对警报线程池的警报线程_为什么警报疲劳仍然会威胁数据库性能

落日映苍穹つ 2022-12-07 13:17 220阅读 0赞

![d37c03d8bc5ff515c9ade4c1d5cd69fa.png][]

对警报线程池的警报线程

Unlike a decade ago, databases have become more complex than before, but so have the means to spot performance issues evolved. For their businesses to remain at par with the ever-changing IT landscapes, most IT professionals have been forced to invest in monitoring tools to help them comb through the system and identify threats. However, a slight problem lies in how these professionals handle database threat alerts.

与十年前不同，数据库已经变得比以前更复杂，但是发现性能问题的方法也随之发展。 为了使他们的业务与不断变化的IT环境保持一致，大多数IT专业人员被迫投资于监视工具，以帮助他们梳理整个系统并识别威胁。 但是，这些专业人员如何处理数据库威胁警报存在一个小问题。

![Why Alert Fatigue Remains a Database Performance Threat][]

[Image Source][]

[图片来源][Image Source]

More than 50% of these professionals end up ignoring the alerts that they get from the tools that they invested in, according to the Dark Reading website. While most professionals get away with this trend, it can be damaging to the IT environment were they to ignore a high priority threat alert. A good example would be the 2013 Target cyber breach which resulted from alert fatigue. Although this behavior can be changed, it requires you to understand what really causes alert fatigue.

根据Dark Reading网站的说法，这些专业人员中有50％以上最终无视他们从投资工具中获得的警报。 尽管大多数专业人员都摆脱了这种趋势，但是如果他们忽略高优先级的威胁警报，则可能会对IT环境造成损害。 一个很好的例子是由于警惕疲劳导致的2013目标网络漏洞。 尽管此行为可以更改，但它要求您了解真正引起警报疲劳的原因。

So, why are alert fatigues still a threat to performance?

那么，为什么警报疲劳仍然会对性能造成威胁？

## 警报可能缺少上下文 **(**Alerts Might Lack Context**)** ##

Sometimes the alerts that reach your security team might lack enough context to use in remediating the situation. This means that the IT professional in charge of that part of the database will have to fly blind to resolve these issues. While the time required to resolve the issue of a single alert under these circumstances might be insignificant, it will quickly turn into an inconvenience if multiple similar alerts reach the same person.

有时，到达您的安全团队的警报可能缺少足够的上下文来补救这种情况。 这意味着负责数据库那部分的IT专业人员将不得不盲目解决这些问题。 尽管在这种情况下解决单个警报问题所需的时间可能微不足道，但是如果多个相似警报到达同一个人，它将很快变成麻烦。

This will mean that they will take more time to resolve the issues, and might end up ignoring some of the alerts. A good [database activity monitoring][] tools should offer enough context on the reason behind the alert. It should provide information about the machine that was affected, the time the problem occurred and offer a little insight on how to remedy the situation.

这意味着他们将花费更多时间来解决问题，并且最终可能会忽略某些警报。 一个好的[数据库活动监视][database activity monitoring]工具应该就警报背后的原因提供足够的上下文。 它应该提供有关受影响的机器，问题发生的时间的信息，并提供有关如何解决这种情况的一些见识。

## 警报冗余 **(**Alert Redundancy**)** ##

In some cases, no single security solution might provide all the security you need, which makes layering solutions a wise choice. The issue comes in when multiple solutions aren’t integrated enough. When two solutions notice an issue with your database, they will both send alerts which will turn out to be redundant to the security professional in charge of that specific area.

在某些情况下，没有一个安全解决方案可以提供您所需的所有安全性，这使分层解决方案成为明智的选择。 当多个解决方案集成不充分时，就会出现问题。 当两个解决方案发现您的数据库存在问题时，它们都会发送警报，这对于负责该特定领域的安全专业人员来说将是多余的。

The trick is to fine-tune the tolerance levels of these solutions. You can start by consolidating and correlating the threat data. The best option, however, would be to switch to a more integrated solution that is platform based – this will also help save cost and [improve vendor relationships][].

诀窍是微调这些解决方案的公差级别。 您可以从合并和关联威胁数据开始。 但是，最好的选择是切换到基于平台的集成度更高的解决方案-这还将有助于节省成本并[改善供应商关系][improve vendor relationships] 。

## 警报传递问题 **(**Alert Delivery Issues**)** ##

In some instances, alerts might be delivered to the wrong person in the organization. Seeing that these alerts do not concern them, chances are that they will ignore them. On the other hand, both high and low priority alerts might be sent out at the same time of the day.

在某些情况下，警报可能会传递给组织中的错误人员。 看到这些警报与他们无关，则有可能它们将忽略它们。 另一方面，高优先级警报和低优先级警报可能会在一天的同一时间发送。

For instance, delivering both types of alerts at 2.00am will increase the chances of a DevOps team member ignoring a high priority alert with the mindset that it might be nothing but minor. In both instances, evaluating your alert protocol is vital.

例如，在凌晨2.00点发布这两种类型的警报将增加DevOps团队成员忽略高优先级警报的机会，因为他们的想法可能只是次要而已。 在这两种情况下，评估警报协议都是至关重要的。

## 误报过多 **(**Excessive False Positives**)** ##

False positives might be inevitable. The monitoring tools that you use might pick up an anomaly that shouldn’t raise any red flags. While a single false positive shouldn’t be too much to deal with, receiving them in high number can be a recipe for danger.

误报可能是不可避免的。 您使用的监视工具可能会发现一个异常，该异常不应引发任何危险信号。 虽然一个假阳性不应该过多处理，但大量接收它们可能会导致危险。

![Excessive False Positives][]

[Image Source][Image Source 1]

[图片来源][Image Source 1]

Since humans tend to get inured to redundancy, your team is likely to ignore all alerts with the mindset that they are all false positives. In case there is a high priority true positive alert in this [sea of false positives][], ignoring it will only lead to trouble. The trick is to fine tune your monitoring tools to reduce the occurrence of false positives.

由于人们倾向于确保冗余，因此您的团队很可能会忽略所有警报，因为它们都是误报。 如果在这一系列[误报中][sea of false positives]存在高优先级的真正肯定警报，则忽略它只会导致麻烦。 诀窍是微调您的监视工具，以减少误报的发生。

## 结论 **(**Conclusion**)** ##

Investing in the best database monitoring tools will only take you so far. The next step should be to tweak the tools to fit your IT environment. Consider the tips above to make every alert you get from such tools worthwhile.

投资最好的数据库监视工具只会带您到现在为止。 下一步应该是调整工具以适合您的IT环境。 考虑上面的提示，使从此类工具获得的所有警报都值得。

> 翻译自: [https://www.thecrazyprogrammer.com/2019/01/why-alert-fatigue-remains-a-database-performance-threat.html][https_www.thecrazyprogrammer.com_2019_01_why-alert-fatigue-remains-a-database-performance-threat.html]

对警报线程池的警报线程

[d37c03d8bc5ff515c9ade4c1d5cd69fa.png]: /images/20221123/4dc3a68c77d54239ad5d44bd10c3fd61.png
[Why Alert Fatigue Remains a Database Performance Threat]: /images/20221123/17dad41591c54b88b622a0e4cc9c4a3e.png
[Image Source]: https://cdn.pixabay.com/photo/2015/09/07/08/22/under-928246_1280.jpg
[database activity monitoring]: https://www.datasunrise.com/activity-monitoring/
[improve vendor relationships]: https://www.cio.com/article/3254644/software-as-a-service/the-truth-about-saas-vendor-management.html
[Excessive False Positives]: /images/20221123/7e337d7ca0c14e2ab4d09a8e1609cd15.png
[Image Source 1]: https://cdn.pixabay.com/photo/2017/03/23/13/56/warning-2168379_1280.png
[sea of false positives]: https://www.techrepublic.com/article/microsoft-5-tips-for-developers-to-reduce-malware-false-positives/
[https_www.thecrazyprogrammer.com_2019_01_why-alert-fatigue-remains-a-database-performance-threat.html]: https://www.thecrazyprogrammer.com/2019/01/why-alert-fatigue-remains-a-database-performance-threat.html