Application Real-Time Monitoring Service:Connect an application to Application Security

Authorization

Before you connect the application to Application Security, you must authorize ARMS to access Alibaba Cloud Security. Then, ARMS gains limited access to relevant resources that Application Security depends on.

1. Log on to the ARMS console.
2. In the left-side navigation pane, choose Application Security > Applications.
3. In the Application Security section, click Access Application Security.
4. In the message that appears, click OK.
   After the authorization, ARMS automatically creates the AliyunServiceRoleForARMSSecurity service-linked role for Application Security. After the authorization is successful, you can view the application list and connect the application to Application Security. For information about the AliyunServiceRoleForARMSSecurity service-linked role, see Service-linked role for Application Security.

   Note If you are prompted that you do not have the permissions to create the service-linked role, contact the owner of the Alibaba Cloud account to add the specified policy for the current RAM user. For more information, see FAQ.

Connect the application to Application Security in Application Monitoring

Connect the application to Application Security in the ARMS console

If you have not activated Application Security when you connect the application to Application Monitoring, you can perform the following operations to connect the application to Application Security:

1. Log on to the ARMS console.
2. In the left-side navigation pane, choose Application Security > Applications. In the top navigation bar, select a region.
   The Applications page lists all Java applications that can be connected.

   Note Before you connect the application, make sure that the version of the ARMS agent is 2.7.1.3 or later.
3. Connect the application.
   • Connect an application: Click Add in the Actions column. In the message that appears, click OK.
   • Connect multiple applications:
     1. On the Applications page, click Add Application.
     2. In the Add Application dialog box, select the applications that you want to connect from the No security applications are added. list, click the > icon to move the selected applications to the Security applications are added. list, and then click OK.
4. Restart the local instances of the application to make the operation take effect.

   On the Applications page, check the connection status of the application in the Status column. After all instances are restarted, the application security feature takes effect on all instances for the application. If only some instances are restarted, the application security feature takes effect only on the restarted instances.

   The Instances Added field in the Status column displays the number of connected instances and the number of all instances. You can click the numbers to view connection status of the instances.

   

Set the prevention mode

After you connect the application to Application Security, you can set the prevention mode of the application. The following prevention modes are available: Monitor, Monitor and Block, and Disable. The default prevention mode is Monitor. If the application is running as expected for a period of time, you can change the prevention mode to Monitor and Block. This ensures that the application can be protected against attacks.

1. In the left-side navigation pane, choose Application Security > Applications. Find the application and then click Protection Settings in the Actions column.
2. In the Protection Settings dialog box, set the following parameters and click OK.

   Parameter	Description
   Protection Mode	Monitor: monitors attacks. If alert rules are configured and an attack is detected, an alert is triggered. The application is not affected. Monitor and Block: monitors and blocks attacks. If an attack is blocked, the application throws an error. Disable: disables the application security feature for the current application. No attacks are detected or blocked.
   Detection Timeout Period	The maximum period to detect attacks. Valid values: 5 to 200000. Unit: milliseconds. Default value: 300. If the detection timeout period is reached, the original business logic continues to be executed even if the detection logic is not executed. We recommend that you use the default value.
   Attack Type	The types of attacks to detect. We recommend that you retain the default settings. To retain the default settings, select Select All. For more information, see Attack types and solutions.

   Note If you modify the protection settings of the application, the new settings take effect with a latency of no more than 30 seconds.

Disconnect the application from Application Security

Disconnect the application from Application Security in Application Monitoring

Use one of the following methods to disconnect your application from Application Security in Application Monitoring:

• If your application is deployed in an ACK cluster:

  Delete the tag armsSecAutoEnable: "on".

• If your application is deployed in another environment:

  Delete the startup parameter -Darms.appsec.enable=true.

Disconnect the application from Application Security in the ARMS console

To disconnect an application from Application Security, choose Application Security > Applications in the left-side navigation pane. On the page that appears, find the application and click Cancel in the Actions column. In the message that appears, click OK. You must restart the local instances of the application to make the operation take effect.

We recommend that you do not disconnect an application from Application Security only for the sake of application performance. After an application is connected to Application Security, the default prevention mode is Monitor. In Monitor mode, Application Security only reports attack alerts and does not block attacks. Therefore, the application is not affected. If you want to disable all security detection capabilities, you can change the prevention mode to Disable. In Disable mode, Application Security does not report attack alerts even if a security attack occurs.