This document will introduce you how to view and operate the list of high-risk command events.
Background Information
Based on multi-dimensional and multi-method means, CWP can monitor commands in the system in real time, and classify the degree of danger of commands by configuring rules. If a high-risk command is detected, the system will provide you with real-time alarm notification.
Operation Steps
Alarm List
- Log in to the CWPP tenant-side console. In the left sidebar, select Intrusion Detection > High-risk Command to enter the alarm list tag page of high-risk commands.
- On the alarm list tag page of high-risk commands, you can view the high-risk command alarm list and perform related operations. On the alarm list interface, information such as the hostname/instance ID, IP address, hit policy type, hit policy, and threat level of the host with a high-risk command alarm can be shown. The list display fields can be customized.
- Filter: The high-risk command alert list supports selecting a date to view, supports querying events by keyword and tag (multiple keywords are separated by the vertical bar "|", and multiple filter tags are separated by the Enter key), and simultaneously supports filtering events by threat level and status.
- Customize list fields: Above the list of high-risk command events to set the list display field. After completing the selection, click OK to successfully set.
- Event list export: Above the high-risk command alert list to export the high-risk command alert list.
- Detailed information: Click Detailed Information to view high-risk command alarm details and process tree information.
- Mark as processed: It is recommended that you manually handle this alarm by referring to the "Repair Advice" in the alarm details. After handling, you can mark the alarm as processed.
- Add to allowlist: Create a release policy for the domain name of the current alarm. When the identical attack occurs again, no alarm will be triggered. Meanwhile, the current alarm status will change to "Added to allowlist".
- Create a blocking strategy: Create a blocking strategy for the domain name of the current alarm, and automatic interception will be performed when the identical attack occurs again.
- Ignore: Only ignore this alarm. If the same situation occurs again, an alarm will still be triggered.
- Delete a record: Delete this alarm record. The console will no longer display it. Deleted records cannot be restored. Proceed with caution.
Policy Configuration
Creating Custom Policy
The high-risk command feature supports creating custom policies to perform corresponding actions on threat commands by setting policies.
- Log in to the CWPP tenant console. Select Intrusion Detection > High-risk Commands in the left sidebar to enter the high-risk commands page.
- Select Policy Settings > Create a Policy to enter the create policy page.
- On the create policy page, fill in the basic information of the policy, including the Policy Name, policy description and enable status.
- Fill in the policy details, including selecting the blocklist/allowlist and the corresponding execution action, filling in the regular expression, selecting the threat level, and selecting the effective host range.
Blocklist rule: An alarm notification will be generated when a threat command is detected on a host.
Description
- The interception policy refers to automatically intercepting the execution of threat commands when a threat command is detected on the host and sending alarm notifications.
- The interception policy is only supported on flagship edition machines.
Allowlist rule: It refers to allowing threat commands to pass through, with no alarm reported or blocking behavior performed.
Description
- If all Ultimate Edition hosts are selected as the effective host range, newly-added Ultimate Edition hosts will automatically be included in the policy effective range.
- You can check to execute the operation of this policy rule for the historic "Pending" Alarms that comply with this policy rule.
- After the settings are completed, you can view them in the policy list. Policies applied to the blocklist in the list will be marked with the corresponding threat level.
- Policies in the policy list can be filtered, edited, and deleted.
- Filter: Configured policies support filtering by keyword and tag (multiple keywords are separated by the vertical bar "|", and multiple filter tags are separated by the Enter key). Filtering is supported by threat level (all/high risk/medium risk/low risk/none), by execution action (alarm/block/pass), and by effective status (effective/not applied).
- Customize list fields: Above the policy list to set the list display field. After completing the selection, click OK to successfully set.
- Enable status: The list supports setting the enable status of policies. In the enable status column, click Enable switch to determine whether to enable this policy.
- Edit: In the right operation column of the policy list, click Edit to proceed with editing the created policy.
- Delete: In the policy list, deletion of configured policies is supported.
System Policy
The high-risk command function adds new system auto interception rules. Once enabled, it supports automatically intercepting detected high-risk system commands. Partial content still requires you to manually configure policies.
- High-risk system commands: High-risk system commands accumulated by host security operation experts and algorithm experts. High-risk commands in this list can be automatically blocked.
- Interception principle explanation: For high-risk command auto-blocking, it uses the way of scanning and killing processes that hit the rules. For example, if process A attempts to create a "/bin/bash -i" process (assuming "bash -i" has been added to the blocklist), then this attempted "/bin/bash" process will be terminated (or creation failed), while process A itself will not be affected.
Note:
- If you detect a false positive blocking scenario, you can create a custom policy for allowlist processing.
- System auto interception rules are only for use on flagship edition hosts.