Purchase Security Center

Description: Provides anti-ransomware backup and recovery. After a ransomware attack, you can use backup files to restore servers and databases.

Purchase instructions:

• The purchase quantity determines the anti-ransomware capacity, which depends on the size of files to back up and the backup retention period, not the number of servers.

• Supported only in specific regions. Set the protection data volume as needed. For supported regions, see Supported regions.

• If you select Set Recommended Policy, important file paths on existing servers are automatically backed up regularly. To adjust, go to the Anti-ransomware page to modify the policy. For details, see Modify server anti-ransomware policies.

Description: Provides identity permission management, automated compliance inspection, and cloud product configuration baseline detection for unified multi-cloud risk management.

Purchase instructions:Billed by service authorization count. Service authorization count =scan count (number of cloud products×number of asset instances×number of check items) + verification count + successful remediation count.

Description:

• Agentic SOC: Supports unified log ingestion across clouds, accounts, and products (such as WAF, Cloud Firewall, and VPC). Provides closed-loop detection and response for security alerts and events, improving security operations and meeting MLPS compliance log audit requirements.

• Security Operations Agent: An advanced intelligent add-on based on Agentic SOC. Powered by Agentic AI, it integrates Alibaba Cloud native security data and infrastructure, using autonomous perception-reasoning-execution capabilities for independent security event analysis and rapid incident response.

Purchase instructions:

• Uses modular billing. Billing items vary based on purchase options. For details, see Agentic SOC - Subscription.

  • Agentic SOC: Billed by Log Ingestion Traffic and Log Storage Capacity separately. You can purchase them based on actual needs.

    Log ingestion traffic (GB/day)

    • Purpose: Used for core security operations such as real-time threat detection, attack tracing, and alert analysis. After purchase, you can use most Agentic SOC core features including threat detection and incident response.

    • Estimate capacity :

      • Estimate based on existing logs

        Daily traffic (GB) = Total log storage capacity (GB) / Log retention days (TTL).

        Example: If you have 10,000 GB of logs retained for 90 days, daily traffic is approximately 10000 / 90 ≈ 111 GB. We recommend purchasing 200 GB/day.

      • Estimate based on log generation rate (EPS)

        Daily traffic (GB) = EPS (logs per second) × 86400 × Average log size (KB) / 1024

        • EPS: Number of logs generated per second.

        • Average log size: Typically between 3 KB and 7 KB.

    Log storage capacity (GB)

    • Purpose: Used for long-term log storage for query and audit, meeting the Cybersecurity Law and MLPS 2.0 requirements that logs must be retained for at least 180 days, and supports retrospective analysis of historical events.

    • Estimate capacity:

      • Estimate by server count: We recommend configuring 120GB of log storage capacity per server.

      • Estimate based on existing capacity: Set the capacity to 3 times your current Security Center - Log Analysis purchase amount.

  • Security Operations Agent: In addition to purchasing Agentic SOC, you also need to purchase Intelligent Usage Analysis and Number of Managed Instances.

    • Intelligent Usage Analysis: Security Operations Agent Analysis usage for alert analysis, incident investigation, tracing, attribution, and security report generation. The purchase quantity cannot be auto-filled and must match Log Ingestion Traffic.

      Note

      Intelligent Usage Analysis Cleared daily. The system automatically throttles after exceeding the limit.

    • Number of Managed Instances: Security Operations Agent Supports cross-instance security operations and automated handling. Billed by managed instance count. Each invoked instance (ECS, WAF, ALB, cross-cloud products, on-premises security vendor products, etc.) counts as one.

      Note

      Cleared monthly. Each instance is counted only once with automatic deduplication.

• If you select Access Policy, automatically connect to the current Alibaba Cloud account's Security Center, WAF, Cloud Firewall and ActionTrail log sources.

Description: Provides one-click remediation of Linux Software Vulnerability and Windows System Vulnerability.

Purchase instructions: Enter the number of vulnerability remediation attempts based on monthly needs.

Description: One-click scanning of images for system vulnerabilities, application vulnerabilities, viruses, and malicious samples, with remediation recommendations.

Purchase instructions:

• Enter the scan authorization count to purchase based on monthly needs.

  Note

  scan authorization count One authorization is consumed when an image digest is first scanned. Repeated scans of the same digest do not consume additional authorizations. If the digest changes, a new authorization is required.

• Available only when the edition is Advanced, Enterprise Edition, Ultimate Enterprise or Value-added Plan.

Description: File tamper-proofing uses real-time monitoring to track file system activities, automatically intercept unauthorized write and delete operations, and record all access for a complete audit trail, ensuring critical file integrity.

Purchase instructions : Select the purchase quantity based on the number of servers to protect.

Description: Detects hidden malware, web shells, viruses, and other risk files in server file systems through deep scanning.

Purchase instructions: Set the purchase quantity to the number of files to scan per month.

Description: Application protection uses RASP (Runtime Application Self-Protection) technology to enable real-time attack detection and blocking.

Purchase instructions: We recommend setting the purchase quantity to the total number of Java processes to protect.

Description: Provides efficient threat honeypot trapping against attackers, improving detection and protection of core assets.

Purchase instructions: Cloud honeypots are billed by probe count. Minimum 20 probes, maximum 500.

Description: Aggregates security logs from cloud assets, provides powerful SQL search and visual reports for event tracing, attack analysis, and compliance audit.

Purchase instructions: Per the Cybersecurity Law, logs must be stored for at least 180 days. We recommend at least 50 GB per server.

Description: Provides comprehensive detection and protection for host and container assets. After purchase, bind assets to a protection level. Protection levels:

Main protection capabilities for each level:

Purchase instructions: must be authorized and applied to specific assets to take effect after activation. You can custom-bind assets.

Description: Provides identity permission management, automated compliance inspection, and cloud product configuration baseline detection for unified multi-cloud risk management.

Purchase instructions:Billed by service authorization count. Service authorization count =scan count (number of cloud products×number of asset instances×number of check items) + verification count + successful remediation count.

Description: Provides one-click remediation of Linux Software Vulnerability and Windows System Vulnerability.

Purchase instructions: Enter the number of vulnerability remediation attempts based on monthly needs.

Description:

• Agentic SOC: Supports unified log ingestion across clouds, accounts, and products (such as WAF, Cloud Firewall, and VPC). Provides closed-loop detection and response for security alerts and events, improving security operations and meeting MLPS compliance log audit requirements.

• Security Operations Agent: An advanced intelligent add-on based on Agentic SOC. Powered by Agentic AI, it integrates Alibaba Cloud native security data and infrastructure, using autonomous perception-reasoning-execution capabilities for independent security event analysis and rapid incident response.

Purchase instructions:

• Based on purchase options, billing items also differ. For billing details, see Agentic SOC - Pay-as-you-go.

  • Agentic SOC: Billed on a tiered basis for Log Ingestion Traffic. The higher the usage, the lower the unit price.

    Important

    In pay-as-you-go mode, you cannot purchase Log Storage Capacity. Therefore, you cannot store logs for queries and audits.

  • Security Operations Agent: In addition to the basic charge for Log Ingestion Traffic from Agentic SOC, you are also charged for Intelligent Usage Analysis and Number of Managed Instances.

    • Intelligent Usage Analysis: The analysis usage consumed by Security Operations Agent to analyze alerts for risk events, investigate events, perform traceability and attribution, and generate security reports.

    • Number of Managed Instances: Security Operations Agent supports security operations and automated handling across instances. Billing is based on the number of managed instances, and each invoked instance is billed. Instances can include ECS, WAF, ALB, multicloud products, and third-party security vendor products.

      Note

      Each instance is counted only once, and duplicates are automatically removed.

• If you select Access Policy, automatically connect to the current Alibaba Cloud account's Security Center, WAF, Cloud Firewall and ActionTrail log sources.

Description: Provides anti-ransomware backup and recovery. After a ransomware attack, you can use backup files to restore servers and databases.

Purchase instructions:

• Billed by backup file size and storage duration. For details, see Anti-ransomware - Pay-as-you-go.

• Supported only in specific regions. Set the protection data volume as needed. For supported regions, see Supported regions.

• If you select Set Recommended Policy, important file paths on existing servers are automatically backed up regularly. To adjust, go to the Anti-ransomware page to modify the policy. For details, see Modify server anti-ransomware policies.

Description: File tamper-proofing uses real-time monitoring to track file system activities, automatically intercept unauthorized write and delete operations, and record all access for a complete audit trail, ensuring critical file integrity.

Purchase instructions: Billed by actual protection duration (seconds) × number of protected servers. Hosts meeting these conditions are automatically counted:

• Servers bound with block rules.

• Servers bound with alert rules where the server edition is below Enterprise Edition or the Host Protection.

Description: Application protection uses RASP (Runtime Application Self-Protection) technology to enable real-time attack detection and blocking.

Purchase instructions: After activation, you must authorize the feature for specific assets. You can custom-bind assets.

Description: Lightweight vulnerability scanning and risk assessment without installing an agent on servers.

Purchase instructions: Billed by scanned data volume.

Description: Provides intrusion detection and vulnerability scanning for Serverless assets (such as ECI). For more, see Serverless container security.

Purchase instructions: After activation, you must authorize the feature for specific assets. You can custom-bind assets.

Description: Detects hidden malware, web shells, viruses, and other risk files in server file systems through deep scanning.

Purchase instructions: Billed by scanned file count. For details, see Malicious file detection - Pay-as-you-go.

Description: Log management based on Alibaba Cloud Log Service (SLS), providing unified log audit, built-in security reports, SQL analysis for tracing, and flexible storage policies.

Purchase instructions: Configure the log storage region.