Viewing Container Alarms

Constraints

Servers that are not protected by HSS do not support operations related to alarms and events.

Procedure

1. Log in to the management console.
2. In the upper left corner of the page, select a region, click , and choose Security & Compliance > HSS.
3. In the navigation pane, choose Detection > Alarms and click the Container Alarms tab to view container alarms and events.
   • View the overview of container alarms and events.
     • Urgent Alarms: Number of urgent alarms that need to be handled. You can click the number to view the alarm list.
     • Total Alarms: Total number of alarms reported on your assets. You can click the number to view all alarms.
     • Containers with Alarms: Number of containers with alarms.
     • Handled Alarms: Number of handled alarms.
   • View the alarms of a certain type or ATT&CK phase.

     In the Alarms to Be Handled area, select an alarm type or att&ck phase.

     ATT&CK attack phase tags are also displayed below alarm names. For more information, see Table 1.

     

     Adversarial Tactics, Techniques and Common Knowledge (ATT&CK) is a framework that helps organizations understand the cyber adversary tactics and techniques used by threat actors across the entire attack lifecycle.

     Table 1 ATT&CK phases

     ATT&CK Phase	Description
     Reconnaissance	Attackers seek vulnerabilities in your system or network.
     Initial Access	Attacker try to enter your system or network.
     Execution	Attackers try to run malicious code.
     Persistence	Attackers try to maintain their foothold.
     Privilege Escalation	Attackers try to obtain higher permissions.
     Defense Evasion	Attackers try to avoid being detected.
     Credential Access	Attackers try to steal account names and passwords.
     Command and Control	Attackers try to communicate with compromised machines to control them.
     Impact	Attackers try to manipulate, interrupt, or destroy your system or data.

   • View details about container alarms and events.
     Click an alarm name to go to its details page. You can view the alarm description, handling suggestion, alarm path and address in HSS forensics, and the handling history of similar alarms. Table 2 describes the details of alarm information.

     

     You can download the alarm source files of certain malware to your local PC for analysis. The password for decompressing the files is unlock.

     Table 2 Alarm detail parameters

     Parameter	Description
     Intelligence Engine	Detection engines used by HSS, including the virus detection engine, AI detection engine, and malicious intelligence detection engine.
     Attack Status	Status of the current threat.
     First Occurred	Time when an attack alarm is generated for the first time
     Alarm ID	Unique ID of an alarm
     ATT&CK Phase	For details about the attack technology models used by attackers in each phase, see Table 1.
     Last Occurred	Time when an attack alarm is generated for the last time
     Alarm Information	Detailed information about an alarm, including the alarm description, alarm summary, affected assets, and handling suggestions.
     Forensics	HSS investigates information such as the attack triggering path or virus type based on the alarm type, helping you quickly trace and locate the attack source. Process Tree: If an alarm event contains process information, you can check the process ID, process file path, process command line, process startup time, and process file hash on the Forensics tab page. You can locate malicious processes based on such information. File Forensics: If an alarm event contains file information, you can check the file path and file hash on the Forensics tab page. You can locate the file change based on the such information. Network Forensics: If an alarm event contains network-related information, you can check the local IP address, local port, remote IP address, remote port, and protocol on the Forensics tab. You can determine whether a user is unauthorized based on such information. User Forensics: If an alarm event contains user-related information, you can check the user name, login IP address, login service type, login service port, last login event, and number of login failures on the Forensics tab. You can determine whether the access is unauthorized based on such information. Registry Forensics: If an alarm event contains registry information, you can check the registry keys and values on the Forensics tab page. You can locate registry risks based on such information. Abnormal Login Forensics: If an alarm event contains abnormal login information, you can check the login IP address and port number on the Forensics tab page. You can determine whether the login is trusted based on such information. Malware Forensics: If an alarm event contains malware information, you can check the malware family, virus name, virus type, and confidence level on the Forensics tab page. Auto-started Item Forensics: If an alarm event contains self-startup item information, you can check the user, command, self-startup item information, and process file command line information on the Forensics tab page. You can locate the auto-started items based on such information. Kernel Forensics: If an alarm event contains kernel information, you can check system functions and kernel functions on the Forensics tab page. You can locate kernel risks based on the information. Container Forensics: If an alarm event contains container information, you can check the container name and image ID on the Forensics tab page. You can locate container risks based on such information.
     Similar Alarms	Alarms that are similar to the current alarm event. You can handle the alarm according to the handling method of the similar alarms.

   • View the pod details of the container alarm event.

     Click the pod name of the target alarm event to view the pod details, including the node IP address, namespace, pod IP address, pod label, and container list.