You can enable features on the Agent Settings tab to improve the running and detection capabilities of the Security Center agent. The features include client protection, local file detection, and client resource management. This topic describes the features that you can enable on the Agent Settings tab and how to enable the features.
Client Protection
The client protection feature blocks malicious operations that attempt to uninstall the Security Center agent. The feature ensures that Security Center provides stable protection capabilities.
Description
After you enable the client protection feature, Security Center provides default capabilities of security protection for the process files in the directory of the Security Center agent. Security Center also blocks all malicious behavior that attempts to uninstall the Security Center agent but is not performed in the Security Center console. This prevents attackers from gaining access to servers and uninstalling the Security Center agent. This also prevents the Security Center agent from being accidentally terminated by other processes. If the Security Center agent on your server is uninstalled or terminated, Security Center cannot protect your server. We recommend that you enable the client protection feature for all servers.
After you enable the client protection feature for your server, you can uninstall the Security Center agent only by using one of the following methods:
Disable the client protection feature for the server and uninstall the Security Center agent from the server.
Uninstall the Security Center agent in the Security Center console. For more information, see Uninstall the Security Center agent.
If the version of the operating system or kernel used by a server is not supported by the feature, you cannot enable the feature for the server.
Limits
All editions of Security Center support this feature. For more information about the features that are supported by each edition, see Functions and features.
Enable the client protection feature for a server
After you enable the client protection feature, the feature protects all servers that are within the protection scope and have the Security Center client installed.
Log on to the Security Center console. In the top navigation bar, select the region of the asset that you want to manage. The following regions are supported: China and Outside China.
In the left-side navigation pane, choose .
Click the tab. In the Client Protection section, turn on Defense mode.
Click Manage to the right of Protection Scope.
In the Client Protection panel, select the servers for which you want to enable the client protection feature and click OK.
NoteIf you enable the client protection feature for a server, the feature immediately takes effect. If you disable the client protection feature for a server, the feature remains in effect for 5 minutes and then becomes invalid.
Check whether the client protection feature is enabled
You can perform the following steps to check whether the client protection feature is enabled for a server:
Log on to the Security Center console. In the top navigation bar, select the region of the asset that you want to manage. The following regions are supported: China and Outside China.
In the left-side navigation pane, choose .
On the page that appears, find the required server and click the server name or click View in the Actions column.
On the server details page, click the Basic information tab. On the tab that appears, click Detail. In the Defensive status section, view the status of Client Protection.
Local File Detection Engine
The local file detection engine is a high-efficiency and low-cost engine that is developed by Alibaba Cloud Security Center to detect threats in files. The local file detection engine is efficient and can reduce performance loss that is caused by data upload and data interaction in threat detection and removal.
If you enable local file detection for a server, threats in the files on the server are detected by using local file detection and cloud file detection engines. The local file detection engine is preferentially used to detect threats. If no threats are detected in a file, the file is uploaded to the cloud for further threat detection.
Limits
Only the Enterprise and Ultimate editions of Security Center support this feature. For more information about how to purchase and upgrade Security Center, see Purchase Security Center and Upgrade and downgrade Security Center.
Enable the local file detection feature for a server
Log on to the Security Center console. In the top navigation bar, select the region of the asset that you want to manage. The following regions are supported: China and Outside China.
In the left-side navigation pane, choose .
Click the tab. In the Local File Detection Engine section, turn on File Test.
Click Manage to the right of Installation Scope.
In the Local File Detection Engine panel, select the server for which you want to enable the local file detection feature and click OK.
Client Resource Management
The Security Center agent is a plug-in that you can install on servers. Before you can use Security Center to protect your servers, you must install the Security Center agent on the servers. Security Center supports multiple agent running modes to meet your security requirements in different scenarios. For more information about the Security Center agent, see Overview.
Supported running modes
When the Security Center agent runs on a server, the agent consumes a small number of server resources. You can change the running mode of the agent to limit the number of resources that the agent can consume. You can select a suitable running mode for a server to enhance security.
If the memory usage or CPU utilization of the Security Center agent exceeds the maximum threshold that you specify in the running mode of the agent, the agent is suspended. When the CPU utilization or memory usage falls below the specified threshold, the agent automatically restarts.
Running mode | Maximum memory usage or CPU utilization | Supported edition | Scenario |
Low Consumption Mode |
| All editions | This mode is suitable for scenarios that have basic security requirements. In this mode, the Security Center agent can automatically downgrade the features that consume a large number of resources. However, threats may not be detected at the earliest opportunity. We recommend that you enable the smooth mode. Note By default, the low consumption mode is enabled for newly added assets. |
Smooth Mode |
| Anti-virus, Advanced, Enterprise, and Ultimate | This mode is suitable for scenarios in which important workloads need to be protected. In this mode, the Security Center agent consumes more resources to collect data and detect risks at the earliest opportunity. |
Custom Mode |
| Enterprise and Ultimate | This mode is suitable for major event protection. In this mode, you can control the memory usage and CPU utilization in a flexible manner. You can also configure the file collection frequency. Important If you set the thresholds to values that are too small, several detection capabilities may become invalid. Proceed with caution. |
Configure a running mode
Log on to the Security Center console. In the top navigation bar, select the region of the asset that you want to manage. The following regions are supported: China and Outside China.
In the left-side navigation pane, choose .
Click the tab. In the Client Resource Management section, click Manage to the right of Smooth Mode or Custom Mode.
In the Smooth Mode or Custom Mode panel, select the servers for which you want to enable the mode and click OK.
You can manually enable only Smooth Mode or Custom Mode for a server. For example, if you enable Custom Mode for a server that is protected in Smooth Mode, the running mode for the server changes to Custom Mode.
NoteIn Custom Mode, more types of threats can be detected, and more alerts are triggered. As a result, the false positive rate may increase. We recommend that you pay attention to alerts and handle the alerts at the earliest opportunity.
Optional. Change the thresholds for memory usage and CPU utilization. You can perform this step if you enable Custom Mode for a server.
The higher the thresholds for memory usage and CPU utilization, the more efficiently Security Center protects your assets. We recommend that you set the thresholds to appropriate values.
Agent Communication Management
You can change the frequency threshold for file collection by the Security Center agent based on your business requirements. This way, the Security Center agent can collect data while minimizing resource consumption.
If you enable Custom Mode in the Client Resource Management section and set File Collection Bandwidth to a value that is too small, files may not be collected at the earliest opportunity. We recommend that you set File Collection Bandwidth to an appropriate value.
Log on to the Security Center console. In the top navigation bar, select the region of the asset that you want to manage. The following regions are supported: China and Outside China.
In the left-side navigation pane, choose .
Click the tab. In the Agent Communication Management section, configure File Collection Bandwidth.
If you select Custom, you can specify the frequency at which the agent collects files from servers. Valid values: 100 to 10000. Unit: times per second.
If you select Unlimited, the frequency at which the agent collects files from servers is not limited.