Security Center generates alerts when it detects intrusions, malware, or abnormal behavior on your assets. This topic describes how to assess alerts, remediate threats, and harden your systems.
Assess security alerts
Before responding to an alert, assess its potential impact, analyze the attack, and identify false positives. The alert details page provides the information you need for this assessment.
View alert details
Log on to the Security Center console.
In the left-side navigation pane, choose . In the upper-left corner of the console, select your asset's region: Chinese Mainland or Outside Chinese Mainland.
NoteIf you have enabled Agentic SOC, the navigation path in the left-side navigation pane changes to .
On the CWPP tab, find the alert and click Details in the Actions column.
ImportantYou can enable alert notifications on the page. You can then use information from the notifications, such as the alert name, to quickly locate the alert.
The Ultimate Edition lets you filter alerts by asset type. Above the alert list, click All, host, container, K8s, or cloud service to view alerts for the corresponding asset type.
Security Center uses a new large model detection engine to intelligently identify malicious files. To view alerts detected by AI, set the AI Detected filter to Yes. View alerts for AI-detected malicious files.
Analyze alert details
Use the attack tracing, and Description to understand the alert's basis, frequency, and potential causes. This helps you determine whether the alert is a false positive and plan your response.
Alert description
The alert description summarizes the detected abnormal activity, its risks and characteristics, and recommended response actions.
Assessment example:
Potential risk: A relevant configuration file was modified to create a logon backdoor.
Recommended response: Confirm with the appropriate business team if this process is normal. If not, terminate the process immediately. Then, investigate the system for other potential threats.
Attack tracing
Attack tracing integrates logs from multiple cloud services to generate a visualized attack path with raw log previews. Use it to identify the root cause of an intrusion and develop a response strategy.
This feature is available only on servers running the Enterprise or Ultimate of Security Center, or that have the Host Protection or Hosts and Container Protection feature enabled.
Security Center generates the attack path within 10 minutes after a threat is detected. Wait at least 10 minutes after an alert before viewing the attack tracing information.
The automated attack tracing information for an alert is automatically deleted 3 months after the alert is generated. Review the attack tracing information promptly.
Use cases:
Attack tracing is ideal for web intrusions, worm events, ransomware, and malicious download connections in cloud environments.
Assessment example:
In the traceability section of the details page, check whether the attack chain is complete and valid. The more complete the attack chain, the more urgently you need to handle the alert.
Click a node in the graph and check the details on the left to determine if the attack objective was achieved. For example:
Check endpoint activity: The attacker executed commands on the server, such as
whoamiornet user.Check for data exfiltration: Look for abnormal outbound connections (to mining pools or C2 servers) or sensitive file read/upload activities.
Check for persistence artifacts: Look for newly created backdoor accounts, scheduled tasks, or malicious services.
Click a node in the tracing graph and, in the node details section on the left, see if the raw logs are verifiable (for example, WAF interception records, host process creation logs, or network connection logs).
Verifiable: There are supporting underlying logs, such as WAF interception records or host process logs for malicious command execution. This proves the attack occurred. If the attack was intercepted, you can mark the alert as "Processed" and no further action is required. If it was not intercepted, you must respond immediately.
Not verifiable: No supporting logs are available. This could be due to log deletion or detection evasion. In this scenario, you must be highly vigilant as it may indicate an advanced attack.
Sandbox detection
Sandbox detection runs suspicious files in a secure, isolated environment to analyze their static and dynamic behavior. Use the results to identify and remediate malicious programs.
The sandbox detection feature is available only for some malware alerts. Its availability is indicated on the alert details page.
In the security alert list, find the target security alert and click Details in the Actions column.
In the Sandbox section, view the sandbox detection results.
Assessment example:
Behavior Tag: These tags label the file's characteristics and highlight its high-risk operations. Red tags indicate the most critical intrusive behaviors.
ATT&CK Matrix: Displays the process flow during the sandbox detection run and highlights high-risk operations performed by the file. Red highlighting indicates the most critical intrusive behaviors.
Security alert remediation
If you determine that an alert is for legitimate activity or requires no action, you can ignore the alert or add it to the whitelist.
For persistent virus threats or recurring alerts, handle the alert in the console and then follow the Security Hardening and Attack Prevention guidelines.
Type | Parameter | Action |
malware | mining program | |
DDoS trojan | ||
trojan program | ||
malicious program | ||
exploit program | ||
suspicious PowerShell command | ||
backdoor program | ||
reverse shell backdoor | ||
file-infecting virus | ||
unusual logon | logon from a malicious IP address | |
successful brute-force cracking on ECS | ||
logon to ECS with an unusual account | ||
logon to ECS from an unusual location | ||
logon with a backdoor account | ||
website backdoor | backdoor (webshell) file detected | |
log/image file containing webshell code | ||
backdoor file for web trojan or hotlinking detected | ||
arbitrary file write backdoor detected | ||
abnormal process behavior | Java application executes abnormal commands | |
suspicious process path | ||
network proxy forwarding behavior | ||
suspicious PowerShell command | ||
persistent backdoor creation behavior | ||
SSH backdoor | ||
suspicious encoded command | ||
suspicious command execution | ||
malicious script | malicious script execution | |
precision defense | evasion of security software | |
cloud product threat detection | RAM sub-account logon from an unusual location |
|
hacking tool exploits AccessKey |
| |
abnormal role permission enumeration |
| |
RAM user performs sensitive operations after logging on to the console | ||
other | Security Center agent unexpectedly goes offline |
Manually handle alerts
If you use the Security Event Response feature to handle an event aggregated from Security Center alerts, Security Center automatically updates the status of the related alerts on the CWPP tab. You do not need to manually update the alert status.
Before you begin
Create a snapshot backup: Before handling an alert, create a snapshot backup of the server in the ECS console to prevent data loss. Create a snapshot.
Server-side investigation: Log on to the server to investigate suspicious processes. Common commands:
Linux servers: Use
ps aux | grep <suspicious process name>to check whether a suspicious process is still running.Linux servers: Use
lsof -p <process PID>to view the files and network connections opened by the process.Windows servers: You can use Task Manager or log on to the server via VNC from the console to view process information. Suspicious processes are often located in directories such as
C:\Users\Administrator\AppData\Local. Confirm whether the process is required by your business before deleting it.
Choose a method
Handling methods are categorized as follows:
Threat Removal: Removes known threats, remediates infections, and blocks threat sources.
Alert Suppression: Handles false positives and known risks by whitelisting or ignoring alerts. Controls notifications for subsequent similar alerts.
Troubleshooting: Troubleshoot and diagnose issues with the Security Center agent.
Threat removal
Virus Detection and Removal
Use cases
Confirmed malicious activity: Use when Security Center detects a running malicious process (virus, trojan, or ransomware) that must be stopped immediately.
Incident response: Use to contain an active virus or data leak before it spreads to other instances.
Before you begin
Virus Scan may cause service interruptions. Inspect the source file before proceeding:
Verify file properties: Confirm that the file is a virus by checking its path, signature, and hash value. This helps prevent the accidental deletion of system or business files.
Assess business dependencies: Check if the file is used by critical services, such as components related to
nginxormysql.
How it works
Immediately terminate the virus process and move the virus file to the quarantine area. Quarantined files cannot be executed, accessed, or spread.
WarningTerminating a process can disrupt dependent services, especially if the malicious process has replaced or infected a legitimate application.
If the quarantined file is a business file infected with malicious code, such as a core application component, quarantining it may lead to service interruptions.
Quarantined files can be restored within 30 days. After restoration, the file reappears in the alert list for continued monitoring. For more information, see View and restore quarantined files.
NoteFiles not restored within 30 days are permanently deleted.
Next steps
Review quarantined files within 30 days to prevent accidental permanent deletion. View and restore quarantined files.
Deep Cleanup
The Deep Cleanup feature is a specialized tool from Security Center experts designed to handle persistent and stubborn viruses.
Use cases
Deep Scan is a specialized solution for stubborn and file-infecting viruses. These viruses typically exhibit the following characteristics:
Infects host files: The virus injects itself into system files, application files, or your personal documents, making them part of the virus.
Difficult to eradicate: A standard virus scan may only remove the parent virus but cannot repair the infected files, causing the issue to recur.
NoteIf a virus does not fit this description, use the standard Virus Scan feature.
Before you begin
A Deep Cleanup carries risks of accidental file deletion, service interruption, and data integrity issues. Inspect the source file before proceeding:
Verify file properties: Confirm that the file is a virus by checking its path, signature, and hash value. This helps prevent the accidental deletion of system or business files.
Assess business dependencies: Check if the file is used by critical services, such as components related to
nginxormysql.
How it works
It cleans up persistent viruses by terminating malicious processes, quarantining malicious files, and removing persistence mechanisms used by viruses and trojans.
The feature can create a snapshot backup. If the deep scan accidentally removes useful data, restore it from the snapshot.
ImportantCreating and retaining snapshots incurs fees from the snapshot service. By default, the billing method is pay-as-you-go. You can consult pre-sales support for fee details.
Next steps
Review quarantined files within 30 days to prevent accidental permanent deletion. View and restore quarantined files.
Quarantine
Use cases
Use when you have confirmed that a file is malicious (backdoor or virus) and must stop it immediately.
How it works
The system moves the suspicious file to a quarantine area. Quarantined files cannot be executed, accessed, or spread.
WarningIf the quarantined file is a business file infected with malicious code, such as a core application component, quarantining it may lead to service interruptions.
Quarantined files can be restored within 30 days. After restoration, the file reappears in the alert list for continued monitoring. For more information, see View and restore quarantined files.
NoteFiles not restored within 30 days are permanently deleted.
Next steps
Review quarantined files within 30 days to prevent accidental permanent deletion. View and restore quarantined files.
Terminate Process
Use cases
Handles alerts related to abnormal process behavior, such as a MySQL process executing an unusual command or a web vulnerability exploit.
How it works
Security Center attempts to terminate the process. If this fails, you can try to terminate the process manually by running the
kill <process ID>command and then selecting the Manually Handled option.NoteYou can find the process ID in the More Information section on the alert details page.
Block
Use cases
This method is often used for IP-based attack scenarios, such as unusual logons and brute-force attacks.
How it works
This action generates a security group defense rule to block access from the malicious IP address.
You can click Details to view the basic information about the generated defense rule, such as Assets, Rule Direction, Port Range, and Rule Direction.
Security Center automatically selects a blocking mechanism based on the agent's installation status. The supported mechanisms are:
-
Security Center: Prioritizes using the Security Center agent to block login attempts. This mechanism is automatically used if you have the Advanced, Enterprise, or Ultimate edition of Security Center and the Malicious Network Behavior Prevention switch is enabled. For information about how to enable the Malicious Network Behavior Prevention switch, see Proactive Defense.
-
ECS Security Group: When this blocking rule is enabled, a corresponding rule is automatically created in the security group. The rule is automatically deleted when it expires or is disabled.
-
The Rule Validity Period is 6 hours by default and cannot be changed.
You can view the generated blocking rules by navigating to and clicking the Defense Against Brute-force Attacks tab. The rules are listed under System Rules.
NoteIf you need to stop the blocking policy early, you can disable the rule on the System Rules page.
Alert suppression
Security Center primarily uses the Add to Whitelist and Ignore methods for alert suppression. For specific alerts, it also supports Do Not Intercept Rule, Defense Without Notification, and Manually Handled.
Add to Whitelist vs. Ignore
Difference | Add to Whitelist | Ignore |
Use case | Permanent exceptions | Temporary or occasional false positives and known issues. |
Scope of impact |
| Only affects the current alert. It has no impact on subsequent alerts. |
Add to Whitelist
After you add an alert to the whitelist, you will no longer be notified of identical alerts or alerts that match the whitelist rules. Use this option with caution.
Use cases
Use when the alert is a false positive or you need a permanent exception rule. For example, if a process making unusual outbound TCP connections is part of normal business, create a whitelist rule to suppress future alerts.
Result
For the current alert
The alert status changes to "Handled", and the specific status is Manually Add to Whitelist.
If an identical alert reoccurs, Security Center does not generate a new alert. Instead, it updates the last occurrence time of the existing one.
For subsequent alerts
If you set a specific whitelist rule, any future alert that matches the rule will automatically be moved to the handled list with the status Automatically Add to Whitelist. You will not receive a notification.
Set a specific whitelist rule (Optional)
In the alert handling dialog box, click the Add to Whitelist tab. Click Create Rule to add a new rule. Click the
icon to delete a rule.ImportantMultiple rules are combined with an OR operator, meaning an alert is whitelisted if it matches any single rule.
Ensure that your rules are precise to avoid an overly broad scope. For example, a rule like "Path contains: /data/" could unintentionally whitelist sensitive subdirectories, increasing security risks.
Each rule has four configuration fields from left to right:
Alert field: You can view the supported alert fields for the current alert in the More Information section on the details page.
Condition type: Supported operators include Matches regex, Greater than, Equals, Less than, and Contains. Details for some rules:
Matches regex: Use a regular expression to precisely match specific patterns. For example, to whitelist all content in the "/data/app/logs/" folder, you can set the rule "Path matches regex: ^/data/app/logs/.*". This rule matches all files and processes in that folder and its subdirectories.
Contains: If you set a rule "Path contains: D:\programs\test\", all events with paths that include this folder will be whitelisted.
Condition value: Supports constants and regular expressions.
Applicable assets:
All assets: The rule applies to all existing and newly added assets.
This Asset Only: The rule applies only to the asset involved in the current alert.
Remove from whitelist
Cancel an automatic whitelist rule
ImportantThis action only affects future alerts. Alerts that match the rule will no longer be automatically whitelisted.
It does not affect alerts that have already been handled; their status remains unchanged.
Log on to the . In the left-side navigation pane, choose .
NoteIf you have subscribed to Agentic SOC, choose .
On the CWPP tab, click Cloud Workload Alert Management in the upper-right corner and select Alert Settings.
On the Alert Settings page, in the Alert Handling Rule section, select Automatically Add to Whitelist as the handling method.
Find the target rule and click Delete in the Actions column to cancel the automatic whitelist rule.
Remove an alert from the whitelist
ImportantAfter you remove an alert from the whitelist, it reappears in the Unhandled alert list, requiring you to evaluate and handle it again.
Log on to the . In the left-side navigation pane, choose .
NoteIf you have subscribed to Agentic SOC, choose .
On the CWPP tab, set the Handled or Not filter to Handled.
Find the alert you want to remove from the whitelist and click Remove from Whitelist in the Actions column.
NoteYou can also select multiple alerts and click Remove from Whitelist at the bottom of the list to perform a bulk removal.
Ignore
Ignoring an alert is a status management action and does not resolve the underlying security issue.
Use this option only after you have confirmed that the alert is a false positive or a known, accepted risk. This helps avoid overlooking real attacks.
We recommend that you periodically review the list of ignored alerts, for example, weekly or monthly.
Use cases
Confirmed false positive or low priority.
Temporary or known issue: The issue exists but is a known, accepted risk or temporary non-malicious state (for example, authorized penetration testing or a maintenance window). Use when you cannot immediately fix the root cause but need to clear the alert list.
Test or development environment: In non-production environments, expected and non-critical alerts appear frequently, interfering with normal monitoring. You need to temporarily suppress them.
Result
For the current alert: The alert status changes to "Handled", and the specific status is Ignored.
For subsequent alerts: No impact. Security Center will generate a new alert if a similar incident occurs.
Stop ignoring an alert
Log on to the . In the left-side navigation pane, choose .
NoteIf you have subscribed to Agentic SOC, choose .
On the CWPP tab, set the Handled or Not filter to Handled.
Find the alert you want to stop ignoring and click Cancel Ignore in the Actions column.
NoteYou can also select multiple alerts and click Cancel Ignore at the bottom of the list to perform a bulk action.
Do Not Intercept Rule
Use cases
This option is currently available only for alerts generated by the Adaptive WebShell Communication Interception rule, which is a System Defense Rule within the Malicious Behavior Defense feature. You can find this feature under .
How it works
The system will stop blocking requests to the corresponding URI and will no longer generate alerts for it.
Defense Without Notification
You will no longer receive separate notifications for subsequent identical alerts. Use this option with caution.
Use cases
This applies to alerts generated by the Malicious Behavior Defense rules (alert type: precision defense), which are found under .
How it works
For the current alert: The alert status changes to "Handled".
For subsequent alerts: When the same defense rule is triggered again, the generated alert event is automatically moved to the handled list, and no notification is sent.
Cancel a "Defend Without Notification" rule
Log on to the . In the left-side navigation pane, choose .
NoteIf you have subscribed to Agentic SOC, choose .
On the CWPP tab, click Cloud Workload Alert Management in the upper-right corner and select Alert Settings.
On the Alert Settings page, in the Alert Handling Rule section, select Defense Without Notification as the handling method.
Find the target rule and click Delete in the Actions column to cancel the rule.
Manually Handled
If you resolved the alert manually, select Manually Handled. The alert's status will change to Manually Handled.
Troubleshooting
Use cases
This is only available for handling Security Center Agent is Offline alerts.
How it works
The diagnostic tool collects agent-related data (network, process, and log information) from the machine and reports it to Security Center for analysis.
This check consumes CPU and memory. Assess the potential impact before running it.
Select a problem mode:
Standard Mode: Collects and reports agent-related log data to Security Center for analysis.
Enhancement Mode: Collects and reports agent-related network, process, and log data to Security Center for analysis.
After you click Handle Now, a diagnostic task is generated. You can view the task progress and results by navigating to and clicking Agent Task Management in the upper-right corner. Agent troubleshooting.
NoteIf a solution is provided in the Result column, follow the recommended steps.
If no solution is provided in the Result column, click Download Diagnostic Logs in the Actions column. Provide the exported diagnostic log and your Alibaba Cloud account ID (AliUid) to the relevant personnel for further analysis.
Console handling
Log on to the Security Center console.
In the left-side navigation pane, choose . In the upper-left corner of the console, select the region of the asset: Chinese Mainland or Outside Chinese Mainland.
NoteIf you have enabled Agentic SOC, the navigation path in the left-side navigation pane changes to .
On the Alert page, on the CWPP tab, locate the target alert. In the Actions column, click Handle. Select a handling method and click Handle Now.
NoteHandling methods vary by alert type. The options available in the console are definitive.
Add remarks to specify the handling reason and the operator. This practice improves the traceability of handled alerts.
Verification
Perform a full scan: After handling an alert, perform a full scan on the server to confirm no new alerts. The full scan requires Agentless Detection (pay-as-you-go).
Confirm no new alerts: After handling, monitor the alert list to ensure alerts of the same type do not reappear. Recurring alerts may indicate an unremoved persistent backdoor. See the troubleshooting section below.
Common Virus Alert Handling Tutorials
Security hardening and attack prevention
Upgrade Security Center Edition: The Enterprise and Ultimate editions support the virus automatic isolation (i.e., automatic virus detection and removal) feature, providing you with precise defense capabilities and supporting more security detection items.
Tighten Access Control: Open only necessary business ports (such as 80 and 443), and configure strict IP whitelist access policies for management ports (such as 22 and 3389) and database ports (such as 3306).
NoteFor Alibaba Cloud ECS servers, see Manage security groups for operations.
Set Complex Server Passwords: Set complex passwords containing uppercase letters, lowercase letters, numbers, and special symbols for servers and applications.
Upgrade Software: Promptly update your application software to the latest official version to avoid using outdated versions that are no longer maintained or have known security vulnerabilities.
Regular Backups: Create a regular snapshot policy for important data and server system disks.
NoteFor Alibaba Cloud ECS servers, see Create policy for operations.
Fix Vulnerabilities Promptly: Regularly use the Security Center Vulnerability Management feature to promptly patch system and application vulnerabilities.
Reset Server System (Use with Caution).
If the virus intrusion is deep and involves underlying system components, it is strongly recommended that you reset the server system after backing up important data. Follow these steps:
Create a snapshot to back up important data on the server. For more information, see Manually create a single snapshot.
Initialize the server operating system. For more information, see Re-initialize system disk (reset OS).
Create a cloud disk from the snapshot. For more information, see Create a data disk from a snapshot.
Attach the cloud disk to the server after reinstalling the system. For more information, see Attach a data disk.
FAQ
Alert handling issues
What should I do if a handled alert recurs?
Recurrent infections can be caused by:
Weak password: Your SSH, RDP, or database password is too simple.
Unpatched vulnerabilities: High-risk vulnerabilities exist in applications such as Redis, XXL-JOB, or WebLogic.
Latent backdoors: The initial cleanup was incomplete and left a hidden backdoor.
Data contamination: You restored a backup or snapshot that contained a virus.
Solution:
Perform security hardening as described in Security hardening and attack prevention.
After removing the virus, back up your data and then restart the server.
WarningRestarting a server causes a brief service disruption. Websites and applications on the server become inaccessible during the restart. Perform this action during off-peak hours.
Some applications may not auto-start or may depend on specific environment variables, requiring a manual restart (for example, certain message queue versions). Evaluate your restart plan in advance.
If the issue persists after a restart, back up your data and then reset the server's operating system.
Why can't I delete a virus file (such as a trojan or mining program)?
The file and its parent directory have an immutable attribute. Use the
chattr -icommand to remove the immutable attribute from the file and its parent directory before deleting them.I received a DDoS trojan alert. Why does the alert persist even after I manually deleted the file?
The file was not completely removed. To resolve this issue, perform the following steps:
If you are using the Free edition of Security Center, you can start a 7-day free trial of the Enterprise or Ultimate edition. Alternatively, see Upgrade Security Center to upgrade to the Antivirus or Enterprise edition.
After the upgrade, go to the security alert handling page, find the DDoS trojan alert, click Handle, and select Antivirus. The system automatically terminates the trojan process and quarantines the file.
How do I whitelist precise defense alerts?
Alerts generated by the precise defense feature rely on a defense plug-in and are automatically blocked. You must manually add these alerts to a whitelist in the Host Rule Management section.
Go to the Security Center console > Protection Settings > Host Protection > Host Rule Management. In the upper-left corner of the page, select the region where your assets are located: Chinese Mainland or Outside Chinese Mainland.
On the Malicious Behavior Defense tab, select the Custom Defense Rule sub-tab and click Create Rule. The following types are supported for whitelisting:
-
Process hash
-
Command line
-
Process Network
-
File Read/Write
-
Registry Operation
-
Load Dynamic-link Library
-
File Rename
-
Console feature issues
What should I do if an alert reports a nonexistent file?
This can happen if the virus was removed by another method or if the virus cleaned up its own traces. To clear this alert, click "Ignore" or "Handled Manually" in the alert list.
I received a security alert, but I cannot find the related data in the console. What should I do?
Check your current Security Center edition. The Free edition has limited functionality. We recommend that you see Upgrade Security Center to upgrade to the Antivirus or Enterprise edition.
Use the Antivirus feature to scan for and handle threats.
How do I handle multiple alerts in bulk?
Security Center currently supports bulk actions such as whitelisting, ignoring, removing from a whitelist, and undoing an ignore action.
In the left-side navigation pane, choose . In the upper-left corner of the console, select the region where your assets are located: Chinese Mainland or Outside Chinese Mainland. In the security alert list, select the alerts you want to handle.
In the lower-left corner, click Ignore Once, Add to Whitelist, Remove from Whitelist, or Cancel Ignore.
Why is the Handle button for a security alert grayed out?
The Free edition does not support handling alerts. Start a 7-day free trial or upgrade to the Antivirus or Enterprise edition.
Different editions support different security alert types.