HEART security.anomaly H-11007
Security anomaly. Unusual activity that may be an attack.
| Code | HEART security.anomaly; inside a message "code": "security.anomaly" |
|---|---|
| H-number | H-11007: area 11, code 007 |
| Area | security: Logins, certificates, tampering |
| Typical severity | warning. A product may set another for its own case. |
| Applies to | Every connected product |
Likely causes
- Network traffic to places the product never talks to.
- Commands or requests unlike normal use.
- A sudden burst of requests, or scanning of its ports.
- Signs of an attack, or of malware on the product.
How to fix or prevent it
- Read what was unusual.
- If in doubt, take the product off the network.
- Update its software, and change its passwords and keys.
What the HEART does by itself
It raises a warning, and may limit what the product accepts until a person looks. It resolves when activity is normal again, or a person dismisses it.
When to call service
If an attack is possible.
Related codes
security.login-failuresH-11001: Many failed loginssecurity.unexpected-accessH-11002: Unexpected accesssecurity.tamper-detectedH-11005: Tampering detected
Inside a message a code is written bare, "code": "storage.full". In logs, tickets, documents and searches it is written
HEART storage.full. Things that simply happen, such as system.started, are event types, not faults.
The codes are defined in Part 3, Section 5.4, and their H-numbers in Section 5.7.
All of it, as data: fault-codes.json.
All fault codes, by area · All fault codes, by H-number · Problem types (API errors)