EncGuard Pro | 告警详情

Alert Detail

告警详情

sample-evt-025

模型预测与异常检测已拆分为 model_prediction 与 anomaly_result 两个解释区。

风险评分 88 high

Basic Info

基础信息

event_id: sample-evt-025
flow_id: sample-exfil-005
src_ip: 10.10.4.64
dst_ip: 198.51.100.81
protocol: tls
timestamp: 2026-01-01T23:20:00Z
风险等级: high
检测类型: data_exfiltration
detectors: rule_engine, attack_chain
source: main_project
chain_related: True

Risk Score

风险评分

final_risk_score: 88
severity: high
security_alert: True

Risk Formation

最终风险形成

rule_score: -
supervised_risk_score: -
calibrated_risk_score: -
anomaly_risk_score: -
final_risk_score: 88
fusion_policy: -
gate_formula: -

Weak Scenario Support

弱覆盖场景补强证据

该事件不属于弱覆盖场景，或无需额外补强说明。

Model Prediction

模型预测 model_prediction

当前事件没有模型推理结果，可能来自规则检测或攻击链分析。

该场景主要由规则、攻击链或异常检测补强，不应表述为当前模型可靠覆盖。

Anomaly Detection

异常检测 anomaly_result

anomaly_score: -
anomaly_risk_score: -
is_anomaly: False

Rule Hits

规则 evidence

data_exfiltration rule_engine · risk_score=88

Evidence

推荐处置 recommendation

TLS flow had 23.8 upload/download ratio
large outbound transfer occurred outside working hours

recommendation：Review endpoint process and validate destination authorization.

Attack Chain

攻击链关联 attack_chain

encrypted_session_to_large_upload chain_id=sample-chain-025 · risk_score=88

Safety Boundary

安全边界说明

EncGuard 不解密 SSH/TLS/HTTPS/SFTP/SCP payload。
当前检测依据为连接元数据、流量统计、规则 evidence、模型预测、异常检测和攻击链聚合。
post_bruteforce_action、encrypted_tunnel、data_exfiltration 主要由规则、攻击链或异常检测补强。

Raw Feature

原始特征详情

当前 flow_id 未匹配到特征详情。

Related Events

相关事件