Client configuration

Feature overview

Agent Protection is a built-in protection mechanism that ensures the stable operation of the Security Center agent. It proactively intercepts unauthorized operations, such as uninstallation and process termination, to prevent the agent from being disabled by attackers or abnormal processes. This way, Security Center can provide continuous protection for your servers.

• Core benefits

  • Prevent malicious uninstallation: Prevents attackers from removing the security agent after they compromise a server.

  • Ensure process stability: Protects the core processes of the agent from accidental or malicious termination.

  • Ensure protection continuity: Prevents security protection interruptions caused by agent failures.

• Compatibility notes: This feature depends on specific operating systems and kernel versions. If the server environment is incompatible, the feature status is displayed as "Protection failed: incompatible kernel version" and the feature does not take effect.

Scope

• Edition limits: This feature is available to both free and paid users of Security Center.

• Operating system and kernel version limits: For more information, see Appendix: Operating systems and kernel versions supported by Agent Protection.

Enable Agent Protection for servers

After the defense mode of Agent Protection is enabled, Agent Protection is automatically enabled for servers on which the agent is installed and that are within the protection scope of Agent Protection.

1. Log on to Security Center console.

2. In the left-side navigation pane, choose System Configuration > Feature Settings. In the upper-left corner of the console, select the region where the asset to be protected is located: Chinese Mainland or Outside Chinese Mainland.

3. Select the Feature Settings > Agent Settings tab. In the Agent Protection section, turn on the Defense Mode switch.

4. To the right of Protection Scope:, click Manage.

5. In the Agent Protection panel, select the servers for which you want to enable Agent Protection, and then click OK.

   Note

   After Self-Protection Status is enabled for a server, the self-protection mechanism immediately takes effect. After Agent Protection is disabled for a server, the self-protection mechanism is disabled 5 minutes later.

View the status of Agent Protection

You can use the following method to check whether Agent Protection is enabled for a server.

1. Log on to Security Center console.

2. In the left-side navigation pane, choose Asset Center > Host. In the upper-left corner of the console, select the region where the asset to be protected is located: Chinese Mainland or Outside Chinese Mainland.

3. Find the target server in the server list, and click the server name or click Actions in the View column.

4. On the server details page, click the Basic Information > Details tab. In the Defense Status section, view the status of Self-Protection Status.

Uninstallation notes

After Agent Protection is enabled, the uninstallation of the agent is restricted. You can uninstall the agent only in the following authorized ways:

1. Uninstall from the console: Uninstall the agent directly in the Security Center console.

2. Uninstall on the server: Disable Agent Protection for the server in the console, and then uninstall the agent on the server.

Feature overview

• The local file detection engine is a local file threat detection engine developed in-house by Alibaba Cloud Security Center. This engine reduces the performance overhead caused by data uploads and cloud-based scan data exchange, and provides high detection efficiency.

• After you enable this feature, files are scanned in dual-engine mode that combines local and cloud-based scanning. The system scans files by using the local engine first. If no threats are detected, the files are uploaded to the cloud for secondary confirmation to ensure comprehensive detection.

Scope

• Subscription: Enterprise or Ultimate (If your current edition does not support this feature, upgrade).

  Note

  The protection edition of the server must be set to the edition you purchased. For more information, see Bind a server protection edition.

• Pay-as-you-go: Host and Container Security pay-as-you-go is activated (If not activated, purchase).

  Note

  The server protection level must be set to Comprehensive Host Protection or Host and Container Security. For more information, see Bind a server protection level.

Enable local file detection

1. Log on to Security Center console.

2. In the left-side navigation pane, choose System Configuration > Feature Settings. In the upper-left corner of the console, select the region where the asset to be protected is located: Chinese Mainland or Outside Chinese Mainland.

3. Select the Settings > Agent Settings tab. In the Local File Detection Engine section, turn on the File Test switch.

4. To the right of Installation Scope, click Manage.

5. In the Local File Detection Engine panel, select the servers for which you want to enable local file detection, and then click OK.

Scope

• Subscription: Enterprise or Ultimate (If your current edition does not support this feature, upgrade).

  Note

  The protection edition of the server must be set to the edition you purchased. For more information, see Bind a server protection edition.

• Pay-as-you-go: Host and Container Security pay-as-you-go is activated (If not activated, purchase).

  Note

  The server protection level must be set to Comprehensive Host Protection or Host and Container Security. For more information, see Bind a server protection level.

Enable in-depth detection

1. Log on to Security Center console.

2. In the left-side navigation pane, choose System Configuration > Feature Settings. In the upper-left corner of the console, select the region where the asset to be protected is located: Chinese Mainland or Outside Chinese Mainland.

3. Select the Settings > Agent Settings tab. In the In-depth Detection Engine section, turn on the Depth Test switch.

4. To the right of Installation Scope, click Manage.

5. In the In-depth Detection Engine panel, select the servers for which you want to enable in-depth detection, and then click OK.

Resource management modes

Configure a protection mode

1. Log on to Security Center console.

2. In the left-side navigation pane, choose System Configuration > Feature Settings. In the upper-left corner of the console, select the region where the asset to be protected is located: Chinese Mainland or Outside Chinese Mainland.

3. Select the Feature Settings > Agent Settings tab. In the Client Resource Management section, find Smooth Mode or Custom Mode, and click Manage on the right side.

4. In the Smooth Mode or Custom Mode panel, select the servers for which you want to adjust the resource management mode of the agent, and then click OK.

   Each server can use only one of the following resource management modes: Smooth Mode and Custom Mode. For example, if a server currently uses Smooth Mode and you configure Custom Mode for the server, the protection mode of the server changes to Custom Mode.

   Note

   In Custom Mode mode, more types of alerts are detected and the detection engine is more sensitive. More alerts are generated and the false positive rate may increase. We recommend that you monitor and handle alerts in a timely manner.

5. (Optional) If Custom mode is configured for a server, you can change the memory usage threshold and CPU usage threshold of the server.

   A higher memory usage or CPU usage threshold provides more accurate protection. We recommend that you set appropriate thresholds.