Viewing Container Alarms
HSS displays alarm and event statistics and their summary all on one page. You can have a quick overview of alarms, including the numbers of urgent alarms, total alarms, containers with alarms, and handled alarms.
The Events page displays the alarm events generated in the last 30 days.
The status of a handled event changes from Unhandled to Handled.
Constraints
Servers that are not protected by HSS do not support operations related to alarms and events.
Viewing Container Alarms
- Log in to the management console.
- In the upper left corner of the page, select a region, click , and choose Security & Compliance > HSS.
- In the navigation pane, choose Detection & Response > Alarms and click the Container Alarms tab to view container alarms and events.
Figure 1 Container alarms
Table 1 Container alarm statistics Parameter
Description
Urgent Alarms
Number of alarms that need to be handled immediately. You can click a value to view the corresponding alarm events.
Total Alarms
Total number of alarms reported on your assets. You can click the number to view all alarms.
Containers with Alarms
Number of containers for which alarms are generated.
Handled Alarms
Number of handled alarms
- Viewing the alarms of a certain type or ATT&CK phase
In the Alarms to Be Handled area, select an alarm type or att&ck phase. For details, see ATT&CK attack phase description.
Adversarial Tactics, Techniques and Common Knowledge (ATT&CK) is a framework that helps organizations understand the cyber adversary tactics and techniques used by threat actors across the entire attack lifecycle.
Table 2 ATT&CK phases ATT&CK Phase
Description
Reconnaissance
Attackers seek vulnerabilities in your system or network.
Initial Access
Attacker try to enter your system or network.
Execution
Attackers try to run malicious code.
Persistence
Attackers try to maintain their foothold.
Privilege Escalation
Attackers try to obtain higher permissions.
Defense Evasion
Attackers try to avoid being detected.
Credential Access
Attackers try to steal account names and passwords.
Command and Control
Attackers try to communicate with compromised machines to control them.
Impact
Attackers try to manipulate, interrupt, or destroy your system or data.
- Viewing details about container alarms and events
Click an alarm name to go to its details page. You can view the alarm description, handling suggestion, alarm path and address in HSS forensics, and the handling history of similar alarms. Table 3 describes the details of alarm information.
For some HSS alarms that have been determined as malware alarms, the alarm source files are saved in the cloud center and you can download them. You can download the alarm source files to your local PC for analysis. The password for decompressing the files is unlock.
For unacknowledged malware alarms, alarm source files cannot be downloaded. Check the actual service conditions and determine whether the files are malicious files.
Table 3 Alarm detail parameters Parameter
Description
Intelligence Engine
Detection engines used by HSS, including the virus detection engine, AI detection engine, and malicious intelligence detection engine.
Attack Status
Status of the current threat.
First Occurred
Time when an attack alarm was first generated
Alarm ID
Unique ID of an alarm
ATT&CK Phase
For details about the attack technology models used by attackers in each phase, see Table 2.
Last Occurred
Time when an attack alarm was last generated
Alarm Information
Detailed information about an alarm, including the alarm description, alarm summary, affected assets, and handling suggestions.
Forensics
HSS investigates information such as the attack triggering path or virus type based on the alarm type, helping you quickly trace and locate the attack source.
- Process Tree: If an alarm event contains process information, you can check the process ID, process file path, process command line, process startup time, and process file hash on the Forensics tab page. You can locate malicious processes based on such information.
- File Forensics: If an alarm event contains file information, you can check the file path and file hash on the Forensics tab page. You can locate the file change based on the such information.
- Network Forensics: If an alarm event contains network-related information, you can check the local IP address, local port, remote IP address, remote port, and protocol on the Forensics tab. You can determine whether a user is unauthorized based on such information.
- User Forensics: If an alarm event contains user-related information, you can check the user name, login IP address, login service type, login service port, last login event, and number of login failures on the Forensics tab. You can determine whether the access is unauthorized based on such information.
- Registry Forensics: If an alarm event contains registry information, you can check the registry keys and values on the Forensics tab page. You can locate registry risks based on such information.
- Abnormal Login Forensics: If an alarm event contains abnormal login information, you can check the login IP address and port number on the Forensics tab page. You can determine whether the login is trusted based on such information.
- Malware Forensics: If an alarm event contains malware information, you can check the malware family, virus name, virus type, and confidence level on the Forensics tab page.
- Auto-started Item Forensics: If an alarm event contains self-startup item information, you can check the user, command, self-startup item information, and process file command line information on the Forensics tab page. You can locate the auto-started items based on such information.
- Kernel Forensics: If an alarm event contains kernel information, you can check system functions and kernel functions on the Forensics tab page. You can locate kernel risks based on the information.
- Container Forensics: If an alarm event contains container information, you can check the container name and image ID on the Forensics tab page. You can locate container risks based on such information.
Similar Alarms
Alarm whose server and event type are the same as those of this alarm. You can handle the alarm according to the handling method of the similar alarms.
- Viewing the pod details of an container alarm event
Click the pod name of the target alarm event to view the pod details, including the node IP address, namespace, pod IP address, pod label, and container list.
- Viewing the alarms of a certain type or ATT&CK phase
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot