Security Center:Configure and run image security scans

Configure scan parameters

On the Scan Configuration tab, set the following parameters:

Parameter	Description
Consumed quota/Purchased quota	The number of scans performed versus the total purchased. If the quota is running low, click Scale Out to purchase more.
Scan Cycle	The frequency for periodic scans. This setting has no effect on manual scans.
Scan Scope	The image repositories to include. Click Manage, select repositories in the Image Management dialog box, and click OK. By default, Automatically Adds New Image Repositories For Scan is enabled — new repositories are automatically added to the periodic scan scope. Click the icon to disable this if needed.
Scan Time Range	Scans images based on their last local update time. If no update time is available, the local creation time is used. For example, with Last 7 Days selected, images last updated more than 7 days ago are excluded — the task status shows as successful, but with 0 successful scans.
Vulnerability Retention Period	How long periodic scan results are retained. Security Center automatically deletes results older than this period.

Manage image repositories

Click the Image Repository tab to view connected repositories:

• acr and defaultAcr types: Container Registry Enterprise Edition instances automatically synced from your Alibaba Cloud account. These cannot be removed from the list.

• harbor, quay, and gitlab types: Private repositories you have connected manually.

From this tab you can:

• Add a repository: Click Add Image Repository to connect a private repository not yet in the list. For more information, see Add image repositories.

• Remove a repository: In the Actions column for the target repository, click Remove, then click OK.

• Set Harbor throttling: For Harbor repositories, click Edit in the Actions column and set the Throttling rate (images scanned per hour, default: 10). Increase this value if you have many images and need them all scanned within the 4-hour window. For example, a Harbor repository with 200 images at the default rate of 10 per hour takes 20 hours — exceeding the timeout, so many images would not be scanned. Setting it to 200 reduces that to 1 hour.

• Monitor sync progress: Click Task Management in the upper-right corner and check the Container Asset Synchronization and Image Asset Synchronization tabs to confirm repositories are ready before running a scan.

Configure baseline checks

1. In the Scan Settings panel, click the Baseline Configuration Management tab.

2. Click Manage to the right of Configuration Scope.

3. In the Baseline Check Scope panel, select the baselines to check, then click Confirm.

Once configured, the selected baselines are checked whenever you run a manual scan or a periodic scan starts.

Configure container runtime image scans

Container runtime image scans detect vulnerabilities in images running in live containers. Only manual scans are supported.

1. In the Scan Settings panel, click the Container Runtime Image Scan tab.

2. Click Configure Scan Scope. In the dialog box, select the cluster and application name to scan, then click OK.

3. Click Scan Now to start the scan immediately.

After the scan completes, go to Task Management > Container Runtime Image Scan to view progress, then check the Image Vulnerability Risk tab on the Container Image Scan page for detected vulnerabilities.

Configure sensitive file scans

Security Center can detect sensitive data in image layers, including application configuration files with embedded credentials, certificates and keys, authentication tokens, and access keys from cloud providers.

1. In the Scan Settings panel, click the Sensitive File Scan Settings tab.

2. Click Manage to the right of Configuration Scope.

3. In the Sensitive File Scan Settings panel, select the check items to include.

1. Toggle the sensitive file detection switch to enable it.

When enabled, sensitive file scans run alongside vulnerability and baseline scans — both on Scan Now and during periodic scans.

Configure the at-risk file whitelist

If a specific sensitive file, build instruction risk, or malicious sample alert is expected or acceptable, add it to the whitelist. Security Center stops generating alerts for whitelisted items.

The whitelist is populated from alerts you dismiss on the Malicious Image Sample, Sensitive Image File, and Image Build Command Risks tabs. You cannot configure the whitelist before running your first scan.

1. In the Scan Settings panel, click the At-risk File Whitelist Configuration tab.

2. On the Sensitive File, Container Build, or Malicious Sample tab, find the target alert type and:

   • Edit: Click Edit in the Actions column, then set the whitelist scope to All Image Repositories or Current Image Repository Only.

   • Delete: Click Delete in the Actions column to remove the alert type from the whitelist. Security Center resumes detecting and alerting on that risk.

Configure automatic vulnerability fixing

Security Center can automatically fix system vulnerabilities in Container Registry Enterprise Edition (ACR Enterprise Edition) image repositories.

1. In the Scan Settings panel, click the Image Risk Fixing Configuration tab.

2. Click the Fixing Configuration switch to enable automatic fixing.

3. Set the following parameters:

   Parameter	Description
   Fixing Period	How often Security Center applies fixes.
   Fixing Scope	Which image repositories in your ACR Enterprise Edition instance to fix.
   Time Range	Only images updated within this period are fixed. If an image has never been updated, its creation time is used. For example, with 7 Days selected, only images updated in the last 7 days receive fixes.

After enabling, Security Center applies fixes when a manual scan runs or when a periodic scan task starts. To check remediation status, go to Task Management > Image Remediation.

Configure the vulnerability whitelist

To exclude a specific vulnerability from scans, add it to the vulnerability whitelist. Security Center stops generating alerts for whitelisted vulnerabilities.

1. In the Scan Settings panel, click the Vulnerability Whitelist Settings tab.

2. Manage whitelist rules:

   • Create a rule: Click Create Rule, then configure the whitelist scope and applicable vulnerability types.

   • Edit a rule: Click Edit in the Actions column to update Rule Scope, Image Selection, or Note.

   • Delete a rule: Click Delete in the Actions column. Security Center resumes detecting and alerting on that vulnerability.

3. Click the icon in the upper-right corner of the Scan Settings panel to close it.