Configure protection editions or levels

Prerequisites

• You have purchased a Security Center subscription instance of the Anti-virus, Advanced, Enterprise, or Ultimate edition. For more information, see Purchase and unsubscribe from Security Center.

• You have onboarded a server to Security Center. For more information, see Install the agent.

Protection edition overview

To meet host and container security protection requirements in different scenarios, Security Center provides the Anti-virus, Advanced, Enterprise, and Ultimate editions. For more information about the capabilities and billing rules of each edition, see Features and Billing description.

Edition limits

A subscription instance supports only one edition. After purchase, the same edition must be bound to all servers.

Default binding rules

• Automatic binding: When you purchase a Security Center paid edition (Anti-virus, Advanced, Enterprise, or Ultimate) subscription, if you do not perform custom on-demand binding, the system automatically and randomly binds the edition to available servers to avoid idle resources. You can remove these bindings in batches at any time.

• LINGJUN, ACK, and connected self-managed cluster assets:

  • If your Security Center edition is the Ultimate Edition, the Ultimate Edition is bound by default and cannot be changed.

  • If your Security Center edition is Anti-virus, Advanced, or Enterprise, the Free Edition is bound by default and cannot be changed.

• Security Center trial edition: The trial edition provides full protection and binds the current trial edition to all servers by default. This setting cannot be modified.

Container asset binding limits

Security Center identifies container assets by detecting whether a container runtime environment (such as Docker or Containerd) is installed on a server or whether container processes are running. Assets that run container workloads support only Ultimate Edition binding. The following asset types are applicable:

• Intelligent Computing LINGJUN assets.

  Note

  On theAsset Center > Host page, on the Server tab, set the Server Type filter to LINGJUN GPU-accelerated Bare Metal Instance to view the list of LINGJUN assets under your account.

• Container Service for Kubernetes (ACK) assets.

• Self-managed Kubernetes cluster assets connected to Security Center.

Edition change limits

• You can bind a purchased edition to a Free Edition server only when the remaining quota is greater than 0.

• You can change the edition to the Free Edition only after the edition has been bound for 30 days and one of the following conditions is met.

  Note

  Authorizations automatically bound by using Default binding rules are not subject to the time limit when changed to the Free Edition for the first time.

  • Servers manually bound to a paid edition.

  • Paid editions bound by using the new host automatic binding method.

• After authorization, you cannot bind another server within 30 days. The authorization is automatically unbound and reclaimed when the ECS instance is released.

• Limits on changing the edition of assets that run container workloads:

  1. If the server does not require container protection, uninstall the container runtime components on the server or stop all container processes.

  2. Then wait for the asset information to be automatically synchronized (up to 24 hours), or manually synchronize assets in Asset Center.

  3. After the asset is no longer identified as a container environment, you can bind it to other edition authorizations such as the Enterprise Edition or Advanced Edition.

Automatic quota revocation

The corresponding quota is automatically reclaimed in the following scenarios:

• An ECS instance is released.

• A third-party server is unbound in the Security Center console.

• An off-cloud host is automatically removed by a scheduled cleanup rule.

If you manually uninstall the Security Center client from a server, the asset status is displayed as Client Offline on the Host page in the Security Center console. In this case, Security Center does not automatically reclaim the corresponding quota.

Quota management entry

• On the Overview page of the Security Center console, if a Manage entry exists on the right side of Protected Servers in the Subscription section, your Alibaba Cloud account has switched to on-demand protection mode and you can manage quotas.

• If no quota management entry exists in the Security Center console, your account is in full protection mode.

  • In full protection mode, all servers connected to Security Center are bound to quotas by default.

  • Security Center will no longer support full protection mode. We recommend that you manually switch from full protection mode to on-demand protection mode. For more information, see How do I manually upgrade from full protection to partial protection mode?.

Manage protection editions for servers

Servers connected to Security Center (which can be viewed on the Host page) support binding protection editions to enable security protection.

1. Log on to Security Center console.

2. In the left-side navigation pane, click Overview.

3. In the Subscription section, click Protected Servers on the right side of Quota Management.

   Alternatively, on the Asset CenterHost page, click Manage in the Remaining Quota section.

4. In the Quota Management dialog box, select the region where the server is located, select an edition for the server, click View Change Details, confirm that the edition is correct, and then click OK.

5. (Optional) If you want new servers to be automatically bound to a protection edition, select Automatically Add New Servers to Security Center.

   Important

   After you select Automatically Add New Servers to Security Center, if the assets are LINGJUN, ACK, or connected self-managed cluster assets, new assets of these types are automatically bound to the Ultimate Edition when the purchased edition is the Ultimate Edition. When the purchased edition is not the Ultimate Edition, new assets of these types are automatically bound to the Free Edition.

Prerequisites

• You have enabled pay-as-you-go for Security Center host and container security. For more information, see Purchase and unsubscribe from Security Center.

• You have onboarded a server to Security Center. For more information, see Install the agent.

Protection levels

Pay-as-you-go instances support binding the following protection levels to servers: Unprotected, Virus Protection, Comprehensive Host Protection, and Comprehensive Host and Container Protection. For more information about the capabilities and billing rules of each level, see Features and Billing description.

Billing rules

Security Center calculates fees based on the following factors:

• The protection level bound.

• The number of servers bound to the protection level.

• The actual protection duration.

The actual protection duration is calculated only when the Security Center client is online. Fees are accumulated by the second and settled by calendar day. For more information, see Billing description.

Default binding rules

• After you enable pay-as-you-go for Security Center host and container security, you can bind any protection level to a server at any time.

• If you do not perform Custom Quota Binding when enabling pay-as-you-go for host and container security, Security Center automatically binds the default protection level to all servers under your Alibaba Cloud account:

  • Server assets that run container environments: Full Protection for Hosts and Containers.

    • ACK cluster nodes.

    • Intelligent Computing LINGJUN assets.

    • Servers in self-managed Kubernetes clusters connected to Security Center.

  • Other server assets: Comprehensive Host Protection.

Container asset protection limits

To ensure that risks of container assets connected to Security Center can be fully monitored, assets that run container workloads support only Full Protection for Hosts and Containers. Other protection levels cannot be bound.

This limit applies to the following container assets:

• ACK assets.

• Intelligent Computing LINGJUN assets.

  Note

  On the Asset Center > Host page, on the Server tab, set the Server Type filter to LINGJUN GPU-accelerated Bare Metal Instance to view the list of LINGJUN assets under your account.

• Self-managed Kubernetes cluster assets connected to Security Center.

Manage protection levels for servers

Servers connected to Security Center (which can be viewed on the Host page) support binding protection levels to enable security protection.

1. Log on to Security Center console.

2. In the left-side navigation pane, click Overview.

3. In the Enable Pay-as-You-Go Service section, click Host and Container Security next to Quota Management. Alternatively, on the Asset CenterHost page, click Quota Management.

4. In the Quota Management dialog box, select the region where the server is located, select a protection level for the server, and click OK.

   1. The optional protection levels include Unprotected, Virus Protection, Comprehensive Host Protection, and Full Protection for Hosts and Containers.

   2. In the Automatically Add New Servers to Security Center section, you can set the default protection level for new hosts.

5. In the Automatically Add New Servers to Security Center section, select the protection level to automatically bind to new servers.

   Important

   For LINGJUN, ACK, and connected self-managed cluster assets, the Full Protection for Hosts and Containers level is bound only when the protection level selected in the Automatically Add New Servers to Security Center section is Full Protection for Hosts and Containers. Otherwise, the Unprotected level is bound to the assets.

6. Click View Change Details, confirm that the changed protection level is correct, and then click OK.