Security Center:FAQ

Novidades

Release notes

Perguntas de pré-venda

• Perguntas sobre avaliação gratuita

  • Can I cancel and reapply for the Enterprise Edition free trial?

  • How do I get Security Center for free?

  • What is the difference between the Free Edition and the Enterprise Edition free trial?

  • Why is there no "Free Trial" entry on the Overview page?

  • Are configurations retained after the Enterprise Edition free trial expires?

• Perguntas sobre aquisição

  • Will subscription and pay-as-you-go services be billed redundantly?

  • Can pay-as-you-go services be converted to subscription?

  • Can subscription and pay-as-you-go be used simultaneously?

  • Why is the actual amount on the purchase page higher than the product pricing?

  • How do I choose the right Security Center edition?

• Perguntas sobre uso do product

  • Does Security Center comply with international security standards?

  • Does Security Center support virus scanning and removal?

  • Can Security Center automatically quarantine infected files?

  • How does Security Center provide end-to-end security during a cyberattack?

  • Can Security Center protect non-Alibaba Cloud servers, such as those in on-premises data centers or from other cloud providers?

  • My server assets are outside the Chinese mainland. Can I still use Security Center? How is my data handled?

Perguntas sobre aquisição e renovação

• Perguntas sobre renovação

  • How do I renew Security Center when it is about to expire?

  • How far in advance can I renew a Security Center instance?

  • Can I downgrade from Security Center Premium Edition to Anti-virus Edition during a renewal with a specification change?

  • How do I change the auto-renewal period or cancel auto-renewal?

  • What do I do if a RAM user has no permission to renew?

  • What do I do if the number of my servers exceeds the number of purchased authorizations?

• Perguntas sobre upgrade e downgrade

  • Can the subscription duration for upgraded server authorizations or value-added services be different from my existing Security Center subscription?

  • Can I downgrade Security Center Enterprise Edition to the Free Edition?

  • Why do I see the message "A pending renewal with a specification change exists. Upgrade or downgrade is not allowed." when I try to upgrade or downgrade?

  • Can I unsubscribe from Security Center and then purchase it again?

• Perguntas sobre reembolso

  • Can I unsubscribe from Security Center and then purchase it again?

• Faturamento de correção de vulnerabilidades

  • After purchasing a subscription for vulnerability fixes, can I still enable pay-as-you-go for vulnerability fixes?

  • How do I switch from a subscription to pay-as-you-go for vulnerability fixes?

  • If I enable pay-as-you-go for vulnerability fixes and then purchase the Premium Edition or higher, will I continue to be charged?

Problemas operacionais no console

Perguntas sobre pontuação de segurança

How do I view the version of the virus library of Security Center?

After I install the Security Center agent on my ECS instances, will the virus library of Security Center be installed on the instances?

What are the priorities to handle security events that I can access in the Secure Score section?

How does the vulnerability scan level affect the security score?

How does the baseline check level affect the security score?

Perguntas sobre ativos

How do I unbind (release) a non-Alibaba Cloud asset?

How does Security Center unbind an Alibaba Cloud ECS server?

Two servers with the same information appear in the server list — one Online and one Offline

Perguntas sobre proteção contra ransomware

• What is the anti-ransomware feature? Why is it charged separately?

• What is the relationship between the Security Center anti-ransomware feature and Alibaba Cloud Cloud Backup?

• Do backups start automatically after purchasing anti-ransomware capacity?

• How do I view my purchased anti-ransomware capacity and its usage?

• How do I clear a large anti-ransomware backup cache that occupies disk space?

• Can I change the backup cache location if it uses too much C drive space?

• What should I do if the anti-ransomware client consumes excessive CPU or memory resources?

• What are the differences between the anti-ransomware solution and snapshot backups?

• What should I do if the purchased anti-ransomware capacity is insufficient?

• What should I do if a protection policy is in an abnormal state?

• Why do .aeqis, .zaegis, or !aegis folders still exist on my server after I disable anti-ransomware?

• Does the anti-ransomware service guarantee compensation for ransomware infections?

• Is anti-ransomware protection necessary for internal network servers without public network access?

• How do I confirm whether a server has been targeted by ransomware when no alerts are generated?

• Why does enabling the Anti-ransomware (bait capture) feature redirect me to the purchase page and show that my configuration has not changed?

• I purchased the anti-ransomware service but haven't used it. Can I request a deferral or refund?

Perguntas sobre proteção contra adulteração de páginas web

• Can the validity period of the Security Center edition differ from that of file tamper protection?

• How do I fix "Protection module initialization failed. Check if other software is intercepting or controlling service creation."?

• What are the requirements for the file tamper protection local backup directory?

• Why does configuring a tamper protection directory prompt a path error?

• Why does file tamper protection fail after configuring a protection directory?

• Can I still write files to a directory after configuring it for protection?

• What should I do if tamper protection does not take effect immediately after configuration?

• Why are no alerts generated when I modify a protected file via SSH, even with tamper protection enabled?

• What should I do if I cannot modify website content and images after configuring tamper protection?

• Why are file operations still blocked or generating alerts after I disable or modify a tamper protection rule?

• Why does the number of tamper protection alerts in the console differ from email notifications?

• Does the absence of tamper protection alerts mean the files are safe?

• Are tamper protection rules automatically generated after a version upgrade?

• What should I do if canceling file tamper protection authorization returns the error "none uuid is not online"?

• Does Security Center provide compensation if a website protected by Web Tamper Protection is tampered with?

• What should I do if the AliWebGuard process is still running after file tamper protection expires or is disabled, causing file synchronization to fail?

Vulnerabilidades de software Linux

• Does Security Center support Ubuntu 24.04? How do I manually scan for vulnerabilities?

• How do I determine whether a Linux kernel version is affected by a specific CVE vulnerability?

• How do I handle the situation where Security Center still reports vulnerabilities after a kernel upgrade fix?

• How do I manually upgrade the Ubuntu kernel?

• What do I do if I receive a target kernel incompatibility error when fixing a kernel vulnerability?

• After running yum update kernel, Nothing to do or no upgrade success message, do I need to restart the server?

• How do I handle timeouts when connecting to the official Alibaba Cloud Yum source?

Correção de vulnerabilidades

• After the OS is end of life (EOL), does Security Center support vulnerability scanning and fixing?

• When multiple services are deployed on the same server, what is the impact scope of system vulnerabilities?

• Do I need to restart the server when fixing vulnerabilities? What is the impact on business?

• What are the risks of not fixing high-risk vulnerabilities (such as Linux Kernel ptrace)?

• Will I be charged again if I click Fix again after a vulnerability fix fails?

• Do I need to wait for the snapshot to complete before fixing? How do I roll back if business is abnormal after fixing?

• Can high-risk vulnerability alerts be deleted directly? How do I handle vulnerabilities that do not need fixing or are false positives?

• Do emergency vulnerabilities showing To Be Protected or Protected need to be handled?

• Do I need to restart the system after vulnerability fixing?

• Is the effect of Security Center automatic Windows patch fixing the same as manual patch download and installation?

• After Microsoft releases a patch, do I need to wait for Security Center synchronization before fixing?

• Does Security Center support generating and exporting vulnerability scan reports?

• How do I determine whether a Linux kernel version is affected by a specific CVE vulnerability?

• How do I handle the execution order, concurrency recommendations, and UI display issues during batch vulnerability fixing?

• Do servers without a public IP address support Security Center vulnerability fixing?

• What are the precautions and recommendations for enabling automatic vulnerability fixing?

• Does fixing database or middleware versions (such as MySQL or Oracle) affect business? What are the precautions?

• What do I do if batch vulnerability fixing shows "No matching records" or an empty list?

• What do I do if vulnerability fixing in an ACK cluster is slow or inefficient?

• I received a high-risk vulnerability notice from the authority, but access control is already in place. How do I fill in the rectification report?

• How do I disable automatic vulnerability fixing to avoid additional charges?

• How do I handle the situation where Security Center still reports vulnerabilities after a kernel upgrade fix?

• How do I manually upgrade the Ubuntu kernel?

• What do I do if I receive a target kernel incompatibility error when fixing a kernel vulnerability?

• When can I use force fix? What are the risks?

• What do I do if some vulnerabilities in the Security Center console show no updates?

• After running yum update kernel, Nothing to do or no upgrade success message, do I need to restart the server?

• How do I view the failure alert after a vulnerability fix fails?

• How do I handle error codes in fix failure alerts?

• Does manual vulnerability fixing cause Security Center to generate false positive attack alerts?

• Why does a vulnerability still show as unfixed or restart required after fixing, or why does verification not respond?

• Why are vulnerabilities detected even though I did not actively install third-party software?

• What does it mean when a vulnerability is marked as fixed with the reason Rule Offline?

• Why are vulnerabilities found in the /usr/share/doc directory? Will the same vulnerabilities reappear after fixing?

Detecção de vulnerabilidades

• Why is the number of emergency vulnerabilities different from the number of application vulnerabilities?

• Does Security Center alert on unlisted CVE vulnerabilities?

• Where can I view the latest classification after vulnerability rule categories are adjusted?

• Does Security Center support Ubuntu 24.04? How do I manually scan for vulnerabilities?

• Why are emergency vulnerabilities not in the Vulnerabilities to Fix (CVE) list?

• How do I stop automatic scanning of emergency vulnerabilities?

• Why do Security Center scan results differ from third-party security software (such as Huorong)?

• Why does Security Center not detect vulnerabilities that third-party scanning tools (such as Qualys) or manual checks report?

• Why do inactive instances still report high-risk vulnerabilities?

• Why do many historical vulnerabilities appear and affect the security score after I turn off the Show Only Real Risk Vulnerabilities switch?

• Does a new scan use or restore historical vulnerability data?

• How do I distinguish between active scanning and passive detection in Security Center vulnerability scan results?

• Why does the application vulnerability detection result not show the specific file path?

• Do Security Center vulnerability scan results overwrite historical data?

• Why does a newly purchased ECS instance have vulnerabilities?

• Why is there a significant difference in vulnerability alert counts between two servers?

• What do I do if an alert reports middleware vulnerabilities such as Redis, but I cannot find the corresponding cloud product instance?

• Why am I prompted that high-risk system vulnerabilities are not fixed?

• What do I do if Vulnerability Management and security alerts have no data after I add a new instance?

Verificações de baseline

• What do I do if a baseline check verification fails?

• What is the difference between a baseline and a vulnerability?

Alertas de segurança

• FAQ about Detection and Response

• How do I determine whether an asset is threatened by crypto-mining?

• Virus interception is not enabled and my server is under a crypto-mining attack. What do I do?

• I accidentally added a crypto-mining alert to the whitelist. How do I remove it?

• How do I check which protection features are enabled?

• How do I verify that automatic virus interception is in effect?

• Why does phpinfo generate an alert? Is it a false positive?

• Does Security Center automatically isolate WebShell files?

• How does Security Center detect WebShells?

• How does Security Center detect hacker intrusion behaviors?

• What are the common hacker intrusion behaviors?

• What objects can be added to the whitelist for security alerts?

• Why are some alerts marked as Expired?

• Why is the first occurrence time of a suspicious domain access alert inconsistent with the detection time?

Ataques de força bruta

• How do I view the number of brute-force attacks or interception status on my server?

• How do I prevent brute-force attacks on my server?

• FAQ about Detection and Response

• Does brute-force prevention support protecting web applications or websites?

• What should I do after a brute-force attack succeeds?

• Why do I still receive password brute-force alerts after changing a weak password?

• Why are there still brute-force attack records for RDP even though the RDP port 3389 is already blocked by security group or firewall rules?

• Does ECS logon weak password refer to system-level RDP or SSH scanning?

• FAQ about Detection and Response

Notificações de alerta

• How do I change the recipients of alert notifications?

• Can I receive alert notifications if I don't select any attention levels in the notification settings?