Updated on 2025-08-26 GMT+08:00

Managing the Alarm Whitelist

You can configure the alarm whitelist to reduce false alarms. Events can be deleted from the whitelist.

Whitelisted events will not trigger alarms.

On the Alarms page, you can add falsely reported alarms to the alarm whitelist. After an alarm is added to the whitelist, HSS will not generate alarms on it.

Adding Events to the Alarm Whitelist

When handling an alarm event, you can select Add it to alarm whitelist. For details, see Handling Server Alarms.

Checking the Alarm Whitelist

Perform the following steps to check the alarm whitelist:

  1. Log in to the management console.
  2. In the upper left corner of the page, select a region, click , and choose Security & Compliance > Host Security Service.
  3. In the navigation pane on the left, choose Detection & Response > Whitelists.
  4. (Optional) If you have enabled the enterprise project function, select an enterprise project from the Enterprise Project drop-down list in the upper part of the page to view its data.
  5. Click the Alarm Whitelist tab to view the whitelist. For more information, see Table 1.

    Figure 1 Alarm whitelist
    Table 1 Alarm whitelist parameters

    Parameter Name

    Description

    Alarm Type

    Name of the alarm whitelist type.

    Whitelist Field

    Whitelisted file field

    Wildcard

    Logic used by a whitelisted rule, which can be equal or include.

    Description

    Description of the whitelist.

    Whitelist Rule

    Whitelisted rule ID

    Added

    Time when an alarm is added to the whitelist.

    Enterprise Project

    Enterprise project

    Occurrences Today

    Number of times that alarm events meet the whitelist conditions today.

    Total Occurrences

    Total number of times that alarm events meet the whitelist conditions. By default, this parameter is not displayed.

Removing an Alarm from the Whitelist

Exercise caution when performing this operation. Whitelisted alarms cannot be restored after removal, and will be reported once triggered. Up to 10,000 alarm whitelist items can be deleted under an account.

  • Delete a whitelist item
    1. In the Operation column of the item, click Delete.
    2. On the Delete Whitelisted Alarm page, confirm the information to be deleted and determine whether to restore associated alarms.

      When adding an alarm to the whitelist, you can whitelist similar alarms. Likewise, when deleting the whitelisted alarm, you can choose whether to restore these similar alarms.

    3. Enter DELETE in the text box and click OK.
    4. Return to the alarm whitelist. Verify that the deleted login whitelist item is not displayed.
  • Delete multiple alarm whitelist items
    1. Select whitelist items and click Delete above the list.
    2. On the Delete Whitelisted Alarm page, confirm the information to be deleted and determine whether to restore associated alarms.

      When adding an alarm to the whitelist, you can whitelist similar alarms. Likewise, when deleting the whitelisted alarm, you can choose whether to restore the similar alarms.

    3. Enter DELETE in the text box and click OK.
    4. Return to the alarm whitelist. Verify that the deleted login whitelist item is not displayed.
  • Delete all alarm whitelist items
    1. Click Delete above the alarm whitelist.
    2. On the Delete All page, confirm the information to be deleted, and choose whether to restore associated alarms.
    3. Enter DELETE in the text box and click OK.
    4. Return to the alarm whitelist. Verify that the deleted login whitelist item is not displayed.