How to configure alert scan scope and alert handling rules-Security Center(Security Center)-阿里云帮助中心

The security alert settings feature allows you to manage web directories in your assets and configure alert whitelist rules, helping you establish more granular threat protection rules with centralized management. This enables timely detection of security threats in your assets and real-time awareness of your security posture. This topic describes how to configure custom web directories and alert handling rules.

Set security alert generation rules

Some alerts depend on system feature settings. You can go to the corresponding pages to manage and configure the relevant rules. The main features are as follows:

Host Protection: Manage unusual logons, Manage approved logons, Virus blocking, and more. These generate alerts of types such as Precise Defense, Unusual Logon, Account Errors, and Malicious Software.
Container Protection: Container proactive defense, Container file protection, and more. These generate alerts of types such as Container Escape Prevention, Proactive Defense for Containers, and Container cluster anomaly.
Feature Settings: Host protection settings, Container protection settings, and more. These generate alerts of types such as Precise Defense, Webshell, Container Escape Prevention, Container cluster anomaly, and Suspicious Process Behavior.

Manage custom web directories

Security Center automatically detects web directories in your server assets and performs dynamic detection and static scans. This feature not only automatically discovers and monitors standard web directories on your servers, but also allows you to manually add custom web directories, bringing them under comprehensive security scanning and protection.

When an attacker attempts to connect through a known web backdoor, Security Center proactively blocks the connection and generates an alert event displayed in the alert list on the security alert handling page.

Feature value

Eliminate security blind spots: In actual business operations, web applications, website source code, or project files may be deployed in non-standard custom paths (for example, /data/wwwroot/my_project or /opt/app). These paths may not be covered by regular automatic scans, creating security "blind spots". By manually adding custom directories, you can bring all web assets (regardless of where they are deployed) under Security Center's monitoring.
Improve detection accuracy: Focusing the scan scope precisely on actual web directories reduces ineffective scanning of non-web files, improving detection efficiency and accuracy.
Flexibly adapt to business architecture: Perfectly supports your customized server deployment and operational practices, ensuring security policies align closely with your business architecture.

Notes

Never add root directories: To ensure server performance and scanning efficiency, you are strictly prohibited from adding the server's root directory (such as / on Linux or C:\ on Windows) as a web directory.

Note
For performance efficiency reasons, adding root directories as web directories is not supported.
Add specific web paths only: Add only the specific paths where your web applications are stored. Adding unrelated directories may cause false positives or unnecessary performance overhead.

Procedure

Log on to Security Center console.
In the left-side navigation pane, choose Detection and Response > Alerts. In the upper-left corner of the console, select the region where the asset to be protected is located: Chinese Mainland or Outside Chinese Mainland.

Note
If you have activated the Agentic SOC service, the left navigation pane entry changes to Agentic SOC > Alerts.
On the Alert page, click Cloud Workload Coverage Alert Management > Alert Settings in the upper-right corner.
In the Custom Web Directory section of the Alert Settings panel, click Manage.
In the Custom Web Directory panel, configure the path and server information.
- Enter the absolute path of the web directory you want to monitor (for example, /home/www/my_app).
- Select the servers on which this path takes effect.
Click OK to complete the addition.

Manage alert handling rules

The alert handling rules management feature provides you with a centralized management interface. When you handle a security alert and select "Add to Whitelist" or "Defend Without Notification", the system automatically generates a corresponding handling rule. Through this feature, you can centrally view, edit, and delete these generated rules, ensuring your security policies remain continuously effective and precise.

Log on to Security Center console.
In the left-side navigation pane, choose Detection and Response > Alerts. In the upper-left corner of the console, select the region where the asset to be protected is located: Chinese Mainland or Outside Chinese Mainland.

Note
If you have activated the Agentic SOC service, the left navigation pane entry changes to Agentic SOC > Alerts.
On the Alert page, click Cloud Workload Coverage Alert Management > Alert Settings in the upper-right corner.
In the Alert Settings panel, click the Alert Handling Rule tab.
In the Alert Handling Rule section, you can Edit and Delete target rules.
- Edit an alert handling rule
  1. Locate the rule you want to edit and click Edit in the Actions column.
  2. In the Edit Rule panel, modify the servers on which this alert handling rule takes effect.
  3. Click OK to complete the modification.
- Delete an alert handling rule
  
  Important
  Deleting a rule means restoring the default detection and alerting behavior. For example, after deleting a whitelist rule, alerts of the same type that were previously ignored will be generated again. Before deleting, make sure you understand the impact.
  1. Locate the rule you want to delete and click Delete in the Actions column.
  2. Click OK to complete the deletion.

Configure alert notifications

Alert notifications are enabled by default. You can disable alert notifications by following these steps. For more information, see Configure security message recipients.

Log on to Security Center console.
In the left-side navigation pane, choose System Configuration > Notification Settings. In the upper-left corner of the console, select the region where the asset to be protected is located: Chinese Mainland or Outside Chinese Mainland.
On the Text Message/Email/Internal Message tab, locate the notification item for Alert.
In the Notification Method column, clear or select the corresponding notification method to stop receiving this type of notification.

Note
You can still view and handle alert events in the Security Center console after disabling notifications.