All Products
Search

This Product

    Security Center:Approved logon management

    Document Center

    Security Center:Approved logon management

    Last Updated:Sep 20, 2026

    The logon management feature of Security Center is a key component for ensuring system security and protecting user data. This topic describes how to effectively manage common logon information and how to view and handle unusual logon alerts.

    Manage common logon information

    You can configure common logon locations, common logon IP addresses, common logon times, and common logon accounts. Security Center generates alerts for logons outside the specified ranges. You can configure common logon information by following these steps.

    Note

    There is no explicit limit on the number of common logon IP addresses. You can configure multiple IP addresses one by one as needed. If you need to configure a large number of IP addresses (such as hundreds), we recommend that you configure IP ranges (in CIDR format) for batch configuration to reduce the number of rules and facilitate subsequent management.

    1. Log on to Security Center console.

    2. In the left-side navigation pane, choose Protection Configuration > Host Protection > Rule Management. In the upper-left corner of the console, select the region where the asset to be protected is located: Chinese Mainland or Outside Chinese Mainland.

    3. On the Host-specific Rule Management page, click the Common Logon Management tab.

    4. On the Common Logon Management tab, manage Approved Logon Location, Approved Logon IP Address, Approved Logon Time, and Approved Logon Account.

      The configuration steps for Approved Logon Location, Approved Logon IP Address, Approved Logon Time, and Approved Logon Account are basically the same. The following example describes how to manage Approved Logon Location. For other rules, follow the same steps as those for Common Logon Location.

      1. On the Approved Logon Location tab, click Create Policy.

      2. In the Approved Logon Location panel, select one or more regions as common logon locations, select the servers to which the rule applies, and click OK to complete the configuration.

    5. Security Center allows you to edit and delete added common logon locations.

      • Click Edit next to the target common logon location to modify the servers to which the logon location applies.

      • Click Delete next to the target common logon location to delete the common logon location configuration.

      • Security Center allows you to add notes to common logon IP addresses. On the Approved Logon IP Address tab, click the Edit icon icon in the Note column of the target IP address to add a description.

    View and handle unusual logon alerts

    View alerts

    • You can view and handle unusual logon alerts on the Alert page, on the CWPP tab, by setting the alert type to Unusual Logon. For more information, see Evaluate and handle security alerts.

    • You can also click Details in the Actions column to view detailed information about the alert risk item.

    Handling instructions

    • IP location accuracy

      • Default accuracy: The IP address location in an Unusual Logon alert is accurate only to the province or state level, such as Guangdong.

      • Limitation: City-level location is not directly supported.

    • How to query detailed location

      To obtain city-level location and carrier information, follow these steps:

      1. Record the IP address: On the alert details page, copy the public IP address of the logon source.

      2. Query by using a third-party service: Use a third-party IP lookup service, such as ipip.net, to query the detailed location and carrier of the IP address.

    • Subsequent handling recommendations

      Take the corresponding security measures based on the query result:

      • Scenario A: Confirmed as a normal logon source

        • Action: Select the alert on the Security Alerts page and add it to the whitelist.

        • Effect: The IP address or CIDR block is added to the trusted list to prevent duplicate alerts.

      • Scenario B: Location does not match expectations (suspicious unauthorized access)

        • Risk: Possible brute-force or unauthorized access risks.

        • Action: Tighten the security group rules of the server.

        • Configuration: For remote management ports (Windows: 3389 / Linux: 22), restrict the source to trusted IP addresses or CIDR blocks only, and deny all other IP addresses.

    FAQ

    • No unusual logon alert is received after common logon rules are configured?

      If you have configured common logon location, common logon IP address, common logon time, or common logon account rules, but no alert is received for a logon outside the specified range, troubleshoot the issue as follows:

      1. Confirm that the rule is in effect: On the Host-specific Rule Management page, on the Common Logon Management tab, check whether the corresponding rule exists and is in normal state.

      2. Confirm that the servers covered by the rule are correct: Each common logon rule must specify the servers to which it applies. Check whether the server on which the unusual logon occurred is included in the rule scope.

      3. Confirm that alert notifications are enabled: Check whether the unusual logon alert notification is enabled in the security alert settings, and whether the notification methods (SMS, email, DingTalk, etc.) are correctly configured. For more information, see the relevant documentation about security alert settings.

      4. View logon logs: In the Security Center console, view logon logs on the Logon Audit or related page to confirm whether the unusual logon behavior is recorded.

    • How do I handle common logon configurations after changing the public IP address of a server?

      After you change the public IP address of a server, the existing common logon IP rules may no longer apply. Meanwhile, logon records from the old IP address before the change may still trigger unusual logon alerts, because Security Center determines unusual logons based on historical logon behavior. Handle the issue as follows:

      1. Update common logon IP addresses: On the Common Logon Management tab, on the Approved Logon IP Address sub-tab, delete the old IP configuration and add the new public IP address.

      2. Ignore old IP alerts: If the unusual logon alert occurs before the IP address change and is triggered by historical logon behavior, you can ignore the alert on the Security Alerts page.

      3. Synchronize the latest asset information: After the IP address change, we recommend that you synchronize asset information in the Asset Center to ensure that the IP addresses of servers recorded by Security Center are up to date.