All Products
Search

This Product

    Security Center:Integrate product logs

    Document Center

    Security Center:Integrate product logs

    Last Updated:Jun 25, 2026

    When logs are scattered across cloud services, third-party tools, and self-managed applications, unified threat detection becomes difficult. Agentic SOC provides a central Integration Center to collect, standardize, and analyze log data from any source — so you can apply consistent detection rules across your entire environment and respond to threats efficiently.

    How it works

    Agentic SOC uses a modular configuration system to automate log ingestion and standardization. Four components work together to form the pipeline:

    • Data Source: The storage location for raw logs — typically a Project and Logstore in Simple Log Service (SLS).

      Note

      Agentic SOC supports three data source types: Agentic SOC Dedicated Collection Channel, User Log Service, and Security Center Log Service. See Data source type comparison for details.

    • Standardized Rule:

      • A set of SPL-based parsing instructions that extract key fields (such as source IP and destination port) from raw logs and convert them into Agentic SOC's unified structured format.

        Important

        Supports ingesting extended fields with the Keep Original setting. Note that this increases ingestion traffic volume, resulting in higher costs.

      • Each Standardized Rule is associated with a Dataset — a predefined model of standard fields that determines what fields are available for log analysis. See Datasets.

    • Standardization Method: The technical pattern for processing logs after standardization. The supported methods are Real-time Consumption and Scan Query.For more information,See Dataset .

    • Access Policy: The core configuration that ties together the Data Source, Standardization Method, and Standardized Rule. It specifies how logs are read, parsed, and processed — and drives automatic log ingestion.

    Integrate Alibaba Cloud products

    This applies to Alibaba Cloud products that deliver logs to your SLS Logstores, such as Web Application Firewall (WAF), Cloud Firewall (CFW), and ActionTrail.

    Integration flowchart

    Parse and Test

    Step 1: Enable product log delivery

    Enable the log audit feature for the target product and deliver its logs to SLS.

    Important

    Alert logs from Alibaba Cloud security products in the central Logstore are automatically delivered to Agentic SOC — you don't need to enable the product's log service for these. Examples include WAF alert logs and CFW alert logs.

    1. Go to the cloud product console (such as WAF or CFW) and find Log Management or Simple Log Service. For reference links, see References for integrating Alibaba Cloud product logs into SLS.

    2. Follow the product documentation to enable log delivery. This typically creates a Project and one or more Logstores in SLS automatically.

      Note

      Log on to the Simple Log Service console to view the Project and Logstore created by the product. For example, WAF logs use a project named wafnew-logstore.

    Step 2: Enable built-in access policies

    Enable manually

    1. Configure the data source. Agentic SOC includes preconfigured data sources for major Alibaba Cloud products. Verify that these configurations match your Logstore information.

      1. Find the cloud product.

        1. Log on to the Security Center console > Agentic SOC > Management > Integration Settings. In the upper-left corner, select the region where your assets are located: Chinese Mainland or Outside Chinese Mainland.

        2. On the Service Integration tab, set Ingestion Settings to Alibaba Cloud, select the product (such as Web Application Firewall), and click Ingestion Settings in the Actions column.

      2. Check the data source status.

        1. Click the name of the data source associated with the product. The page redirects to the Data Source tab.

        2. Check the connection status:

          • Normal: Agentic SOC can access the Logstore. Proceed to the next step.

          • Abnormal: The configuration is incorrect. Click Edit in the Actions column and verify:

            • Instance information: Confirm the Region, Project, and Logstore match what was created in Step 1.

            • Source log service: Confirm the SLS Logstore is active — the Project is not disabled and new logs are being written.

          • Not connected: The data source is not configured. Click Edit in the Actions column, then click Create Instance and select the Region ID, Project and Logstore created in Step 1.

    2. Enable the built-in access policy.

      1. Return to the Service Integration tab and go to Access Settings for the product.

      2. Modify the standardization method (optional). For some product policies, you can change the Standardization Method between Real-time Consumption and Scan Query. See Standardized fields and datasets.

        Important

        • If the data source type is Security Center Log Service or the log type is an alert log, the method is fixed to Real-time Consumption and cannot be changed.

        • If the dataset (StoreView) associated with Standardization Category or Structure already has five Scan Query policies attached, select Real-time Consumption for the current policy. Otherwise, the policy cannot be enabled.

        Parse and Test

      3. Log standardization test

        If you changed the standardization method, run a test before enabling the policy.

        Warning

        The Logstore for the data source must contain data. The test cannot run on an empty Logstore.

        1. Log sample selection: The system automatically fetches log samples from the last 7 days by default. You can also manually select a time range.

        2. SPL syntax: The syntax from the current policy's standardization rule is synchronized by default. To modify the syntax, go to the Standardized rules and datasets tab and edit the rule.

        3. After obtaining log samples, click Parse and Test.

        4. After the test passes, click Complete.

      4. Enable the policy.

        Turn on the switch in the Enabling Status column.

        Important

        If you enabled the recommended access policy when purchasing Agentic SOC, built-in policies for Security Center, WAF, Cloud Firewall, and ActionTrail are already enabled. See Enable access policies for subscription and Enable log access policies for pay-as-you-go.

    Enable in batches (recommended)

    Batch integration automatically enables access policies and discovers data sources across multiple products at once.

    1. Access the Security Center console - Agentic SOC - Management - Access Settings. In the upper-left corner of the page, select the region where the assets to be protected are located: Chinese Mainland or Outside Chinese Mainland.

    2. Configure batch integration.

      Click Access Settings and complete the configuration:

      • Access Settings:

        • Increment Access: Keeps all enabled access policies and adds only the data sources and policies from the current configuration.

        • Full Access: Overwrites and replaces all existing access settings. Policies not selected in the current configuration are disabled.

          Warning

          Full Access is an overwrite operation. It may disable running policies and interrupt data integration. Proceed with caution.

      • Accessible Account: Select the current account and its member accounts.

      • Alibaba Cloud Services: Select the cloud products and their corresponding data sources.

        Note

        To quickly enable data analytics, click Use Recommended Policy. The system selects the data sources with the most analytical value for each product based on best practices.

      • Auto-Add New Data Sources: When enabled, new Logstores are automatically included in the data source's collection scope — no manual updates needed.

    3. Confirm and start data integration.

      Click OK. The system automatically:

      • Integrates all Logstores: Ingests all enabled Logstores associated with the selected products and accounts in SLS.

      • Activates access policies: Enables the access policies that correspond to the selected data sources.

      Important

      New access policies may take some time to deploy and initialize. Wait for the process to complete before verifying results.

    4. Confirm the enabled status.

      1. Return to the access list, select the product, and click Ingestion Settings in the Actions column.

        Note

        For member accounts, go to Multi-account Access Settings, then click Multi-account Access in the Actions column for the target data source.

      2. Check the access state in the access policy list. If the state is abnormal, check the data source status. See Check the data source status..

    Step 3: Add a new access policy (optional)

    Some products support custom access policies.

    1. In the access policy list, click Create Access Policy.

      Note

      If Create Access Policy is not displayed, the product does not support this feature.

    2. On the Create Access Policy page, select the Data Source,Standardized Rule, and Standardization Method. If no suitable options exist, create a new data source and a custom standardization rule.

      Important

      Only data sources from the current account are supported. Data sources from member accounts cannot be used here.

    3. Complete the Test Log Standardization and enable the policy.

    Integrate third-party logs

    Agentic SOC supports logs from third-party clouds (Fortinet, Chaitin, Microsoft, Sangfor, Tencent Cloud, Huawei Cloud, Hillstone Networks, Knownsec, and Microsoft Cloud) and custom product applications.

    Integrate logs from third-party cloud products

    Third-party cloud products with logs not in SLS

    For Tencent Cloud and Huawei Cloud WAF and CFW products, Agentic SOC provides a built-in data import feature.

    Supported products:

    Cloud provider

    Product

    Log type

    Tencent Cloud

    Web Application Firewall (WAF)

    Attack log, access log

    Cloud Firewall (CFW)

    Alert log

    HUAWEI CLOUD

    Web Application Firewall (WAF)

    Attack log, access log

    Cloud Firewall (CFW)

    Alert log

    Integration flowchart

    Parse and Test

    Procedure

    1. Create a data source. Create a dedicated Agentic SOC data source to receive the third-party cloud log data. Skip this step if you already have one.

      1. Go to Security Center console > Agentic SOC > Management > Integration Settings. In the upper-left corner, select the region for the assets you want to protect: Chinese Mainland or Outside Chinese Mainland.

      2. On the Data Source tab, create a data source. See Create a data source: Logs not in SLS.

        • Source Data Source Type: Select User Log Service or Agentic SOC Dedicated Collection Channel. See Data source type comparison.

        • Add Instances: We recommend that you create a new Logstore to isolate the data.

    2. Import data. Follow Import Huawei Cloud log data or Import Tencent Cloud log data to import the third-party cloud data into the data source created in Step 1.

    3. Configure an access policy.

      1. On the Service Integration tab, set Ingestion Settings to the third-party vendor (such as Huawei Cloud).

      2. Click Ingestion Settings for the target product, then click Create Access Policy.

      3. Configure the data source:

        • Data Source Name: Select the data source created in Step 1.

        • Standardized Rule: Select the built-in standardization rules for Huawei Cloud or Tencent Cloud.

        • Standardization Method: Only Real-time Consumption is supported. Scan Query is not available for this scenario.

      4. On the Log Parsing page, click Parse and Test.

        Warning

        The Logstore corresponding to the data source must contain data. Otherwise, the test cannot proceed.

      5. After the test passes, click Complete, then enable the policy.

    Third-party logs already in SLS

    If logs from products such as Fortinet, Chaitin, or Sangfor are already collected into an SLS Logstore (via Logtail or Syslog-ng), follow this flow. For data collection methods, see Data collection overview.

    Parse and Test

    1. Configure the data source.

      1. Find the integration product.

        1. Go to Security Center console > Agentic SOC > Management > Integration Settings. In the upper-left corner, select the region where the assets you want to protect are located: Chinese Mainland or Outside Chinese Mainland.

        2. On the Service Integration tab, set Ingestion Settings to the third-party vendor (such as Huawei Cloud).

      2. Update the data source.

        1. Click the name of the data source associated with the product. You are redirected to the Data Source tab. Click Edit in the Actions column.

        2. Click Create Instance and select the Region ID, Project, and Logstore where the third-party logs are stored.

          Note

          Log on to the Simple Log Service console to find the Logstore information.

    2. Enable the built-in access policy.

      1. Return to the Service Integration tab and go to Access Settings for the product.

      2. Click Edit in the Actions column for the built-in access policy. On the Log Parsing page, click Parse and Test. See Log standardization test .

      3. After the test passes, click Complete, then enable the policy.

    Integrate logs from custom product applications

    Custom product applications

    Use this flow to integrate logs from your own applications or products not covered by built-in integrations.

    Before you begin, confirm the following:

    • Whether your logs are already collected in SLS. If not, decide whether to use Agentic SOC Dedicated Collection Channel (Agentic SOC creates and manages the Logstore) or User Log Service (you create the Logstore yourself).

    • You will need to write a custom SPL-based standardization rule for your log format.

    Integration flowchart

    Parse and Test

    1. Add a product.

      1. Access the Security Center console - Agentic SOC - Management - Access Settings. In the upper-left corner of the page, select the region where the assets to be protected are located: Chinese Mainland or Outside Chinese Mainland.

      2. On the Service Integration tab, in the Multi-cloud Service Access area, click Add Service and enter the Service Provider and Service Name.

    2. Add a data source. On the Data Source tab, click Add Data Source. See Data source.

      • If logs are already in SLS: Set Source Data Source Type to User Log Service and select the corresponding Logstore.

        Note

        Log on to the Simple Log Service console to find the Logstore information.

      • If logs are not yet in SLS:

        • Agentic SOC Dedicated Collection Channel: Agentic SOC creates a dedicated Project (aliyun-cloudsiem-channel-AlibabaCloudUID-cn-RegionID) and Logstore in SLS automatically.

        • User Log Service: Go to the Simple Log Service console and create the Logstore first.

    3. After configuring the data source, refer to Data Collection Overview or contact the SLS helpdesk to collect product logs and send them to the corresponding SLS Logstore.

    4. Add a standardization rule.

      On the Standardized Rule tab, click Create Custom Rule. See Create a custom standardization rule.

      Set the vendor and product to match what you added in Step 1.

    5. Add and enable an access policy.

      1. Return to the Service Integration tab, find the product added in Step 1, and click Ingestion Settings in the Actions column.

      2. On the Ingestion Settings page, click Create Access Policy and configure:

        • Data Source: Select the data source configured in Step 2.

        • Standardized Rule: Select the rule configured in Step 3.

        • Standardization Method: Real-time Consumption or Scan Query.

          Important

          If the data source type is Agentic SOC Dedicated Collection Channel, select Real-time Consumption.

      3. On the Log Parsing page, click Parse and Test. See Log standardization test.

        Warning

        The data source's Logstore must contain data. The test cannot run on an empty Logstore.

      4. After the test passes, click Complete, then enable the policy.

    Analyze integrated data

    After integrating product logs, configure threat detection rules to analyze logs, generate alerts, and respond to cloud security risks. See Configure threat detection rules.

    Limitations

    • Scan Query policy limit: A dataset (associated with a standardized rule) supports a maximum of five access policies in Scan Query mode.

    • Multi-account integration:

      • Logs from member accounts can only be ingested using Real-time Consumption. Scan Query is not supported. See Multi-account management.

      • Custom access policies cannot be added for data sources from member accounts.

    • Standardization method restrictions: If the data source type is Agentic SOC Dedicated Collection Channel or the log type is an alert log, only Real-time Consumption is supported.

    Billing

    Log integration fees depend on the data source type.

    Data source type

    Agentic SOC billing

    SLS billing

    Notes

    Agentic SOC Dedicated Collection Channel

    Log ingestion fees + log storage and write fees (consumes Log Ingestion Traffic)

    Internet traffic fees (not storage or writes)

    Agentic SOC creates and manages SLS resources, so Logstore storage and write fees are billed by Agentic SOC.

    User Log Service

    Log ingestion (consumes Log Ingestion Traffic)

    All costs: storage, writes, and data transfer

    SLS manages all log resources and bills all associated fees.

    Security Center Log Service

    Consumes Log Ingestion Traffic

    None

    Internal Security Center logs. No SLS fees apply.

    References

    Standardization method comparison

    Dimension

    Real-time Consumption

    Scan Query

    How it works

    Write-time standardization: Agentic SOC consumes logs from the data source, standardizes them, and stores them in the Agentic SOC log space.

    Schema-on-read: Reads logs directly from the data source without storing replicas.

    Core advantages

    High query performance and fast analysis.

    Lightweight deployment and lower cost.

    Log storage and fees

    If you purchase Log Storage Capacity, standardized logs are automatically delivered to Log Management in Agentic SOC. This delivery consumes your Agentic SOC Log Storage Capacity and cannot be disabled.

    No replicas stored. Raw log storage is billed by the source (SLS).

    Applicable data source types

    Security Center Log Service, User Log Service, Agentic SOC Dedicated Collection Channel

    User Log Service only (excluding alert logs)

    Performance and quota

    No limit on the number of access policies.

    Max five Scan Query policies per dataset; full indexes not available; query performance degrades as scanned data volume grows; parse-json, parse-kv, parse-regexp, parse-csv, expand-values, and let operators are not supported.

    Multi-account access

    Supported

    Not supported

    Scenario restrictions

    Required if the data source is the Agentic SOC Dedicated Collection Channel or the log type is an alert log.

    None

    Data source type comparison

    Dimension

    User Log Service

    Agentic SOC Dedicated Collection Channel

    Security Center Log Service

    Log storage and management

    You manage your own SLS projects and Logstores.

    Agentic SOC automatically creates and manages dedicated SLS projects and Logstores.

    Security Center internal logs; not stored in your SLS.

    Supported standardization methods

    Real-time Consumption, Scan Query (excluding alert logs)

    Real-time Consumption

    Real-time Consumption

    Use cases

    Ingest logs delivered to SLS from Alibaba Cloud products (WAF, CFW, etc.) or collected to SLS from third-party products using Logtail.

    Collect logs from third-party clouds (Tencent Cloud, Huawei Cloud) not already in SLS; collect custom application logs without an existing delivery method.

    Analyze internal Security Center logs.

    References for integrating Alibaba Cloud product logs into SLS

    Log Service (SLS) Log Collection Reference

    FAQ

    • Why does the data source show "Abnormal" or "Not connected"?

      1. Check the AliyunServiceRoleForSas service-linked role first — it must have at least AliyunLogReadOnlyAccess on the SLS Logstore. This is the most common cause.

      2. If permissions are correct, go to the data source edit page in Agentic SOC and verify the Region, Project, and Logstore names (watch for typos and extra spaces).

      3. Finally, log on to the SLS console and confirm the Project is not disabled and new data is being written.

    • Why does the access policy fail to enable?

      Each dataset (StoreView) supports a maximum of five access policies in Scan Query mode. If you've hit this limit, switch the policy's standardization method to Real-time Consumption. See Access policy fails to be enabled.

    • What do I do if the log standardization test fails or data cannot be parsed?

      1. First, confirm the SLS Logstore contains recent data (preferably written within the last hour) — the test cannot run on an empty Logstore.

      2. If the Logstore has data but the test still fails, check whether the SPL statement in your standardization rule correctly parses the raw log format. Debug the SPL statement on the query and analysis page in the SLS console.