Security Center:Features

Security score

Calculates a 0–100 health score using data from dual global data centers (China and Global). Points are deducted dynamically based on active security events and configuration issues across your cloud assets. A higher score means a stronger security posture and fewer unresolved risks — so you can prioritize which issues to address first.

Supported editions: All editions and protection levels (no additional purchase required).

Asset overview

Provides a panoramic view of cloud assets, network topology, security score, and asset security risks — a single entry point for managing cloud asset security.

Container asset overview

Visualizes the security status and network topology of container assets — clusters, containers, images, and applications — so you can manage container security from a single view.

Server list

Shows the protection status, group, region, and VPC statistics for all your servers.

Supported editions: All editions and protection levels (no additional purchase required).

Asset fingerprint investigation

Collects detailed fingerprint data across 12 dimensions so you can inventory assets and detect anomalies:

Security check

Runs one-click checks — vulnerability detection, baseline checks, and more — across specified servers based on your configurations.

Container assets

Shows security status and risk information for all clusters, pods, containers, and images.

Cloud products

Provides security status for your cloud products, with statistics by category — including Server Load Balancer and ApsaraDB RDS.

Supported editions: All editions and protection levels (no additional purchase required).

Website

Shows security status for all your websites, including root domain names, subdomains, asset risk status, and alert counts.

Supported editions: All editions and protection levels (no additional purchase required).

Serverless assets

Detects runtime security risks for serverless cloud product instances — Serverless App Engine (SAE) and serverless instances of Container Compute Service (ACS). Provides malicious file detection, vulnerability scanning, and compliance baseline checks.

Asset exposure analysis

Scans your Alibaba Cloud resources — ECS instances, gateway assets, system components, and ports — to identify vulnerabilities and security risks exposed to the Internet, so you can find and resolve issues before attackers can exploit them.

Vulnerability management

Automatically discovers, assesses, and fixes security vulnerabilities on your servers — replacing manual patching with automated scanning and remediation at scale.

Scan methods

• Manual scan: Immediately assesses the current vulnerability status of your servers.

• Automatic scan (periodic): Sets up recurring tasks for continuous vulnerability monitoring.

Fix methods

• One-click fix: Fix vulnerabilities directly from the console without logging on to servers. Not supported for Application Vulnerability or Urgent Vulnerability types.

• Automatic fix: Enable Automatic Vulnerability Remediation to periodically fix newly discovered vulnerabilities on a schedule. Depends on the one-click fix feature; supported only for non-kernel Linux system vulnerabilities.

• Manual fix: Log on to the server and follow the fix suggestions in the vulnerability details. Use this method when one-click fix is not supported for the current edition or vulnerability type, or when the Vulnerability Fix feature is not enabled.

Vulnerability types and detection

Edition and protection level support

Cloud Security Posture Management (CSPM)

Cloud Security Posture Management (CSPM) uses automated risk checks, baseline scans, and attack path analysis to discover and manage security risks across your cloud assets — including configuration errors and server configuration defects — and provides remediation suggestions. By correlating vulnerabilities, exposed assets, and misconfigurations, CSPM helps you understand potential attack paths and prioritize which risks to address first.

CSPM includes three capabilities:

Cloud product configuration risk check

Scans cloud asset configurations across three scenarios: identity and permission management, security best practices, and compliance checks. Covers multicloud environments.

Baseline risk check

Dives into the host operating system level to detect and remediate issues based on industry standards:

Container baseline checks follow Alibaba Cloud container security best practices for Docker, Kubernetes master nodes, and Kubernetes node nodes.

Attack path analysis

Correlates vulnerabilities, exposed assets, and misconfigurations to visualize potential attack paths through your cloud environment — helping you prioritize which risks to address first.

Edition support

*Subscription without CSPM value-added service:*

*Subscription with CSPM value-added service:*

*Pay-as-you-go:*

Enable the pay-as-you-go CSPM feature.

AccessKey leak detection

Monitors GitHub in real time to detect whether any publicly available source code contains AccessKey information for your Alibaba Cloud account — so you can act before credentials are misused.

Supported editions: All editions and protection levels (no additional purchase required).

Cloud Honeypot

Deploys honeypots on key attack paths to lure attackers, feed them realistic but fake data, and record complete attack behavior for source tracing. Prolongs attack time, captures advanced unknown attacks, and gives your security team a proactive defense advantage.

Malicious file detection

Identifies malicious files across three surfaces:

• File Detection SDK: Uses the Security Center multi-engine detection platform. Integrate malicious file detection into your own code with a small amount of SDK code.

• OSS file detection: Scans files in Alibaba Cloud Object Storage Service (OSS) buckets for malicious content.

• Malicious file handling: When a risk file — web shell, mining program, or Trojan — is detected in an ECS instance or OSS bucket, Security Center generates an alert. Handle detected files with Add to Whitelist, Ignore, or Block Access.

Log Analysis

Centralizes and stores security-related logs for unified query and analysis, helping you locate issues quickly and meet compliance audit requirements.

• Host logs: Logon activity, process startups, account snapshots, and DNS requests — for monitoring user activity, system events, and application operations.

• Security logs: Vulnerabilities, baselines, security alerts, and CSPM data — for observing security trends and identifying system weaknesses.

Security alerts

CWPP (Cloud Workload Protection Platform) security alerts detect threats across hosts, containers, and cloud products in real time — covering process, file, and network activity. Detection and precise defense models cover threats including abnormal process behavior, web shells, malware, vulnerability exploits, and container escapes. High-risk attacks such as ransomware, reverse shells, malicious command execution, loading of high-risk drivers, and planting of malicious files are actively intercepted.

Handle threats with:

• Threat removal: Virus Detection and Removal, Deep Cleanup, Quarantine

• Alert suppression: Add to Whitelist, Ignore

Network Defense Alert (formerly Attack Analysis) — enabled when Network Threat Prevention rules are active in Host Rules - Malicious Behavior Defense and Host Rules - Brute-force Attacks Protection — defends and intercepts high-risk network attacks: malicious DNS requests, web shell uploads, adaptive web attack defense, and brute-force attacks.

Subscription detection scope:

Pay-as-you-go detection scope:

Security event handling

Uses graph computing technology to aggregate related CWPP alerts — such as those sharing the same MD5 hash or parent process ID — into security events. Assess the impact of an event, contain the threat, and harden the system to prevent recurrence.

Handling methods: Use Recommended Handling Policy, Add to Whitelist, Update Incident Status, Run Playbook.

Supported editions: All editions and protection levels (no additional purchase required). Different editions support different alert types for event aggregation.

Log Management

Stores and displays Security Center logs — vulnerability logs, security alert logs, and client event logs — to help you locate alerts, trace attack sources, and improve response speed.

Virus scan

Built on the Alibaba Cloud machine learning virus scan engine — trained through automated analysis of massive virus samples, persistence methods, and attack techniques — this feature lets you run one-click virus scanning across your servers.

Host rule management

Three rule types harden your server security:

• Malicious Behavior Defense: Built-in and custom defense rules to intercept malicious behaviors on your servers.

• Defense Against Brute-force Attacks: Protection policies that prevent brute-force cracking of host account passwords.

• Common Logon Management: Define allowed logon locations, IP addresses, times, and accounts — and get alerts when logons fall outside these parameters.

Core file monitoring

Monitors core files in real time for access, modification, deletion, and renaming operations — reducing the risk of core files being stolen or tampered with.

Agentless detection

Scans for ECS vulnerabilities, malicious files, and baseline configuration issues without installing a client agent.

Anti-ransomware

Backs up and recovers server and database files to reduce the impact of ransomware attacks.

Web tamper proofing

Monitors website directories in real time and restores tampered files or directories from backups — preventing the injection of Trojans, black links, or illegal content such as terrorist threats or pornography.

Feature settings - Host Protection settings

Configure how the host protection engine behaves on your servers:

Proactive Defense

Additional settings

• Webshell Detection and Removal: Periodically scans website servers and web page directories for web shells and Trojans.

• Adaptive Threat Detection Capability: Automatically enables strict alert mode when a high-risk intrusion event occurs on a server.

• Alert Settings:

  • Balanced Mode (default): Minimizes false positives while detecting more potential risks.

  • Strict Mode: Broader suspicious behavior alerts with higher false positive rates. Use during major security events.

Active container defense

Three mechanisms protect your container runtime:

• Risk Image Blocking: Checks images for security risks and takes intercept, alert, or allow actions on images matching active container defense rules — ensuring only approved images start in the cluster.

• Non-image Program Defense: Detects and intercepts programs that start inside a container but are not part of the original image — actively defending against malware intrusion.

• Container Escape Prevention: Detects high-risk behaviors across processes, files, and system calls to block container escape attempts and protect the host.

Container file protection

Monitors directories and files within containers in real time, generating alerts or intercepting tampering when a directory or file is maliciously altered — preventing injection of illegal information or malicious code into your applications.

Container Firewall

A firewall service for container environments. When an attacker exploits a vulnerability or malicious image to intrude into a container cluster, Container Firewall generates an alert or intercepts the abnormal behavior.

Container image signing

Signs container images so only approved, signed images can be deployed — preventing unauthorized or unsigned images from starting.

Container image signing is currently available only for Kubernetes clusters in the China (Hong Kong) region.

Image Security Scan

Scans container images for high-risk system vulnerabilities, application vulnerabilities, malicious viruses, web shells, malicious scripts, configuration risks, and sensitive data.

CI/CD integration

Integrates with Jenkins or GitHub to detect security risks during the project build phase — high-risk system vulnerabilities, application vulnerabilities, malicious viruses, web shells, malicious execution scripts, configuration risks, and sensitive data in images. Provides vulnerability fix suggestions.

Feature settings - Container Protection settings

Configure container security detection behavior:

• Threat Detection on Kubernetes containers: Detects security issues in running container clusters in real time. Checks:

  • Abnormal command execution in K8s API Server

  • Abnormal directory mounting in pods

  • Lateral movement using K8s Service Account

  • Startup of pods with malicious images

• Container Escape Prevention: Detects high-risk behaviors across processes, files, and system calls to block escape attempts.

Task Hub

Manages and executes batch vulnerability fix tasks across multiple servers.

Security Report

Customize the security data you want to track and have it delivered periodically to the email inboxes of your security team.

Feature settings - Client Capability Configuration

Configure how the Security Center agent runs on your servers:

• Agent Protection: Intercepts attempts to uninstall the agent without using the Security Center console — preventing attackers from disabling protection.

• Client Resource Management: Adjusts the agent's running mode to limit resource consumption. Modes: Low Consumption Mode, Smooth Mode, Custom Mode.

• Local File Detection Engine: Runs security checks on newly created script and binary files, generating alerts when threats are detected.

• In-depth Detection Engine: Detects deeper security risks such as rootkits, tunneling, and backdoors.

Feature settings - Other Configurations

• Data Delivery of ActionTrail: Uses the Security Center service-linked role to ship ActionTrail data to the Security Center logStore. Enables threat detection for abnormal AccessKey calls, unusual RAM account logons, and high-risk command execution. Supported by all editions by default.

• Global Log Filter: Deduplicates and filters client logs before reporting to reduce log storage costs. Requires the Log Analysis value-added service (subscription).

Feature settings - Client

View servers with unprotected clients, get security commands, and manage client uninstallation. Supports proxy access client solutions.

Supported editions: All editions and protection levels (no additional purchase required).

Multicloud Configuration Management

Three capabilities for managing assets beyond Alibaba Cloud:

• [Multicloud asset integration](https://www.alibabacloud.com/help/en/security-center/user-guide/use-multi-cloud-configuration-management/#task-2092350): Integrates non-Alibaba Cloud servers — third-party cloud servers and IDC servers — into Security Center for unified protection and management.

• [IDC asset integration](https://www.alibabacloud.com/help/en/security-center/user-guide/add-a-server-in-a-data-center-to-security-center): Creates an IDC probe to detect and discover IDC servers and synchronize them to Asset Center.

• [Asset Management Rules](https://www.alibabacloud.com/help/en/security-center/user-guide/use-the-feature-of-asset-management-rules#task-2113161): Groups or tags servers that meet defined conditions to improve asset management efficiency.

Supported editions: All editions and protection levels (no additional purchase required).

Notification Settings

Configure alert policies for security alerts, vulnerability intelligence, and baseline risks. Delivery channels:

• Email / Internal Message

• DingTalk Chatbot

• Cloud Monitor Push

Multi-account security management

Manages asset security across multiple member accounts within your enterprise — providing a unified view of security risks for all accounts.

Supported editions: All editions and protection levels (no additional purchase required).

Compliance Check

• Security Compliance Check: Covers classified protection compliance across communication networks, regional boundaries, computing environments, and Management Hub. Generates classified protection compliance reports.

• ISO 27001 Compliance Check: Checks whether your system meets ISO 27001 certification requirements across asset management, access control, cryptography, and operational security.

Supported editions: All editions and protection levels (no additional purchase required).