MTD Overview

Prerequisites

You have purchased the MTD service in the current region.

Procedure

1. Log in to the management console.
2. Click in the upper left corner of the management console and select a region or project.
3. Click in the navigation pane on the left and choose Security & Compliance > Managed Threat Detection.
   Figure 1 Home page of MTD
   

4. Check the service overview. It introduces main functions of MTD and the service architecture.
   • No threat detection service has been created is displayed, if you did not create the detection service in your region. You can click Buy MTD in the upper right corner to go to the service purchase page.
     Figure 2 Detection service not purchased
     
   • If you have purchased MTD package in your region, the service overview is automatically hidden. To show it, click .
     Figure 3 Service overview
     

     If you click the close button in the upper right corner, the overview pane will not be displayed next time.

     

     If you did not purchase the MTD package in the current region, the service overview module is displayed by default and cannot be closed.

5. View the process flow.

   To use MTD, you need to buy MTD, create a detector, and store threat detection results.

   1. Buy MTD.

      You need to purchase a package for each region. If you have purchased one in the current region, in the process flow changes to .

   2. Create a detector.

      Create a detector for each region. If a detector has been created for the current region, changes to .

   3. Configure data storage.

      You can upload data to OBS.

      By default, MTD stores the detection results of the last 30 days. To store the data of a longer period (180 days to meet compliance requirements), click Upload to OBS to go to the Data Synchronization page and enable the function. For details, see Synchronizing Detection Results.

   4. Click the close button in the upper right corner of the pane. The overview pane will not be displayed next time.
      

      • If you have not created a detector or enabled the all log detection items for your services in the current region, the Process Flow pane is displayed by default and cannot be closed.
      • After Process Flow is closed, you can click Process Flow in the upper part of the page to show the Process Flow.

6. View package details. The name of the purchased package is displayed in the upper right corner of the page. Move the cursor to the package. The package details are displayed, as shown in Figure 4.
   Figure 4 Viewing package details
   

7. View alarm types and alarm details. For details, see Viewing Detection Results.