Security Center:Agentless detection

Activate the service

1. Activate the service

   1. Log on to the Security Center console. In the top navigation bar, select the region where your assets are located: Chinese Mainland or Outside Chinese Mainland.

   2. In the navigation pane on the left, choose Protection Configuration > Host Protection > Agentless Detection. On the page that appears, click Activate Now and agree to the terms of service.

      Important

      Agentless detection uses a pay-as-you-go billing method.

2. Complete service authorization (first-time users only)

   The first time you use this feature, the system prompts you to authorize a service-linked role. Follow the on-screen instructions and click Authorize Now.

   Note

   After the authorization is successful, Security Center automatically creates the AliyunServiceRoleForSas service-linked role. For more information about AliyunServiceRoleForSas, see Service-linked role for Security Center.

Create and run a detection task

Manage detection tasks

Analyze and handle risks

After a task is successfully completed, you can view and handle the detected security risks on the Agentless Detection page.

1. View risk details

   On the Agentless Detection page, go to the tab for the relevant detection policy, such as Server Check. Then, go to the tab for the target risk type, such as Vul Risk. In the list, find the target risk item and click View or Details in its Actions column to view specific information.

2. Handle risk alerts

   Vulnerability risks

   • How to handle: Find the vulnerability that you want to handle and click Add to Whitelist in the Actions column.

     Warning

     Agentless detection does not support vulnerability fixing.

   • Supported action: Add to whitelist.

     Important

     • This action adds the specified vulnerability to the whitelist. You will no longer receive alerts for the vulnerability. Proceed with caution.

     • After you add a vulnerability to the whitelist, the system automatically synchronizes this setting to the Scan Configuration > Manage Whitelist > Vulnerability Whitelist tab. You can view the added whitelist rules on the corresponding tab.

   Baseline checks

   • How to handle: In the list of check items, find the item that you want to handle and click Add to Whitelist in the Actions column.

   • Supported action: Add to whitelist.

     Important

     • After you add a check item to the whitelist, this check is no longer performed on new servers. Proceed with caution.

     • After you add a check item to the whitelist, the system automatically synchronizes this setting to the Scan Configuration > Manage Whitelist > Baseline Whitelist tab. You can view the added whitelist rules on the corresponding tab.

   Malicious samples

   • How to handle: In the alert list, find the alert that you want to handle and click Change Status or Handle in the Actions column.

   • Supported actions:

     • Add to Whitelist: If you confirm that the file is not malicious, you can add the alert to the whitelist based on the whitelist rules and their scope.

       Important

       • If you add an alert to the whitelist, any future occurrences of the same alert are automatically moved to the processed list, and you no longer receive notifications. Proceed with caution.

       • You can handle identical alerts in batches. The supported actions vary based on the alert type. For more information, see the console.

       • After you add an alert to the whitelist, the system automatically synchronizes this setting to the Scan Configuration > Manage Whitelist > Malicious Sample Whitelist tab. You can view the added whitelist rules on the corresponding tab.

     • Manually Handled: After you manually resolve the risk that caused the alert, you can mark the alert as Manually Handled.

     • Mark as False Positive: You can mark this alert as a false positive. Security Center uses your feedback to continuously optimize its scanning capabilities.

     • Ignore: This action ignores only the current alert. If the same issue is detected again, a new alert is generated.

   Sensitive files

   • How to handle:

     1. In the sensitive file alert list, find the alert that you want to handle and click Details in the Actions column to view a detailed description and hardening suggestions.

     2. In the risk list of the details panel, click Handle in the Actions column. In the dialog box that appears, select how to handle the alert and click OK.

   • Supported actions:

     • Add to Whitelist: If you confirm that the file is not malicious, you can add the alert to the whitelist based on the following rules:

       Important

       • If you add an alert to the whitelist, any future occurrences of the same alert are automatically moved to the processed list, and you no longer receive notifications. Proceed with caution.

       • You can configure multiple rules. All rules have an AND relationship. This means that all conditions must be met for the alert to be whitelisted.

       • After you add an alert to the whitelist, the system automatically synchronizes this setting to the Scan Configuration > Manage Whitelist > Sensitive File Whitelist tab. You can view the added whitelist rules on the corresponding tab.

       • MD5: For the wildcard character, you can select only equals and then enter the MD5 hash of the file.

       • Path: For the wildcard character, you can select contains, prefix, or suffix and then enter the specific path.

     • Manually Handled: After you manually resolve the risk that caused the alert, you can mark the alert as Manually Handled.

     • Mark as False Positive: You can mark this alert as a false positive. Security Center uses your feedback to continuously optimize its scanning capabilities.

     • Ignore: This action ignores only the current alert. If the same issue is detected again, a new alert is generated.

Set detection whitelists

1. On the Agentless Detection page, click Scan Settings and go to the Manage Whitelist tab.

2. Based on the risk type, click Create Rule on the corresponding tab.

3. Configure the whitelist rule as described below.

   Important

   The following whitelist configurations apply to all assets.

   Vulnerability whitelist

   • Vulnerability Type: Only Linux Software Vulnerability, Windows System Vulnerability, and Application Vulnerability are supported.

   • Vulnerability Name: The system retrieves the latest vulnerability data based on the selected Vulnerability Type.

   Malicious sample whitelist

   • Alert Name: The default value is ALL, which means the whitelist rule applies to all types of alerts. This cannot be modified.

   • Whitelist Field: The default value is fileMd5, which means the MD5 hash of the file is whitelisted. This cannot be modified.

   • Wildcard Character: You can select only equals.

   • Rule Content: Enter the MD5 hash of the file.

   Baseline whitelist

   • Check Item Type: Specify the baseline check items that you do not want to scan.

   • Check Item: The check items that are pulled depend on the selected Check Item Type.

   Sensitive file whitelist

   • Check Item for Sensitive Files: Specify the items that you do not want to scan.

   • Configure Whitelist Conditions:

     Note

     You can configure multiple rules. All rules have an AND relationship. This means that all conditions must be met for the alert to be whitelisted.

     • MD5: For the wildcard character, you can select only equals and then enter the MD5 hash of the file.

     • Path: For the wildcard character, you can select contains, prefix, or suffix and then enter the specific path.

Connect and detect multicloud assets

Agentless detection supports connecting to Amazon Web Services (AWS) in regions Outside Chinese Mainland. To connect, perform the following steps:

1. Prepare AWS access credentials In your AWS account, create an IAM user with programmatic access and obtain the Access Key ID and Secret Access Key. Ensure that this user has permissions to access and create EC2 snapshots.

   Important

   To use the Agentless Detection feature, you must create a custom IAM policy with specific permissions for Security Center in your AWS account. For more information, see Create a custom policy for agentless detection.

2. Configure the connection solution

   1. In the upper-left corner of the console, select the Outside Chinese Mainland region.Agentless Detection On the Server Check tab, in the Add Multi-cloud Asset section, click Access below the icon.

   2. On the Add Assets Outside Cloud page, on the Create Sub-account tab, configure the parameters as described below and click Next.

      • Solution: Manual Configuration.

      • Permission Description: Select Agentless Detection.

3. Submit credential information

   On the Submit AccessKey Pair tab, accurately enter the credential information that you created in your AWS account and click Next.

   1. RAM User SecretID and RAM User SecretKey: Enter the AWS RAM user API key information that you obtained in Step 1.

   2. Provisioning Region: Select an available region. The system uses the selected region to verify asset accessibility and retrieve the corresponding cloud resource data.

   3. Domain: Configure this parameter based on the selected provisioning region. For AWS China regions, select China. For all other regions, select International.

4. Policy configuration

   On the Policy Configuration tab, configure the parameters as described below.

   • Select region: Select the regions of the AWS assets that you want to provision.

     Note

     The asset data is automatically stored in the data center that corresponds to the region selected in the upper-left corner of the Security Center console.

     • Chinese Mainland: Data centers located in the Chinese mainland.

     • Outside Chinese Mainland: The data center is in Singapore.

   • Region Management: Select this option. When selected, assets in new regions for this AWS account are automatically synchronized and do not need to be added manually.

   • AK Service Status Check: You can set the interval at which Security Center automatically checks the validity of the API key for the AWS account, or select "Shutdown" to disable the check.

5. Click OK.

   After you complete the permission verification and policy configuration, you can create agentless detection tasks for your AWS EC2 instances.

Detection capabilities

The following table lists the main detection items that are supported by agentless detection.

Supported operating systems for vulnerability scans