Updated on 2022-03-14 GMT+08:00

Viewing Detected Threats

MTD detects IAM, DNS, CTS, OBS, and VPC logs of global services in the target region. MTD detects potential malicious activities and unauthorized behavior through IP addresses and domain names in service logs in real time and generates alarms. You can perform the following steps to quickly detect threats, and check and handle them in descending order of alarm severity to secure running of your services.

Figure 1 Detection principles

Detection Result

  1. Log in to the management console.
  2. Click and choose Security & Compliance > Managed Threat Detection.

    Figure 2 MTD console

  3. Choose Detection Result in the navigation pane on the left.

    • If there are no alarms, a message is displayed, indicating that no threats have been found in the latest log data of your service up to now. The alarm types are displayed.
      Figure 3 No threats found
    • If there are alarms, the alarm list is displayed.
      • Click Currently, xx alarm types are supported. In the displayed pane, you can view examples of all alarm types for logs of different services. For details, see Example Alarms and Statistics.
      • It takes about three months to train the AI detection model based on your actual data after the model is brought online. The detection result in the training phase may be inaccurate. To improve the accuracy, you can click Report Alarm Accuracy in the Operation column of the alarm list.
      1. Alarms are sorted in descending order of the latest occurrence time. Table 1 describes information about the alarm list.
        Table 1 Alarm information

        Parameter

        Description

        Log Type

        Service logs for which the alarm is generated

        • IAM
        • VPC
        • DNS
        • CTS
        • OBS

        Alarm Type

        Multiple types of alarms are supported. For details, see Viewing Alarm Types.

        Alarm Title

        Description of an alarm

        Severity

        Severity of an alarm

        • Critical
        • High
        • Medium
        • Low
        • Informational

        Currently, alarm must be manually checked and handled. You are advised to view alarm types and handle the alarms in descending order of the alarm severity.

        Affected Resources

        Number of resources that may be under threats

        Alarms Triggered

        Number of times that an alarm is generated. You can click to switch the sorting order.

        First Occurrence

        Time when the alarm is generated for the first time. You can click to switch the sorting order.

        Last Occurrence

        Time when the alarm was generated last time. You can click to switch the sorting order.

      2. Click an alarm title to view details. You can come up with a handling method of the potential threats based on attack information such as the resource name, ID, type, and region.
      3. Report alarm accuracy.

        You can report the detection accuracy to help MTD improve.

        • Report a single alarm. Click Report Alarm Accuracy in the Operation column. In the dialog box that is displayed, click Accurate or Inaccurate.
        • Report alarms in batches. Select multiple alarms and click Report Alarm Accuracy above the check boxes. In the dialog box that is displayed, click Accurate or Inaccurate.

Alarm Type Details

MTD integrates three detection models: detection policy, threat intelligence, and AI detection engine. Table 2 describes the details, covering 71 alarm types.

A single alarm can be of one or more severities based on evaluation methods and risk coefficients.

Table 2 Detection models

Model

Description

Log Types and Quantity

AI detection engine

Machine learning is used to explore suspicious access behavior to detect potential threats.

  • IAM logs: 8 types
  • DNS logs: 2 types

Detection policy

The logs are checked based on existing standards and fixed policies.

OBS logs: 11 types

Threat intelligence

Correlation analysis and detection on log information are performed based on the historical valid intelligence collected by third parties. The third-party intelligence is updated once a day.

  • IAM logs: 22 types
  • CTS logs: 5 types
  • VPC logs: 12 types
  • DNS logs: 11 types