Alert Management
Download
Focus Mode
Font Size
Where Did the Alarm Information for Security Baseline Go?
The number following an alarm type indicates the number of unhandled alarms in the current list (for BOT attacks, it shows the total number of alarms). If the corresponding security baseline alarm switch is not enabled, the console will not display the security baseline option.
Why Is Blocking Followed by Banning?
The Intrusion Defense feature detects network attacks based on sessions. It only blocks all access operations from an IP address when that IP address is blocked (added to the blocklist).
How to Modify After an Operation on an Event is Performed
Log in to the CFW console and go to the Intrusion Defense module. You can then delete entries from the Blocklist or Allowlist.=
How to View the Threat Profile of an IP Address
In the security event alarm, you can refer to the threat profile viewing described in Viewing and Handling of Alarm Events.
In the Block and Intercept Statistics, you can directly click the IP address to navigate.
What Does the Red Exclamation Mark Next to an IP Address Mean?
This IP address may belong to a Tencent Cloud CDN. We do not recommend that you manually block or ban it. If you have enabled the Intrusion Defense blocking mode, CFW automatically blocks attack traffic originating from this address. Normal traffic will be allowed, so you can rest assured.
How Often Is Alarm Center Data Updated?
The Alarm Center data is updated every 10 minutes.
What Operations Are Required After CFW is Purchased to Generate Traffic Trend Charts in Alarm Center?
1. On the Firewall Toggle page, select the corresponding instance, choose Firewall Toggle > OK to enable the firewall.
2. After you enable the Firewall Toggle, the Access Control of CFW defaults to the Allow All mode, and the Intrusion Defense defaults to the Observe mode. Therefore, there is no impact on your business system.
Why Is No Data Displayed in the Blocking Statistics of Alarm Center?
1. Please confirm whether you have enabled the corresponding Firewall Toggle and set the Block or Intercept mode.
2. Select All Policies under the Block Statistics to check whether the corresponding events are visible.
3. If you still cannot see the corresponding events, please contact us for further verification. Thank you for your understanding and support.
Can Bandwidth Alarms Still Be Received When Root Account and Sub-Account Are Not Selected as Alarm Objects in Alarm Center?
If you do not select the root account and sub-account to receive alarms, SMS and in-site message notifications from the Alarm Center will not be sent. However, alarms will still be displayed on the console.
Help and Support
Was this page helpful?
You can also Contact sales or Submit a Ticket for help.
Help us improve! Rate your documentation experience in 5 mins.
Feedback