Help Center/ Cloud Firewall/ User Guide/ System Management/ Alarm Notification
Updated on 2025-11-04 GMT+08:00
View PDF
Share

Alarm Notification

After alarm notification is enabled, CFW will send notifications to you through the method you specified (such as email or SMS) so that you can monitor the firewall status and quickly detect exceptions.

Alarm Notification Items

CFW supports the following alarm notification items.

Table 1 Alarm notification items

Alarm Notification Item

Description

Attack Alarm

If CFW detects an intrusion prevention event and the specified trigger conditions are met, an alarm notification will be sent.

High Traffic Warning

If the peak traffic passing through CFW reaches a certain percentage (for example, 70%, 80%, or 90%) of the purchased traffic processing capacity, and such excession occurs three or more times within 5 minutes, an alarm notification will be sent.

EIP Not Protected

If CFW detects unprotected EIPs under your account, it will send an alarm notification once a day.

Abnormal External Connection Alarm

If CFW detects suspicious behavior of IP addresses or domain names that may be used for external connections and the trigger conditions are met, it will send an alarm notification.

Setting Alarm Notifications

Perform the following operations to set alarm notifications:

Attack Alarm

  1. Log in to the CFW console.
  2. Click in the upper left corner of the management console and select a region or project.
  3. (Optional) Switch to another firewall instance. Select a firewall from the drop-down list in the upper left corner of the page.
  4. In the navigation pane, choose System Management > Notifications.

    Figure 1 Alarm notifications

  5. In the Operation column of Attack alarm, click Edit, and configure notification item parameters. For details, see Table 2.

    The notification settings take effect immediately after being modified.

    Figure 2 Notification item settings - attack alarm
    Table 2 Attack alarm parameters

    Parameter

    Description

    Description

    IPS attack alarm

    Level

    Select the risk levels that trigger notifications.

    The options are Serious, High, Medium, and Low. Multiple options can be selected.

    For example, if you select High and Medium, the firewall will notify you by SMS message or email when detecting an intrusion with a high- or medium-level risk.

    Notification Time

    Select a time range for sending notifications.

    CFW sends notifications only within the alarm notification period. If an exception is detected outside this period, no notifications will be sent.

    Trigger Condition

    Configure the trigger condition.

    Alarm notifications are sent if the number of attacks is at least equal to the threshold configured for a certain period.

    Recipient Group

    Select a topic from the drop-down list to configure the endpoints for receiving alarm notifications.

    If there are no topics, click View Topic and perform the following steps to create a topic:
    1. Create a topic. For details, see Creating a Topic.
    2. Add one or more subscriptions to the topic. You will need to provide a phone number, email address, function, platform application endpoint, DMS endpoint, or HTTP/HTTPS endpoint for receiving alarm notifications. For details, see Adding a Subscription.
    3. Confirm the subscription.

  6. Click OK.
  7. In the Status column of Attack alarm, click to enable it.

High Traffic Warning

  1. Log in to the CFW console.
  2. Click in the upper left corner of the management console and select a region or project.
  3. (Optional) Switch to another firewall instance. Select a firewall from the drop-down list in the upper left corner of the page.
  4. In the navigation pane, choose System Management > Notifications.

    Figure 3 Alarm Notification

  5. In the Operation column of High Traffic Warning, click Edit, and configure notification item parameters. For details, see Table 3.

    The notification settings take effect immediately after being modified.

    Figure 4 Notification item settings - high traffic warning
    Table 3 High traffic warning parameters

    Parameter

    Description

    Description

    An alarm is generated if the traffic reaches the specified percentage of the traffic processing capability you purchased.

    Level

    Select a percentage. When the maximum peak inbound or outbound traffic reaches the percentage of the traffic processing capability you purchased, an alarm notification is triggered.

    For example, you can select 70%, 80%, or 90%.

    If this parameter is set to 80%, an alarm notification is sent when the used traffic reaches 80% of the purchased traffic.

    Notification Time

    Select a time range for sending notifications.

    CFW sends notifications only within the alarm notification period. If an exception is detected outside this period, no notifications will be sent.

    Trigger Condition

    Once a day

    Recipient Group

    Select a topic from the drop-down list to configure the endpoints for receiving alarm notifications.

    If there are no topics, click View Topic and perform the following steps to create a topic:
    1. Create a topic. For details, see Creating a Topic.
    2. Add one or more subscriptions to the topic. You will need to provide a phone number, email address, function, platform application endpoint, DMS endpoint, or HTTP/HTTPS endpoint for receiving alarm notifications. For details, see Adding a Subscription.
    3. Confirm the subscription.

  6. Click OK.
  7. In the Status column of High Traffic Warning, click to enable it.

EIP Not Protected

  1. Log in to the CFW console.
  2. Click in the upper left corner of the management console and select a region or project.
  3. (Optional) Switch to another firewall instance. Select a firewall from the drop-down list in the upper left corner of the page.
  4. In the navigation pane, choose System Management > Notifications.

    Figure 5 Alarm Notification

  5. In the Operation column of the EIP Not Protected alarm, click Edit, and configure notification item parameters. For details, see Table 4.

    The notification settings take effect immediately after being modified.

    Figure 6 Notification settings - EIP Not Protected
    Table 4 Parameters of the alarm EIP Not Protected

    Parameter

    Description

    Description

    This alarm indicates there are unprotected EIPs.

    Notification Time

    Select a time range for sending notifications.

    CFW sends notifications only within the alarm notification period. If an exception is detected outside this period, no notifications will be sent.

    Trigger Condition

    Once a day

    Recipient Group

    Select a topic from the drop-down list to configure the endpoints for receiving alarm notifications.

    If there are no topics, click View Topic and perform the following steps to create a topic:
    1. Create a topic. For details, see Creating a Topic.
    2. Add one or more subscriptions to the topic. You will need to provide a phone number, email address, function, platform application endpoint, DMS endpoint, or HTTP/HTTPS endpoint for receiving alarm notifications. For details, see Adding a Subscription.
    3. Confirm the subscription.

  6. Click OK.
  7. In the Status column of EIP Not Protected, click to enable it.

Abnormal External Connection Alarm

  1. Log in to the CFW console.
  2. Click in the upper left corner of the management console and select a region or project.
  3. (Optional) Switch to another firewall instance. Select a firewall from the drop-down list in the upper left corner of the page.
  4. In the navigation pane, choose System Management > Notifications.

    Figure 7 Alarm Notification

  5. In the Operation column of the Abnormal External Connection Alarm alarm, click Edit, and configure notification item parameters. For details, see Table 5.

    The notification settings take effect immediately after being modified.

    Figure 8 Notification item settings - abnormal external connection alarm
    Table 5 Parameters of Abnormal External Connection Alarm

    Parameter

    Description

    Description

    This alarm indicates there are unprotected EIPs.

    Notification Time

    Select a time range for sending notifications.

    CFW sends notifications only within the alarm notification period. If an exception is detected outside this period, no notifications will be sent.

    Trigger Condition

    Configure the trigger condition.

    Alarm notifications are sent if the number of abnormal external connections is at least equal to the threshold configured for a certain period.

    Recipient Group

    Select a topic from the drop-down list to configure the endpoints for receiving alarm notifications.

    If there are no topics, click View Topic and perform the following steps to create a topic:
    1. Create a topic. For details, see Creating a Topic.
    2. Add one or more subscriptions to the topic. You will need to provide a phone number, email address, function, platform application endpoint, DMS endpoint, or HTTP/HTTPS endpoint for receiving alarm notifications. For details, see Adding a Subscription.
    3. Confirm the subscription. After the subscription is added, confirm the subscription.

  6. Click OK.
  7. After confirming that the information is correct, click in the Status column of the row where the Abnormal External Connection Alarm is located to enable this function.

References

To add assets to the EIP Not Protected alarm whitelist, click Add to Alarm Whitelist in the Operation column of the alarm. Select EIPs, add them to the whitelist on the right, and click OK. The whitelisted EIPs will no longer trigger this alarm.

Parent Topic: System Management