Help Center/ Host Security Service/ User Guide (Ankara Region)/ Intrusion Detection/ Alarms/ HSS Alarms/ Viewing Intrusion Alarms
Updated on 2024-04-15 GMT+08:00
View PDF
Share

Viewing Intrusion Alarms

HSS displays alarm and event statistics and their summary all on one page. You can have a quick overview of alarms, including the numbers of servers with alarms, handled alarms, unhandled alarms, blocked IP addresses, and isolated files.

The Events page displays the alarm events generated in the last 30 days. You can manually handle the alarmed items.

The status of a handled event changes from Unhandled to Handled.

Alarms generated by AV detection and HIPS detection are displayed under different types of events.

  • Alarms generated by AV detection are displayed only under the Malware events.
  • Alarms generated by HIPS detection are displayed in subcategories of all events.

Constraints and Limitations

  • To skip the checks on high-risk command execution, privilege escalation, reverse shells, abnormal shells, or web shells, manually disable the corresponding policies in the policy groups on the Policies page. HSS will not check the servers associated with disabled policies. For details, see Viewing a Policy Group.
  • Other detection items cannot be manually disabled.
  • Servers that are not protected by HSS do not support operations related to alarms and events.

Procedure

  1. Log in to the management console.
  2. Click in the upper left corner of the page, select a region, and choose Security > Host Security Service.
  3. In the navigation pane on the left, choose Detection > Alarms and click Server Alarms.

    Table 1 Alarm statistics

    Parameter

    Description

    Time range

    You can select a fixed period or customize a time range to search for alarms. Only alarms generated within 30 days can be queried.

    The options are as follows:

    • Last 24 hours
    • Last 3 days
    • Last 7 days
    • Last 30 days

    Affected Servers

    Number of servers for which alarms are generated.

    Alarms to be Handled

    Number of alarms to be handled.

    By default, all unhandled alarms are displayed on the Events page.

    Handled Alarms

    Number of handled alarms.

    Blocked IP Addresses

    Number of blocked IP addresses. You can click the number to check blocked IP address list.

    The blocked IP address list displays the server name, attack source IP address, login type, blocking status, number of blocks, blocking start time, and the latest blocking time.

    If a valid IP address is blocked by mistake (for example, after O&M personnel enter incorrect passwords for multiple times), you can manually unblock it. If a server is frequently attacked, you are advised to fix its vulnerabilities in a timely manner and eliminate risks.

    NOTICE:
    • After a blocked IP address is unblocked, HSS will no longer block the operations performed by the IP address.
    • A maximum of 10,000 IP addresses can be blocked for each type of software.

      If your Linux server does not support ipset, a maximum of 50 IP addresses can be clocked for MySQL and vsftp.

      If your Linux server does not support ipset or hosts.deny, a maximum of 50 IP addresses can be blocked for SSH.

    Isolated Files

    HSS can isolate detected threat files. Files that have been isolated are displayed on a slide-out panel on the Server Alarms page. You can click Isolated Files on the upper right corner to check them.

    You can recover isolated files. For details, see Managing Isolated Files.

  4. Click an alarm event in the list of event types to view the affected servers and occurrence time of the event. The following information is displayed:

    • Total number of alarms
    • Number of each type of alarms

  5. Click an alarm name to view its details.

Parent topic: HSS Alarms