About Alert Management

Reading time: About 3 minutes

Alerts play a key role in attack detection and response within Analysis & Logs. Alert Management focuses on security detection scenarios, centrally managing security-related alert rules and the historical events they trigger.

With this feature, you can flexibly adapt to your security monitoring needs: you can directly enable predefined rules that the security operations team has developed for different attack scenarios, or create custom alert rules to gain real-time awareness of abnormal business states. You can also review the alert history to understand and trace back attack activity.

How It Works

System-defined Rules and Custom Rules

System-defined rules: Developed by security operations experts, these continuously monitor all hostnames with protection enabled and log their alert history. You can choose whether to receive alert notifications, but you cannot edit or delete these rules. Currently, three types of system-defined alerts are supported:

Note: System-defined rules cannot be edited or deleted.

Custom rules: You can create custom alert rules based on your own business needs, covering scenarios such as L4 protection, L7 protection, and resource line failover. Depending on your monitoring goals, you can freely combine multi-dimensional detection conditions and configure flexible notification methods to meet your operations needs.

Alert Cycle

A complete alert cycle consists of three phases:

1. Trigger phase: An alert is generated once its conditions are met
2. Ongoing phase: Alert notifications continue to be sent while the conditions persist
3. Recovery phase: The alert is resolved once the conditions no longer apply