess
Resource Access Manager
Simple Message Notification
Application Performance Management
Application Operations Management
Organizations
Optimization Advisor
IAM Identity Center
Cloud Operations Center
Resource Governance Center
Migration
Server Migration Service
Object Storage Migration Service
Cloud Data Migration
Migration Center
Cloud Ecosystem
KooGallery
Partner Center
User Support
My Account
Billing Center
Cost Center
Resource Center
Enterprise Management
Service Tickets
HUAWEI CLOUD (International) FAQs
ICP Filing
Support Plans
My Credentials
Customer Operation Capabilities
Partner Support Plans
Professional Services
Analytics
MapReduce Service
Data Lake Insight
CloudTable Service
Cloud Search Service
Data Lake Visualization
Data Ingestion Service
GaussDB(DWS)
DataArts Studio
Data Lake Factory
DataArts Lake Formation
IoT
IoT Device Access
Others
Product Pricing Details
System Permissions
Console Quick Start
Common FAQs
Instructions for Associating with a HUAWEI CLOUD Partner
Message Center
Security & Compliance
Security Technologies and Applications
Web Application Firewall
Host Security Service
Cloud Firewall
SecMaster
Anti-DDoS Service
Data Encryption Workshop
Database Security Service
Cloud Bastion Host
Data Security Center
Cloud Certificate Manager
Edge Security
Situation Awareness
Managed Threat Detection
Blockchain
Blockchain Service
Web3 Node Engine Service
Media Services
Media Processing Center
Video On Demand
Live
SparkRTC
MetaStudio
Storage
Object Storage Service
Elastic Volume Service
Cloud Backup and Recovery
Storage Disaster Recovery Service
Scalable File Service Turbo
Scalable File Service
Volume Backup Service
Cloud Server Backup Service
Data Express Service
Dedicated Distributed Storage Service
Containers
Cloud Container Engine
SoftWare Repository for Container
Application Service Mesh
Ubiquitous Cloud Native Service
Cloud Container Instance
Databases
Relational Database Service
Document Database Service
Data Admin Service
Data Replication Service
GeminiDB
GaussDB
Distributed Database Middleware
Database and Application Migration UGO
TaurusDB
Middleware
Distributed Cache Service
API Gateway
Distributed Message Service for Kafka
Distributed Message Service for RabbitMQ
Distributed Message Service for RocketMQ
Cloud Service Engine
Multi-Site High Availability Service
EventGrid
Dedicated Cloud
Dedicated Computing Cluster
Business Applications
Workspace
ROMA Connect
Message & SMS
Domain Name Service
Edge Data Center Management
Meeting
AI
Face Recognition Service
Graph Engine Service
Content Moderation
Image Recognition
Optical Character Recognition
ModelArts
ImageSearch
Conversational Bot Service
Speech Interaction Service
Huawei HiLens
Video Intelligent Analysis Service
Developer Tools
SDK Developer Guide
API Request Signing Guide
Terraform
Koo Command Line Interface
Content Delivery & Edge Computing
Content Delivery Network
Intelligent EdgeFabric
CloudPond
Intelligent EdgeCloud
Solutions
SAP Cloud
High Performance Computing
Developer Services
ServiceStage
CodeArts
CodeArts PerfTest
CodeArts Req
CodeArts Pipeline
CodeArts Build
CodeArts Deploy
CodeArts Artifact
CodeArts TestPlan
CodeArts Check
CodeArts Repo
Cloud Application Engine
MacroVerse aPaaS
KooMessage
KooPhone
KooDrive
On this page

Viewing Detected Threats

Updated on 2022-03-14 GMT+08:00

MTD detects IAM, DNS, CTS, OBS, and VPC logs of global services in the target region. MTD detects potential malicious activities and unauthorized behavior through IP addresses and domain names in service logs in real time and generates alarms. You can perform the following steps to quickly detect threats, and check and handle them in descending order of alarm severity to secure running of your services.

Figure 1 Detection principles

Detection Result

  1. Log in to the management console.
  2. Click and choose Security & Compliance > Managed Threat Detection.

    Figure 2 MTD console

  3. Choose Detection Result in the navigation pane on the left.

    • If there are no alarms, a message is displayed, indicating that no threats have been found in the latest log data of your service up to now. The alarm types are displayed.
      Figure 3 No threats found
    • If there are alarms, the alarm list is displayed.
      NOTE:
      • Click Currently, xx alarm types are supported. In the displayed pane, you can view examples of all alarm types for logs of different services. For details, see Example Alarms and Statistics.
      • It takes about three months to train the AI detection model based on your actual data after the model is brought online. The detection result in the training phase may be inaccurate. To improve the accuracy, you can click Report Alarm Accuracy in the Operation column of the alarm list.
      1. Alarms are sorted in descending order of the latest occurrence time. Table 1 describes information about the alarm list.
        Table 1 Alarm information

        Parameter

        Description

        Log Type

        Service logs for which the alarm is generated

        • IAM
        • VPC
        • DNS
        • CTS
        • OBS

        Alarm Type

        Multiple types of alarms are supported. For details, see Viewing Alarm Types.

        Alarm Title

        Description of an alarm

        Severity

        Severity of an alarm

        • Critical
        • High
        • Medium
        • Low
        • Informational

        Currently, alarm must be manually checked and handled. You are advised to view alarm types and handle the alarms in descending order of the alarm severity.

        Affected Resources

        Number of resources that may be under threats

        Alarms Triggered

        Number of times that an alarm is generated. You can click to switch the sorting order.

        First Occurrence

        Time when the alarm is generated for the first time. You can click to switch the sorting order.

        Last Occurrence

        Time when the alarm was generated last time. You can click to switch the sorting order.

      2. Click an alarm title to view details. You can come up with a handling method of the potential threats based on attack information such as the resource name, ID, type, and region.
      3. Report alarm accuracy.
        NOTE:

        You can report the detection accuracy to help MTD improve.

        • Report a single alarm. Click Report Alarm Accuracy in the Operation column. In the dialog box that is displayed, click Accurate or Inaccurate.
        • Report alarms in batches. Select multiple alarms and click Report Alarm Accuracy above the check boxes. In the dialog box that is displayed, click Accurate or Inaccurate.

Alarm Type Details

MTD integrates three detection models: detection policy, threat intelligence, and AI detection engine. Table 2 describes the details, covering 71 alarm types.

NOTE:

A single alarm can be of one or more severities based on evaluation methods and risk coefficients.

Table 2 Detection models

Model

Description

Log Types and Quantity

AI detection engine

Machine learning is used to explore suspicious access behavior to detect potential threats.

  • IAM logs: 8 types
  • DNS logs: 2 types

Detection policy

The logs are checked based on existing standards and fixed policies.

OBS logs: 11 types

Threat intelligence

Correlation analysis and detection on log information are performed based on the historical valid intelligence collected by third parties. The third-party intelligence is updated once a day.

  • IAM logs: 22 types
  • CTS logs: 5 types
  • VPC logs: 12 types
  • DNS logs: 11 types

We use cookies to improve our site and your experience. By continuing to browse our site you accept our cookie policy. Find out more

Feedback

Feedback

Feedback

0/500

Selected Content

Submit selected content with the feedback