Overview

Updated on 2025-05-13 GMT+08:00

View PDF

An alert is a notification of abnormal signals in O&M. It is usually automatically generated by a monitoring system or security device when detecting an exception in the system or networks. For example, when the CPU usage of a server exceeds 90%, the system may generate an alert. These exceptions may include system faults, security threats, or performance bottlenecks.

Generally, an alert can clearly indicate the location, type, and impact of an exception. In addition, alerts can be classified by severity, such as critical, major, and minor, so that O&M personnel can determine which alerts need to be handled first based on their severity.

The purpose of an alert is to notify related personnel in a timely manner so that they can make a quick response and take measures to fix the problem.

When SecMaster detects an exception (for example, a malicious IP address attacks an asset or an asset has been hacked into) in cloud resources, it generates an alert and displays the threat information on the Alerts page in SecMaster. For details about preset alert types, see Preset Alert Types.

On SecMaster Alerts page, you can:

Check alert details. You can check alerts generated over the last 360 days as well as their details, including the alert name, type, severity, and time it was generated. You can customize filters to quickly search for a specific alert by its name, risk severity, occurrence time, and other attributes.

Convert an alert into an incident or associate an alert with incidents. During the alert analysis, if SecMaster detects attacks or serious threats, it converts such alerts into incidents or associates such alerts with certain incidents.

Start or stop one-click blocking by using an emergency policy. You can quickly contain a certain type of attacks from malicious IP addresses based on attack sources identified in an alert.

Disable or delete an alert. Deleted alerts cannot be restored. Exercise caution when performing this operation.

Add an alert or edit parameters for an alert.

Import or export alerts.

Alerts and attacks are different. The following table lists their differences.

**Table 1** Differences between alerts and attacks
Name	Data Source	Supported Operation
Alerts	Alerts generated by SecMaster threat detection models Alerts customized and added by users Alerts imported by users	Check alert details. You can check alerts generated over the last 360 days as well as their details, including the alert name, type, severity, and time it was generated. You can customize filters to quickly search for a specific alert by its name, risk severity, occurrence time, and other attributes. Convert an alert into an incident or associate an alert with incidents. During the alert analysis, if SecMaster detects attacks or serious threats, it converts such alerts into incidents or associates such alerts with certain incidents. Start or stop one-click blocking by using an emergency policy. You can quickly contain a certain type of attacks from malicious IP addresses based on attack sources identified in an alert. Disable or delete an alert. Deleted alerts cannot be restored. Exercise caution when performing this operation. Add an alert or edit parameters for an alert. Import or export alerts. You can import or export alerts.
Attacks	Attacks are reported by the layer-7 security products. For details, see Overview.	Viewing Attack Information Exporting Attacks Handling Attacks

Alert Severity Levels

**Table 2** Alert severity levels
Severity	Description
Critical	A critical alert indicates that the system is severely attacked, which may cause data loss, system breakdown, or long service interruption. For example, such alerts are generated if ransomware encryption behaviors or malware is detected. You need to handle them immediately to avoid severe system damage.
High	A high-risk alert indicates that the system may be under an attack that has not caused serious damage. For example, such alerts are generated if unauthorized login attempts are detected or unsafe commands (for deleting critical system files or modifying system settings) are executed. You need to investigate and take measures in a timely manner to prevent attacks from spreading.
Medium	A medium-risk alert indicates that the system has potential security threats, but there are no obvious signs of being attacked. For example, if abnormal modifications of a file or directory are detected, there may be potential attack paths or configuration errors in the system. You need to further analyze and take proper preventive measures to enhance system security.
Low	A low-risk alert indicates that a minor security threat exists in the system but does not have significant impact on your system. For example, such alerts are generated if port scans are detected, indicating that there may be attackers trying to find system vulnerabilities. These alerts do not require immediate emergency measures. If you have high requirements for asset security, you should also pay attention to alerts at this level.
Informational	The resource has potential errors, which might affect services. If you have high requirements for asset security, you should also pay attention to alerts at this level.

Attack Handling Methods

For attacks reported by the security products of seven layers of defense, you can handle, disable, or ignore alerts on SecMaster. For details, see Handling Attacks.

Closing an alert: If an alert has been manually handled, you can close it.
Ignoring an alert: If the risk of an alert is controllable, you can ignore the alert. The next time this type of alert is triggered, a new alert will be generated.

Limitations and Constraints

Deleting an alert: Only alerts defined or imported by you can be deleted.
Importing an alert: Only files in .xlsx can be imported. Each time you can import a file no larger than 5 MB with a maximum of 100 records.
Exporting an alert: A maximum of 9,999 alerts can be exported.
One-click blocking or unblocking: For details, see Limitations and Constraints.

Parent topic: Alert Management

Previous topic: Alert Management

Next topic: Viewing Alert Details