Purchase and activate Agentic SOC

Choose a billing method

You can flexibly combine billing methods for log ingestion traffic and log storage capacity based on your needs. For example, use subscription for log ingestion traffic and pay-as-you-go for Log Management.

Choose a service

Agentic SOC provides two service tiers. Compare the following sections to determine which tier meets your requirements.

• Agentic SOC (Basic): Rule-based threat detection and response with preset playbooks and lightweight AI models.

• Security Operations Agent: An advanced tier built on Agentic SOC. Uses a Multi-Agent architecture powered by large-scale AI models for autonomous incident investigation, threat detection, and response coordination.

Subscription

1. Log on to the Security Center console.

2. On the Agentic SOC page, click Activate Subscription. On the Quick Purchase tab, Billing Method defaults to Subscription.

3. Click Create Service-linked Role to complete cloud service access authorization. Skip this step if you have already created the role.

   After authorization, Security Center automatically creates the service-linked role AliyunServiceRoleForSasCloudSiem so that Agentic SOC can access resources in your other cloud services. For more information, see Service-linked roles for Security Center.

4. Select the service to purchase: Agentic SOC or Security Operations Agent. For the differences between these two services, see Choose a service.

5. Set the purchase quantity based on your selected service.

   • Agentic SOC: Billed by Log Ingestion Traffic and Log Storage Capacity independently. Purchase each based on your needs.

   • Security Operations Agent: In addition to Agentic SOC billing items, also requires Intelligent Usage Analysis and Number of Managed Instances.

1. Choose whether to enable Access Policy.

   • If you select the access policy, Agentic SOC automatically ingests logs from Security Center, Web Application Firewall, Cloud Firewall, and ActionTrail under your current Alibaba Cloud account after activation. For more information, see Recommended log ingestion policy.

   • If you do not select the access policy, no predefined ingestion settings are applied. After purchase, manually select log sources based on your needs. For instructions, see Product logs.

2. Review the Security Center Related Agreements, then click Order Now.

Pay-as-you-go

1. Log on to the Security Center console.

2. On the Agentic SOC page, click Activate Pay-as-you-go and select the services to activate.

3. Review the billing rule descriptions. Billing varies by activated service.

   • Billing method:

     • Agentic SOC: Billed by daily log ingestion traffic (GB) using tiered cumulative pricing. Daily cost is the sum of each tier.

       Important

       The minimum billing unit is 1 GB. Usage less than 1 GB is billed as 1 GB.

     • Security Operations Agent: In addition to tiered cumulative billing by daily log ingestion traffic (GB), the following billing items apply:

       • Intelligent Analysis Flow: Billed by the analysis usage (GB) consumed by the AI security agent for alert triage, incident investigation, traceability, attribution, and security report generation.

       • Onboarded Assets: Billed by the number of Agent instance invocations. Products such as ECS, WAF, ALB, cross-cloud products, and on-premises security vendor products are all counted as instances.

         Important

         Each instance is counted only once. Duplicates are automatically removed.

   • Billing cycle: Billed by calendar day.

   • Price:

     • Log Ingestion Traffic: Tiered pricing by daily log ingestion traffic (GB).

       Daily log ingestion traffic range	Price	Cost formula (Y = daily traffic in GB)
       1–10 (GB/day)	CNY 15/GB	15 × Y (CNY)
       11–50 (GB/day)	CNY 10/GB	15×10 + 10×(Y−10) (CNY)
       51–100 (GB/day)	CNY 9/GB	15×10 + 10×40 + 9×(Y−50) (CNY)
       >100 (GB/day)	CNY 8/GB	15×10 + 10×40 + 9×50 + 8×(Y−100) (CNY)

     • Intelligent Analysis Flow: CNY 1/GB/day.

     • Onboarded Assets: CNY 15 per instance per month.

4. Choose whether to enable One-click Ingestion.

   • If you select One-click Ingestion, Agentic SOC automatically ingests logs from Security Center, Web Application Firewall, Cloud Firewall, and ActionTrail under your current Alibaba Cloud account after activation. For more information, see Recommended log ingestion policy.

     After you enable the recommended log ingestion policy, the system automatically ingests the specified log types into Agentic SOC. Security Center generates a bill the next day based on your actual log ingestion volume.

   • If you do not enable One-click Ingestion, manually select log sources based on your needs. For instructions, see Product logs.

5. Click Activate and Authorize.

   After this operation, Security Center automatically creates the service-linked role AliyunServiceRoleForSasCloudSiem so that Agentic SOC can access resources in your other cloud services. For more information, see Service-linked roles for Security Center.

Subscription

Pay-as-you-go

Other purchase entry points

You can also purchase Agentic SOC on the Security Center purchase page or on the console Overview page. For Security Center edition selection and other service purchases, see Purchase and Unsubscribe from Security Center.

Recommended log ingestion policy

After you enable the recommended log ingestion policy, Agentic SOC automatically ingests logs from Security Center, Web Application Firewall, Cloud Firewall, and ActionTrail under your current Alibaba Cloud account—no manual configuration required.