Help Center/ Host Security Service/ User Guide/ Detection and Response/ HSS Alarms/ Managing Isolated Files
Updated on 2024-09-03 GMT+08:00
View PDF

Managing Isolated Files

HSS can isolate detected threat files. Files that have been isolated are displayed on a slide-out panel on the Server Alarms page. You can click Isolated Files on the upper right corner to check them, and can recover or delete isolated files anytime.

For details about events that can be isolated and killed, see Server Alarms.

Constraints

Servers that are not protected by HSS do not support alarm-related operations.

Isolation and Killing Operations

  1. Log in to the management console.
  2. In the upper left corner of the page, select a region, click , and choose Security & Compliance > HSS.
  3. In the navigation pane on the left, choose Detection & Response > Alarms and click Server Alarms.

    If your servers are managed by enterprise projects, you can select the target enterprise project to view or operate the asset and detection information.

    Figure 1 Server alarms

  4. Locate an event that can be isolated and killed, click Handle in the Operation column, and select Isolate and Kill in the displayed box.

    For details about events that can be isolated and killed, see Server Alarms.

  5. Click OK and isolate and kill the target alarm event.

    Files that have been isolated are displayed on a slide-out panel on the Server Alarms page and cannot harm your servers. You can click Isolated Files on the upper right corner to check them.

Checking Isolated Files

  1. In the alarm statistics area on the Server Alarms page, click the number above Isolated Files to check the isolated files.

    Figure 2 Alarm statistics

  2. Check the servers, names, paths, and modification time of the isolated files.

Restoring Isolated Files

If you want to de-isolate an isolated file, you can restore it by referring to the following steps.

  1. Click Restore in the Operation column of the list. The dialog box is displayed.
  2. Click OK.

    The permissions for this file will be restored to what they were before it was isolated.

Deleting Isolated Files

If you want to permanently delete an isolated file, you can perform the deletion operation by referring to the following steps.

  1. Click Delete in the Operation column of the list. The dialog box is displayed.

    To delete isolated files in batches, select multiple isolated files and click Delete in the upper left corner of the list.

  2. Click OK.

    Deleted isolated files cannot be restored. Exercise caution when performing this operation.

Parent Topic: HSS Alarms