Viewing Alarms

Constraints

• Ignoring or marking an alarm event is only supported in the standard and professional editions.
• Exporting only a certain type of alarms is not supported. You can export all alarms for the last 180 days.
• When search filters are applied to search for alarms, a maximum of 10,000 alarms can be displayed.

Viewing Alarm Details

1. Log in to the management console.
2. Click in the upper left corner of the page and choose Security & Compliance > Situation Awareness.
3. In the navigation pane on the left, choose Threat Alarms > Alarms.
   Figure 1 Viewing alarms
   

4. Specify Alarm Name, Risk Severity, Time, and/or Status to display only alarms that meet the filter criteria you specified.
   • Alarm Name is the category that the alarm belongs to.
   • Risk Severity is severity of an alarm. The options are Critical, High, Medium, Low, and Informational.
   • Status is the handling status of an alarm. The options are Unhandled, Ignored, and Handled Offline.
   • Time indicates a time range to display alarms generated during such range. The options are Today, Yesterday, Last 3 days, Last 7 days, Last 30 days, and Last 6 months.

5. If a large number of alarms are displayed after applying your search filters, you can use the search function to quickly locate specific alarms.

   You can select Asset IP Address, Alarm Source IP Address, or Host ID from the drop-down list, enter an IP address or ID in the search box, and click to locate information about alarms generated for a specified asset.

6. Viewing alarm details.

   Click an alarm name in the alarm list. The Alarm Details window slides out from the right. You can view the basic information, detection source, attack source, and affected users of the alarm, and change the alarm processing status.

Marking Alarm Events

You can manually mark an alarm event reported by SA.

1. On the Alarms tab, mark the processing status of alarms.
   • Ignore: If an alarm does not cause any harm, it can be marked as Ignored.
   • Mark as Offline: If the alarm has been handled offline, click Mark as Offline in the Operation column. In the displayed dialog box, fill in Processor, Processing Time, and Processing Result, and click OK.

2. Marks the processing status of multiple alarms once.

   Select one or more alarms in the Unhandled status and click Ignore or Mark as Offline above the alarm list to handle all selected alarms at a time.

3. Marks the processing status of a single alarm.

   In the Operation column of the target alarm, click Ignore or Mark as Offline to handle the alarm.

4. Cancel the alarm processing status marking.

   To change the processing status of an alarm, locate the target row and click Unignore or Unmark in the Operation column to restore the alarm to the Unhandled status and then re-mark the alarm processing status.

Exporting Alarm Events

On the Alarms tab, click Export All Alarms above the alarm list to export all threat alarms into an Excel file and save the file locally. After all alarms are exported, you can view them offline.

Figure 2 Exporting alarm events

The exported Excel file contains information such as Event ID, Affected Resource, Severity, and Discovered.

NOTE:

Currently, only all alarm events generated for the last 180 days can be exported.