Security Center allows administrators to register fraud detection capabilities as extensions in DataWorks. These extensions function as fraud detection rules to detect risks in user operations. When a user performs an operation that a fraud detection rule monitors, the rule determines whether a risk exists. If the extension returns a "failed" or "warning" result, the system triggers a configured threat response. This topic describes how to configure fraud detection rules and their corresponding threat responses.
Background information
Security Center provides fraud detection and response capabilities through extensions. You can use official DataWorks extensions to manage high-risk behaviors or develop and deploy custom extensions on the DataWorks Open Platform to handle complex scenarios. These extensions function as fraud detection rules, extending your internal risk control platform to the DataWorks big data platform.
Limits
You can configure threat responses only for extensions that are Published and have the extension point type Data download pre-event - file generation. For more information about supported events and extension statuses, see List of supported extension point events and Publish and manage extensions.
Only the Approval and Blocking threat response methods are supported.
Only Resource Access Management (RAM) users with the AliyunDataWorksFullAccess policy and members with the DataWorks Tenant Administrator or Security Administrator role can create and manage fraud detection rules. For more information, see View the permissions of a RAM user and Manage the permissions of a RAM user.
Supported management events
Data download pre-event - file generation
Data upload pre-event
Go to the Fraud Detection rules page
Log on to the DataWorks console. In the target region, click in the left-side navigation pane. On the page that appears, click Go to Security Center.
In the navigation pane on the left, choose .
Configure a fraud detection rule
The Fraud Detection Rules page lists extensions grouped by action name. Each extension handles a specific type of management event. For each action, you can find the default Security Center extension. If the default extension does not meet your needs, you can develop a custom extension for your risk control requirements and register it on the Extensions page of the DataWorks Open Platform. If the extension handles an event type supported by Security Center, such as Data download pre-event - file generation, it is automatically added as a fraud detection rule.
Default fraud detection rules
For example, consider the Data download pre-event - file generation action. If you enable the default Security Center extension (Trigger Approval-specific Extension), all data download operations in all workspaces trigger an Approval response.
The default Security Center extension supports only approval rules that apply to all workspaces. This means that you must set the applicable scope to Global when you configure the extension check rule. For more information, see Create an approval policy.
Custom fraud detection rules
Click Create Extensions to go to the Extensions page of the Open Platform.
On the Extension page of the Open Platform, develop an extension. For more information, see Procedure.
You can register your existing local risk control logic as a fraud detection rule in DataWorks Security Center. You can also develop new risk control logic for your specific scenarios and register it as a DataWorks extension.
NoteCurrently, only extensions with the extension point type Data download pre-event - file generation are automatically added as fraud detection rules in Security Center. This means that when you register an extension, you must set the extension point to Data download pre-event - file generation.
Configure threat responses
In the Operation column, click Configure Response.
Configure the threat response.
Threat response rules support two policies: blocking and approval.
Block: If an extension returns a "failed" result, the operation is blocked by default. When an extension check returns a "failed" result, the threat response policy immediately blocks the user's operation. For example, if an extension check for a data download by User A returns "failed", the download is stopped.
Approval: If the extension returns a "warning" result and you have configured an approval response policy, the approval flow associated with the extension is automatically triggered.
NoteThe default extension in Security Center returns a "warning" status by default. You can configure an approval response policy for it.
Configure an approval policy.
Click
to add an approval policy. If a suitable policy does not exist, click Create an approval policy. For more information, see Extension approval policies.If the threat response is set to approval, a "warning" result from the extension check triggers the approval policy configured for that workspace.
For global extensions that apply to all workspaces, if a specific workspace does not have a configured response policy, the operation is allowed by default, and the flow is not blocked. For example, consider an enabled extension for the Data download pre-event - file generation action. All data download operations in any workspace are blocked until the extension returns a result. When the extension returns a "warning" status:
If the workspace where the download was triggered has a configured approval policy, the approval flow defined for that workspace is automatically triggered.
If the workspace where the download was triggered does not have a configured approval policy, the download proceeds as normal.
NoteFor approval policies, a lower priority value indicates a higher priority.
If an operation matches the applicable scope of multiple approval policies, the policy with the highest priority is used.