Security Center:Handle security events

Prerequisites

• The threat analysis and response feature is purchased and enabled. For more information about the threat analysis and response feature, see Overview.

• Logs of cloud services are added to the threat analysis and response feature. For more information, see Add logs of cloud services.

• A detection rule used to detect alerts and analyze logs is created. For more information, see Use detection rules.

View the details of a security event

1. Log on to the Security Center console. In the top navigation bar, select the region of the asset that you want to protect. You can select China or Outside China.

2. In the left-side navigation pane, choose Threat Analysis and Response > Security Event Handling.

3. On the Security Event Handling page, specify a time range for the Occurred Within parameter to view the security events within the specified time range.

   You can filter security events based on the risk level, status, name, and ID of security events, and the asset ID. The risk levels are High Risk, Medium Risk, Low Risk, and the states are Unhandled, Handling, Failed, and Handled.

   

4. On the Security Event Handling page, find the security event whose details you want to view and click Details in the Actions column.

   You can determine the priority of handling a security event based on its risk level. The following table describes the risk levels of security events.

   Risk levels of security events

   Risk level	Description
   High Risk	If a high-risk event is generated, malicious behavior or objects are detected on your assets. A high-risk event is probably a successful intrusion event. We recommend that you check and handle the event at the earliest opportunity. Example: Suspicious process - Reverse shell.
   Medium Risk	If a medium-risk event is generated, suspicious malicious behavior or objects are detected on your assets. A medium-risk event may be a successful intrusion event. The event may also be triggered by unusual O&M behavior. Example: Unusual logon. A medium-risk event indicates that your assets have a certain probability of being attacked. We recommend that you view the details of the event and check whether risks exist. If risks exist, handle the risks.
   Low Risk	If a low-risk event is generated, a successful intrusion may have been performed, or your assets are under continuous external scans and attacks. Example: Access from 106.11.XX.XX. If you have high security requirements for your assets, pay attention to low-risk events.

5. On the event details page, view the information about the security event on different tabs. The following table describes the tabs.

   Tab	Description
   Incident Information	This tab displays information such as the Alibaba Cloud account to which the security event belongs, the risk level, description, and occurrence time of the event, and the assets that are affected by the event. To view the information about an affected asset, find the asset in the Affected Assets section and move the pointer over Details in the Actions column. In the tooltip that appears, view the asset information such as the asset name, the public and private IP addresses, and the operating system.
   Attack Timeline	This tab displays the timeline of alerts that are aggregated into the event. You can view the development process of the event on this tab. This helps you handle and prevent such events. You can click an alert icon to view the information about the alert.
   Alert	This tab displays the alerts that are aggregated into the event. To view the information about an alert and the associated exceptions of the alert, find the alert and click Details in the Actions column.
   Incident Source Tracing	This tab displays the event tracing diagram and the preview of original data. The event source tracing feature processes, aggregates, and visualizes logs from various cloud services by using a big data analytics engine. Then, the feature generates an event tracing diagram based on the analysis result. This helps you identify the causes of events and configure event handling policies at the earliest opportunity. To view information about a node, click the node in the diagram. To download the event tracing diagram displayed on the current page, specify the tracing image style, and view the node legend, click the , , and Legend icons in the upper-right corner of the Incident Source Tracing tab. Note The event source tracing feature supports security events that meet all the following conditions: The alerts that are aggregated into the events are reported by Security Center. The event tracing diagrams can be reproduced from the contextual logs of entities involved in the alerts that are aggregated into the events. Entities include IP addresses, processes, files, file paths, logon events, and attack payloads.

Handle security events

To reinforce the security of your system, we recommend that you handle security events that are detected by the threat analysis and response feature at the earliest opportunity. We also recommend that you handle High Risk security events at the earliest opportunity. You can manually handle security events or initiate automatic event handling.

• Manually handle security events: You can review and handle security events based on the risk levels of the events and business scenarios. This method is suitable for complex security events and new types of unknown threats that you need to identify and handle by using professional knowledge.

• Initiate automatic event handling: The system automatically handles security events based on the configured playbooks and rules. For example, the system quarantines infected hosts or blocks suspicious IP addresses. This method is suitable for security events that are known and well-defined, and low-complexity threats that you need to handle quickly. For example, the system can automatically handle large amounts of similar low-risk alerts.

What to do next

View the disposal center

You can centrally view event handling details in the disposal center supported by the threat analysis and response feature. The disposal center displays event handling policies and tasks from the handling entity dimension, and allows you to manage the policies and tasks.

A handling policy describes the details of scenario-specific event handling for a handling entity. A handling task describes the details of scope-specific event handling. A scenario is a playbook, and a scope is a cloud account to which the handled event belongs.

Handling policies

A handling policy describes the event handling details of an entity for which an alert is generated. The entity can be an IP address, file, or process. You can view a handling policy to obtain the entity, scenario, and scope of a security event.

Data sources for handling policies:

• The result when you manually handle an event on the Security Event Handling page. For more information, see Handle security events.

• The result of an automated execution of an SOAR playbook. For more information, see Use SOAR.

To view the information about handling policies, you can choose Threat Analysis and Response > Disposal Center in the left-side navigation pane. Then, click the Handling Policies tab.

• In the Entity Object/Characteristic column, you can click an entity to view the context, Alibaba Cloud threat intelligence, and related alerts of the entity.

• In the Associated Source column, you can click the source of a handling policy to view the alerts, events, or playbooks that are related to the handling policy.

• In the Actions column, you can click View Task. On the Handling Tasks page, you can view the information about the tasks that are related to the handling policy.

Handling tasks

You can view a handling task to obtain the malicious entities that are detected and the event handling status of related cloud services. For example, you can view the status of malicious IP addresses that are blocked by Cloud Firewall. You can check whether the IP addresses are being blocked, fail to be blocked, fail to be unblocked, or are blocked.

To view the information about handling tasks, you can choose Threat Analysis and Response > Disposal Center in the left-side navigation pane. Then, click the Handling Tasks tab.

• If the handling policy that is associated with a handling task is updated or the handling task fails to be run, you can click Retry in the Actions column to run the task again.

• After a task is run, if a cloud service blocks the IP address of the entity and you confirm that the block action is not required, you can click Unblock in the Actions column to unblock the IP address.

View alerts

After the alert logs of Security Center, Web Application Firewall (WAF), and Cloud Firewall are added to the threat analysis and response feature, you can view the raw data of the alerts in real time. This way, you can manage cross-platform alerts in a centralized manner. This simplifies the monitoring process of security logs and improves the efficiency of security O&M. This also improves security and optimizes the response mechanism.

1. In the left-side navigation pane, choose Threat Analysis and Response > Alert.

   Note

   If the Alerts page of Security Center is displayed, you can click Global Security Alerts in the upper-right corner to switch to the Alert page of the threat analysis and response feature.

2. Optional. On the Alert page, configure filter conditions.

   You can select data sources of alerts from the Cloud Service drop-down list, such as Aliyun Cloud Firewall, Aliyun Cloud Security Center, Aliyun Siem, and Aliyun Web Application Firewall.

   Note

   If you select Aliyun Siem, you can view the alerts that are generated based on the predefined and custom detection rules.

3. Find the alert whose information you want to view and click Details in the Actions column.

   The information includes Affected Asset, Occurrence Time, Data Source, Account Receiving Alert, and Associated Exception.

References

• For security events that are defined or threats that require quick handling, you can use SOAR of the threat analysis and response feature to implement automated security response based on configured rules and playbooks in collaboration with multiple cloud services. For more information, see Use SOAR.

• You can call API operations to query information about security event handling and handle security events. For more information about the supported API operations, see Event Response.