Managing the Alarm Whitelist¶
You can configure the alarm whitelist to reduce false alarms. Events can be deleted from the whitelist.
Whitelisted events will not trigger alarms.
On the Alarms page, you can add falsely reported alarms to the alarm whitelist. After an alarm is added to the whitelist, HSS will not generate alarms on it.
Adding Events to the Alarm Whitelist¶
Method | Description |
|---|---|
Add to alarm whitelist | Choose to add the alarm to the whitelist when handling it. The following types of events can be added to the alarm whitelist:
|
Checking the Alarm Whitelist¶
Perform the following steps to check the alarm whitelist:
Log in to the management console.
Click
in the upper left corner of the page, select a region, and choose Security > Host Security Service. The HSS page is displayed.In the navigation pane on the left, choose Intrusion Detection > Whitelists.
Click the Alarm Whitelist tab to view the whitelist. For more information, see Table 2.
Table 2 Parameter description¶ Parameter Name
Description
Alarm Type
Name of the alarm whitelist type.
Whitelist Field
Whitelisted file field
Wildcard
Logic used by a whitelisted rule, which can be Equals or Contains.
Whitelist Rule
Whitelisted rule ID
Description
Description of the target whitelist.
Added
Time when an alarm is added to the whitelist.
Enterprise Project
Enterprise project
Removing an Alarm from the Whitelist¶
To remove an alarm from the whitelist, select it and click Delete.
Note
Exercise caution when performing this operation. Whitelisted alarms cannot be restored after removal, and will be reported once triggered.
After an alarm is deleted from the whitelist, the handling status of the events associated with the alarm is not updated. To change the status, choose Intrusion Detection > Alarms, click Handle in the Operation column of an event, and select Remove from whitelist.