Help Center/ Managed Threat Detection/ User Guide/ Viewing Detection Results
Updated on 2023-01-05 GMT+08:00

Viewing Detection Results

This section describes how to view alarm details about the detected logs.

Prerequisites

You have purchased the MTD package and enabled log detection.

Procedure

  1. Log in to the management console.
  2. Click in the upper left corner of the management console and select a region or project.
  3. Click in the navigation pane on the left and choose Security & Compliance > Managed Threat Detection.

    Figure 1 Home page of MTD

  4. Choose Detection Result in the navigation pane on the left.

    • If there is no alarm, a message is displayed, indicating that no threats are found in the latest log data of your service. The alarm types are displayed.
      Figure 2 No threats found
    • If there are alarms, they are displayed.
      • Click Currently, xx alarm types are supported. In the displayed pane, you can view examples of all alarm types for logs of different services. For details, see Example Alarms and Statistics.
      • It takes about three months to train the AI detection model based on your actual data after the model is brought online. The detection result in the training phase may be inaccurate. To help MTD improve the accuracy, click Report Alarm Accuracy in the Operation column of the alarm list.
      1. Alarms are sorted in descending order of the latest occurrence time. Table 1 describes information about the alarm list.
        Table 1 Alarm information

        Parameter

        Description

        Log Type

        Service logs for which the alarm is generated

        • IAM
        • VPC
        • DNS
        • CTS
        • OBS

        Alarm Type

        Multiple types of alarms are supported. For details, see Viewing Alarm Types.

        Alarm Title

        Description of an alarm

        Severity

        Severity of an alarm

        • Critical
        • High
        • Medium
        • Low
        • Informational

        Currently, alarm must be manually checked and handled. You are advised to view alarm types and handle the alarms in descending order of the alarm severity.

        Affected Resources

        Number of resources that may be under threats

        Alarms Triggered

        Number of times that an alarm is generated. You can click to switch the sorting order.

        First Occurrence

        Time when the alarm is generated for the first time. You can click to switch the sorting order.

        Last Occurrence

        Time when the alarm was generated last time. You can click to switch the sorting order.

      2. Click an alarm title to view details. You can come up with a handling method of the potential threats based on attack information such as the resource name, ID, type, and region.
      3. Report alarm accuracy.

        You can report the detection accuracy to help MTD improve.

        • Report accuracy for a single alarm. Click Report Alarm Accuracy in the Operation column. In the dialog box that is displayed, click Accurate or Inaccurate.
        • Report accuracy for alarms in batches. Select multiple alarms and click Report Alarm Accuracy above the check boxes. In the dialog box that is displayed, click Accurate or Inaccurate.