View anomaly alerts
The anomaly alert feature uses built-in and custom detection models to detect and generate alerts for anomalous operations on sensitive data. This topic describes how to manage these models and process anomaly events.
Prerequisites
Security audit is enabled. For more information, see Enable security audit.
View anomaly alerts for a single instance
Log on to the ApsaraDB Security Center console.
On the Security Center page, click Anomaly Alerts.
On the Anomaly Alerts page, view anomaly events for sensitive data.
Click the Data Flow Anomaly, Behavior Anomaly, or Custom Anomaly tab to view statistics for each type of anomaly event.
In the Actions column for the target anomaly event, click View Details. In the Anomaly Event Details pane, you can view basic information, object information, event description, and processing history.
In the Actions column for the target anomaly event, click Process.
In the Risk Alert pane, handle the alert by following the suggested solution.
Configure the following parameters:
Event Verification Result
Confirm as Anomaly and Processed: Select this option to confirm the event as an anomaly. You must then find the anomaly's source and resolve it in the corresponding cloud product. If a confirmed anomaly is not resolved, DAS will continue to generate alerts for it.
Add to Whitelist: Select this option if the event is a normal operation that requires no action. After you add an event to the whitelist, DAS stops generating similar alerts.
Processing Record: Enter notes about how you handled the anomaly alert. Optionally, select the Strengthen detection for this leakage risk after selection checkbox. If you select this option, DAS adds the anomaly event to the false-positive sample repository to optimize the accuracy of future detections.
Click Export above the anomaly event list to export the listed events.
View anomaly alerts for all instances
If you have enabled the security audit feature for multiple database instances, you can view all their anomaly alerts in one place.
Log on to the ApsaraDB Security Center console.
On the Security Center page, click Anomaly Alerts.
On the Anomaly Alerts page, view anomaly events for sensitive data.
Click the Data Flow Anomaly, Behavior Anomaly, or Custom Anomaly tab to view statistics for each type of anomaly event.
In the Actions column for the target anomaly event, click View Details. In the Anomaly Event Details pane, you can view basic information, object information, event description, and processing history.
In the Actions column for the target anomaly event, click Process.
In the Risk Alert pane, handle the alert by following the suggested solution.
Configure the following parameters:
Event Verification Result
Confirm as Anomaly and Processed: Select this option to confirm the event as an anomaly. You must then find the anomaly's source and resolve it in the corresponding cloud product. If a confirmed anomaly is not resolved, DAS will continue to generate alerts for it.
Add to Whitelist: Select this option if the event is a normal operation that requires no action. After you add an event to the whitelist, DAS stops generating similar alerts.
Processing Record: Enter notes about how you handled the anomaly alert. Optionally, select the Strengthen detection for this leakage risk after selection checkbox. If you select this option, DAS adds the anomaly event to the false-positive sample repository to optimize the accuracy of future detections.
Click Export above the anomaly event list to export the listed events.
Risk levels
Each alert has a risk level based on the sensitivity level of the matched file.
| Event type | Risk level | Condition |
|---|---|---|
| Abnormal flow | High | Highest sensitivity level of matched file is S3 or above |
| Abnormal flow | Medium | Highest sensitivity level of matched file is S1 or S2 |
| Abnormal flow | Low | Highest sensitivity level of matched file is N/A |
| Abnormal behavior | Medium | Highest sensitivity level of matched file is S2 or above |
| Abnormal behavior | Low | Highest sensitivity level of matched file is S1 or lower |
| Custom exceptions | Configured by you | Determined by your model configuration |
Related documentation
By default, Security Center enables all built-in anomaly detection models. You can disable any models that you do not need. You can also create custom detection models by specifying criteria such as the accessed database, table, field, access source, or instance. For more information, see Configure alert rules.