FAQ

What's new

Release notes

Pre-sales questions

• Free trial questions

  • Can I cancel and reapply for a free trial of the Enterprise edition?

  • How can I use Security Center for free?

  • What are the differences between the Security Center Basic edition and the free trial of the Enterprise edition?

  • Why can't I find the free trial option on the Overview page?

  • Are my configurations retained after the free trial of the Enterprise edition expires?

• Purchase questions

  • Will I be charged twice if I use both subscription and pay-as-you-go services?

  • Can I switch from a pay-as-you-go service to a subscription plan?

  • Can I use subscription and pay-as-you-go services at the same time?

  • Why is the price on the buy page higher than the list price?

  • How do I choose the right edition of Security Center?

• Product usage questions

  • Does Security Center comply with international security standards?

  • Does Security Center support virus scanning and removal?

  • Can Security Center automatically quarantine virus files?

  • How does Security Center provide end-to-end security capabilities in attack and defense scenarios?

  • Can I use Security Center to protect servers outside of Alibaba Cloud, such as on-premises servers or servers from other cloud providers?

  • Can I use Security Center if my assets are outside the Chinese mainland? How is my data processed?

• Other questions

  • What is the relationship between Aegis and Security Center?

  • What features are different after I upgrade from Aegis Enterprise edition to Security Center Advanced edition?

Purchase and renewal questions

• Renewal questions

  • How do I renew Security Center when it is about to expire?

  • How far in advance can I renew a Security Center instance?

  • Can I downgrade from the Advanced edition to the Anti-virus Edition when I renew?

  • How do I change the auto-renewal cycle or cancel auto-renewal?

  • The Renew button is grayed out with the message "Your current number of authorizations is insufficient. Please upgrade to increase the number of authorizations before renewing."

  • What do I do if a RAM user does not have the permissions to renew?

• Upgrade and downgrade questions

  • What do I do if the number of my servers exceeds my authorized quota?

  • Can I specify a different value for the Protected Servers parameter or a different duration for a value-added feature when I upgrade Security Center?

  • Can I downgrade the Enterprise edition of Security Center to the Basic edition?

  • Why do I see the message "A pending renewal with a specification change exists. Upgrade or downgrade is not allowed." when I try to upgrade or downgrade?

• Refund questions

  • Billing FAQ

• Vulnerability fixing billing

  • Billing FAQ

  • How do I switch from subscription to pay-as-you-go for vulnerability fixing?

  • If I enable pay-as-you-go for vulnerability fixing and then purchase the Advanced edition or higher, will I continue to be charged?

Console operation issues

Security score questions

• How do I view the version of the virus library?

• After I install the Security Center agent on my ECS instances, is the Security Center virus library automatically installed?

• What is the priority for handling events to improve my security score?

• How does changing the vulnerability attention level affect the security score?

• How does changing the baseline attention level affect the security score?

Asset questions

• How do I unbind (release) a non-Alibaba Cloud asset?

• How do I unbind an ECS instance from Security Center?

• Two servers with the same information appear in the server list. Why is one online and the other offline?

Anti-ransomware questions

• How do I purchase anti-ransomware capacity?

• What is the anti-ransomware feature and why is it billed separately?

• What is the relationship between the anti-ransomware feature in Security Center and Cloud Backup?

• Are backups started automatically after I purchase anti-ransomware capacity?

• The anti-ransomware backup cache uses a large amount of disk space. How do I clear it?

• The anti-ransomware backup cache is using too much space on the C: drive. Can I change the cache location?

• What do I do if the anti-ransomware client consumes excessive server CPU or memory resources?

• What are the differences between the anti-ransomware solution (Enterprise edition + anti-ransomware) and snapshot backups?

• What do I do if my purchased anti-ransomware capacity is insufficient?

• What do I do if a protection policy is in an abnormal state?

Web tamper proofing questions

• My Security Center subscription has almost three years left. Can I purchase web tamper proofing for only one year?

• Does web tamper proofing support files of any size?

• When I start web tamper proofing, I receive the message "Protection module initialization failed. Check whether other software has blocked or controlled service creation." What should I do?

• What are the requirements for the local backup directory for web tamper proofing?

• I received a path error when configuring the protected directory.

• Why does web tamper proofing fail after I configure a protected directory?

• Can I write to a protected directory?

• What should I do if web tamper proofing doesn't take effect immediately after I protect a directory?

• Why don't I receive a security alert after I enable web tamper proofing, log on via SSH, and modify a protected file?

• What should I do if I can't modify website content and images after enabling web tamper proofing?

• What should I do if I receive an SMS or email notification about a website backdoor?

Linux software vulnerabilities

• How do I manually scan my servers for Linux software vulnerabilities?

• Vulnerability management FAQ

• How do I upgrade the kernel from version 3.1* to 4.4 on an Ubuntu 14.04 system?

• Vulnerability management FAQ

• Vulnerability management FAQ

• Vulnerability management FAQ

• Vulnerability management FAQ

• Parameters for Linux software vulnerabilities

Vulnerability fixing

• Troubleshoot vulnerability fixing failures

• Recommendations for fixing software vulnerabilities on servers

• Vulnerability management FAQ

• Vulnerability management FAQ

• Vulnerability management FAQ

• Vulnerability management FAQ

• Vulnerability management FAQ

• Why are vulnerabilities still displayed on the console after the agent on my server goes offline or is disabled?

• How do I clear Windows vulnerability fix patch packages from the agent directory?

• Vulnerability management FAQ

• Vulnerability management FAQ

• Vulnerability management FAQ

• What do I do if Security Center fails to verify a system vulnerability fix?

• Vulnerability management FAQ

• Vulnerability management FAQ

• Vulnerability management FAQ

Vulnerability detection

• What do I do if I cannot enable vulnerability detection for a server on the Assets page?

• Vulnerability management FAQ

• Vulnerability management FAQ

• Vulnerability management FAQ

• Vulnerability management FAQ

• Vulnerability management FAQ

Baseline checks

• What do I do if a baseline check verification fails?

• What is the difference between a baseline and a vulnerability?

Security alerts

• Does Security Center support real-time detection for rootkit alerts?

• Detection and response FAQ

• How can I determine whether a mining threat exists on my assets?

• What should I do if my server is under a mining attack and virus blocking is not enabled?

• I accidentally added a mining alert to the whitelist. How do I remove it?

• How do I check which protection features are enabled?

• How do I confirm that automatic virus blocking is active?

• Why does phpinfo generate a security alert? Is it a false positive?

• Does Security Center automatically quarantine webshell files?

• How does Security Center detect webshells?

• How does Security Center detect hacker intrusions?

• What are common types of hacker intrusions?

• What objects can be added to the whitelist for security alerts?

• Why is the status of some alerts "Expired"?

• Why is there a discrepancy between the first occurrence time and the detection time for suspicious domain access alerts?

Brute-force attacks

• How do I view the number of brute-force attacks on my server or their interception status?

• How do I prevent brute-force attacks on my server?

• What do I do if the anti-brute-force attack feature is triggered by mistake?

• Does the anti-brute-force attack feature protect web applications or websites?

• What should I do after a successful brute-force attack?

• Why do I still receive brute-force attack alerts after changing a weak password?

• Why are there still records of RDP brute-force attacks after I blocked port 3389 in security group or firewall rules?

• Do weak ECS logon passwords refer to system-level scans for RDP or SSH?

• How do I handle blocked remote logons over SSH or RDP?

Alert notifications

• How do I change the recipients of alert notifications?

• Can I receive alert notifications if I don't select any attention levels in the notification settings?