All Products
Search

This Product

    Security Center:Evaluate and handle security alerts

    Document Center

    Security Center:Evaluate and handle security alerts

    Last Updated:Sep 18, 2026

    Security Center generates security alerts when it detects intrusions, malware, or abnormal behavior on your assets. Timely and correct alert handling is critical for business stability and data security. This topic describes how to follow the emergency response process to quickly assess risks, eliminate threats, and harden systems.

    Security alert handling assessment

    Before handling a security event, assess the alert impact, analyze the attack, and identify false positives to avoid disrupting normal operations. Use the alert details page to gather information for your assessment.

    View alert details

    1. Log on to Security Center console. In the left-side navigation pane, choose Detection and Response > Alerts。

      Note

      If you have enabled Agentic SOC, in the left-side navigation pane, choose Agentic SOC > Alerts。

    2. In Alert page,CWPP tab, locate the target alert, and click Actions column Details to go to the alert details page for complete information.

      • You can System Configuration > Notification Settings alert notifications. Use alert information such as the alert name to quickly locate the target alert.

      • The Ultimate Edition supports filtering alerts by asset type. Above the alert list, click All, Host, Container, K8s, or Cloud Service to view alerts for the corresponding asset type.

      • Security Center has added a large model detection engine that can intelligently identify malicious files. You can set the filter condition to AI Detected (Set the filter value to is) to view AI-detected alerts. For more information, seeAI-detected malicious file alerts。

    Note

    Historical alert records are retained for about one year. Alerts beyond the retention period are displayed as Expired data status.

    Analyze alert details

    You can Alert attack tracing,Description to obtain alert evidence, occurrence count, and possible causes. Use this information to determine whether the alert is a false positive and develop a handling plan. Domain names in network traffic alerts come from traffic identification and may not be your actual assets.

    Alert field descriptions

    • Alert time: The alert details page contains multiple time fields. Description:

      • First detection time: The first time the alert was detected by Security Center.

      • Latest detection time: The last time the alert was detected. If the same process or file triggers the alert multiple times, this time is continuously updated.

      • Alert report time: The time when the client reported the alert data to the cloud.

    • Basic Information: Alert Name, Urgency, Alert ID, Alert Type, Status, Attack Stage, Detection Mode.

    • Affected Asset: Displays asset information such as the public IP affected by this alert.

      Note

      Precision defense alert details do not display the request source IP.Asset at risk display the public and private IP addresses of the affected asset, not the request source IP. To investigate the source IP, check server DNS logs (see the Local log investigation section).

    • Description: Description, Handling suggestions.

    • More Information: Taking malicious script alerts as an example, the More information area displays information about alert-related files, including the following fields:

      • Malicious script path: The original storage path of the file on the ECS instance, such as /tmp/.test_alert.sh。

      • Malicious script tag: Risk tags of alert-related files, such as Reverse Shell.

      • File MD5: The MD5 value of the alert-related file.

      • Source file download: Points to a Security Center hosted bucket (such as sas-file-general-26) download link is only for temporary download of source files. For the original storage location, see Malicious script path field.

      • Sample download: For file-type alerts such as malicious scripts and webshells, you can go to the alert details page More information area and click Source file download link to obtain malicious file samples for local analysis.

      • Process PID: For alerts containing process information, go to the alert details page More information area or process tree view to check the PID of the infected process for manual investigation on the server.

      • Affected asset: On the alert details page,Asset at risk area to directly view the ECS instance ID and server details of affected assets to confirm which assets to investigate.

    Attack tracing

    Security Center provides automated attack tracing that integrates logs from multiple cloud services. Through big data analysis, it generates visualized intrusion path diagrams with raw data previews. This feature helps quickly identify intrusion causes and develop emergency strategies for web intrusions, worm events, ransomware, and malicious download connections in cloud environments.

    • Capabilities:

      • Only bound to Enterprise、Ultimate authorization or Comprehensive Host Protection、Hosts and Container Protection servers support this feature.

      • Security Center generates the automated attack tracing path within 10 minutes after detecting a threat. We recommend that you wait at least 10 minutes after the alert before viewing attack tracing information.

      • Automated attack tracing information is automatically deleted 3 months after the alert is triggered. Review the attack tracing information promptly.

    • Assessment example：

      • In the tracing area on the details page,Check whether the attack chain is complete and valid. The more complete the attack path, the more urgently you need to handle the alert. Refer to the following description Determine whether the path is valid:

        • Invalid path: The tracing result shows only single-point scanning or probing behavior (such as isolated port scans or failed exploit attempts) without subsequent actions (no connection established, no commands executed, no malicious files downloaded).

        • Valid path: The tracing diagram shows a clear intrusion path (for example:Exploit → Webshell upload → Internal network probing → Malicious file download → Lateral movement）。

      • Click a node in the tracing diagram. In the left-side node details area,Check whether the attack target was reached. For example:

        • Check endpoint behavior: The attacker executed commands on the server (such as whoami、net user）。

        • Check for data leaks: Abnormal outbound connections (to mining pools or C2 servers) or sensitive file reading/uploading.

        • Check persistence traces: Backdoor accounts, scheduled tasks, or malicious services were created.

      • Click a node in the tracing diagram. In the left-side node details area, view Whether raw logs are verifiable (such as WAF blocking records, host process creation logs, and network connection logs).

        • Verifiable: underlying logs exist (such as WAF blocking records or host process logs of malicious command execution) that prove the attack occurred. If blocked, mark as Handled. If not blocked, handle it as soon as possible.

        • Not verifiable: No logs support the finding (logs may have been deleted or detection bypassed). This scenario requires high alertness and may indicate advanced attack traces.

    Sandbox detection

    Security Center provides sandbox detection that runs files in a secure, isolated environment to analyze static and dynamic file behavior data. It safely runs suspicious applications and detects suspicious file behavior. Use sandbox detection results to handle malicious programs when alerts are generated.

    Note

    The sandbox detection feature is available only for some malware alerts. Check the actual page for availability.

    1. In the Alerts page, find the target alert and click Actions column and click Details。

    2. In Sandbox area to view sandbox detection results.

    Assessment example：

    The top of the sandbox detection result page displays file information (file name, threat tag, SHA1/MD5/SHA256 hash values). Below are five tabs:Behavior tags、Process details、Network behavior、File behavior、ATT&CK matrix. The ATT&CK matrix view is divided into 12 columns by attack stage (Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact). Each column displays attack technique cards and hit counts. Red numbers indicate high-risk stages.

    • Behavior Tag: Tag intrusion files with feature labels to mark high-risk operations caused by intrusion files (red indicates the most noteworthy intrusion behavior).

    • ATT&CK Matrix: Displays the sandbox detection process flow and marks high-risk operations caused by intrusion files (red indicates the most noteworthy intrusion behavior).

    Quick reference for alert handling

    Important

    • After verifying alert information, if you determine it is normal behavior or does not require handling, you can selectIgnoreorAdd to Whitelistmethod to handle security alerts.

    • Security alerts only indicate security risks and do not block domains or services.

    • For stubborn virus threats or recurring alerts, after console handling, refer toSecurity hardening and attack preventionto harden security.

    Alert type

    Alert name

    Recommended handling method

    Malware

    Mining program

    Virus Detection and Removal

    DDoS trojan

    Trojan program

    Malicious program

    Exploit program

    Suspicious PowerShell command

    Backdoor program

    Reverse Shell backdoor

    File-infecting virus

    Deep Cleanup

    Unusual logon

    Logon from a malicious IP address

    Block

    Successful brute-force attack on ECS

    Logon to ECS with an unusual account

    Logon to ECS from an unusual location

    Backdoor account logon

    Webshell

    Backdoor (Webshell) file found

    Quarantine

    Log/image files containing WEBSHELL code

    Webshell or hotlinking backdoor file found

    Arbitrary file write backdoor found

    Process abnormal behavior

    Java application executing abnormal commands

    Terminate Process

    Suspicious process path

    Network proxy forwarding behavior

    Suspicious PowerShell command

    Persistent backdoor creation behavior

    SSH backdoor

    Suspicious encoded command

    Suspicious command execution

    Malicious script

    Malicious script code execution

    Terminate Process

    Precision defense

    Anti-security software

    Deep Cleanup

    Suspicious file upload through API

    Troubleshooting

    Cloud product threat detection

    RAM sub-account logon from an unusual location

    1. Change account password orRestrict access by IP address。

    2. Change alert status toManually Handled。

    Hacker tools using AccessKey

    AK -level alerts belong to cloud product threat detection and are not directly associated with ECS instances. Entity information in alert details does not include server instances. To locate affected servers, query AccessKey ID Query AccessKey call records and trace affected assets using the call IP in alert details. For the query procedure, seeDetect AccessKey leaks。

    1. Delete or disable the RAM user's AccessKey。

    2. Change alert status toManually Handled。

    Abnormal role permission enumeration behavior

    1. Log on with a RAM administrator accountRAM console， Modify RAM user permissions.

    2. Change alert status toManually Handled。

    RAM user logs on to the console to perform sensitive operations

    Other

    Security Center agent is abnormally offline

    Troubleshooting

    Manually handle alerts

    Important

    If you use theSecurity event handlingfeature handled an event aggregated from Security Center alerts, Security Center automatically updates CWPP the status of related alerts. You do not need to manually update alert status.

    Before you begin

    • Create snapshot backup: Before handling security alerts, we recommend that you create a snapshot backup for the server to prevent business impact or data loss. Create snapshots in the ECS console. For more information, seeCreate policy。

    • Server-side investigation: You can log on to the server and use command-line tools to investigate suspicious processes. Common commands:

      • Linux server: Use ps aux | grep <suspicious process name> Check whether suspicious processes are still running.

      • Linux server：Use lsof -p <process PID> View files opened by the process and network connections.

      • Windows server: You can use Task Manager or log on to the server through the console VNC to view process information. Abnormal processes are usually in C:\Users\Administrator\AppData\Local and other directories. Confirm whether the process is required by your business before deleting it.

    • Paid edition limitations: Alert handling (file quarantine, IP blocking, whitelisting, etc.) requires a paid Security Center edition. If you use the free edition or your authorization has expired, you cannot handle alerts directly in the console. You need toPurchase Security CenterAnti-Virus Edition or above.

    Choose a handling method

    Handling methods can be divided into the following categories:

    • Threat removal: Directly remove and block known security threats, remediate infections, prevent new attacks, block threat sources, and protect asset security

    • Alert suppression: Used to handle false positives or acceptable risks. Mark alerts as invalid through whitelisting or ignoring, and control whether subsequent alerts are generated.

    • Troubleshooting: Troubleshoot Security Center client anomalies for assisted diagnosis.

    Threat removal

    Virus Detection and Removal

    • Use cases

      • Confirm malicious activity: When Security Center detects running malicious processes such as viruses, trojans, or ransomware that need to be blocked immediately.

      • Emergency response requirements: Need to quickly contain virus spread or data leak risks to prevent threats from spreading to other servers.

    • Before you begin

      Virus scan may cause service interruption risks. To avoid affecting normal business, check source files before handling. Common checkpoints include:

      • Verify file properties: Confirm whether the file is a virus by checking the file path, signature, and hash value (avoid accidentally deleting system/business files).

      • Business dependency assessment: Check whether the file is called by critical services (such as nginx、mysql related components).

    • How it works

      • Immediately terminate the virus process and move the virus file to quarantine. After quarantine, the file cannot be executed, accessed, or spread.

        Warning

        • Terminating the process may cause service anomalies that depend on it (for example, the virus disguises itself as a legitimate process).

        • If the quarantined file is a business file infected with malicious code (such as a core application component), quarantine may cause service interruption.

      • Quarantined files can be restored within 30 days. Restored files reappear in the alert list and Security Center continues to monitor them. For restoration, seeViewing and recovering quarantined files。

        Note

        Files not restored within 30 days are automatically deleted and cannot be recovered.

    • Next steps

      Regularly review the quarantine: Confirm file properties within 30 days to avoid irreversible deletion. To view quarantined files, seeViewing and recovering quarantined files。

    Deep Cleanup

    Deep Cleanup a specialized removal capability developed by the Security Center security expert team after in-depth analysis and testing of this persistent and stubborn virus.

    • Use cases

      Deep scan is targeted at Persistent, file-infecting viruses specialized solution. Characteristics of this type of virus:

      • Infect host files: The virus injects itself into system files, application files, or personal documents, making them part of the virus.

      • Hard to eradicate: Standard virus scan only deletes the virus parent body but cannot repair infected files, causing recurring issues.

      Note

      If the virus is not of this type, use the standard Virus Scan feature first.

    • Before you begin

      Deep Cleanup Possible causes Risk of accidental file deletion, service interruption, and data integrity risk. To avoid affecting normal business, check source files before handling. Common checkpoints include:

      • Verify file properties: Confirm whether the file is a virus by checking path, signature, and hash (avoid deleting system/business files).

      • Business dependency assessment: Check whether the file is called by critical services (such as nginx、mysql related components).

    • How it works

      • Clean up stubborn viruses by terminating malicious virus processes, quarantining malicious files, and removing persistent virus/trojan residency items.

      • In addition, you can create snapshots to back up data so that you can restore cleared data through snapshots during deep virus scan.

        Important

        Creating and retaining snapshots incurs fees. Fees are charged by the snapshot product. The default billing method is pay-as-you-go (post-paid).You can contact pre-sales consultation for cost information.

    • Next steps

      Regularly review the quarantine: Confirm file properties within 30 days to avoid irreversible deletion. To view quarantined files, seeViewing and recovering quarantined files。

    Quarantine

    • Use cases

      When a file is confirmed as a backdoor, virus, or other malicious file, immediately block its execution.

    • How it works

      • The system Move suspicious files to quarantine. After quarantine, the file cannot be executed, accessed, or spread.

        Warning

        If the quarantined file is a business file infected with malicious code (such as a core application component), quarantine may cause service interruption.

      • Quarantined files can be restored within 30 days. Restored files reappear in the alert list and Security Center continues to monitor them. For restoration, seeViewing and recovering quarantined files。

        Note

        Files not restored within 30 days are automatically deleted and cannot be recovered.

    • Next steps

      Regularly review the quarantine: Confirm file properties within 30 days to avoid irreversible deletion. To view quarantined files, seeViewing and recovering quarantined files。

    Terminate Process

    • Use cases

      Mainly used for handling Process abnormal behavior types alerts, such as MySQL executing abnormal commands or web exploit attacks causing abnormal command execution.

    • How it works

      Security Center will try to terminate the process. If it fails, try manually terminating the process kill process ID, and then select "Manually Handled" handling method.

      Note

      The process ID can be viewed on the alert details page - More Information.

    Block

    • Use cases

      Mainly used for IP attack scenarios such as unusual logon and brute-force attacks.

    • How it works

      • Execute Block operation, Security Center automatically creates corresponding security group defense rules to block malicious IPs from accessing affected assets.

        • You can click Show Details to view the basic information of the generated defense rule. For example,Assets、Rule Direction、Port Range、Rule Direction。

        • Security Center automatically selects the blocking mechanism based on client installation. Supported blocking mechanisms:

          • Security Center: Prioritize using the Security Center plugin to block logon behavior. When the Security Center instance is Advanced, Enterprise, or Ultimate Edition and Malicious Network Behavior Prevention switch, Security Center automatically selects this plugin. Enable Malicious Network Behavior Prevention For the specific operation of the switch, seeProactive defense。

          • ECS Security Group: When the blocking rule is enabled, the corresponding security group rule is automatically created. The rule is automatically deleted when the blocking rule expires or is disabled.

            Note

            When an ECS instance is used as a backend server of CLB (Classic Load Balancer), CLB forwarding traffic bypasses the security group ACL rules of the backend ECS instance. The security group cannot intercept the original client IP. In this scenario, the blocking action of the security group does not take effect. We recommend that you configure an access control blacklist on the CLB listener to block malicious IPs. Go to the CLB console, select the target instance in Instance Management, go to Listener Management, select the target listener, go to the Access Control page, set access control to Blacklist, and add the malicious IPs to block.

      • Rule Validity Period which is the effective duration of the blocking rule. Default: 6 hours. Options: 30 minutes, 1 hour, 2 hours, 6 hours, 12 hours, 1 day, 7 days, 14 days, 30 days.

      • Generated blocking rules can be viewed in Protection Configuration > Host Protection > Host-specific Rule Management in Defense Against Brute-force Attacks tab,System rules to view.

        Note

        To terminate the blocking policy early, disable the switch in System Rules.

    Alert suppression

    Security Center mainly uses Add to Whitelist、Ignore method to implement alert suppression ， Also supports specific alerts for Do Not Intercept Rule、Protect Without Notification、Manually Handled。

    After the large model detection engine is updated, it may re-scan existing files in the system, causing new alerts for files that did not trigger alerts before. This is normal behavior due to improved detection capability and not a false positive. After confirming the file is a normal business file, you can Add to Whitelist, subsequent alerts for the same file are not triggered. In cluster environments such as SLB, AI detection runs per instance. The same file may trigger alerts on different servers. Confirm and whitelist each server individually.

    Add to Whitelist andIgnoredifferences

    Differences

    Add to Whitelist

    Ignore

    Scenarios

    Permanent exception issues

    Applicable to temporary or occasional false positives or known issues.

    Impact scope

    • When the same host asset has a file with the same MD5 at the same file path as this alert,

    • If other whitelist rules are configured, subsequent alerts matching the rules are also not notified.

    Handles only the current alert with no impact on subsequent alerts.

    Add to Whitelist

    Warning

    After whitelisting, the same alerts and alerts matching the whitelist rule are no longer notified. Choose carefully.

    • Use cases

      The current alert is a false positive, or add a permanent exception rule. For example, if a suspicious process sending outbound TCP packets is actually a normal business interaction, or suspected scanning behavior is actually normal network detection, set a whitelist rule to avoid such false positives.

    • Handling result description

      • For the current alert

        • This alert changes to Handled. The alert status is Manually Allowlisted。​

        • When the same alert occurs again, no new alert data is generated, but the latest occurrence time of this alert is updated.

          What are identical alerts?

          Identical alerts refer to security threats with highly consistent alert characteristics. For example:

          • Virus alerts: same asset + same virus file path + same virus file MD5.

          • Unusual logon: same asset + same logon IP.

      • For subsequent alerts

        If a specific whitelist rule is configured, when a matching alert occurs again, the alert is automatically added to the Handled list with status Automatically Add to Whitelist and no more alert notifications are sent.

    • Set specific whitelist rules (optional)

      In the alert handling dialog box, click Add to Whitelist tab. Click Create Rule Add a rule. ClickimageYou can delete a rule.

      Important

      • When multiple rules are configured, they have an OR relationship. If any rule is matched, whitelisting is applied.

      • Ensure when configuring rules Accuracy to avoid overly broad scope. For example, "Path contains: /data/" may accidentally whitelist sensitive subdirectories.​

      Each rule has 4 configuration boxes from left to right. Description:

      1. Alert information fields: On the details page,More Information to view which alert information fields are supported for the current alert.

      2. Condition type: Supports regex match, greater than, equal to, less than, contains, and other operations. Some rule descriptions:

        • Regular expression: Regular expressions can precisely match specific patterns. For example, to whitelist all content under the "/data/app/logs/" folder, set the rule "Path matches regex: ^/data/app/logs/.*$".​

        • Contains keyword: Set the rule "Path contains: D:\programs\test\". All events with this path are whitelisted.

      3. Condition value: Supports constants and regular expressions.

      4. Applicable assets：

        • All assets: Takes effect on new assets and all connected assets.

        • Current Asset: Only effective for assets involved in the current alert.

    • Cancel whitelisting

      Note

      Whitelist rules for precision defense alerts need to be configured in Protection Configuration > Host Protection > Rule Management page,Malicious Behavior Defense Custom Defense Rule tab.

      • Cancel automatic whitelist rule

        1. Log on Security Center console. In the left-side navigation pane, choose Detection and Response > Alerts。

          Note

          If you have enabled Agentic SOC, in the left-side navigation pane, choose Agentic SOC > Alerts。

        2. Click CWPP the upper-right corner of the Cloud Workload Coverage Alert Management . Select Alert Settings。

        3. In Alert Settings page Alert Handling Rule area, select the handling method Automatically Add to Whitelist。

        4. Locate the target rule and click Delete in the Actions column to cancel the automatic whitelist rule.

      • Cancel alert whitelisting

        1. You must log on to Security Center console. In the left-side navigation pane, choose Detection and Response > Alerts。

          Note

          If you have enabled Agentic SOC, in the left-side navigation pane, choose Agentic SOC > Alerts。

        2. CWPP tab,Handled or Not filter condition to Handled。

        3. Locate the alert to cancel whitelisting and click the Actions column Remove from Whitelist button to cancel the whitelist for the current alert. You can also select multiple alerts and click at the bottom of the list Remove from Whitelist button to batch cancel whitelisting.

    Ignore

    Important

    • "Ignore" is only an alert status management operation. It does not resolve the underlying security issue.

    • Only use this after fully confirming it is a false positive or known/accepted risk to avoid covering up real attacks.

    • We recommend that you regularly (weekly or monthly) review the Ignored alert list.

    • Use cases

      • Confirmed as a false positive or low priority.

      • Temporary/known issues: The issue exists but is a known and accepted risk, or a temporary, non-malicious state (for example, authorized penetration testing or abnormal behavior during a maintenance window). The root cause cannot be fixed immediately, but the alert list needs cleanup

      • Test or debugging environment: In non-production environments (such as development and testing environments), expected alerts that do not affect security may interfere with normal monitoring. Suppress them temporarily.

    • Handling result description

      • For the current alert: This alert changes to Handled. The alert status is Ignored。​

      • For subsequent alerts: No impact. When alerts of the same type appear again, Security Center alerts you again.

    • Cancel ignore

      1. Log on Security Center console. In the left-side navigation pane, choose Detection and Response > Alerts。

        Note

        If you have enabled Agentic SOC, in the left-side navigation pane, choose Agentic SOC > Alerts。

      2. CWPP tab,Handled or Not filter condition to Handled。

      3. Locate the alert to cancel ignore and click the Actions column Cancel Ignore button to cancel the ignore status of the current alert.

        Note

        You can also select multiple alerts and click at the bottom of the list Cancel Ignore button to batch cancel ignoring.

    Do Not Intercept Rule

    • Scenarios

      Currently supports handling only Protection Configuration > Host Protection > Host-specific Rule Management in Malicious Behavior Defense System Defense Rule in Adaptive WebShell communication blocking alerts generated by rules.

    • How it works

      The system does not block requests for the corresponding URI and no alerts are generated.

    Protect Without Notification

    Warning

    Subsequent identical alerts are not notified separately. Choose carefully.

    • Scenarios

      by Protection Configuration > Host Protection > Host-specific Rule Management in Malicious Behavior Defense alerts generated by rules (alert type: precision defense).

    • How it works

      • Current alert: This alert changes to Handled.

      • Subsequent alerts: When the same defense rule is hit again, the generated alert is automatically added to the Handled list and no alert notification is sent.

    • Cancel defense-only-no-notification rule

      1. Log on Security Center console. In the left-side navigation pane, choose Detection and Response > Alerts。

        Note

        If you have enabled Agentic SOC, in the left-side navigation pane, choose Agentic SOC > Alerts。

      2. Click CWPP the upper-right corner of the Cloud Workload Coverage Alert Management . Select Alert Settings。

      3. In Alert Settings page Alert Handling Rule area, select the handling method Protect Without Notification。

      4. Locate the target rule and click Delete in the Actions column to cancel the automatic whitelist rule.

    Manually Handled

    If you have manually handled this alert, select Manually Handled. The current alert status is updated to Manually Handled。

    Troubleshooting

    Scenarios

    Only supports handling Security Center agent offline anomaly alerts.

    How it works

    The client diagnostic program of Security Center collects client-related network, process, and log data on the local machine and reports it to Security Center for analysis.

    Important

    The check consumes some CPU and memory resources. Evaluate before use.

    • Select the problem mode:

      • Standard Mode: Collect client-related log data and report to Security Center for analysis.

      • Enhancement Mode: Collect client-related network, process, and log data and report to Security Center for analysis.

    • Click Handle Now, a diagnostic task is generated. You can Asset Center > Host the upper-right corner of the page Agent Task Management to view diagnostic task results and progress. For more information, seeClient troubleshooting。

      Note

      • If in Result column provides solutions. Handle the alert according to the provided solutions.

      • If in Result column does not provide a solution. Click Actions column Download Diagnostic Logs. Provide the exported diagnostic logs and AliUid to relevant personnel for further verification and analysis.

    Console handling

    1. Log on Security Center console. In the left-side navigation pane, choose Detection and Response > Alerts。

      Note

      If you have enabled Agentic SOC, in the left-side navigation pane, choose Agentic SOC > Alerts。

    2. In Alert page CWPP tab, locate the target alert, and click in the Actions column Handle, select the handling method for the alert, and then click Handle Now。

      Note

      • Different alert types support different handling methods. Refer to the console page for details.

      • You can fill in remarks as needed, including the reason for handling the alert and the operator, to facilitate management of handled alerts.

    Post-handling verification

    • Confirm the alert is handled: In the Alerts page, set Status Set the filter condition to Handled to confirm the target alert appears in the Handled list. In Handling status column to view the handling method name (such as Virus Scan, Ignored, Manually Handled, etc.) and confirm the alert has been handled as expected.

    • Perform a full disk scan: After handling alerts, we recommend that you perform a full disk scan on the server to confirm no new alerts. Full disk scan requires agentless detection (pay-as-you-go). See virus scan documentation.

    • Confirm no new alerts: After handling, monitor the alert list. If alerts persist, persistent backdoors may exist. See the recurring alert troubleshooting below.

    Emergency response

    Common operations

    • Change password: After receiving an unusual logon alert, if the operation is not performed by you, immediately change the ECS instance password. You can use the Reset Instance Password feature in the ECS console. For SSH weak password intrusion, immediately change the root password to a complex combination of uppercase letters, lowercase letters, digits, and special characters. Enable SSH key-based logon and disable password-based logon to prevent brute-force attacks.

    • Block the attacker source IP: Confirm that malicious processes are terminated and block the attacker source IP in the security group. Configure the Alibaba Cloud security group to deny all port access from related IPs to immediately block remote logon.

    • Investigate persistent backdoors: Check crontab, startup items, SSH public keys (~/.ssh/authorized_keys), and other files for suspicious entries to ensure no persistent backdoors are left by attackers.

    Local log investigation

    In addition to the attack tracing feature of Security Center, you can also manually check server system logs to investigate intrusion paths:

    • Linux server: Check /var/log/secure or /var/log/auth.log files to confirm unusual logon records and attack sources.

    • Windows server: Use Event Viewer to check security logs and focus on logon success/failure events.

    • Linux server: Check /var/log/messages files or DNS-related entries in systemd logs to investigate abnormal DNS requests.

    • Windows server : Through Event Viewer > DNS Server Check DNS query records to investigate abnormal DNS requests.

    Handling command execution after an AccessKey leak

    Receive RAM sub-account AccessKey attempted denied operation alert indicates that the AccessKey is trying to call an unauthorized API. For example, calling Ecs:DescribeInstances failed. This alert is a clear signal that the AccessKey may be leaked or abused. Handle it immediately. If you suspect the attacker has executed commands on the affected ECS instance through Cloud Assistant, follow these steps to investigate and clean up:

    Note

    If not yet confirmed AccessKey whether it is leaked, you canDetect AccessKey leaksto view leak detection results.

    1. Adjust authorization and AccessKey

      1. Immediately disable the AccessKey of the relevant RAM user to block subsequent unauthorized calls.

      2. Check whether the permission policy of the RAM user has excessive authorization.

      3. In ActionTrail by AccessKey ID to query historical API call records and evaluate the affected cloud services, performed operations, and impact scope.

    2. Investigate and clean up the server:

      1. Confirm command execution:

        1. Log on ActionTrail console. On the event query page, filter by Cloud service name Filter ECS, or use Advanced query by Event name Search InvokeCommand。

        2. Click the target event View details. In the returned JSON event record, requestParameters obtained from CommandContent (BASE64 encoded, decode to view the actual command content) and InstanceId (identifies the affected ECS instance).

      2. Log on to the server for investigation: Based on the information obtained in the previous step, InstanceId Log on to the corresponding ECS instance and perform the following checks:

        • Run ps aux Check for abnormal processes.

        • Run crontab -l Check for abnormal scheduled tasks.

        • Run cat /root/.ssh/authorized_keys Check whether SSH backdoor public keys are planted.

      3. Clean up residuals and harden: Remove malicious processes and files found in the previous step, delete abnormal scheduled tasks and backdoor public keys, and replace leaked AccessKey and restart the server to complete hardening.

    Common Virus Alert Handling Tutorials

    Security hardening and attack prevention

    • Upgrade Security Center edition: Enterprise and Ultimate editions support automatic virus quarantine to provide precision defense capabilities and support more security detection items.

    • Tighten access control: Open only required business ports (such as 80 and 443). Configure strict IP whitelist access policies for management ports (such as 22 and 3389) and database ports (such as 3306).

      Note

      For Alibaba Cloud ECS servers, seeManage security groupsto perform the operation.

    • Perform baseline check: In the left-side navigation pane, choose Risk governance > Cloud security posture management . In System baseline risks tab to view and handle baseline risk items.

    • Enable log analysis: In the left-side navigation pane, choose Risk governance > Log analysis. After enabling, security logs are retained and searchable.

    • Enable anti-ransomware backup: In the left-side navigation pane, choose Protection configuration > Anti-ransomware. Create and enable anti-ransomware backup policies for important servers.

    • Enable Security AI Assistant: Open at the top of the Overview page Security AI Assistant to obtain AI analysis conclusions and handling suggestions for the alert.

    • Set a complex server password: Set complex passwords containing uppercase letters, lowercase letters, digits, and special characters for servers and applications.

    • Upgrade software: Update applications to the latest official version. Avoid using unsupported versions or old versions with known security vulnerabilities.

    • Regular backup: Create regular snapshot policies for important data and server system disks.

      Note

      For Alibaba Cloud ECS servers, seeCreate policyto perform the operation.

    • Repair vulnerabilities promptly: Regularly use Security CenterVulnerability repairfeature to promptly patch system high-risk vulnerabilities and application vulnerabilities.

    • Reset the server OS (choose carefully)。

      If the virus has deeply infiltrated the system and is associated with underlying system components, we strongly recommend that you reset the server OS after backing up important data. Procedure:

      1. Create snapshots to back up important data on the server. For more information, seeManually create a single snapshot。

      2. Initialize the server OS. For more information, seeRe-initialize system disk (reset OS)。

      3. Use the snapshot to create a cloud disk. For more information, seeCreate a data disk from a snapshot。

      4. Attach the cloud disk to the server after OS reinstallation. For more information, seeAttach a data disk。

    FAQ

    Alert handling FAQ

    • What should I do if handling fails or alerts recur?

      1. If handling fails or the same alert recurs after cleanup, troubleshoot in the following order:

        Symptom

        Common causes

        Handling method

        Quarantine/terminate process failed

        The server agent is offline or the version is too low. Handling commands cannot be delivered.

        In Assets Confirm the client is online. Refer toAgent offline troubleshootingRetry after restoration.

        Quarantine failed

        The malicious process is still running and occupying the file, or the file has been deleted.

        • First terminate malicious processes (such as using kill command), then quarantine the file.

        • Directly mark the alert as Handled when the file does not exist.

        Alerts recur (common in worms and mining)

        Only subprocesses/virus files were cleaned. Persistence mechanisms such as the parent process, scheduled tasks, and startup items were not removed.

        Use the process tree in alert details to locate the parent process. Check and clean up crontab scheduled tasks, startup items, SSH public keys, and unknown accounts. Refer toBest practices for handling mining programs。

        Alerts recur on a schedule (such as at a fixed time every week)

        Scheduled remote download tasks exist, or other compromised hosts in the same network segment are repeatedly causing lateral infections

        Check scheduled tasks on all servers. Perform virus scans on other hosts in the same VPC

        Handling button unavailable

        The free edition or expired authorization does not support handling operations.

        PleasePurchase Security Centera higher protection edition, forAsset binding authorization。

        Other

        • Weak password: SSH/RDP/database passwords are too simple.

        • Vulnerability not repaired: Applications such as Redis, XXL-JOB, and WebLogic have high-risk vulnerabilities.

        • Backdoor lurking: Initial cleanup was incomplete, leaving hidden backdoors.

        • Data contamination: Restored a backup/snapshot infected with a virus.

      2. If alerts persist after the above steps, undeTECTED backdoors may exist. We recommend Back up data after Reset the server OS。

        Warning

        This operation has a risk of data loss. Back up data first. Carefully evaluate the impact scope before proceeding.

        1. Create snapshots to back up important data on the server. For more information, seeManually create a single snapshot。

        2. Initialize the server OS. For more information, seeRe-initialize system disk (reset OS)。

        3. Use the snapshot to create a cloud disk. For more information, seeCreate a data disk from a snapshot。

        4. Attach the cloud disk to the server after OS reinstallation. For more information, seeAttach a data disk。

    • What should I do if a web application creates an abnormal subprocess alert?

      Such alerts are usually triggered when SQL Server enables xp_cmdshell, suspicious stored procedure calls to invoke system commands, or web exploit triggers. Check the command line and parent process in alert details for abnormal files, such as C:\Users\Public\tmp_out.txt; then disable high-risk database features and check scheduled tasks and auto-start items to remove items that may continue to trigger abnormal subprocesses.

    • Sensitive command execution (such as cat /etc/ssh/sshd_config) alert?

      cat /etc/ssh/sshd_config is used to view SSH configuration information and may trigger alerts in strict mode. Confirm whether this is an expected O&M operation. If not, treat it as a security risk and investigate related processes and operation sources.

    • What should I do if a suspected external logon scanning/attack alert is generated?

      This alert indicates the server may be compromised and used for external attacks. Terminate malicious processes, quarantine related files, perform a full disk virus scan, check system logs to investigate the intrusion path, and harden security group rules and password policies.

    • What should I do if a cloud host security protection service disable alert is generated?

      This alert indicates attackers may be trying to disable protection processes such as AliSecCheck. Perform a virus scan, quarantine infected files, and terminate abnormal processes. Then investigate intrusion traces and persistence mechanisms on the server.

    • Cannot delete virus files (trojans, mining programs)?

      The file and its parent directory have hidden attributes. Use the chattr -i command to remove the immutable attribute from the file and parent directory before deleting.

    • The server has a DDoS trojan alert, and the file has been manually deleted but the alert persists?

      Files are not completely deleted. Solution:

      1. When Security Center is the free edition, you can activatedays free trial of Enterprise or Ultimate Edition. Or refer toPurchase Security Center. Upgrade Security Center to Anti-Virus Edition or Enterprise Edition.

      2. After activation, go to the alert handling page, find DDoS trojan, click Handle, and select Virus Scan. The system terminates the trojan process and quarantines the file. For more information, seeVirus Detection and Removal。

    • How do I whitelist precision defense alerts?

      Alerts generated by precision defense rely on defense plugins. Blocking is automatically applied after such alerts are generated. Manually whitelist in Host Rule Management. Procedure:

      1. Access the Security Center console - Protection Settings - Host Protection - Host Rule Management. In the upper-left corner of the page, select the region of your assets: Chinese Mainland or Outside Chinese Mainland.

      2. In Malicious Behavior Defense tab Custom Defense Rule sub-tab, click Create Rule. Supported whitelist types:

        • Process hash

        • Command line

        • Process Network

        • Network interception (source IP/domain)

          You can configure blacklist or whitelist rules for source IP addresses or domains. When a security alert indicates a reverse shell or persistent malicious outbound connection, you can block specific attack source IPs by creating custom network interception rules. Malicious IPs or domains provided by customer service or security teams can also be added to the blacklist for interception.

          For example, after handling a reverse shell alert or a persistent malicious outbound connection alert, if the attacker source IP has been confirmed and the malicious process has been terminated, you can block the IP by performing the following steps:

          1. On the Malicious Behavior Defense page, click the Custom Defense Rule tab, and then click Create Rule.

          2. Select Network Interception as the rule type, add the confirmed attacker source IP or malicious domain to the blacklist, set the action to Block, and then select the servers where the rule takes effect.

          We recommend that you also configure security group rules for protection: create a security group deny rule for the target instance in the ECS console and add the confirmed malicious IP to both the outbound and inbound deny lists to immediately block malicious traffic. For more information, see the security group rule configuration documentation in the ECS documentation.

        • File Read/Write

        • Registry Operation

        • Load Dynamic-link Library

        • File Rename

    • What should I do if only Whitelist and Ignore options are available for alert handling?

      Some alerts may only have Whitelist and Ignore options, without Terminate Process or Virus Scan options. This usually means the process is no longer running or the file has been deleted. Suggestions:

      • If you confirm the threat has been removed (process terminated, files deleted), you can select Ignore or Manually Handled to close the alert.

      • If you still need to terminate the process, select Terminate Process first and then refresh the page to view handling options.

      • For stubborn viruses or recurring alerts, follow the Security hardening and attack prevention section above for thorough handling.

    • Does a webshell alert belong to automatic system operations?

      Webshell attacks are usually external intrusion behavior. Attackers exploit vulnerabilities to upload webshells or write backdoors through code execution vulnerabilities. This is not an automatic system operation. Handle as an intrusion: combine Alert details and local server logs to investigate the intrusion entry. Remove malicious files and abnormal processes, and complete vulnerability repair, access control, and account security hardening.

    • What should I do if I receive a notification of suspected malicious behavior on a server (large-scale SSH port scanning or external attacks)?

      • The server has been shut down: If the server is no longer in use, you can ignore this notification first.

      • Continue to use: Reinstall the OS to thoroughly remove the virus. In the ECS console, find the instance and choose All Operations > Initialize Disk (must be stopped). After reinstallation, harden security: configure a strong password, restrict security group rules to allow only specified IPs for remote logon, and open only required business ports.

      • About blocking: If no external attacks are detected after reinstallation, platform bans are generally not triggered. If access issues persist after a clean virus scan, check other causes such as security group configurations and the server firewall.

    • Why is the SSH port displayed as 22 in alert details?

      If sshd_config not explicitly configured in Port field, Security Center identifies SSH as port 22 by default. Even if the actual port has been changed, alert details may still show port 22. Check the actual SSH configuration of the server.

    • What should I do if I continue to receive successful SSH brute-force attack alerts after fixing?

      Check whether the non-standard port (such as 5522) is correctly configured and in actual use. If the alert persists after configuration check, back up necessary data and reset the instance.

    • Why do alerts continue after virus/malicious files are deleted?

      Security Center retains historical threat records for about one year. Even if virus files are deleted, if no handling operation is performed (such as ignore or whitelist), the system continues to send notifications based on historical records. Suggestions:

      • After confirming the threat is removed, perform Ignore or Manually Handled on related alerts in the alert list.

      • If the alert time is before the security operation, you can ignore the alert after confirming security.

    • What should I do if I still receive unusual logon alerts for the old IP after changing the public IP?

      Old IP alerts after an IP change are usually triggered by Security Center based on historical logon behavior. Suggestions:

      • If the alert time is before the IP change, you can ignore the alert.

      • Synchronize the latest asset information in the asset center to ensure Security Center records the current valid IP addresses.

    • Cannot find specific weak password users and passwords in the alert details?

      In the Actions column on the Alerts page, click Details to view weak password users and credentials. If details are not shown, the alert may be historical or expired. Change relevant account passwords to complex passwords containing uppercase letters, lowercase letters, digits, and special characters.

    • How do I authorize Alibaba Cloud engineers to investigate and handle viruses?

      • Fill in authorization information in the ticket, provide the server password, and authorize Alibaba Cloud engineers for remote on-site investigation.

      • Prerequisites: For high-risk operations, create a snapshot backup before authorizing engineers for on-site operations. Operations without snapshots are not allowed. Engineers cannot create snapshots for you. Complete the snapshot backup first.

      • If you do not know the server password, you can reset the instance password in the ECS console.

    • Why is the Handle button grayed out or unresponsive?

      Common causes:

      1. Currently using the free edition or no protection authorization purchased: The free edition only supports viewing some alerts and does not support handling operations (quarantine, blocking, whitelisting, etc.). FirstPurchase Security CenterAnti-Virus Edition or above, and ensure the affected server is bound to the authorization.

      2. Instance expired: After a subscription instance expires, handling capability becomes invalid. Renew and try again.

      3. Insufficient RAM user permissions: AliyunYundunSASFullAccess permission is required. Read-only permission (ReadOnlyAccess) cannot perform handling operations.

      4. The server agent for the alert is offline: Handling commands cannot be delivered. First refer toAgent offline troubleshootingRestore the client online status.

    Console feature issues

    • What should I do if the alert shows the file does not exist?

      This may be because the virus has been removed by other means or cleaned up itself. Click Ignore or Manually Handled in the alert list to clear this alert.

    • Received a security alert but no related data in the console?

      • Security Center alert data is displayed by region. You can switch regions in the upper-left corner of the Alerts page Chinese Mainland and Outside Chinese Mainland region. If you receive an alert notification but the alert is not displayed on the page, switch to another region using the region selector at the top.

      • Check your Security Center edition: The free edition has limited features. We recommendPurchase Security Center. Upgrade Security Center to Anti-Virus Edition or Enterprise Edition.

      • Some alerts may come from Alibaba Cloud traffic monitoring, security intelligence analysis, or other Alibaba Cloud security products. These alerts may not appear in the Security Center CWPP console.

    • How do I handle multiple alerts in batch?

      Security Center currently supports batch whitelisting, ignoring, canceling whitelist, and canceling ignore to handle security alerts.

      1. Log on Security Center console. In the left-side navigation pane, choose Detection and Response > Alert Go to the Alerts page and select the alerts to handle in batch.

      2. Click the lower-left Ignore This Time、Add to Whitelist、Remove from Whitelist、Cancel Ignore button.

    • Why is the security alert handling button grayed out?