Managed Security Service (MSS) provides dashboards on its Overview page that display key metrics and threat trends derived from security service processes and results. These dashboards help you understand the current threat status of your network, view responses from security services, and monitor the business value that MSS provides. By monitoring and handling security risks in your network, MSS helps ensure your business continuity and security. This topic describes the data metrics on the Overview page.
Log on to the Managed Security Service console. By default, the Overview page is displayed.
(Optional) In the upper-left corner of the Overview page, you can filter the data by time range and alert source.
By default, statistics for the last 30 days are displayed. You can filter the data by Last 7 Days, Last 6 Months, Last 1 Year, or a custom time range.
If you have activated security products, such as Security Center, Web Application Firewall (WAF), Cloud Firewall, and Anti-DDoS, MSS integrates the threat data from these products to help you monitor and handle all alerts. From the alert source drop-down list, you can select a source to filter the alerts.
By default, the Auto Refresh feature is enabled to automatically update the page data every 5 minutes. You can manually enable or disable this feature in the upper-right corner of the Overview page.
On the Overview page, you can view the service statistics.
The Overview page contains various modules, such as security service statistics, security protection coverage, and an alert handling overview. For more information, see the following table.
Module
Description
Security service data statistics
(Marked as ① in the figure)
Displays MSS statistics to help you understand the response status of security services.
Service Responses: The total number of service ticket responses within the selected time range and the year-over-year growth rate.
Average Response Time: The average time taken to resolve each alert, from generation to resolution, within the selected time range.
Closed-loop Risk Rate: The percentage of alerts that were closed within the selected time range. Issue Closure Rate = (Number of closed alerts ÷ Total number of alerts) × 100%.
Ticket Responses: The total number of alerts that are generated within the selected time range.
Unhandled Risks: The total number of unremediated system and application vulnerabilities within the selected time range.
Handled Risks: The total number of vulnerabilities fixed within the selected time range, including system and application vulnerabilities.
Risk Convergence Rate: The percentage of vulnerabilities fixed within the selected time range. This value is calculated using the following formula: (Number of fixed vulnerabilities ÷ Total number of vulnerabilities) × 100%.
Managed Security Service: Displays the service expiration date and the number of days remaining. If the service is about to expire, click Renew Now and follow the prompts to complete the renewal.
Protection Coverage (Indicated by ② in the figure)
Displays the protection status of cloud assets in your Alibaba Cloud account across different dimensions. This helps you understand the security status of your cloud assets and identify unprotected assets.
WAF Protection Coverage: The coverage of cloud assets protected by WAF and its year-over-year growth rate.
WAF Protection Coverage = (Number of assets protected by WAF ÷ Total number of assets that can be protected by WAF in the current Alibaba Cloud account) × 100%.
ECS Protection Coverage: The percentage of ECS assets protected by Security Center and its year-over-year growth rate.
ECS Protection Coverage = (Number of ECS assets protected by Security Center ÷ Total number of ECS assets in the current Alibaba Cloud account) × 100%.
EIP Protection Coverage: The percentage of EIPs protected by Cloud Firewall and the year-over-year growth rate of the coverage.
EIP Protection Coverage = (Number of EIPs protected by Cloud Firewall ÷ Total number of EIPs in the current Alibaba Cloud account) × 100%.
Alert Handling Overview (Indicated by ③ in the figure)
Displays the percentage of security alerts in different states (Handled, Unhandled, and In Progress), and the growth rate of the total number of alerts compared with the same period in the previous year.
Alert Handling Rate = Number of handled alerts ÷ (Number of handled alerts + Number of unhandled alerts + Number of in-progress alerts) × 100%.
Alert Trend (Indicated by ④ in the figure)
The line chart on the left shows the trend in the total number of generated alerts and the number of converged alerts.
The list on the right shows the top 10 alert types with the largest number of handled alerts.
Trend of Network Attack Events: This section is marked as ⑤ in the figure.
Displays the trend in the total number of alerts triggered by different sources. Alert sources include Anti-DDoS, WAF, and Cloud Firewall.
Trend of Affected Attacked Assets (⑥ in the figure)
Displays the trend in the number of ECS assets that triggered alerts.
Trend of Vulnerability Risk Convergence
(Item ⑦ in the figure)
Displays the trends in the number of generated vulnerabilities and the number of fixed vulnerabilities. Vulnerability types include system vulnerabilities and application vulnerabilities.
Trend of Compliance Risk Convergence (⑧ in the figure)
Displays the trends in the number of generated baseline risks and the number of fixed baseline risks.