Alarm
Unduh
Mode fokus
Ukuran font
The Database Risk Monitoring and Alarm module enables precise identification and closed-loop handling of violations. It achieves this through a system for real-time monitoring and response to security events on database assets.
Alarm List
1. Log in to the CSC console. In the left navigation pane, click Data Security Situation Management > Database Risk Monitor.
2. On the Database Risk Monitoring page, click the Alarm Tag.
3. On the Alarm Tag page, you can view the relevant alarm information for your current database assets. The alarm list displays the alarm name/type, alarm level, asset instance ID/name, database account, associated user/type, alarm detection time, and processing status.
Viewing Alarm Details
On the Alarm Tag page, click the target Alarm name to view information such as the alarm trigger reason, details of the violation (including the SQL statement and source IP address), and associated assets.
Alarm Handling Operations
Marking As Ignored
Mark the status of false positive or non-actionable alarms to eliminate interference in risk statistics.
Note:
If an alarm's handling status is marked as Ignored, the corresponding risk will not be included in risk statistics.
1. On the Alarm Tag page, you can process target alarms individually or in batches:
Single Alarm Handling: In the target alarm's operation column, click Mark As Ignored.
Batch Handling: Select multiple target alarms, and click Mark As Ignored.
2. In the secondary confirmation dialog, click Confirm to mark the alarm as ignored.
Adding Allowlists
For behaviors that require long-term allowance, you can add the policy triggered by the alarm to the rule allowlist.
1. On the Alarm Tag page, in the target alarm's operation column, click Add to Allowlist.
2. In the Add to Allowlist window, review the allowlist policy content. After confirming it is correct, click Confirm to add the policy information triggered by this alarm to the allowlist.
Note:
After the allowlist policy rule takes effect, the corresponding behavior no longer triggers an alarm.
Marking as Handled
Update the status of alarms for which emergency response has been completed to achieve a closed-loop handling process.
1. On the Alarm Tag page, select one or multiple target alarms, and click Tag Disposal.
2. In the confirmation window, verify the alarm information. After confirming it is correct, click OK to mark the alarm as handled.
Note:
After an alarm's handling status is marked as Handled, the alarm will not be included in risk statistics.
Alarm Policy Configuration
1. Log in to the CSC console. In the left navigation pane, click Data Security Situation Management > Database Risk Monitor.
2. On the Database Risk Monitoring page, click Policy Management in the upper-right corner.
3. In the Policy Management window, click the Alarm Policy Tag.
4. On the Alarm Policy Tag page, all built-in preset alarm policies are displayed. On this Tag page, you can enable/disable alarm policies, adjust their threat levels, modify their content, and perform other operations.
Enabling/Disabling Alarm Policies
On the Alarm Policy Tag page, select the target alarm policy. In the Policy Switch column, click the Switch to enable or disable the alarm policy.
Editing Alarm Policies
1. On the Alarm Policy Tag page, select the target alarm policy. In the Operations column, click Edit.
2. In the Edit Policy window, you can modify the threat level and policy content (excluding service accounts).
Alarm Allowlist Management
1. Log in to the CSC console. In the left navigation pane, click Data Security Situation Management > Database Risk Monitor.
2. On the Database Risk Monitoring page, click Policy Management in the upper-right corner.
3. In the Policy Management window, click the Alarm Allowlist Policy Tag.
4. On the Alarm Allowlist Policy Tag page, all added alarm allowlist policies are displayed.
5. On the Alarm Allowlist Policy Tag page, you can periodically view the allowlist, click "Edit" to modify rules, or "Delete" to remove expired / invalid rules.
Bantuan dan Dukungan
Apakah halaman ini membantu?
Anda juga dapat Menghubungi Penjualan atau Mengirimkan Tiket untuk meminta bantuan.
masukan