Security Center:Log management

Enable Log Management

Log Management can be enabled using either the subscription or pay-as-you-go billing method.

1. Log on to the Security Center consoleSecurity Center console.Log on to the Security Center console.

2. In the left navigation pane, choose Detection and Response > Log Management. In the upper-left corner, select the region where your assets are located: Chinese Mainland or Outside Chinese Mainland.

   If you have purchased Agentic SOC log ingestion traffic on a subscription basis or enabled pay-as-you-go for Agentic SOC, the navigation entry changes to Agentic SOC > Log Management.

3. On the Log Management page, click Activate Subscription or Activate Pay-as-you-go.

   • Subscription: On the purchase page, under Agentic SOC, set Purchase or Not to Yes, select the log storage capacity, click Order Now, and complete the payment. See Purchase Security Center for details on other purchasable features.

   • Pay-as-you-go: In the dialog box, read the billing rules, select a storage region, and click Activate and Authorize.

   If you have already purchased Agentic SOC log ingestion traffic, click Enable Pay-as-you-go for Log Management in the upper-right corner of the page, or upgrade your service to add log storage capacity for Agentic SOC. See Upgrades and downgrades.

Disable Log Management

1. Log on to the Security Center consoleSecurity Center console.Log on to the Security Center console.

2. In the left navigation pane, choose Agentic SOC > Log Management. In the upper-left corner, select the region where your assets are located: Chinese Mainland or Outside Chinese Mainland.

3. On the Log Management page, verify that Log Usage shows 0 GB. If log usage is not 0, click Clear in the upper-right corner, wait for the logs to be cleared, then continue.

4. Disable the service based on your billing method:

   • Subscription

     • Method 1 — Downgrade:

       1. On the Overview page, click Change > Downgrade.

       2. On the Order Downgrade tab, set Log Storage Capacity in the Agentic SOC section to 0 GB.

          

       3. Accept the Security Center Service Agreement and click Order Now.

     • Method 2 — Unsubscribe: Submit a ticketticket to unsubscribe from your Security Center instance.

   • Pay-as-you-go: On the Overview page of the Security Center console, in the Pay-as-you-go section, turn off the Log Management switch. > Warning: Turning off the Log Management switch automatically disables log delivery and deletes the corresponding Logstore. Deleted log data cannot be recovered.

Using Agentic SOC log ingestion traffic without log storage capacity

If you have purchased Agentic SOC log ingestion traffic (subscription or pay-as-you-go) but have not purchased log storage capacity, you can query a subset of standardized logs on the Log Management page — specifically, logs from access policies where Standardization Method is set to Scan Query.

In this configuration:

• Security Center logs cannot be delivered or viewed.

• Standardized logs from Real-time Consumption access policies cannot be delivered or viewed.

For a full comparison of features available under different billing configurations, see Purchase and enable the Agentic SOC feature.

Enable log delivery

After you purchase log storage capacity, Agentic SOC enables delivery for all Security Center log types by default. If you have not purchased the corresponding value-added services (such as application protection or malicious file detection), the delivery switches for those log types remain disabled.

Click Log Settings on the Log Management page to view and update delivery status for each log type.

Query Security Center logs

The method for querying logs in the Log Management feature is the same as that in the Log Analysis feature of Security Center. For more information, see Custom log query and analysis.

1. In the left navigation pane, choose Agentic SOC > Log Management. In the upper-left corner, select the region where your assets are located.

2. In the upper-left corner of the Log Management page, click Security Center Logs and select the log type to view.

   

3. Set a time range and use search statements to retrieve logs and view analysis results.

How delivery works

Standardized logs are produced when Agentic SOC normalizes ingested logs into a common schema. Delivery is automatic — you cannot enable or disable it manually. Delivery is triggered in two scenarios:

• When an access policy's Standardization Method is set to Real-time Consumption, Agentic SOC delivers the normalized logs to the corresponding Logstore, organized by standardized category. A log delivery task is created automatically when you create the access policy.

• When custom rules generate alert logs (such as EDR alert logs or firewall alert logs), those logs are also delivered automatically.

On the Standardized Log tab of the Log Settings panel, the Number of references column shows how many access policies with Real-time Consumption are associated with each standardized category and structure.

Query standardized logs

Agentic SOC supports searching logs by standardized structure and querying across multiple Logstores using datasets (StoreView). For cross-Logstore query and analysis examples, see Common query/analysis result examples.

Modify the log retention period

The default retention period for delivered logs is 180 days. Modify it as needed to meet your compliance or cost requirements.

1. In the left navigation pane, choose Agentic SOC > Log Management. In the upper-left corner, select your region.

2. In the upper-right corner of the Log Management page, click Log Settings.

3. On the Security Center Logs or Standardized Log tab, click the icon in the Log Retention Period column to update the value.

Increase or clear storage capacity

On the Agentic SOC > Log Management page, you can view your current log usage and total purchased capacity.

• Scale Out: Click Scale Out to purchase additional log storage capacity. Make sure you have sufficient capacity — when it is exhausted, new logs cannot be stored.

• Clear: Click Clear to delete all stored logs. The deletion process takes 0–24 hours.

Why can't I enable pay-as-you-go billing for Log Management?

There are three common reasons:

Reason 1: You have an active subscription for Agentic SOC log storage or log analysis.

Unsubscribe from the existing subscription, then enable pay-as-you-go for Log Management.

Reason 2: Your Agentic SOC feature is on the 1.0 architecture.

Upgrade the Agentic SOC feature from 1.0 to 2.0, then enable pay-as-you-go for Log Management.

If you prefer not to upgrade to the 2.0 architecture, you can still use Log Management by purchasing log storage capacity on a subscription basis.

Reason 3: You purchased Agentic SOC log storage on or before April 26, 2024.

After upgrading to the 2.0 architecture, your original subscription capacity is preserved and Log Management continues to work normally. To switch from subscription to pay-as-you-go, follow the steps for Reason 1. For architecture upgrade details, see [Notice] Upgrade of the Agentic SOC feature.

What is the difference between Log Analysis and Log Management?

Both features provide security log query and analysis in Security Center, but they differ in scope and flexibility.

Use Log Management if you need standardized log storage, flexible billing, or configurable retention — for example, to meet classified protection compliance requirements.