Cloud Firewall integrates with Simple Log Service (SLS) to collect, query, analyze, transform, and consume traffic logs from your protected assets in real time. Use this feature to monitor network activity, respond to security incidents, and meet classified protection compliance requirements.
Use cases
Log analysis is suited for enterprises that need security compliance, flexible log configuration, and visibility into network traffic.
Compliance audit: Store access logs for more than six months to meet classified protection requirements and respond to log audits.
Security analysis and emergency response: Trace and analyze security incidents, identify threat sources, analyze attack patterns, and block potential attacks.
Data center integration: Export logs to self-managed data centers for centralized log management and analysis.
Performance monitoring: Monitor network performance in real time to identify and diagnose issues, improving service availability and operational efficiency.
Billing 2.0
Starting October 15, 2025, the billable items for Cloud Firewall will be updated to Billing 2.0. New users use Billing 2.0 by default. Existing users can continue to use Billing 1.0 and can choose to upgrade to Billing 2.0. For more information about the pricing changes in Billing 1.0 and how to upgrade to Billing 2.0, see Billing 1.0 and upgrade instructions.
Cost description
The Agentic NDR log analysis feature is billed independently, with charges issued separately from the Agentic NDR side. This feature is completely isolated from the Cloud Firewall log analysis storage space, and you must activate the NDR log analysis service separately.
Pay-as-you-go
Price: CNY 2 per TB per hour.
Storage capacity: The optional range is 1 TB to 500 TB, with a purchase increment of 1 TB.
Subscription
Price: CNY 500 per 1 TB per month.
Storage capacity: The optional range is 1 TB to 500 TB, with a purchase increment of 1 TB.
Logstore description
After you enable the log analysis feature, Agentic NDR automatically creates a dedicated Project (named agentic-ndr-<Alibaba Cloud account ID>-<RegionID>) and a dedicated Logstore (named agentic-ndr-logstore) to store all log data collected by Agentic NDR.
You can sign in to the Simple Log Service console to view the dedicated Project and Logstore for Agentic NDR. Do not delete the Project or Logstore. If you accidentally delete them, the lost log data cannot be recovered, and you must re-enable the log analysis feature to continue using it.
Billing 1.0 (legacy)
Cost description
Pay-as-you-go cost description
After you enable the log analysis feature, Simple Log Service (SLS) handles billing. Agentic NDR and Cloud Firewall log analysis share the same storage space.
Subscription cost description
The Agentic NDR log analysis feature is billed independently, with charges issued separately from the Agentic NDR side. For pricing details, see Log storage capacity for log analysis. This feature is completely isolated from the Cloud Firewall log analysis storage space, and you must activate the NDR log analysis service separately.
Agentic NDRAfter logs are pushed to Simple Log Service, no additional charges are incurred for the dedicated Logstore. However, if you perform operations such as data transformation or data shipping in the Simple Log Service console, you may be charged for these operations.
When the Logstore is billed based on the pay-by-feature billing method, data transformation, data shipping, and streaming reads from public endpoints performed in the Simple Log Service console incur charges for computing, data shipping, and public network read traffic. For more information, see Billable items for the pay-by-feature billing method.
When the Logstore is billed based on the pay-by-data-volume billing method, operations such as data transformation and data shipping in Simple Log Service are free. You are charged only when reading data from public endpoints, based on standard Simple Log Service rates. For more information, see Billable items for the pay-by-data-volume billing method.
Logstore description
Pay-as-you-go Cloud Firewall: After you enable the Cloud Firewall log analysis feature, Cloud Firewall automatically creates a dedicated Project and a dedicated Logstore to store all log data collected by Cloud Firewall and Agentic NDR. The dedicated Project is named cloudfirewallnew-project-Alibaba Cloud account ID-Region ID, and the dedicated Logstore is named cloudfirewall-logstore.
Subscription Cloud Firewall: After you enable the log analysis feature, Agentic NDR automatically creates a dedicated Project (named agentic-ndr-<Alibaba Cloud account ID>-<Region ID>) and a dedicated Logstore (named agentic-ndr-logstore) to store all log data collected by Agentic NDR.
You can sign in to the Simple Log Service console to view the dedicated Project and Logstore for Agentic NDR. Do not delete the Project or Logstore. If you accidentally delete them, the lost log data cannot be recovered, and you must re-enable the log analysis feature to continue using it.
Limitations
Agentic NDRThe stored Logstore is a dedicated Logstore and has the following limitations:
You cannot write other data to the dedicated Logstore. However, there are no special restrictions on querying, statistics, alerting, and consumption.
You cannot modify the data retention period of the dedicated Logstore in the Simple Log Service console. You can modify the retention period in the Cloud Firewall console.
Your Simple Log Service account must be in good standing (no overdue payments). Otherwise, the Agentic NDR log analysis feature is suspended.
Ensure that you have sufficient log storage capacity. When the log storage capacity is full, new logs cannot be written.
NoteThe log storage capacity usage displayed in the console is not updated in real time and may lag behind actual usage by up to two hours.