The alarm list supports viewing alarm records of core file anomalies, enabling users to process (mark as processed, add to allowlist, or ignore) these alarm records and to delete these alarm records.
Note:
Currently, core file monitoring is only available on Linux operating systems with kernel version 3.10 and later.
Processing Alarm Records
1. Log in to the CWPP console. In the left sidebar, choose Cyber Defense > CoreFile Monitor > Alert list. 2. On the alarm list page, choose the required alarm record, click Process, and choose Mark as processed, Add to allowlist, Ignore, or Delete the record.
Field Description:
Mark as Processed: You can manually process the alarm, and after that, it can be marked as processed.
Add to Allowlist: Add the current file path to the allowlist. Subsequent read/modification actions will not trigger alarms. Proceed with caution.
Ignore: Only ignore this alarm. If the same situation occurs again, an alarm will still be triggered.
Delete the Record: Delete the alarm record. It will no longer be displayed on the console and cannot be recovered. Proceed with caution.
3. In the Secondary Confirmation dialog box, click Confirm to process the alarm record.
4. The alarm list also supports batch processing of alarm records. After choosing one or more alarm records, click Mark as processed or Ignore in the upper left corner. After a secondary confirmation, the chosen alarm records can be processed.
Deleting Alarm Records
1. On the alarm list page, you can delete alarm records individually or in batch. Single: Choose the required alarm record, and click Process > Delete. A deletion confirmation dialog box will pop up.
Batch: Choose one or more alarm records, and click Delete in the upper left corner. A deletion confirmation dialog box will pop up.
2. In the deletion confirmation dialog box, click Confirm to delete the chosen alarm records.
Note:
Once the chosen alarm records are deleted, they will no longer be displayed in the console and cannot be recovered. Proceed with caution.
Was this page helpful?