All Products
Search

This Product

    :Runtime environment

    Document Center

    :Runtime environment

    Last Updated:Jun 25, 2026

    After you enable the Agent Firewall, you must enable protection for the runtime environments of your agent assets. You can view the asset overview on the Agent Runtime Environment page and enable traffic diversion protection.

    Prerequisites

    Before proceeding, ensure that you have Enable Agent firewall (enabled the Agent Firewall).

    Enable protection for an Agent

    1. Log on to the Cloud Firewall console.

    2. In the left-side navigation pane, choose Agent Firewall > Runtime Environment.

    3. The agent asset list at the bottom of the page shows the Agent Network Environment, Running Workload, Associated Agents, and Associated Skills/Tools columns. You can filter assets by Running Workload, Protection Status, or Public IP Address. If your target asset is not listed, click Synchronize Assets to synchronize the asset list.

    4. To protect a target asset, enable protection for its runtime environment. Click View Protection Settings in the Protection Status column for the target Agent Network Environment, and then turn on the Protection Switch.

      Important

      After you turn on the Protection Switch, the system attempts to enable Cloud Firewall Traffic Diversion and NDR Traffic Mirroring for the corresponding asset. These two features consume the instance quotas of Internet Firewall and Agentic NDR, respectively. If the instance quota has reached its upper limit, the corresponding feature fails to enable. For full protection coverage, we recommend enabling both features so that the asset reaches the Full Protection state.

      For users without Agentic NDR enabled (protection is limited to specific regions; refer to Supported regions), billing rules by payment method are as follows:

      • Subscription Cloud Firewall: After enabling the Protection Switch, you can enable NDR Traffic Mirroring for up to three Agent Network Environment free of charge. This edition supports only Agent Firewall features and does not support other Agentic NDR features beyond asset onboarding.

      • Pay-as-you-go Cloud Firewall: After enabling the Protection Switch, the system automatically provisions a pay-as-you-go Agentic NDR instance, which incurs additional charges.

    View Agent protection status

    • View protection overview: At the top of the Runtime Environment page, you can view the counts for Agent Network Environment, Fully Protected, Partial Protection, Unprotected, and Associated Agents.

    • View agent details: In the agent asset list at the bottom of the page, you can perform the following operations:

      • Click the image icon in the Agent Network EnvironmentAssociated Agents column to view the names and types of agents.

      • In the Associated Skills/Tools column, click the image icon to view associated skills, or click the image icon to view associated tools.

    What to do next

    After you enable protection for an agent, the firewall automatically activates Data Leak Detection, Skill File Threat Detection, and Behavior and Traffic Auditing.

    To maximize protection, you must also manually configure the following rules:

    • Access Control: Controls which external services and IP addresses your agents can access.

    • Skill Usage Anomaly Detection: Monitors agent skill usage patterns and detects behavioral deviations.

    • Tool Call Anomaly Detection: Detects unusual or unauthorized tool invocations by agents.

    For configuration details, see Create agent behavioral control rules (the rule configuration guide).