Managing Isolated Files

Constraints

Servers that are not protected by HSS do not support alarm-related operations.

Isolation and Killing Operations

1. Log in to the management console.
2. In the upper left corner of the page, select a region, click , and choose Security & Compliance > HSS.
3. In the navigation pane on the left, choose Detection > Alarms and click Server Alarms.
   

   If your servers are managed by enterprise projects, you can select an enterprise project to view or operate the asset and scan information.

   Table 1 Alarm statistics

   Parameter	Description
   Enterprise Project	Select an enterprise project and view alarm details by enterprise project.
   Time range	You can select a fixed period or customize a time range to search for alarms. Only alarms generated within 30 days can be queried. The options are as follows: Last 24 hours Last 3 days Last 7 days Last 30 days
   Urgent Alarms	Number of urgent alarms that need to be handled.
   Total Alarms	Total number of alarms on your assets.
   Affected Servers	Number of servers for which alarms are generated. When checking alarms generated in the last 24 hours, you can click the number of servers to go to the Servers & Quota page and check the corresponding servers.
   Handled Alarms	Number of handled alarms.
   Blocked IP Addresses	Number of blocked IP addresses. You can click the number to check blocked IP address list. The blocked IP address list displays the server name, attack source IP address, login type, blocking status, number of blocks, blocking start time, and the latest blocking time. If a valid IP address is blocked by mistake (for example, after O&M personnel enter incorrect passwords for multiple times), you can manually unblock it. If a server is frequently attacked, you are advised to fix its vulnerabilities in a timely manner and eliminate risks. NOTICE: The agent of Linux 3.2.10 or later supports IPv6 interception. The agent of a version earlier than Linux 3.2.10 supports TCP Wrapper interception, but does not support IPv6 interception using IPTables. After a blocked IP address is unblocked, HSS will no longer block the operations performed by the IP address. A maximum of 10,000 IP addresses can be blocked for each type of software. If your Linux server does not support ipset, a maximum of 50 IP addresses can be clocked for MySQL and vsftp. If your Linux server does not support ipset or hosts.deny, a maximum of 50 IP addresses can be blocked for SSH.
   Isolated Files	HSS can isolate detected threat files. Files that have been isolated are displayed on a slide-out panel on the Server Alarms page. You can click Isolated Files on the upper right corner to check them. You can recover isolated files. For details, see Managing Isolated Files.

4. Locate an event that can be isolated and killed, click Handle in the Operation column, and select Isolate and Kill in the displayed box.
   

   For details about events that can be isolated and killed, see Server Alarms.

5. Click OK and isolate and kill the target alarm event.

   Files that have been isolated are displayed on a slide-out panel on the Server Alarms page and cannot harm your servers. You can click Isolated Files on the upper right corner to check them.

Checking Isolated Files

1. In the alarm statistics area on the Server Alarms page, click the number above Isolated Files to check the isolated files.
   Figure 1 Alarm statistics
   

2. Check the servers, names, paths, and modification time of the isolated files.

Restoring Isolated Files

If you want to de-isolate an isolated file, you can restore it by referring to the following steps.

1. Click restore in the Operation column of the file isolation box list. The restore isolated files dialog box is displayed.
2. Click OK.
   

   Recovered files will no longer be isolated. Exercise caution when performing this operation.

Deleting Isolated Files

If you want to permanently delete an isolated file, you can perform the deletion operation by referring to the following steps.

1. Click Delete in the Operation column of the list. The dialog box is displayed.

   To delete isolated files in batches, select multiple isolated files and click Delete in the upper left corner of the list.

2. Click OK.
   

   Deleted isolated files cannot be restored. Exercise caution when performing this operation.