# Handling Abnormal Events

If State of the Zone is Abnormal or Attacked, and Defense State is Undefended or Part Defended, you need to enable defense manually.

#### Context

The system automatically enables the defense mechanism against certain attacks such as those on DNS rate limiting by source IP address or domain name even if Defense Mode of a Zone is set to Manual.

#### Procedure

1. Choose Defense > Policy Settings > Zone.
2. Check the values in the State and Defense State columns.

   If State of the Zone is Abnormal or Attacked, and Defense State is Undefended or Part Defended, perform the following operations to handle abnormal events. Otherwise, no operation is required.

3. Click the state value of the State column.
4. On the Abnormal Events tab page, search abnormal events on the detecting device and cleaning device of the Zone.
5. Select the event (of the cleaning device) whose Defense State is Undefended and click , enable the defense mechanism of the cleaning device against abnormal events.

   Only the cleaning device can handle abnormal events.

Parent topic: Attack Response and Source Tracing

Copyright © Huawei Technologies Co., Ltd.