Security Center:Proactive Container Defense

Supported clusters

Risk Image Blocking currently supports only some cluster types of Container Service for Kubernetes (ACK). The following table describes the supported cluster types.

How it works

After you create a Risk Image Blocking rule for a cluster, Security Center intercepts each request to create resources (such as pods) using images in the cluster and validates the image against the risks configured in the rule. If the image matches the rule, Security Center performs the alert, intercept, or allow action and generates a security event for alert and intercept actions.

If multiple rules are configured for the same cluster, all rules take effect. If an image matches multiple rules, multiple alerts are generated and the corresponding actions are performed.

If you configure multiple items in the same rule, Security Center immediately performs the rule action when any item matches and does not continue to match other items. The matching sequence of items in a rule is: Unscanned Image, Baseline, Malicious Internet Image, Malicious Sample, Vulnerability, Sensitive File, and Build Risk Exists.

Prerequisites

Before creating a defense rule, make sure that you have installed the policy governance components in the ACK console: gatekeeper, policy-template-controller, and logtail-ds. For more information, see Step 1: Install or upgrade policy governance.

Create a rule

1. Log on to Security Center console.

2. In the left-side navigation pane, choose Protection Configuration > Container Protection > Proactive Defense for Containers. In the upper-left corner of the console, select the region where the asset to be protected is located: Chinese Mainland or Outside Chinese Mainland.

3. Select the Risk Image Blocking rule type and click Create Rule.

   If you have already created defense rules for the cluster, you can also quickly create a new rule by copying an existing rule. Click Copy in the Actions column of an existing rule, modify the rule configuration in the Copy Rule panel based on your business needs, and then click OK to create the rule.

4. In the Create Rule panel, define the rule and click Next.

   Parameter	Description
   Rule Name	Select a rule template from the drop-down list and enter a name. You can select Blank template to create a set of custom configuration items, or select a template that contains a set of predefined risk configuration items.
   Rule Description	Enter a description for the rule.
   Rule Configuration	The following rule configurations are supported. Select the corresponding check box to enable detection, and clear the check box to disable detection. Unscanned Image ： : After this option is enabled, Security Center detects the start of images that have not been scanned by the image security scan feature. Important When this option is enabled, we recommend that you set the rule action to Alert first. If you have stricter security control requirements, observe the alert events for a period and confirm that the rule does not affect normal business before switching to Block. Malicious Internet Image ： : After this option is enabled, Security Center detects the start of images marked as malicious on the Internet, such as malicious images downloaded from public image repositories or images pulled from Docker Hub public repositories that contain backdoors, trojans, or other malicious programs. Baseline ： : After this option is enabled, Security Center checks whether container images comply with predefined security configuration standards and best practices. Vulnerability ： : After this option is enabled, Security Center detects vulnerabilities in images that may cause security risks in container environments, including application-related vulnerabilities in images. Malicious Sample ： : After this option is enabled, Security Center detects malicious files, malicious code, and malicious behaviors that may exist in container images and at container runtime. Sensitive File ： : After this option is enabled, Security Center detects common sensitive files. Built Risks Exist ： : After this option is enabled, Security Center detects image build command risks. Important After an image matches the corresponding rule, Security Center generates an alert based on the rule configuration and performs the corresponding action based on the rule action. You can configure specific detection rules for baseline, vulnerability, malicious sample, sensitive file, and build risk exists based on your business needs. The optional conditions for each type of rule configuration item are in an OR relationship. For example, in the vulnerability configuration, if you set the risk level to High and specify specific CVE ID , the rule is matched if the started image contains high-risk vulnerabilities or the CVE IDs you specified.
   Rule Action	Select the action that Security Center performs when an enabled detection rule is matched. Options: Alerts: After the image starts, on the Alert page, an event with the action Rule Action Alerts is generated. Block: When the image starts, images that match the rule are blocked from starting, and on the Alert page, an event with the action Rule Action Block is generated. Allow: After the image starts, on the Alert page, an alert with the action Rule Action Allow is generated.
   Add to Whitelist	Click Create Rule and enter the image tag name to add to the whitelist. Up to 20 whitelist entries are supported. After an image is added to the rule whitelist, Security Center does not validate the security risks of the image when it starts. Fuzzy matching by keyword is supported. For the image address yundun-example-registry.cn-hangzhou.aliyuncs.com/yundun-example/yun-repo:test, you can enter partial keywords for fuzzy matching. The following whitelist configurations can match the image address: yun-repo test yun-repo:test repo:test

5. Select the protection scope and click OK.

   Click the Cluster, Image, or Tag tab to switch to the corresponding tab and select the assets to protect.

View alerts

After you create a risk image blocking rule, go to the Security Center console, Detection and Response > Alerts page, set the alert type to Risk Image Blocking to view the relevant alerts. You can click Actions in the target alert row and then click Details to handle the risk event based on the Suggestions on the alert details page.

Manage rules

After you create a risk image blocking rule, you can perform the following operations:

• View protection scope

  Click the number in the Protection Scope column of the target rule to view the clusters, images, and tags protected by the rule in the Protection Scope panel.

• Edit rule

  Click Edit in the Actions column of the target rule to modify the rule definition and protection scope in the Edit Rule panel.

• Copy rule

  Click Copy in the Actions column of the target rule to modify the rule definition and protection scope in the Copy Rule panel and quickly create a new rule.

• Delete rule

  Important

  After a rule is deleted, protection for the clusters in the protection scope becomes invalid and the rule cannot be restored. Proceed with caution.

  Click Delete in the Actions column of the target rule, and click OK in the dialog box to delete the rule.

Container image restrictions for rule activation

Container images in rules must meet the following requirements. Otherwise, the defense rules and whitelist rules cannot be triggered for the container images.

• The full path length of a program running in a container cannot exceed 1,023 characters.

• The namespace length of a container cluster cannot exceed 287 characters.

• The Security Center client processes in the container must be AliYunDun ≥ aegis_12_13 and AliHips ≥ 00_43.

• For container images in whitelist rules, make sure that the container image name does not exceed 287 characters.

Manage system rules

• Rule enablement

  • Security Center provides a default non-image program defense system rule and enables it by default for users who have not configured custom non-image program defense rules. The system rule generates alerts for non-image program starts in all clusters connected to Security Center.

  • You can manually enable or disable the system rule.

• Rule action

  The system rule action is Alert, which means Security Center only generates alerts and does not intercept when non-image program starts occur.

• View rule

  You can view the non-image program defense system rule on the Security Center console Protection Configuration > Container Protection > Proactive Defense for Containers page, under the Non-image Program Defense rule's System Rules tab.

• Rule update

  You can modify the cluster scope in which the system rule takes effect. If clusters change or new cluster assets are added, the system rule automatically adds the new clusters to the protection scope.

• Rule usage

  • When you use the non-image program defense feature for the first time, we recommend that you fully observe whether the system rule alerts have false positives.

  • The system rule does not support whitelists or intercepting risky behaviors. If you need to configure a whitelist or intercept risky behaviors, create a custom rule.

  • After you create a custom rule, the system rule is automatically disabled and cannot be re-enabled. To enable the system rule, delete all custom rules.

Create a custom rule

1. Log on to Security Center console.

2. In the left-side navigation pane, choose Protection Configuration > Container Protection > Proactive Defense for Containers. In the upper-left corner of the console, select the region where the asset to be protected is located: Chinese Mainland or Outside Chinese Mainland.

3. In the rule type list, click Non-image Program Defense.

4. On the Custom Rules tab, click Create Rule.

5. In the Create Rule panel, define the rule and click Next.

   Parameter	Description
   Rule Name	Enter a rule name.
   Rule Description	Enter a rule description.
   Status	Turn the rule on or off. Options: On: The rule is enabled after creation and automatically protects clusters in the protection scope. Off: The rule is disabled after creation and does not take effect.
   Defense Action	Select the defense action of the rule. Options: Alerts: Security Center only generates an alert when an untrusted process is detected. Block: Security Center generates an alert and intercepts the process when an untrusted process is detected. Note We recommend that you enable Alert mode first. After confirming that normal business does not install or start executable programs outside the image during container runtime, enable Block mode to avoid false interception of normal processes.
   Create File Directory Whitelist	Click Create Rule and enter the file directory to add to the whitelist. Example: /user/name1.
   Create Image Whitelist	Click Create Rule and enter the image name to add to the whitelist. For the image address yundun-example-registry.cn-hangzhou.aliyuncs.com/yundun-example/yun-repo:test, you can enter partial keywords for fuzzy matching. The following whitelist configurations are valid: yun-repo test yun-repo:test repo:test

6. Click OK to confirm the creation of the custom rule. The system rule is automatically disabled.

7. Select the clusters in which the rule takes effect and click OK.

   You can select clusters connected to Security Center. Only one defense rule can be configured for each cluster. If a cluster is already in the protection scope of another rule, you cannot select it again.

View alerts

After you create and enable a non-image program defense rule, go to the Security Center console Detection and Response > Alerts page, set the alert type to Proactive Defense for Containers, and look for alerts with the name Non-image program start. These are the alerts generated by the non-image program defense feature. The following alerts are generated based on the defense action configured in the rule:

• For rules with the defense action Alerts, the security alerts are in the Unhandled state. We recommend that you handle these alerts promptly. For more information, see Evaluate and handle security alerts. When filtering, set Handled to Unhandled and use the Severity tags (Urgent, Suspicious, Reminder) to further filter. Eligible alerts are displayed in a list, including severity, alert name, affected asset, and latest occurrence time. You can click Handle or Details to perform operations.

• For rules with the defense action Block, the alerts are in the Process Not Exists or Process Terminated state. Security Center has automatically handled these alerts, and you can view them in the handled alert list. The following describes the two states:

  • Process Not Exists: The process existed for a short time and stopped running before Security Center handled it. No further action is required.

  • Process Terminated: Security Center has intercepted the process and no manual action is required.

  Set Handled to Handled and Alert Type to Container Active Defense. The list displays alerts such as Non-image program start and their handling status.

Manage rules

After you create a rule, you can perform the following operations in the non-image program defense rule list:

• View protection scope

  Click the number in the Protection Scope column of the target rule to view the cluster scope protected by the rule in the Protection Scope panel.

• Enable or disable rule

  Turn the switch in the Enable column of the target rule on or off to enable or disable the rule.

• Edit rule

  Click Actions in the target rule row and then click Edit. Custom rules support modifying the rule name, description, status, defense action, whitelist settings, and protection scope.

• Delete rule

  Important

  • System rules cannot be deleted.

  • After a rule is deleted, it cannot be restored. Make sure you no longer need the rule before deleting it.

  Click Actions in the target rule row and then click Delete. Click OK in the dialog box to delete the rule.

Supported clusters

This feature supports only clusters that meet both of the following conditions:

• The servers running the clusters are connected to Security Center.

• The clusters are ACK managed cluster, ACK dedicated cluster, or self-managed Kubernetes clusters connected to Security Center.

Prerequisites

• At least one of Malicious Host Behavior Prevention or Webshell Connection Prevention is enabled. For more information, see Host protection settings.

• Container Escape Prevention is enabled. For more information, see Container escape prevention.

Manage system rules

• Rule enablement

  • Security Center provides multiple container escape prevention rules. By default, all clusters connected to Security Center have all container escape prevention rules enabled. The container escape prevention rules enabled by default by Security Center are collectively called system rules.

  • You can manually enable or disable system rules.

• Rule action

  The system rule action is Alert, which means the system rule only generates alerts and does not intercept escape behaviors when escape behaviors occur.

• View rule

  You can view the detailed information of system rules on the Security Center console Protection Configuration > Container Protection > Proactive Defense for Containers page, under the Container Escape Prevention rule's System Rules tab.

• Rule update

  You can modify the cluster scope in which the system rule takes effect. If clusters change or new cluster assets are added, the system rule automatically adds the new clusters to the protection scope.

• Rule usage

  • When you use the container escape prevention feature for the first time, we recommend that you fully observe whether the alerts under the system rule have false positives. If no false positives are found, you can change the rule action to Block.

  • System rules do not support whitelists or intercepting risky behaviors. If you need to configure a whitelist or intercept risky behaviors, create a custom rule.

  • After you create a custom rule of a specific type, the corresponding system rule is automatically disabled.

Create a custom rule

Custom rules support the same rule types as system rules, and additionally support whitelist configuration and intercepting risky behaviors.

1. Log on to Security Center console.

2. In the left-side navigation pane, choose Protection Configuration > Container Protection > Proactive Defense for Containers. In the upper-left corner of the console, select the region where the asset to be protected is located: Chinese Mainland or Outside Chinese Mainland.

3. In the rule type list, click Container Escape Prevention.

4. On the Custom Rules tab, click Create Rule.

5. In the Create Rule panel, define the rule and click Next.

   Parameter	Description
   Rule Name	Enter a rule name.
   Rule Type	Select a rule type from the drop-down list. You can select the required type from the rule types provided by Security Center based on your protection needs. After you select a rule type, all detection items supported by that type are selected by default. If you do not need to enable a specific detection item, you can clear its check box. Go to the console to view the supported rule types and detection item details.
   Defense Action	Select the defense action. Options: Alerts: Security Center only generates an alert when a defined risk is detected. Block: Security Center generates an alert and intercepts the corresponding process or operation when a defined risk is detected. Important In some normal business scenarios, rules may be triggered. When configuring rules, we recommend that you fully observe in Alert mode before enabling Block mode for the rule.
   Add to Whitelist	Click Create Rule and enter the image name to add to the whitelist. Up to 32 whitelist entries are supported. Fuzzy matching by keyword is supported. For the image address yundun-example-registry.cn-hangzhou.aliyuncs.com/yundun-example/yun-repo:test, you can enter partial keywords for fuzzy matching. The following whitelist configurations are valid: yun-repo test yun-repo:test repo:test Important After an image is added to the rule whitelist, Security Center does not check escape behaviors for the image. Proceed with caution.

   After this step is completed, Security Center has created the corresponding rule in the rule list.

6. Select the clusters to protect and click OK.

   You can select clusters that are connected to Security Center. If you need to protect a self-managed Kubernetes cluster, connect it to Security Center first. For more information, see Add a self-managed Kubernetes cluster to Security Center.

View alerts

After you create and enable a container escape prevention rule, go to the Security Center console page, set the alert type to Container Escape Prevention to view container escape prevention alerts. The following alerts are generated based on the defense action configured in the container escape prevention rule:

• For rules with the defense action Alerts, the security alerts are in the Unhandled state. We recommend that you handle these alerts promptly. For more information, see Evaluate and handle security alerts. On the Security Alert Handling page, select the Container tab and set Handled to Unhandled.

• For rules with the defense action Block, the alerts are in the Blocked state, which means Security Center has automatically intercepted the escape behavior and no manual action is required. After a rule with the defense action Block triggers an alert, go to the Security Alert Handling page, select the Container tab, set Handled to Handled, and add the Alert Type filter (such as Container Escape Prevention) to view the corresponding alert records. The status is displayed as Block successful.

Manage rules

• View protection scope

  Click the number in the Protection Scope column of the target rule to view the cluster scope protected by the rule in the Protection Scope panel. The Interceptable Status column in the panel indicates the Security Center agent status on the servers running the clusters. Rules take effect only when the agent is in the Normal state. If the status is Abnormal, on the Feature Settings page for the servers running the clusters, enable Malicious Host Behavior Prevention or Webshell Connection Prevention to make the agent status normal. For more information, see Host protection settings.

• Enable or disable rule

  Turn the switch in the Enable column of the target rule on or off to enable or disable the rule.

• Edit rule

  Click Actions in the target rule row and then click Edit. You can modify the rule name, type, status, defense action, and protection scope. The edited rule takes effect within 10 minutes.

• Delete rule

  Important

  • System rules cannot be deleted.

  • After a rule is deleted, it cannot be restored. Make sure you no longer need the rule before deleting it.

  Click Actions in the target rule row and then click Delete. Click OK in the dialog box to delete the rule.