tencent cloud

Tencent Cloud Firewall

DocumentaçãoTencent Cloud FirewallOperation GuideNetwork Detection and ResponseConfiguration Traffic Collection Scope

Configuration Traffic Collection Scope

Download
Modo Foco
Tamanho da Fonte
Última atualização: 2026-07-08 16:53:19

Feature Overview

NDR supports customizing the traffic collection scope to ingest traffic from specified assets for NDR analysis.
Note:
Only CVM and container clusters support configuring the traffic collection scope.

Operation Steps

1. Log in to the CFW console, in the left sidebar, choose Network Detection and Response > Traffic Access.
2. On the Traffic Access page, click Traffic Collection Configuration.
3. On the Manage traffic collection scope page, click Create filter conditions to configure the traffic collection scope.
4. In the Create filter conditions dialog, fill in the basic information and rule configuration, click OK to save, and the traffic collection scope takes effect immediately.
Parameter Name
Parameter Description
Basic information
Name
Name of the traffic collection scope rule.
Application Assets
Select assets to which this rule applies from CVM assets and container cluster assets.
Rule Configuration
Priority
Assigned automatically based on policy type and cannot be edited manually. The priority for the exclusion policy is 0, for the collection policy is 1, and for the system fallback exclusion policy is 2. A smaller number indicates a higher priority.
Protocol
Supports TCP, UDP, and ICMP protocols. Selecting ALL means all are supported.
Access source
Only CIDR format is supported, for example: 10.0.0.0/16.
Source Port
The port range is 0~65535, and the following formats are supported:
All ports: -1/-1.
Single port: for example, 22.
Port range: for example, 80~88.
Multiple ports: for example, 22/80.
Access Destination
Only CIDR format is supported, for example: 10.0.0.0/16.
Destination port
The port range is 0~65535, and the following formats are supported:
All ports: -1/-1.
Single port: for example, 22.
Port range: for example, 80~88.
Multiple ports: for example, 22/80.
Policy
The rule supports two policy types: collection and exclusion.
collect: Traffic that matches the policy is ingested into NDR for analysis.
exclude: Traffic that matches the policy is excluded from NDR analysis.
Note:
The system automatically provides a fallback exclude rule, which cannot be deleted or edited.
A maximum of 5 rule configurations are supported. The system's fallback exclusion rule is not counted towards the quota.
5. After the rule is saved, you can check whether the collection scope rule has taken effect in the CVM and container cluster asset list on the Network Detection and Response > Traffic Access page.
When no traffic collection scope is configured, the scope is displayed as Full Collection, and all inbound and outbound mirrored traffic is collected.
When a traffic collection scope is configured, the configured Traffic Collection Scope Rule Name is displayed. Traffic matches rules based on policy type priority. Click Rule Name to view details of the specific filter conditions.


Anterior: Encrypted Traffic DetectionPróximo: Network Detection and Response Capability

Ajuda e Suporte

Esta página foi útil?

comentários