Help Center/ Host Security Service/ User Guide/ Detection and Response/ HSS Alarms/ Managing Isolated Files
Updated on 2025-08-26 GMT+08:00
View PDF
Share

Managing Isolated Files

HSS can isolate detected threat files. Files that have been isolated are displayed on a slide-out panel on the Server Alarms page. You can click Isolated Files on the upper right corner to check them, and can recover or delete isolated files anytime.

For details about events that can be isolated and killed, see Server Alarms.

Constraints

Servers that are not protected by HSS do not support alarm-related operations.

Isolation and Killing Operations

  1. Log in to the management console.
  2. In the upper left corner of the page, select a region, click , and choose Security & Compliance > Host Security Service.
  3. In the navigation pane on the left, choose Detection & Response > Alarms and click Server Alarms.

    Figure 1 Server alarms

  4. (Optional) If you have enabled the enterprise project function, select an enterprise project from the Enterprise Project drop-down list in the upper part of the page to view its data.
  5. Locate an event that can be isolated and killed, click Handle in the Operation column, and select Isolate and Kill in the displayed box.

    For details about events that can be isolated and killed, see Server Alarms.

  6. Click OK and isolate and kill the target alarm event.

    Files that have been isolated are displayed on a slide-out panel on the Server Alarms page and cannot harm your servers. You can click Isolated Files on the upper right corner to check them.

Checking Isolated Files

  1. In the alarm statistics area on the Server Alarms page, click the number above Isolated Files to check the isolated files.

    Figure 2 Alarm statistics

  2. Check the servers, names, paths, and modification time of the isolated files.

Restoring Isolated Files

If you want to de-isolate an isolated file, you can restore it by referring to the following steps. The permissions for this file will be restored to what they were before it was isolated. Exercise caution when performing this operation.

  1. Click Restore in the Operation column of the list. The dialog box is displayed.
  2. Click OK.

Deleting Isolated Files

If you want to permanently delete an isolated file, you can perform the deletion operation by referring to the following steps.

  1. Click Delete in the Operation column of the list. The dialog box is displayed.

    To delete isolated files in batches, select multiple isolated files and click Delete in the upper left corner of the list.

  2. Click OK.
Parent Topic: HSS Alarms