Configuring Alarm Monitoring

You can configure alarm types you want to monitor under the Alarm Monitoring Settings tab. After you complete the configuration, SA detects and pushes only alarms of configured types.

Currently, you can configure alarm monitoring information in the List Settings, Type and Level Settings, and Alarm Source Settings areas.
- List Settings: You can set a maximum of 50 pieces of information. The information must be IP addresses, IP addresses with port numbers, IP addresses with masks, or IP address ranges. Each piece of information must be different from others. Every two pieces of information must be separated with a line break.
- Type and Level Settings: You can select Brute-force attack, Web Attack, Exploit, Abnormal behavior, and/or Zombie and specify risk severity, including Critical, High, Medium, Low, and Informational.
- Alarm Source Settings: You can select IDS, IPS, DDoS, HSS, and WAF as your alarm sources.
After alarm monitoring settings are completed, only the alarms that meet the configured conditions are listed on the Threat Alarms page. The alarm monitoring settings take effect only for alarms generated after the settings are completed.
By default, no alarm monitoring settings are configured, so SA monitors attacks on all ports and IP addresses of assets and displays threat alarms of all assets across your account.

Constraints

Select at least one alarm type and one alarm risk severity for each alarm type. Otherwise, the alarm monitoring settings will not work.
Select at least one alarm source. Otherwise, the alarm monitoring settings will not work.

Prerequisites

Your professional edition SA is available.

Procedure

Log in to the management console.
Click in the upper left corner of the page and choose Security & Compliance > Situation Awareness.
In the navigation pane on the left, choose Settings > Notifications. On the displayed page, choose Alarm Settings > Alarm Monitoring Settings.
Configure an alarm monitoring list.

In the List Settings area, click Configure in the Operation column and complete configuration in the displayed dialog box.
To set the alarm monitoring source list, perform the following steps:
1. Import a monitoring list.
  Click Select File and select the target file in TXT format. The selected file is displayed in the text box.
2. Enter required IP addresses, IP addresses with port numbers, IP addresses with masks, or IP address ranges in the text box.
  If you enter 0.0.0.0/0:3389, 0.0.0.0/0:22, and 10.1.1.1 in the text box, SA only displays the alarm information of attacks to these objects. Figure 1 shows an example.
3. Synchronize security group policies.
  Click Synchronize Security Group Policy to synchronize security group policies into the text box of List Settings. After the synchronization is complete, the objects to be monitored are automatically displayed in the text box.
4. Click OK.
  Figure 1 Alarm monitoring list
Select the alarm monitoring type and risk severity.

In the Type and Level Settings area, select the notification items and alarm risk severity options of the alarm types you want to monitor. For unselected Notification Item and Risk Severity, SA will stop monitoring related alarm types.

SA then monitors the alarm information of the selected threat types and risk severity options.
Figure 2 Selecting the notification items and alarm risk severity options
Set the alarm sources.

In the Alarm Source Settings area, select the Notification Items.

SA then monitors the alarm information from the selected options.

Figure 3 Selecting notification items
Click Apply. It takes 3 to 5 minutes for the alarm monitoring settings to take effect.