Viewing and Handling Honeypot Protection Events

Scenario

By default, the servers that proactively connect to the dynamic honeypot port are compromised intranet servers. Once a suspicious connection behavior is detected, an alarm is reported.

Procedure

1. Log in to the management console.
2. In the upper left corner of the page, select a region, click , and choose Security & Compliance > HSS.
3. Choose Prevention > Dynamic Port Honeypot. The Dynamic Port Honeypot page is displayed.
4. (Optional) If you have enabled the enterprise project, select the enterprise project where the target server resides from the drop-down list.
5. Under the introductions, view the protection overview.
   • You can view the number of protection policies, protected servers, and protection events.
   • You can enable the Automatically apply default policies to newly add servers. If is displayed, the function is enabled.
   Figure 1 Protection information overview
   

6. Click the Protection Events tab to view honeypot protection events. For details about the parameters in the event list, see Table 1.

   Table 1 Parameters in the event list

   Parameter	Description
   Alarm Name	The name of an alarm event. Click an alarm name to view the details. For details, see Table 3.
   Alert Severity	Alarm threat level. Honeypot protection events are classified into the following two levels: High risk: The remote server connects to the honeypot port for multiple times. Medium risk: The remote server is connected to the honeypot port.
   Alarm Summary	Summary of alarm events. Based on the information, you can learn about the server that may be compromised and the connection between the server and the port.
   Affected Asset	Dynamic port server connected to the compromised server.
   Alarm Reported	Time when an alarm occurred.
   Status	Alarm handling status, which can be Handled or To be handled.
   Operation	You can handle alarm events.

7. After confirming the alarm information, click Handle in the Operation column of the event whose Status is To be handled. The Handle Alarm dialog box is displayed.

   If you need to handle multiple alarm events in batches, click Batch Handle in the upper left corner of the list.

8. Select a solution. For details about the solution, see Table 2.

   Table 2 Parameters for handling alarm events

   Parameter	Description
   Action	Ignore: Ignore the alarm event. The alarm is still generated when the next threat event occurs. Manually handling: You can manually isolate ports for the compromised server. Add to alarm whitelist: Add the trusted server that triggers an alarm to the whitelist so that no alarm will be generated when similar threat events occur.
   Batch handling	If you need to handle the same alarm event at the same time, you can select the parameter.
   Remarks (Optional)	To facilitate identification of the current processing, supplementary description can be provided.

9. Click OK.

Alarm Details Parameters

For details about the parameters on the alarm details, see Table 3.

Filtering Events in Different Handling Statuses

Select an event in the target status from the drop-down list.

Figure 2 Filtering events