Managing the Alarm Whitelist

Adding Events to the Alarm Whitelist

When handling an alarm event, you can select Add it to alarm whitelist. For details, see Handling Server Alarms.

Checking the Alarm Whitelist

Perform the following steps to check the alarm whitelist:

1. Log in to the management console.
2. In the upper left corner of the page, select a region, click , and choose Security & Compliance > Host Security Service.
3. In the navigation pane on the left, choose Detection & Response > Whitelists.
4. (Optional) If you have enabled the enterprise project function, select an enterprise project from the Enterprise Project drop-down list in the upper part of the page to view its data.
5. Click the Alarm Whitelist tab to view the whitelist. For more information, see Table 1.
   Figure 1 Alarm whitelist
   

   Table 1 Alarm whitelist parameters

   Parameter Name	Description
   Alarm Type	Name of the alarm whitelist type.
   Whitelist Field	Whitelisted file field
   Wildcard	Logic used by a whitelisted rule, which can be equal or include.
   Description	Description of the whitelist.
   Whitelist Rule	Whitelisted rule ID
   Added	Time when an alarm is added to the whitelist.
   Enterprise Project	Enterprise project
   Occurrences Today	Number of times that alarm events meet the whitelist conditions today.
   Total Occurrences	Total number of times that alarm events meet the whitelist conditions. By default, this parameter is not displayed.

Removing an Alarm from the Whitelist

Exercise caution when performing this operation. Whitelisted alarms cannot be restored after removal, and will be reported once triggered. Up to 10,000 alarm whitelist items can be deleted under an account.

• Delete a whitelist item
  1. In the Operation column of the item, click Delete.
  2. On the Delete Whitelisted Alarm page, confirm the information to be deleted and determine whether to restore associated alarms.

     When adding an alarm to the whitelist, you can whitelist similar alarms. Likewise, when deleting the whitelisted alarm, you can choose whether to restore these similar alarms.

  3. Enter DELETE in the text box and click OK.
  4. Return to the alarm whitelist. Verify that the deleted login whitelist item is not displayed.
• Delete multiple alarm whitelist items
  1. Select whitelist items and click Delete above the list.
  2. On the Delete Whitelisted Alarm page, confirm the information to be deleted and determine whether to restore associated alarms.

     When adding an alarm to the whitelist, you can whitelist similar alarms. Likewise, when deleting the whitelisted alarm, you can choose whether to restore the similar alarms.

  3. Enter DELETE in the text box and click OK.
  4. Return to the alarm whitelist. Verify that the deleted login whitelist item is not displayed.
• Delete all alarm whitelist items
  1. Click Delete above the alarm whitelist.
  2. On the Delete All page, confirm the information to be deleted, and choose whether to restore associated alarms.
  3. Enter DELETE in the text box and click OK.
  4. Return to the alarm whitelist. Verify that the deleted login whitelist item is not displayed.