Security Center generates different alerts for your assets in real time. The types of alerts include web tampering, suspicious processes, webshells, unusual logons, and malicious processes. Security Center detects threats in your assets based on more than 250 threat detection models. This allows you to monitor the security status of your assets at the earliest opportunity.
Security Center generates alerts when it detects threats on your cloud services or assets. For example, alerts are generated if attacks initiated from a malicious IP address are detected or your host is intruded after it runs a malicious script or visits a malicious download source.
To view the alerts generated for your assets, you can navigate to.
- By default, all defense features, excluding the application whitelist and web tamper proofing features, supported by the current Security Center edition are enabled. To enable the application whitelist and web tamper proofing features, you must upgrade Security Center to the Basic Anti-Virus, Advanced, or Enterprise edition. For more information, see Upgrade and downgrade Security Center.
- Application whitelist and web tamper proofing are value-added services provided by Security Center. To use the application whitelist feature, you must apply for it. For more information, see Application whitelist. To use the web tamper proofing feature, you must purchase and enable it. The web tamper proofing feature is supported by the Basic Anti-Virus, Advanced, and Enterprise editions of Security Center. Security Center Basic does not support this feature. For more information about how to enable the web tamper proofing feature, see Enable tamper protection.
- Cloud threat detection is automatically enabled and supported only by Security Center Enterprise. To use cloud threat detection, you must upgrade the Basic Anti-Virus or Advanced edition of Security Center to the Enterprise edition.
Threat detection models
Security Center provides more than 250 threat detection models to help you detect threats in a comprehensive way. In the upper-left corner of the Alerts page, click the icon to view the models. The models are used to detect threats through 10 stages of a network attack, including Attack Portal, Load Delivery, Privilege Escalation, and Escape Detection. This achieves full-link cloud threat detection.
Security Center provides statistics on enabled defense items. This allows you to obtain up-to-date information about the alerts on your assets, enabled defense items, and disabled defense items. On the Alerts page of the Security Center console, you can view statistics on alerts and enabled defense items.
|Alerting Server(s)||The number of servers on which alerts are generated.||
Click the number below Alerting Server(s) to go to the Server(s) tab of the Assets page. The Server(s) tab displays the details of servers on which alerts are generated.
|All Alerts||The total number of unhandled alerts.||
You can view the details of all unhandled alerts on the Alerts page. For more information, see View and handle alert events.
|Urgent Alerts||The number of unhandled Urgent alerts.||
Click the number below Urgent Alerts. The urgent alerts are displayed on the Alerts page. You can view and handle the Urgent alerts.
The alerts generated by Security Center are classified into the following risk levels:
Note We recommend that you handle the Urgent alerts at the earliest opportunity.
|Precise Defense||The number of viruses that are automatically quarantined by the antivirus feature.||Click the number below Precise Defense. The related alerts are displayed on the Alerts
page. You can view all viruses that are automatically quarantined by the antivirus
Note You can ignore the viruses that are quarantined by Security Center.
|IP blocking / All||
||Click a number below IP blocking / All. In the IP Policy Library panel, you can view the enabled or all IP blocking rules. For more information about IP blocking rules, see Configure IP blocking policy.|
|Number Of Quarantined Files||The number of files that are quarantined by Security Center based on blocked alerts.||Click the number below Number Of Quarantined Files. In the Quarantine panel, you can view the details of quarantined files. The quarantined files cannot affect your servers. For more information, see Use the quarantine feature.|
Since December 20, 2018, the Basic edition of Security Center generates alerts only for unusual logons and other DDoS attacks. To enable more advanced detection features, you must upgrade the Basic edition to the Basic Anti-Virus, Advanced, or Enterprise edition. For more information about the types of alerts that each edition can generate, see Features.
For more information about the specific check items of each type of alert in Security Center and check principles, see Alerts.
The following table describes all types of alerts that Security Center can generate.
|Tamper Protection||Security Center monitors web directories in real time and restores tampered files
or directories based on the backup files. This prevents websites from malicious modification,
trojans, hidden links, and uploads of violent or illicit content. Security Center
can detect the following suspicious activities:
Note Web tamper proofing is a value-added service that is provided by Security Center. To use this feature, you must purchase and activate it. The Basic edition of Security Center does not support web tamper proofing. For more information, see Web tamper proofing.
|Suspicious Process||Security Center can detect the following suspicious processes:
|Webshell||Security Center uses engines developed by Alibaba Cloud to scan for common webshell
files. Security Center supports scheduled scan tasks, provides real-time protection,
and quickly quarantines webshell files.
Note Security Center Basic detects only some webshells. If you use Security Center Basic and need to detect all webshells, we recommend that you upgrade Security Center to the Basic Anti-Virus, Advanced, or Enterprise edition. For more information, see Renew the subscription to Security Center.
|Unusual Logon||Security Center detects unusual logons to your servers. You can configure approved
logon IP addresses, time periods, and accounts. Logons from unapproved IP addresses,
accounts, or time periods trigger alerts. You can manually add approved logon locations
or set the system to automatically update approved logon locations. You can also specify
assets on which alerts are triggered when unusual logon locations are detected.
Security Center can detect the following logon events:
|Suspicious Event||Security Center detects suspicious activities.|
|Sensitive File Tampering||Security Center checks whether malicious modification of sensitive files exists on your servers. The modification includes tampering of pre-loaded configuration files in Linux shared libraries.|
|Malicious Process||Security Center uses the agent to scan your servers in real time and generates alerts
if viruses are detected. You can handle the detected viruses in the Security Center console.
Security Center can detect the following malicious activities and processes:
|Unusual Network Connection||Security Center detects unusual network connections and disconnections.
Security Center can detect the following network activities:
|Other||Security Center detects unusual disconnections of the Security Center agent and other network intrusions, such as DDoS attacks.|
|Suspicious Account||Security Center detects unapproved accounts that attempt to log on to your assets.|
|Application intrusion event||Security Center detects intrusion activities that use system application components.|
|Cloud threat detection||Security Center detects whether threats exist in other Alibaba Cloud services you have purchased. The threats include suspicious deletion of ECS security group rules.|
|Precision defense||The antivirus feature provides precise protection against mainstream ransomware, DDoS trojans, mining programs, trojans, malicious processes, webshells, and worms. For more information about how to enable this feature, see Proactive defense.|
|Application Whitelist||You can create a whitelist policy for servers that require reinforced protection. If the suspicious or malicious processes that are identified by the policy are not added to the whitelist, Security Center generates alerts.|
|Persistence||Security Center detects suspicious scheduled tasks on the servers. When persistent threats against the servers are detected, Security Center generates alerts.|
|Web Application Threat Detection||Security Center detects intrusion activities that use web applications.|
|Malicious scripts||Security Center detects whether the system services of your assets are attacked or
modified by using malicious scripts. If potential script attacks are detected, Security
Center generates alerts.
Malicious scripts are classified into file-based scripts and fileless scripts. After an attacker gains control over a server, the attacker uses scripts for additional attacks. For example, the attacker may insert mining programs and webshells, and add administrator accounts. Programming languages of malicious scripts include Bash, Python, Perl, PowerShell, Batch, and VBScript.
|Threat intelligence||Security Center uses the threat intelligence library developed by Alibaba Cloud to perform correlation analysis on access traffic and logs. Security Center also detects threat events, including access to malicious domains, connections to malicious download sources, and access form malicious IP addresses.|
|Malicious Network Activity||Security Center identifies unusual network behaviors based on log data, such as network content and server behaviors. Malicious network behaviors include intrusions into the host by connecting to open networks and unusual behaviors of the cracked host.|
|K8s Abnormal Behavior||Security Center monitors the security status of running containers in a Kubernetes
cluster. This allows you to detect security risks and attacker intrusion in a timely
Log on to the Security Center console and click Settings in the left-side navigation pane. In the K8s Threat Detection section of the General tab, you can turn on Threat Detection to allow Security Center to detect the container cluster errors. For more information, see Threat detection for Kubernetes containers.
|Trusted exception||Security Center detects whether your system processes have been modified and whether exceptions occur when you start the system.|