Viewing Attack Defense Information on the Dashboard

Scenario

During routine network security O&M, enterprises need to know the security status of traffic at any time. CFW provides the security dashboard, which allows you to quickly view the protection statistics of the attack defense function (IPS, reverse shell prevention, sensitive directory scan prevention, and antivirus) for the inbound/outbound Internet traffic and VPC border traffic within seven days. In this way, you can adjust protection settings based on your traffic protection status in a timely manner.

Constraints

Viewing IPS Protection Information on the Dashboard

1. Log in to the CFW console.
2. Click in the upper left corner of the management console and select a region or project.
3. (Optional) Switch to another firewall instance. Select a firewall from the drop-down list in the upper left corner of the page.
4. In the navigation pane, choose Attack Defense > Security Dashboard.
5. In the upper part of the page, click the Internet Borders or Inter-VPC Borders tab.
6. On the Statistics Dashboard page, check the attack defense statistics of the firewall instance. You can select the query time in the upper right corner of each module.
   • Security Dashboard: Number of attacks detected by IPS, numbers of allowed and blocked accesses, and number of attacked ports.
   • Attacks: Number of times that IPS blocks or allows traffic.
   • Visualizations: Top 5 items ranked by specific parameters of the attacks detected or blocked by IPS. For details, see Table 2. Click a data record to view attack event details. For details, see Table 1.

     Table 2 Security dashboard statistics parameters

     Parameter	Description
     Attack Types	Attack type.
     Top Internal Attack Source IP Addresses	IP addresses of the assets that are on your cloud but launch attacks on external IP addresses.
     Top External Attack Source IP Addresses	External IP addresses that launch attacks on your cloud assets.
     Top External Attack Source Regions	Regions of the external IP addresses that launch attacks on your cloud assets.
     Top Attack Destination IP Addresses	Destination IP addresses of attacks.
     Top Attacked Ports	Attacked ports.

Checking Top Attack Sources on the Dashboard

1. Log in to the CFW console.
2. Click in the upper left corner of the management console and select a region or project.
3. (Optional) Switch to another firewall instance. Select a firewall from the drop-down list in the upper left corner of the page.
4. In the navigation pane, choose Attack Defense > Security Dashboard.
5. In the upper part of the page, click the Internet Borders or Inter-VPC Borders tab.
6. Click the Top Attack Sources tab. On the displayed page, view information about the top 50 attack sources that were detected or blocked in a specified period.
   • The table shows the top 50 records with the highest access traffic. Each record includes the top five ports and applications with the highest access traffic.
   • Check whether the traffic is normal or malicious.
     • If the IP address is normal, click Add to Whitelist in the Operation column to add it to the whitelist. CFW will directly allow traffic from the IP address.
     • If the IP address is malicious,
       • Click Create Address Group or Add to Address Group to add one or multiple IP addresses to an address group. Then, manually configure a protection rule to block attacks. For details, see Configuring Protection Rules to Block or Allow Internet Border Traffic.
       • Click Add to Blacklist in the Operation column of an IP address. CFW will block the traffic from the IP address.
   • If the number of IP addresses to be added to the blacklist exceeds the upper limit, you can use the traffic blocking function to quickly block IP addresses. For details, see Quickly Block Malicious Traffic Through Traffic Blocking.
   • To export data, select records and click Export above the list, and set the export scope. Data will be exported to the local PC.

Checking Top Attack Targets on the Dashboard

1. Log in to the CFW console.
2. Click in the upper left corner of the management console and select a region or project.
3. (Optional) Switch to another firewall instance. Select a firewall from the drop-down list in the upper left corner of the page.
4. In the navigation pane, choose Attack Defense > Security Dashboard.
5. In the upper part of the page, click the Internet Borders or Inter-VPC Borders tab.
6. Click the Top Attack Targets tab. On the displayed page, view information about the top 50 attack targets that were detected or blocked in a specified period.
   • The table shows the top 50 records with the highest access traffic. Each record includes the top five ports and applications with the highest access traffic.
   • To export data, select records and click Export above the list, and set the export scope. Data will be exported to the local PC.

References

• For details about logs, see Attack Event Logs.
• For details about attack defense capabilities, see Attack Defense Overview.
• For details about how to handle incorrect IPS blocking, see What Do I Do If IPS Blocks Normal Services?
• For details about how to modify the IPS action, see Configuring Basic IPS Protection. For details about how to modify the virus defense action, see Configuring Virus Defense.