Core File Monitoring

The monitoring rules of core file monitoring are divided into system rules and custom rules. The system rules are rule configurations accumulated through multi-models by host security operation experts and algorithm experts, which are applicable to most tamper monitoring requirements for user configuration. You can also customize rules according to business needs. Custom rules support editing, copying and deleting.

Note:

• Core file monitoring is a feature of CWP Ultimate Edition.
• Core file monitoring currently supports operating systems with a Linux kernel version of 3.10 or higher.

Create Rule

1. Log in to the tenant-side console of CWPP. In the left sidebar, select Intrusion defense > Core file monitoring.
2. On the Monitoring rule configuration page, click Add Rule in the upper left corner. A new rule popup pops up on the right.
3. In the Add Rule pop-up window, sequentially configure basic setting, rule content settings and effective server range parameter.

   • Basic setting

        Field Description:
     

     • Rule Name: Custom name.
     • Threat level: You can choose high risk, medium risk, low risk or none according to actual needs.
     • Enable status: Enable or disable this new rule.

   • Rule content settings: click Add Rule, and you can add multiple rows, with a maximum of 20 rows.

     Field Description:

     • Monitoring behavior: modify files/read files.
     • Process file path: the path to process file that initiates the file tampering action. For example, for the program /usr/bin/vi, the corresponding rule can be */vi.
     • File path: for example, /etc/cron.d/attack. The corresponding rule can be /etc/cron.d/*.
     • Execution action: Alarm refers to generating an automatic alarm event for file system changes and recording event details; Allow operation refers to performing an allow operation on file system change events and recording event details.

       Note:

       When the alert bypass process path and the accessed file match, and there is an overlap in the effective servers, no alarm will be generated for the overlapping part of the servers (i.e., the release conditions take precedence).

   • Effective host range: You can select all servers or selected servers according to actual needs.

4. After the configuration is complete, click Save just.

Manage Rules

Edit Rule

1. The newly added rules are shown in Core File Monitoring > Monitoring Rule Configuration. The operation list supports Copy, Edit, and Delete.

   Note:

   Once deleted, the rule cannot be restored. Proceed with caution.

Alarm List

The alarm list supports viewing core file anomaly alert records. Alarm records can be processed (marked as processed, added to allowlist, ignored), or deleted.

Handling Alarm Records

1. Log in to the tenant console of CWPP. In the left sidebar, select Intrusion Defense > Core File Monitoring.
2. On the Alarm List page, select the required alarm record, click Handle, and select Mark as Processed, Add to Allowlist, Ignore, or Delete Record. Field Descriptions:
   • Mark as processed: Manually handle the alarm and mark the alarm as processed after handling.
   • Add to allowlist: Add the current file path to the allowlist. Subsequently, no alarm will be reported for corresponding read/modify actions. Proceed with caution.
   • Ignore: Only ignore this alarm. If the same situation occurs again, an alarm will still be triggered.
   • Delete a record: Delete this alarm record. The console will no longer display it. Deleted records cannot be restored. Proceed with caution.

Deleting Alarm Records

1. On the Alarm List page, you can delete alarm records individually or in batches.
   • Each: Select the required alarm record, click Delete, and a confirm deletion dialog box pops up.
   • Batch: Select one or more alarm records, click Delete in the upper left corner, and a confirm deletion dialog box pops up.
2. In the confirm deletion dialog box, click OK to delete the selected alarm record.

   Note:

   Deleted alarm records will no longer be displayed on the console. Deleted records cannot be restored. Proceed with caution.