Security Center:Manage clusters and repository images

Supported cluster types

Security Center supports the following cluster types:

View cluster security risks

1. Log on to the Security Center consoleSecurity Center consoleSecurity Center consoleSecurity Center console.

2. In the left navigation pane, choose Assets > Container. In the upper-left corner, select your region.

3. On the Cluster tab, view the number of connected clusters, at-risk clusters, and the full cluster list.

• Search for a cluster: Use the search bar to filter by cluster ID, type, or other attributes.

• View risk details: Click the cluster name or View in the Actions column to open the risk details page. The page shows statistics and lists for security alerts, vulnerabilities, configuration risks (Kubernetes configuration risks and baseline risks), and container firewall alerts.

Enable K8s log threat detection

K8s log threat detection lets Security Center retrieve cluster log data to identify high-risk operations and attack behaviors, providing deeper security coverage than agent-based detection alone.

For ACK managed and dedicated clusters:

1. Enable the log audit feature in the Container Service console. See Use the cluster API server audit feature.

   1. Log on to the Container Service Management console. In the left navigation pane, click Clusters.

   2. Click the target cluster name. In the left navigation pane, choose Security Management > Audit.

   3. Follow the on-screen instructions to select a Simple Log Service (SLS) project and enable the feature.

2. In the Security Center console, enable K8s threat detection for containers.

For self-managed Kubernetes clusters:

See Enable log threat detection.

After enabling the feature, go to the Clusters tab on the Container page. Check the K8s Log Status column for the target cluster to confirm that log threat detection is active.

Analyze cluster port exposure

Exposing container ports to the internet creates attack surfaces for network intrusions and data breaches. Security Center's exposure analysis detects publicly reachable ports across your clusters.

Exposure analysis currently supports ACK managed and dedicated clusters only.

Security Center runs a full exposure analysis on all connected clusters every morning. To run an on-demand analysis, click Exposure Analysis in the Actions column for the target cluster on the Cluster tab.

(Optional) Click Task Management in the upper-right corner. On the Container Exposure tab of the Task Management panel, check the progress and details of the exposure analysis.

To view exposure results:

1. On the Container page, click the target cluster name.

2. On the cluster details page, click the Container tab and set the Exposed filter to Yes.

1. Hover over the icon in the Exposed column to see the exposed port details.

Close any internet-exposed ports that are not in active use to reduce your attack surface.

View image repositories

1. Log on to the Security Center consoleSecurity Center consoleSecurity Center consoleSecurity Center console.

2. In the left navigation pane, choose Assets > Container. In the upper-left corner, select your region.

3. On the Image tab, view image repository information.

The Overview section shows the number of at-risk images and your Remaining Quota for image security scans.

• Increase scan quota: In the Remaining Quota section, click Increase Quota. See Upgrade and downgrade.

• Register a private repository: In the Add Third-party Image Repository section, click Add. See Add an image repository.

The repository list shows all repositories connected to Asset Center, including repository name, region, type, and risk status.

• Search for a repository: Use the search bar to filter by instance ID, namespace, or other attributes.

• View repository details: Click the repository name or View in the Actions column. The details page lists each image with its name, version, size, and risk status. The Created At/Updated At column reflects Security Center's first and most recent sync times, not the local creation and update times of the repository.

• View Platform for AI (PAI) image repositories: Apply the Tag > PAI filter in the search bar.

• Enable automatic sync for Container Registry Enterprise Edition: Click Synchronize in the Actions column for a repository. Once enabled, assets added to the Container Registry Enterprise Edition instance are automatically synced to the image list in Security Center.

To view or export threat and vulnerability details for a specific image version, go to the repository details page, find the target version, and click Handle in the Actions column.

Scan container images

Image scanning detects vulnerabilities, baseline risks, malicious samples, and sensitive files in your container images.

1. Log on to the Security Center consoleSecurity Center consoleSecurity Center consoleSecurity Center console.

2. In the left navigation pane, choose Assets > Container. In the upper-left corner, select your region.

3. On the Image tab, click Scan Now in the Container Image Scan section.

1. In the Quick Scan dialog box, select an image type and configure the scan scope, then click OK. For scan scope configuration options, see Perform image security scans.

2. (Optional) Click Task Management in the upper-right corner. On the Image Scan, Image Risk Fixing, and Container Runtime Image Scan tabs, track scan progress and review repair information.