Viewing Detection Results

Prerequisites

You have purchased the MTD package and enabled log detection.

Procedure

1. Log in to the management console.
2. Click in the upper left corner of the management console and select a region or project.
3. Click in the navigation pane on the left and choose Security & Compliance > Managed Threat Detection.
   Figure 1 Home page of MTD
   

4. Choose Detection Result in the navigation pane on the left.
   • If there is no alarm, a message is displayed, indicating that no threats are found in the latest log data of your service. The alarm types are displayed.
     Figure 2 No threats found
     
   • If there are alarms, they are displayed.
     

     • Click Currently, xx alarm types are supported. In the displayed pane, you can view examples of all alarm types for logs of different services. For details, see Example Alarms and Statistics.
     • It takes about three months to train the AI detection model based on your actual data after the model is brought online. The detection result in the training phase may be inaccurate. To help MTD improve the accuracy, click Report Alarm Accuracy in the Operation column of the alarm list.
     1. Alarms are sorted in descending order of the latest occurrence time. Table 1 describes information about the alarm list.

        Table 1 Alarm information

        Parameter	Description
        Log Type	Service logs for which the alarm is generated IAM VPC DNS CTS OBS
        Alarm Type	Multiple types of alarms are supported. For details, see Viewing Alarm Types.
        Alarm Title	Description of an alarm
        Severity	Severity of an alarm Critical High Medium Low Informational Currently, alarm must be manually checked and handled. You are advised to view alarm types and handle the alarms in descending order of the alarm severity.
        Affected Resources	Number of resources that may be under threats
        Alarms Triggered	Number of times that an alarm is generated. You can click to switch the sorting order.
        First Occurrence	Time when the alarm is generated for the first time. You can click to switch the sorting order.
        Last Occurrence	Time when the alarm was generated last time. You can click to switch the sorting order.

     2. Click an alarm title to view details. You can come up with a handling method of the potential threats based on attack information such as the resource name, ID, type, and region.
     3. Report alarm accuracy.
        

        You can report the detection accuracy to help MTD improve.

        • Report accuracy for a single alarm. Click Report Alarm Accuracy in the Operation column. In the dialog box that is displayed, click Accurate or Inaccurate.
        • Report accuracy for alarms in batches. Select multiple alarms and click Report Alarm Accuracy above the check boxes. In the dialog box that is displayed, click Accurate or Inaccurate.