You can enable features on the Agent Settings tab to ensure the running and detection capabilities of the Security Center agent. The features refer to client protection and local file detection. This topic describes the features that you can enable on the Agent Settings tab. This topic also describes how to enable the features.
Client Protection
The client protection feature blocks malicious operations that attempt to uninstall the Security Center agent. The feature ensures that Security Center provides stable protection capabilities.
Description
After you enable the client protection feature, Security Center provides default capabilities of security protection for the process files in the directory of the Security Center agent. Security Center also blocks all malicious behavior that attempts to uninstall the Security Center agent but is not performed in the Security Center console. This prevents attackers from gaining access to servers and uninstalling the Security Center agent. This also prevents the Security Center agent from being accidentally terminated by other processes. If the Security Center agent on your server is uninstalled or terminated, Security Center cannot protect your server. We recommend that you enable the client protection feature for all servers.
After you enable the client protection feature for your server, you can uninstall the Security Center agent only by using one of the following methods:
Disable the client protection feature for the server and uninstall the Security Center agent from the server.
Uninstall the Security Center agent in the Security Center console. For more information, see Uninstall the Security Center agent.
If the version of the operating system or kernel used by a server is not supported by the feature, you cannot enable the feature for the server.
Limits
All editions of Security Center support this feature. For more information about the features that are supported by each edition, see Functions and features.
Enable the client protection feature for a server
After you enable the client protection feature, the feature protects all servers that are within the protection scope and have the Security Center client installed.
Log on to the Security Center console. In the top navigation bar, select the region of the asset that you want to manage. The following regions are supported: China and Outside China.
In the left-side navigation pane, choose .
Click the tab. In the Client Protection section, turn on Defense mode
On the right of Protection Scope, click Manage.
In the Client Protection panel, select the servers for which you want to enable the client protection feature and click OK.
NoteIf you enable the client protection feature for a server, the feature immediately takes effect. If you disable the client protection feature for a server, the feature is still in effect for 5 minutes and then becomes invalid.
Check whether the client protection feature is enabled
You can use one of the following methods to check whether the client protection feature is enabled for a server:
Log on to the Security Center console. In the top navigation bar, select the region of the asset that you want to manage. The following regions are supported: China and Outside China.
In the left-side navigation pane, choose .
On the page that appears, find the required server and click the server name or click View in the Actions column.
On the server details page, click the . In the Defensive status section, view the status of Client Protection.
Local File Detection Engine
The local file detection engine is a high-efficiency and low-cost engine that is developed by Alibaba Cloud Security Center to detect threats in files. The local file detection engine is efficient and can reduce performance loss that is caused by data upload and data interaction in threat detection and removal.
If you enable local file detection for a server, threats in the files on the server are detected by using local file detection and cloud file detection engines. The local file detection engine is first used to detect threats. If no threats are detected in a file, the file is uploaded to the cloud for further threat detection.
Limits
Only the Enterprise and Ultimate editions of Security Center support this feature. For more information about how to purchase and upgrade Security Center, see Purchase Security Center and Upgrade and downgrade Security Center.
Enable the local file detection feature for a server
Log on to the Security Center console. In the top navigation bar, select the region of the asset that you want to manage. The following regions are supported: China and Outside China.
In the left-side navigation pane, choose .
Click the tab. In the Local File Detection Engine section, turn on File Test.
On the right of Installation Scope, click Manage.
In the Local File Detection Engine panel, select the server for which you want to enable the local file detection feature and click OK.