Threat Analysis and Response provides predefined detection rules that analyze alert logs to identify attack chains and generate security events. You can enable or disable predefined rules or create custom rules as needed.
Multi-account management overview
If you log on to the Security Center console as a global account administrator in a multi-account scenario, switch views on the Detection Rules page before configuring rules or datasets:
Current Account View: Rules and datasets apply only to log data from the current account.
Global Account View: Rules and datasets apply to log data from all Alibaba Cloud accounts managed by Threat Analysis and Response.
For more information, see Multi-account management.
Configure detection rules
Detection rules define policies for analyzing log data from cloud products. You specify the log scope, matching fields, aggregation fields, and other parameters to control how logs are analyzed to identify security risks. Threat Analysis and Response supports predefined and custom rules.
Enable or disable predefined rules
Security Center provides predefined rules for detecting alerts and events, such as abnormal process behavior, successful web attacks, malicious domain requests, suspicious logons, abnormal network traffic, malicious network requests, and abnormal web behavior. You can view, enable, or disable predefined rules, but you cannot edit or delete them.
Log on to the Security Center console.
In the navigation pane on the left, choose . In the upper-left corner of the console, select the region where your assets reside: Chinese Mainland or Outside Chinese Mainland.
On the Predefined tab, view the list of predefined rules.
(Optional) In the Actions column of a predefined rule, click Details to view its basic information, logic, and event generation settings.
Click the switch in the Rule Status column of a predefined rule to enable or disable it.
Create a custom rule
If predefined rules do not meet your requirements, you can create a custom rule.
Log on to the Security Center console.
In the navigation pane on the left, choose . In the upper-left corner of the console, select the region where your assets reside: Chinese Mainland or Outside Chinese Mainland.
On the Custom tab, click Create Rule.
On the Create Rule page, configure the rule information.
Parameter
Description
Basic Information
Set basic information for the custom rule.
Rule Name: Enter a name for the custom rule.
Rule Description: Enter a description to clarify the rule's purpose.
Threat Level: Select the risk level for alerts or events detected by this rule from the drop-down list. For more information about risk levels, see Security events.
Threat Type: Select the threat type defined by this rule from the drop-down list. For more information about alert types, see Overview of CWPP (Cloud Workload Protection Platform) security alerts.
Rule Logic Settings
Set aggregation rules for security alerts.
Log Scope: Select the log category and log type for the custom rule.
Security Center lists available log types based on connected cloud products.
Match Field: Select fields and field values to match alerts or events. Security Center provides available fields based on your selected log scope.
Click Add Field to add fields to a group. Fields within a group use an AND relationship.
Click Add Field Group to add field groups. Field groups use an OR relationship.
Aggregation Field: Select fields for event aggregation.
Maximum Logs: Set the threshold condition for triggering an alert based on log fields.
Statistical Period: Set the time window for alert aggregation.
Security Center aggregates logs of the selected type within this period based on the aggregation fields.
Incident Generation Settings
Specify whether alerts detected by this rule are converted into events.
Select Yes to convert matching alerts into events. Choose one of the following event generation methods:
Use Built-in Incident Aggregation Rule: Alerts matching this rule are aggregated into predefined events (events generated by predefined rules).
Aggregate Each Alert to Incident: Each alert generates a separate event.
Aggregate All Rule-triggered Alerts into Incident: All alerts matching this rule are aggregated into a single event.
If you select this option, set the Execution Cycle for alert aggregation. The maximum period is 24 hours.
(Optional) Click Test and select a test method to verify the rule.
The following test methods are available:
Simulation Data: Write an SQL statement to test matching data. Refer to the simulated data value examples when writing the statement. After entering the values, click Test.
Business Data: Use real production data to test the rule. Click Test to view a line chart of alert and event counts, along with lists of alerts and events.
Tests run for 7 days by default. You can click Publish or End Test to stop the test early. Clicking Publish activates the rule immediately. Clicking End Test returns you to the rule management page by using the
icon. Security Center creates the rule in a disabled state.If you skip the test, confirm that the rule is correctly configured on the Create Rule page and then click Publish.
To save the rule without publishing it, click Save as Draft.
After creating a custom rule, you can view, test, enable, disable, edit, or delete it on the Detection Rules page.
Manage datasets
Datasets let you centrally manage data objects such as IP blacklists and whitelists, core asset lists, or custom threat intelligence Indicators of Compromise (IOCs). A dataset is a two-dimensional table that stores custom data for reuse in detection rules and response playbooks.
Create a dataset
In the navigation pane on the left, choose . In the upper-left corner of the console, select the region where your assets reside: Chinese Mainland or Outside Chinese Mainland.
Click the Dataset tab, and then click Add Dataset to open the Add Dataset panel.
In the Dataset section, click Download File Template to download the template to your computer. Fill out and save the template.
Note the following:
Specify the primary key when uploading the template. The primary key is used to search for and match log data. Primary key fields cannot be empty or contain duplicate values.
If the primary key column of the uploaded dataset contains duplicate values, the system automatically removes the duplicates.
The uploaded file template must not exceed 3 MB.
The file template must contain no more than 5,000 dataset records.
The value of a dataset field in the file template cannot exceed 200 bytes.
Return to the Add Dataset panel. Enter a name and description, upload the dataset file, specify the primary key, and click Next.
The system validates the dataset fields. If errors are found, modify the fields as prompted.
On the Verify and Create tab, confirm that the uploaded dataset is correct and then click OK.
What to do next
You can reference datasets in detection rules or response playbooks. For more information, see Security events and Response rules.
The Referenced column in the dataset list shows how many rules and playbooks reference a dataset.
Additional operations
To modify a dataset, click Edit in the Actions column of the dataset list.
To batch-update a dataset, edit the dataset file template on your computer, click Batch Update in the Actions column, and re-upload the template.
To delete a dataset, click Delete in the Actions column.
NoteYou cannot delete datasets that are referenced by detection rules or playbooks.
Custom rule examples
The following examples show how to configure custom rules for typical threat scenarios.
SQL injection attack (union-based injection)
Scanner IPs attacking WAF
Java process executing suspicious sensitive commands
Host brute-force attack
Host connecting to mining domains
Sudden surge in HTTP access requests
References
Review and handle security events generated by Threat Analysis and Response. For more information, see Security events.
Use the Log Management feature to browse and query log data across multi-resource environments. For more information, see Log search.
Call API operations to query rule lists, update custom rule status, or delete custom rules. For more information, see Rule management.