EncGuard Pro | 告警详情

Alert Detail

告警详情

sample-evt-023

模型预测与异常检测已拆分为 model_prediction 与 anomaly_result 两个解释区。

风险评分 89 high

Basic Info

基础信息

event_id: sample-evt-023
flow_id: sample-exfil-003
src_ip: 10.10.4.62
dst_ip: 203.0.113.82
protocol: scp
timestamp: 2026-01-01T23:10:00Z
风险等级: high
检测类型: data_exfiltration
detectors: rule_engine, attack_chain
source: main_project
chain_related: True

Risk Score

风险评分

final_risk_score: 89
severity: high
security_alert: True

Risk Formation

最终风险形成

rule_score: -
supervised_risk_score: -
calibrated_risk_score: -
anomaly_risk_score: -
final_risk_score: 89
fusion_policy: -
gate_formula: -

Weak Scenario Support

弱覆盖场景补强证据

该事件不属于弱覆盖场景，或无需额外补强说明。

Model Prediction

模型预测 model_prediction

当前事件没有模型推理结果，可能来自规则检测或攻击链分析。

该场景主要由规则、攻击链或异常检测补强，不应表述为当前模型可靠覆盖。

Anomaly Detection

异常检测 anomaly_result

anomaly_score: -
anomaly_risk_score: -
is_anomaly: False

Rule Hits

规则 evidence

data_exfiltration rule_engine · risk_score=89

Evidence

推荐处置 recommendation

SCP transfer had a 28.39 upload/download ratio
unknown destination received 65 MB over encrypted SSH-based protocol

recommendation：Validate file transfer ticket and destination ownership.

Attack Chain

攻击链关联 attack_chain

encrypted_session_to_large_upload chain_id=sample-chain-023 · risk_score=89

Safety Boundary

安全边界说明

EncGuard 不解密 SSH/TLS/HTTPS/SFTP/SCP payload。
当前检测依据为连接元数据、流量统计、规则 evidence、模型预测、异常检测和攻击链聚合。
post_bruteforce_action、encrypted_tunnel、data_exfiltration 主要由规则、攻击链或异常检测补强。

Raw Feature

原始特征详情

当前 flow_id 未匹配到特征详情。

Related Events

相关事件