Security Center:Scan for vulnerabilities

Server IP addresses of the web scanner

When you use Security Center to scan for application vulnerabilities in your servers, Security Center simulates intrusions that are launched from the Internet to scan your servers. If your servers are protected by a security protection or monitoring system, such as Web Application Firewall (WAF) or Secure Operations Center (SOC), we recommend that you add the server IP addresses of the web scanner to the whitelist in your protection or monitoring system. This ensures that your scan tasks run as expected. You must add the following IP addresses to the whitelist in your protection or monitoring system:

47.110.180.32, 47.110.180.33, 47.110.180.34, 47.110.180.35, 47.110.180.36, 47.110.180.37, 47.110.180.38, 47.110.180.39, 47.110.180.40, 47.110.180.41, 47.110.180.42, 47.110.180.43, 47.110.180.44, 47.110.180.45, 47.110.180.46, 47.110.180.47, 47.110.180.48, 47.110.180.49, 47.110.180.50, 47.110.180.51, 47.110.180.52, 47.110.180.53, 47.110.180.54, 47.110.180.55, 47.110.180.56, 47.110.180.57, 47.110.180.58, 47.110.180.59, 47.110.180.60, 47.110.180.61, 47.110.180.62, and 47.110.180.63

Procedure

1. Log on to the Security Center console.In the left-side navigation pane, choose Risk Management > Vulnerabilities.
2. On the Vulnerabilities page, run a manual scan task or configure an automatic periodic scan task.
   • Run a manual scan task on your servers

     If you want to check whether vulnerabilities exist on your servers, you can use the quick scan feature to run a manual scan task on your servers.

     1. On the Vulnerabilities page, click Scan now.

        Before you use the quick scan feature, you can click Settings in the upper-right corner of the page. In the Settings panel, click Manage to the right of each check item and check whether the servers that you want to scan are displayed in the Assets section.

     2. In the Scan for Vulnerabilities dialog box, select the type of vulnerabilities that you want to scan for and click OK.
        Note

        • After you use the quick scan feature, Security Center scans all protected assets. The time required to complete the scan is approximately 30 minutes. Wait until the scan is complete. You can refresh the page to view the most recent statistics.
        • After a scan task is created, you must wait for at least 15 minutes before you can stop the scan task.
   • Run an automatic periodic scan task on your servers

     You can configure an scan cycle for an automatic periodic scan task. Then, Security Center runs the automatic periodic scan tasks to scan for vulnerabilities on your servers on a regular basis.

     1. In the upper-right corner of the Vulnerabilities page, click Settings.
     2. In the Settings panel, configure the parameters based on your business requirements.

        Parameter	Description
        Linux Software	Turn on or turn off the switches to enable or disable the scan for Linux software vulnerabilities, Windows system vulnerabilities, Web-CMS vulnerabilities, and urgent vulnerabilities. After you turn on a switch, you can click Manage to right to add or remove servers that you want to scan for the corresponding vulnerabilities.
        Windows System
        Web CMS
        Emergency
        Application	Turn on or turn off the switch to enable or disable the scan for application vulnerabilities.
        YUM/APT Source Configuration	Turn on or turn off the switch to specify whether to preferentially use YUM or APT sources of Alibaba Cloud to fix vulnerabilities. Note Before you fix a Linux software vulnerability, you must specify a valid YUM or APT source. If you specify an invalid YUM or APT source, the vulnerability may fail to be fixed. After you turn on the switch, Security Center automatically selects a YUM or APT Source Configuration of Alibaba Cloud. This improves the success rate of vulnerability fixing. We recommend that you turn on YUM/APT Source Configuration.
        Emergency vul(s) Scan Cycle	Specify the scan cycle for urgent vulnerabilities. Note Only users of the Advanced, Enterprise, and Ultimate editions of Security Center can specify the Emergency vul(s) Scan Cycle parameter. By default, the scan period for urgent vulnerabilities is 00:00:00 to 07:00:00. If your servers are deployed in a private network or urgent vulnerability detection is not required, you can set Emergency vul(s) Scan Cycle to Stop. Your servers may be attacked in various ways. We recommend that you set Emergency vul(s) Scan Cycle to a value other than Stop. This way, Security Center detects urgent vulnerabilities on your servers in a timely manner.
        Application Vul(s) Scan Cycle	Specify the scan cycle for application vulnerabilities. Note Only users of the Enterprise and Ultimate editions of Security Center can specify the Application Vul(s) Scan Cycle parameter. By default, the scan period for application vulnerabilities is 00:00:00 to 07:00:00.
        Retain Invalid Vul for	Specify the number of days after which a detected vulnerability is automatically deleted. Note If you do not handle a detected vulnerability and the vulnerability is no longer detected in multiple subsequent detection, the vulnerability is automatically removed from the Vulnerabilities page after the specified number of days. If vulnerabilities of the same type are detected, Security Center still generates alerts.
        Vul scan level	Specify priorities for the vulnerabilities that Security Center detects. Note Security Center detects and displays only vulnerabilities that have the priorities specified by the Vul scan level parameter. If you select High and Medium, Security Center detects only vulnerabilities that have High and Medium priorities. On the Vulnerabilities page, only vulnerabilities that have High and Medium priorities are displayed.
        Vulnerability Whitelist Settings	If you do not want to scan for a vulnerability, you can add the vulnerability to the vulnerability whitelist. Security Center does not detect the vulnerabilities in the vulnerability whitelist. Add whitelist rules: Click Add rules. In the AddVulnerability rule panel, configure an whitelist rule based on a specified type of vulnerabilities. Edit whitelist rules: Click Edit on the right of the vulnerability that is added to a whitelist rule. In the panel that appears, modify the Rule scope and Note parameters. Remove vulnerabilities from the whitelist: Click Delete on the right of a vulnerability to remove the vulnerability from the whitelist. After you remove the vulnerability from the whitelist, Security Center can detect the vulnerability and generate alerts for the vulnerability.

   After the vulnerability settings are configured, Security Center detects vulnerabilities on your servers based on the configurations. You can click Task management in the upper-right corner of the Vulnerabilities page and view the scan progress of vulnerabilities. After the scan is complete, you can click a tab on the Vulnerabilities page to view the most recent scan results.