Alarm Overview
Download
Focus Mode
Font Size
The Alarm Center is the unified intrusion detection portal of CSC, centrally displaying and handling host and container security alarms. It supports multiple types of intrusion detection and the AI-Link Intelligent Chain Engine (multi-behavior combination attacks), covers the complete workflow from alarm viewing, analysis, and investigation to response, and centrally manages multiple accounts.
Prerequisites
Before using the Alarm Center, confirm that you have purchased a protection license, installed the client on target assets and bound the license (see the following table for feature differences between license editions), and configured notification channels as needed.
Feature | Free Edition | Professional | Ultimate Edition |
Intrusion Detection | Password Cracking and Abnormal Login Detection | All intrusion detection + AI interpretation | All intrusion detection + AI interpretation |
Response and Disposal | Manual Handling + Add to Allowlist | Automatic interception/isolation by preset rules + add to allowlist | Automatic interception/isolation by preset rules + add to allowlist + custom blacklist |
Depth Investigation | - | AI interpretation | Event investigation and tracing + AI interpretation |
Usage Steps
Alarm detection depends on the following prerequisite configurations:
Configuration Item | Function | Entry |
Log Collection | The log collection scope determines the richness of log information, helping improve traceability efficiency. | Client Management > Enhanced Log Collection |
Log Storage | Log storage supports backtracking and in-depth analysis. | Log Analysis > Log Configuration |
Protection Configuration | If the switch is disabled, no alarm is generated for the corresponding scenario. | Alarm Center > Policy Management > Protection Configuration |
Rule Management | System/custom rules affect hit results. | Alarm Center > Policy Management > Rule Management |
Notification Configuration | Notification modules, levels/types, asset scopes, and notification time settings |
Note:
The system provides default configurations, which you can adjust as needed to strengthen detection and defense.
After the policy configuration is completed, the system automatically starts detection. When a rule is matched, an alarm is generated and sent through the configured channel.
Rule matching: Collected logs are matched against system built-in rules, custom rules, and built-in engines.
Alarm generation: After a rule is matched, an alarm is automatically generated and displayed in the Alarm Center list.
Notification push: Notifications are pushed to relevant personnel in real time through configured notification channels.
After receiving an alarm, Ops personnel need to analyze the threat and handle it.
Threat analysis: View alarm details and perform initial analysis based on the alarm summary, intelligence analysis, and alarm source location. The system determines the alarm severity based on key hit AI interpretation, process chain tracing, and ATT&CK phase mapping.
Depth investigation: Restore the attack chain and identify the impact scope through AI interpretation, raw log analysis, and host-based depth tracing.
Response closure: Perform response actions such as ignore, add to allowlist, isolate, depth scan and kill, and delete.
After the response is completed, continuously optimize the rules based on actual results:
False positive allowlisting: Add the rule or match item corresponding to the alarm to the allowlist.
False negative blocklisting: Adjust rule thresholds or add newly discovered threats to the blocklist.
Rule tuning: Locate the rule that generated the alarm based on the alarm source information and optimize it.
How to Determine Handling Priority
The priority of an alarm is determined by four types of attributes: alarm type, threat level, ATT&CK stage, and detection mode (rule confidence).
Alarm Type
Alarms can be divided into groups such as files and processes, logins and accounts, and host behaviors based on attack stages. The corresponding alarm subtypes and primary response methods for each group are as follows.
Category | Alarm Subtype | Definition | Recommended Action |
Files and processes | File Scan and Kill - Malicious File | Landed samples such as trojans/viruses/web shells Note: Recognizable virus types include: Backdoor, DDoS, Downloader, Hacktool, Trojan, MalScript, Malware, Miner, Proxytool, Ransomware, WebShell, Rootkit, Exploit, Worm, Macro, PasswordStealer, and more. | Isolate/Deep scan/Delete |
| File Scan and Kill - Malicious Process | Process activities related to malicious programs (including abnormal processes) | Terminate Process/Depth Scan |
Login and account | Unusual Login | Uncommon IPs/users/login locations/times | Depth scan/Enable QR code login |
| Password Cracking | Brute-force cracking of SSH/RDP | Automatic blocking/Depth scan/Enable QR code login |
Host behavior | High-Risk Command | High-Risk Command Execution | Interception |
| Local Privilege Escalation | Abnormal privilege escalation | Change the execution action to interception. |
Network behavior | Malicious Request | Malicious outbound connections/callbacks | Interception |
| Reverse shell | Reverse Shell connection | Interception |
| Network Attack | Malicious traffic, attempted attacks, and similar activities | Perform manual analysis; application protection can be enabled. |
Combined attack | Multi-behavior Attack | AI-Link correlated temporal attack chain | Perform depth scan or mitigation as needed after analysis (such as IP address blocking). |
Threat Level
The threat level indicates the severity of the security event corresponding to the alarm. The response recommendations are as follows:
Level/Icon | Meaning | Typical Scenario | Recommended Action |
 | Has a significant impact on assets and may lead to severe events such as data corruption, service interruption, or malicious resource occupation. | Ransomware or mining program running | Handle Immediately. |
 | High-risk security event with significant risk. | Malicious file dropped, password cracked successfully | Prioritize Handling. |
 | Medium-risk event that requires attention and handling. | High-Risk Command Execution | Analyze Promptly. |
 | Low-risk event that can be handled within the planned time. | Port scanning and probing, similar to Ops behavior | Handle as Planned. |
 | Potential risk or informational event. Rules can be optimized periodically based on alarms. | Auditing, Ops observation of custom new rules, and weak signal detection during important period guarantee | Attention can be reduced in daily scenarios; attention should be maintained during important period guarantee. |
Detection Mode
It represents the confidence level of the matched rule and is used to assist in determining the response priority. The response recommendations are as follows:
Mode | Meaning | Typical Scenario | Recommended Action |
Precise | High-confidence attack fingerprints/behaviors, with highly reliable malicious conclusions upon matching. | Routine security operations and analysis of confirmed intrusion events | Prioritize handling as an intrusion event. |
Balanced | Moderately suspicious behavior with potential attack intent. | Conduct routine security operations and capture medium-risk suspicious activities. | Verify with assets and context. |
Deep | Behavior is highly suspicious, and some behaviors may also be close to normal Ops. | Screen for potential risk clues during major event assurance and high-security-level special inspections. | Verify with the business context to avoid incorrect handling. |
Note:
The three detection modes correspond to the rule modes in the AI-Link engine (Precise/Balanced/Depth):
In the AI-Link engine configuration under Protection Configuration, select a rule mode to enable the rules in that detection mode.
If no rule mode is selected, the rules in the corresponding detection mode do not take effect, and no new alarm records for that mode will be generated in the alarm list.
ATT&CK Stage
ATT&CK is a widely used attack behavior classification framework in the industry. A later stage indicates that the attack has advanced further and caused greater harm. To help you determine the response priority, three response recommendations are provided below based on urgency.
Recommended Action | Description | Involved Stage |
Handle Immediately. | The attacker has achieved their objective or is causing damage, so immediate response is required. | Data Theft (TA0010) Attackers exfiltrate collected data to external locations. Impact (TA0040) Attackers damage or tamper with systems or data. |
Focus | The attack has entered the system and is advancing deeper. Timely handling can block the subsequent attack chain. | Initial Access (TA0001) Entry points that attackers attempt to use to access the system, such as vulnerability exploitation, phishing, and supply chain attacks. Code Execution (TA0002) Attackers execute malicious code on the system, such as running commands or scripts. Persistence (TA0003) Attackers maintain access to the system and do not lose permissions even after a restart or credential change. Permission Escalation (TA0004) Attackers obtain higher permissions and escalate from a standard user to an administrator or Root. Defense Evasion (TA0005) Attackers evade detection by disabling security software, hiding their activities, or using other methods. Credential Access (TA0006) Attackers steal credentials such as account passwords and keys. Lateral Movement (TA0008) Attackers move laterally from compromised machines to other machines. Data Collection (TA0009) Attackers collect sensitive data and prepare to exfiltrate it. Command and Control (TA0011) Attackers establish C&C channels with compromised machines and issue commands. |
General Attention | The attacker has not yet entered the system. This is a pre-attack reconnaissance and preparation signal, which requires attention but with relatively low priority. | Reconnaissance (TA0043) Attackers scan and collect information about the target before intrusion. Resource Development (TA0042) Attackers prepare resources for attacks, such as registering malicious domains and building C2 infrastructure. Environment Reconnaissance (TA0007) Attackers probe the system environment to learn about the network topology, installed software, and other details. Unknown Stage Unclassified Attack Behavior |
Help and Support
Was this page helpful?
You can also Contact sales or Submit a Ticket for help.
Help us improve! Rate your documentation experience in 5 mins.
Feedback