An alarm processing method, device, apparatus and medium

Abstract

The application discloses an alarm processing method and device, equipment and medium, and belongs to the technical field of network security. The method comprises the following steps: performing alarm disposal on a received alarm task; when a first trigger instruction is received, all alarm tasks received by a target monitoring platform are classified and displayed on a first page; when a second trigger instruction is received, alarm disposal process information of a target alarm task is displayed on a second page; wherein the target alarm task is any one of the alarm tasks received by the target monitoring platform. Through the method, a user can intuitively and centrally view all alarm tasks on the target monitoring platform and the detailed disposal process of each alarm task in the first page and the second page of the target monitoring platform, so that the user can more conveniently monitor and manage the alarm tasks on the target monitoring platform, and thus the user experience of the user in processing the alarm tasks can be further improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to an alarm processing method, apparatus, device, and medium. Background Technology

[0002] In practical applications, in order to ensure the normal and stable operation of the enterprise network communication environment, a monitoring platform is usually used to monitor the enterprise's network communication environment, which will generate a large number of alarm tasks in the monitoring platform.

[0003] In existing technologies, these alarm tasks are distributed across dozens of pages on the monitoring platform. This makes it impossible for users to effectively monitor and manage the alarm tasks generated by the platform, significantly reducing the user experience when processing alarm tasks. Currently, there is no effective solution to this technical problem.

[0004] Therefore, how to further improve the user experience when handling alarm tasks is a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] In view of this, the purpose of this invention is to provide an alarm processing method, apparatus, device, and medium to further improve the user experience when processing alarm tasks. The specific solution is as follows:

[0006] An alarm handling method, applied to a target monitoring platform, includes:

[0007] Perform alarm processing on received alarm tasks;

[0008] When the first trigger command is received, all alarm tasks received by the target monitoring platform are categorized and displayed on the first page.

[0009] When the second trigger command is received, the alarm handling process information of the target alarm task is displayed on the second page; wherein, the target alarm task is any alarm task received by the target monitoring platform.

[0010] Preferably, the process of handling the received alarm task includes:

[0011] The received alarm tasks shall be handled manually and / or by work orders and / or by response plans and / or by security policies and / or by system defense policies.

[0012] Preferably, the process of classifying and displaying all alarm tasks received by the target monitoring platform on the first page includes:

[0013] On the first page, all alarm tasks received by the target monitoring platform are displayed according to the alarm handling process and / or the handling result evaluation process.

[0014] Preferably, the process of displaying the alarm handling process information of the target alarm task on the second page includes:

[0015] The second page displays the alarm information, alarm change records, alarm handling methods, and alarm handling quality of the target alarm task.

[0016] Preferably, the process of displaying the alarm information, alarm change records, alarm handling methods, and alarm handling quality of the target alarm task on the second page includes:

[0017] If the target alarm task is handled by the response plan, the alarm handling method of the target alarm task will be displayed on the second page according to the ID of the response plan;

[0018] If the target alarm task is handled by a security policy, the target alarm handling method corresponding to the security policy is queried in the preset policy storage table according to the ID of the security policy, and the target alarm handling method is displayed on the second page.

[0019] If the target alarm task is handled by the system's defense strategy, the alarm handling method for the target alarm task will be displayed on the second page according to the source IP and / or destination IP of the target alarm task.

[0020] Preferably, after the process of displaying the alarm information, alarm change records, alarm handling methods, and alarm handling quality of the target alarm task on the second page, the method further includes:

[0021] The alarm handling quality of the target alarm task is evaluated to obtain the target evaluation result;

[0022] The handling method for the target alarm task is optimized using the target evaluation results.

[0023] Preferably, the process of evaluating the alarm handling quality of the target alarm task includes:

[0024] The alarm handling quality of the target alarm task is evaluated based on the alarm handling efficiency and / or alarm suppression effect and / or alarm response time of the target alarm task.

[0025] Accordingly, the present invention also discloses an alarm processing device applied to a target monitoring platform, comprising:

[0026] The alarm handling module is used to handle received alarm tasks.

[0027] The categorized display module is used to categorize and display all alarm tasks received by the target monitoring platform on the first page when the first trigger command is received.

[0028] The information display module is used to display the alarm handling process information of the target alarm task on the second page when the second trigger command is received; wherein, the target alarm task is any alarm task received by the target monitoring platform.

[0029] Accordingly, the present invention also discloses an alarm processing device, comprising:

[0030] Memory, used to store computer programs;

[0031] A processor, used to implement the steps of an alarm processing method as disclosed above when executing the computer program.

[0032] Accordingly, the present invention also discloses a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of an alarm processing method as disclosed above.

[0033] As can be seen, in the alarm processing method provided by this invention, when the target monitoring platform receives an alarm task, it first processes the received alarm task; and when the target monitoring platform receives a first trigger instruction, it will centrally categorize and display all received alarm tasks on the first page; simultaneously, when the target monitoring platform receives a second trigger instruction, it will display detailed alarm processing information for the target alarm task on the second page; wherein, the target alarm task is any alarm task received by the target monitoring platform. Compared with the prior art, this method can categorize and display all received alarm tasks on the first page of the target monitoring platform and display the detailed alarm processing flow for the target alarm task on the second page. This allows users to intuitively and centrally view all alarm tasks on the target monitoring platform and the detailed processing flow for each alarm task on both the first and second pages of the target monitoring platform. Therefore, users can more quickly and effectively monitor and manage alarm tasks based on the alarm information presented on the first and second pages of the target monitoring platform. Thus, this method can further improve the user experience when processing alarm tasks. Correspondingly, the alarm processing device, equipment, and medium provided by the present invention also have the above-mentioned beneficial effects. Attached Figure Description

[0034] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0035] Figure 1 A flowchart of an alarm processing method provided in an embodiment of the present invention;

[0036] Figure 2 This is a structural diagram of an alarm processing device provided in an embodiment of the present invention;

[0037] Figure 3 This is a structural diagram of an alarm processing device provided in an embodiment of the present invention. Detailed Implementation

[0038] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0039] Please see Figure 1 , Figure 1 A flowchart of an alarm processing method provided in an embodiment of the present invention is shown, the method comprising:

[0040] Step S11: Process the received alarm tasks;

[0041] Step S12: When the first trigger command is received, all alarm tasks received by the target monitoring platform are categorized and displayed on the first page;

[0042] Step S13: When the second trigger command is received, the alarm handling process information of the target alarm task is displayed on the second page; wherein, the target alarm task is any alarm task received by the target monitoring platform.

[0043] This embodiment provides an alarm processing method that can further improve the user experience when managing alarm tasks. This alarm processing method is described with the target monitoring platform as the executing entity.

[0044] Specifically, when the target monitoring platform receives an alarm task, its first step is to process the received alarm task. The alarm tasks received by the target monitoring platform include: traffic alarms, hacker attack alarms, security protection alarms, and asset attack alarms, etc. During this process, if the target monitoring platform receives a first trigger command from the user, it will centrally display all received alarm tasks categorized on the first page.

[0045] When the target monitoring platform categorizes and displays all received alarm tasks on the first page, it can do so by alarm time, alarm severity, alarm duration, or a user-defined method. The specific categorization is not limited here, as long as users can intuitively view all received alarm tasks on the first page.

[0046] When the target monitoring platform receives a second trigger command from the user, it will display detailed alarm handling information for the target alarm task on the second page. A target alarm task refers to any alarm task received by the target monitoring platform. In other words, users can intuitively view the detailed alarm handling process of a target alarm task on the second page of the target monitoring platform, including the alarm time, handling method, handling time, and suppression effect.

[0047] It is conceivable that when users can intuitively and centrally view all alarm tasks on the target monitoring platform and the detailed handling process of each alarm task on the first and second pages of the target monitoring platform, users can monitor and manage alarm tasks on the target monitoring platform more quickly and effectively, thereby further improving the user experience when handling alarm tasks.

[0048] As can be seen, in the alarm handling method provided in this embodiment, when the target monitoring platform receives an alarm task, it first processes the received alarm task; and when the target monitoring platform receives a first trigger instruction, it will centrally categorize and display all received alarm tasks on the first page; simultaneously, when the target monitoring platform receives a second trigger instruction, it will display detailed alarm handling process information for the target alarm task on the second page; wherein, the target alarm task is any alarm task received by the target monitoring platform. Compared with the prior art, this method can categorize and display all received alarm tasks on the first page of the target monitoring platform and display the detailed alarm handling process for the target alarm task on the second page. This allows users to intuitively and centrally view all alarm tasks on the target monitoring platform and the detailed handling process for each alarm task on both the first and second pages of the target monitoring platform. Therefore, users can more quickly and effectively monitor and manage alarm tasks based on the alarm information presented on the first and second pages of the target monitoring platform. Thus, this method can further improve the user experience when processing alarm tasks.

[0049] Based on the above embodiments, this embodiment further explains and optimizes the technical solution. As a preferred implementation, the above step: the process of handling the received alarm task, includes:

[0050] The received alarm tasks shall be handled manually and / or by work orders and / or by response plans and / or by security policies and / or by system defense policies.

[0051] In practical applications, the target monitoring platform can use various processing methods to handle the alarm tasks it receives, such as manual handling, work order handling, response plan handling, security policy handling, and system defense policy handling, etc.

[0052] The process can be categorized into three types: manual handling, system defense, and system defense. Manual handling refers to the target monitoring platform assigning received alarm tasks to designated personnel for manual processing. Work order handling involves the target monitoring platform generating work orders for received alarm tasks and assigning them to appropriate personnel. Emergency response plan handling involves the target monitoring platform handling alarm tasks according to preset processing procedures. Security policy handling involves the target monitoring platform matching alarm types against pre-defined search criteria and then searching for corresponding security handling strategies based on the matching results. System defense policy handling involves the target monitoring platform configuring appropriate collaborative defense strategies according to user needs, matching the alarm task type against the user-defined collaborative defense strategies, and then handling the alarm task based on the matching results. In actual operation, the target monitoring platform primarily uses security devices to block alarm tasks.

[0053] Clearly, the technical solution provided in this embodiment can improve the diversity and flexibility of the target monitoring platform in handling alarm tasks.

[0054] Based on the above embodiments, this embodiment further explains and optimizes the technical solution. As a preferred implementation, the above steps: the process of classifying and displaying all alarm tasks received by the target monitoring platform on the first page includes:

[0055] The first page displays all alarm tasks received by the target monitoring platform according to the alarm handling process and / or the assessment process of the handling results.

[0056] In this embodiment, when classifying and displaying the alarm tasks received by the target monitoring platform on the first page of the target monitoring platform, the display can be based on the alarm handling process and / or the handling result evaluation process.

[0057] Specifically, in practical applications, the `alarmstatus` field can be used to categorize and display processed, processing, and unprocessed alarm tasks on the target monitoring platform's first page. Then, the `assess` field can be used to categorize and display the evaluation progress of each alarm task's processing result on the target monitoring platform's first page. More specifically, the `assessstory` field can be used to categorize and display evaluated and unevaluated alarm tasks on the target monitoring platform's first page, and the `assessresult` field can be used to categorize and display valid and invalid alarm tasks on the target monitoring platform's first page.

[0058] Obviously, the technical solution provided in this embodiment can display the alarm tasks received by the target monitoring platform in a more detailed manner on the first page of the target monitoring platform.

[0059] Based on the above embodiments, this embodiment further explains and optimizes the technical solution. As a preferred implementation, the above steps: the process of displaying the alarm handling process information of the target alarm task on the second page includes:

[0060] The second page displays the alarm information, alarm change records, alarm handling methods, and alarm handling quality of the target alarm task.

[0061] In this embodiment, in order to display the alarm handling process information of the target alarm task in more detail on the second page of the target monitoring platform, the alarm information, alarm change records, alarm handling methods and alarm handling quality of the target alarm task are displayed on the second page.

[0062] Specifically, when displaying the alarm information of the target alarm task on the second page, other alarm tasks originating from the same IP (Internet Protocol) as the target alarm task can also be displayed on the second page in the form of a trend chart. This allows you to determine the changing trend of attacks originating from a certain source IP address, and you can also visually see from the trend chart whether the trend of asset attacks is decreasing. At the same time, you can also see the suppression effect of the target monitoring platform on the target alarm task.

[0063] When displaying alarm change records for target alarm tasks on the second page, alarm tag fields can be used to mark these changes. That is, when an alarm record for a target alarm task changes, the target monitoring platform adds a corresponding handling field to the target alarm task. For example: {"disposetime": "2022-07-20 09:00:00", "alarmstatus", "processing", "disposeuser": "system"}, {"disposetime": "2022-07-20 10:00:00", "alarmstatus", "processing", "disposeuser": "user1"}. This alarm handling mode will display the following information on the second page: User 1 modified the target alarm task's completion time to: 2022-07-20 10:00:00, and the system modified the target alarm task's completion time to: 2022-07-20 09:00:00.

[0064] The second page displays the alarm handling methods for target alarm tasks, specifically showing whether the target alarm task is handled manually, via work order, through a response plan, by security policy, or by system defense policy. This approach allows staff to clearly understand how to handle target alarm tasks.

[0065] The second page can also display the alarm handling quality of the target alarm task. That is, the second page can also show the suppression effect of the target monitoring platform on the target alarm task and determine whether the target monitoring platform's handling result of the target alarm task is invalid or effective.

[0066] Obviously, the technical solution provided in this embodiment can display the alarm handling process information of the target alarm task in more detail on the second page of the target monitoring platform, and enable users to effectively track the handling process of the target alarm task.

[0067] As a preferred implementation, the above steps, including the process of displaying the alarm information, alarm change records, alarm handling methods, and alarm handling quality of the target alarm task on the second page, include:

[0068] If the target alarm task is handled by the response plan, the alarm handling method of the target alarm task will be displayed on the second page according to the ID of the response plan.

[0069] If the target alarm task is handled by a security policy, the target alarm handling method corresponding to the security policy will be queried in the preset policy storage table according to the security policy ID, and the target alarm handling method will be displayed on the second page.

[0070] If the target alarm task is handled by the system's defense policy, the alarm handling method for the target alarm task will be displayed on the second page based on the source IP and / or destination IP of the target alarm task.

[0071] In this embodiment, when displaying the alarm handling method of the target alarm task on the second page of the target monitoring platform, the alarm handling method of the target alarm task can be displayed through the tag mapping information corresponding to the target alarm task.

[0072] For example: when a target alarm task is handled by a response plan, the target monitoring platform can display detailed response plan information for the target alarm task using the unique ID (Identity Document) corresponding to the response plan; similarly, when a target alarm task is handled by a work order, the target monitoring platform can display the work order information for the target alarm task using the unique ID corresponding to the work order; when a target alarm task is handled by a security policy, the target monitoring platform can query the target alarm method corresponding to the security policy in the preset policy storage table using the security policy ID, and then display the target alarm handling method corresponding to the target alarm task on the second page; when a target alarm task is handled by a system defense policy, the target monitoring platform can reverse query the system defense policy that meets the conditions using the source IP and / or destination IP of the target alarm task, and then display the alarm handling method corresponding to the target alarm task on the second page.

[0073] Obviously, the technical solution provided in this embodiment can clearly and in detail display the alarm handling method corresponding to the target alarm task on the second page of the target monitoring platform.

[0074] As a preferred implementation, the above steps, after displaying the alarm information, alarm change records, alarm handling methods, and alarm handling quality of the target alarm task on the second page, further include:

[0075] The quality of alarm handling for target alarm tasks is evaluated to obtain target evaluation results;

[0076] The handling methods for target alarm tasks are optimized based on the target evaluation results.

[0077] Understandably, by assessing the quality of alarm handling for target alarm tasks, one can relatively accurately determine whether the alarm handling methods for target alarm tasks are reasonable and whether there is room for further improvement and optimization of the alarm handling methods for target alarm tasks.

[0078] Therefore, when the alarm handling quality of the target alarm task is displayed on the second page of the target monitoring platform, the alarm handling quality of the target alarm task can also be evaluated to obtain the target evaluation result. Then, the target evaluation result can be used to optimize the handling method of the target alarm task. That is, by adjusting and improving the alarm handling method of the target alarm task based on the target evaluation result, the alarm handling method of the target alarm task can be made more reasonable and effective.

[0079] Clearly, the technical solution provided in this embodiment can further improve the accuracy and reliability of the target alarm task alarm handling method.

[0080] As a preferred implementation, the above step: the process of evaluating the alarm handling quality of the target alarm task, includes:

[0081] The alarm handling quality of the target alarm task is evaluated based on the alarm handling efficiency and / or alarm suppression effect and / or alarm response time.

[0082] In practical applications, the quality of handling target alarm tasks can be evaluated based on their alarm handling efficiency, alarm suppression effect, and alarm response time. This allows us to determine whether the alarm handling method of the target alarm task is effective and whether it has achieved the effect of suppressing the target alarm task by the target monitoring platform.

[0083] Specifically, the alarm handling efficiency, alarm suppression effect, and alarm response time of an alarm task can be used as three evaluation indicators. Appropriate weighting coefficients can be assigned to these three indicators to calculate the alarm handling quality of the alarm task. Then, the alarm handling quality of the alarm task can be evaluated based on the alarm handling quality data. Alternatively, in practice, other user-defined indicators can be used to quantify and evaluate the alarm handling quality of the target alarm task; these will not be elaborated upon here.

[0084] Clearly, the technical solution provided in this embodiment can more accurately evaluate the quality of alarm handling for target alarm tasks.

[0085] Please see Figure 2 , Figure 2 This is a structural diagram of an alarm processing device provided in an embodiment of the present invention. The device includes:

[0086] The alarm handling module 21 is used to handle the received alarm tasks.

[0087] The classification display module 22 is used to classify and display all alarm tasks received by the target monitoring platform on the first page when the first trigger command is received.

[0088] The information display module 23 is used to display the alarm handling process information of the target alarm task on the second page when the second trigger command is received; wherein, the target alarm task is any alarm task received by the target monitoring platform.

[0089] Preferably, the alarm handling module 21 includes:

[0090] The alarm handling unit is used to manually handle received alarm tasks and / or process work orders and / or respond to contingency plans and / or process security policies and / or process system defense policies.

[0091] Preferably, the category display module 22 includes:

[0092] The classification display unit is used to display all alarm tasks received by the target monitoring platform on the first page according to the alarm handling process and / or the handling result evaluation process.

[0093] Preferably, the information display module 23 includes:

[0094] The information display submodule is used to display the alarm information, alarm change records, alarm handling methods, and alarm handling quality of the target alarm task on the second page.

[0095] Preferably, the information display submodule includes:

[0096] The first display unit is used to display the alarm handling method of the target alarm task on the second page according to the ID of the response plan if the target alarm task is handled by the response plan.

[0097] The second display unit is used to query the target alarm handling method corresponding to the security policy in the preset policy storage table according to the ID of the security policy when the target alarm task is handled by the security policy, and display the target alarm handling method on the second page.

[0098] The third display unit is used to display the alarm handling method of the target alarm task on the second page according to the source IP and / or destination IP of the target alarm task if the target alarm task is handled by the system defense strategy.

[0099] Preferred options also include:

[0100] The result evaluation module is used to evaluate the alarm handling quality of the target alarm task after the process of displaying the alarm information, alarm change records, alarm handling methods and alarm handling quality of the target alarm task on the second page, and obtain the target evaluation result.

[0101] The method optimization module is used to optimize the handling method of the target alarm task based on the target evaluation results.

[0102] Preferably, the result evaluation module includes:

[0103] The result evaluation unit is used to evaluate the alarm handling quality of the target alarm task based on the alarm handling efficiency and / or alarm suppression effect and / or alarm response time of the target alarm task.

[0104] The alarm processing apparatus provided in this embodiment of the invention has the beneficial effects of the aforementioned alarm processing method.

[0105] Please see Figure 3 , Figure 3 This is a structural diagram of an alarm processing device provided in an embodiment of the present invention. The device includes:

[0106] Memory 31 is used to store computer programs;

[0107] The processor 32 is configured to implement, when executing a computer program, the steps of an alarm handling method as disclosed above.

[0108] The alarm processing device provided in this embodiment of the invention has the beneficial effects of the alarm processing method disclosed above.

[0109] Accordingly, embodiments of the present invention also disclose a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of an alarm processing method as disclosed above.

[0110] The computer-readable storage medium provided in this embodiment of the invention has the beneficial effects of the alarm processing method disclosed above.

[0111] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0112] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0113] The above provides a detailed description of an alarm processing method, apparatus, device, and medium provided by the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. An alarm processing method, characterized in that, Applied to target monitoring platforms, including: Perform alarm processing on received alarm tasks; When the first trigger command is received, all alarm tasks received by the target monitoring platform are categorized and displayed on the first page. When the second trigger command is received, the alarm handling process information of the target alarm task is displayed on the second page; wherein, the target alarm task is any alarm task received by the target monitoring platform. The process of displaying the alarm handling process information for the target alarm task on the second page includes: The second page displays the alarm information, alarm change records, alarm handling methods, and alarm handling quality of the target alarm task; The process of displaying the alarm information, alarm change records, alarm handling methods, and alarm handling quality of the target alarm task on the second page includes: If the target alarm task is handled by the response plan, the alarm handling method of the target alarm task will be displayed on the second page according to the ID of the response plan; If the target alarm task is handled by a security policy, the target alarm handling method corresponding to the security policy is queried in the preset policy storage table according to the ID of the security policy, and the target alarm handling method is displayed on the second page. If the target alarm task is handled by the system's defense strategy, the alarm handling method for the target alarm task will be displayed on the second page according to the source IP and / or destination IP of the target alarm task.

2. The alarm processing method according to claim 1, characterized in that, The process of handling received alarm tasks includes: The received alarm tasks shall be handled manually and / or by work orders and / or by response plans and / or by security policies and / or by system defense policies.

3. The alarm processing method according to claim 1, characterized in that, The process of classifying and displaying all alarm tasks received by the target monitoring platform on the first page includes: On the first page, all alarm tasks received by the target monitoring platform are displayed according to the alarm handling process and / or the handling result evaluation process.

4. The alarm processing method according to claim 1, characterized in that, After the process of displaying the alarm information, alarm change records, alarm handling methods, and alarm handling quality of the target alarm task on the second page, it also includes: The alarm handling quality of the target alarm task is evaluated to obtain the target evaluation result; The handling method for the target alarm task is optimized using the target evaluation results.

5. The alarm processing method according to claim 4, characterized in that, The process of evaluating the alarm handling quality of the target alarm task includes: The alarm handling quality of the target alarm task is evaluated based on the alarm handling efficiency and / or alarm suppression effect and / or alarm response time of the target alarm task.

6. An alarm processing device, characterized in that, Applied to target monitoring platforms, including: The alarm handling module is used to handle received alarm tasks. The categorized display module is used to categorize and display all alarm tasks received by the target monitoring platform on the first page when the first trigger command is received. The information display module is used to display the alarm handling process information of the target alarm task on the second page when the second trigger command is received; wherein, the target alarm task is any alarm task received by the target monitoring platform. The information display module includes an information display sub-module, which is used to display the alarm information, alarm change records, alarm handling methods and alarm handling quality of the target alarm task on the second page; The information display submodule includes: The first display unit is used to display the alarm handling method of the target alarm task on the second page according to the ID of the response plan if the target alarm task is handled by the response plan. The second display unit is used to query the target alarm handling method corresponding to the security policy in the preset policy storage table according to the ID of the security policy when the target alarm task is handled by the security policy, and display the target alarm handling method on the second page. The third display unit is used to display the alarm handling method of the target alarm task on the second page according to the source IP and / or destination IP of the target alarm task if the target alarm task is handled by the system defense strategy.

7. An alarm processing device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of an alarm processing method as described in any one of claims 1 to 5 when executing the computer program.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of an alarm processing method as described in any one of claims 1 to 5.

Images