One-click Blocking or Unblocking
Scenario
An emergency policy is used to quickly prevent attacks. You can select a block type based on the alert source to block attackers. Table 1 lists recommended settings. You can also block a single attack source based on the comprehensive investigation of multiple alerts.
Alert Type |
Defense Layer |
Recommended Policy |
---|---|---|
HSS alerts |
Server protection |
VPC policies are recommended to block traffic. |
WAF alerts |
Application protection |
WAF policies are recommended to block traffic. |
CFW alerts |
Network protection |
CFW policies are recommended to block traffic. |
IAM alerts |
Identity authentication |
IAM policies are recommended to block traffic. |
OBS and DBSS alerts |
Data protection |
You can use VPC or CFW policies based on actual attack scenarios and investigation results to disconnect attack sources from protected resources. |
This topic describes how to block or unblock attack sources quickly.
One-click Blocking
- Log in to the management console.
- Click in the upper left corner of the page and choose Security & Compliance > SecMaster.
- In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
Figure 1 Workspace management page
- In the navigation pane on the left, choose
.Figure 2 Alerts
- In the alert list, locate the row that contains the target alert and choose Operation > One-Click Block in the Operation column. The One-Click Block panel is displayed on the right.
You can also go to the details page of the target alert and click One-Click Block in the upper right corner of the page.
- On the displayed page, configure the blocking policy.
Table 2 One-click blocking Parameter
Description
Block Object
- If you select IP for Blocked Object Type, enter one or more IP addresses or IP address ranges you want to block. If there are multiple IP addresses or IP address ranges, separate them with commas (,). Example:
- Single IP address: 192.168.0.0
- IP address range: 192.168.0.0/12
- If you select IAM for Blocked Object Type, enter IAM user names.
- A maximum of 50 IP addresses, IP address ranges, or IAM users can be blocked by an emergency policy once.
Label
Label of the custom emergency policy.
Operation Connection
Select the operation connections for the policy.
Block Aging
Check whether the policy needs to be stopped.
- If you select Yes, set the aging time of the policy. For example, if you set the aging time to 180 days, the policy is valid within 180 days after the setting. After 180 days, the IP address or IP address range will not be blocked.
- If you select No, the policy is always valid and blocks the specified IP address or IP address range.
Reason Description
Description of the custom policy.
- If you select IP for Blocked Object Type, enter one or more IP addresses or IP address ranges you want to block. If there are multiple IP addresses or IP address ranges, separate them with commas (,). Example:
- Confirm settings and click OK. In the displayed dialog box, click OK.
One-click Unblocking
- Log in to the management console.
- Click in the upper left corner of the page and choose Security & Compliance > SecMaster.
- In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
Figure 3 Workspace management page
- In the navigation pane on the left, choose
.Figure 4 Alerts
- In the alert list, locate the row that contains the target alert, click Operation > One-Click Unblock in the Operation column.
You can also go to the details page of the target alert and click One-Click Unblock in the upper right corner of the page.
- In the displayed dialog box, enter the reason and click OK.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot