DocsICP FilingConsole
Documentation
Home Page Security Center Detection and Protection Security Operations Agent SecOps Agent user guide

SecOps Agent user guide

Updated at:
Copy as MD
Product
My Favorites

SecOps Agent drives security O&M through natural language, letting you run security inspections, handle alerts, and generate reports without navigating deep console menus. Use it to lower the operations threshold for security teams and to automate recurring inspections through scheduled tasks, team collaboration, and skill extension. This topic describes how to create and manage tasks, work with skills and teams, configure system settings, and view usage statistics.

Scope

  • Purchase and activate SecOps Agent.

  • Supported services: Security Center, Agent Security Center, SASE, Cloud Firewall, Anti-DDoS, WAF, Data Security Center, and Bastionhost.

  • Data isolation: The Chinese mainland and regions outside the Chinese mainland are two independent instances. You must create tasks separately for each instance. Each instance can access only data in its own region and does not support cross-region access.

Create tasks

SecOps Agent supports two task types. One-time tasks are suitable for instant queries and ad-hoc handling. Scheduled tasks are suitable for automated scenarios such as recurring inspections and periodic reports.

One-time tasks

  1. Log on to the Security Center console.

  2. In the left-side navigation pane, click SecOps Agent. In the upper-left corner of the console, select the region where the assets to be protected are located: Chinese Mainland or Outside Chinese Mainland.

  3. Click New Task. In the input box, describe the task in natural language or enter / to invoke quick skills.

    Note

    You can refer to the example tasks below the input box for a quick start, such as "Which RAM users do I manage?" and "Summarize and export vulnerability data of all RAM users in Security Center".

  4. (Optional) Click the Agent mode drop-down list below the input box and select the execution mode for the task.

    • Single Agent: Executes directly without team routing.

    • Team: A team can contain multiple roles. Each team is coordinated by a single Leader.

    • Roles: The actual executor of skills. Each role corresponds to a set of skills.

  5. Send the task. The Agent automatically understands the task intent, orchestrates the execution steps, and calls the corresponding skills to complete the operation.

    After you send the task, you can track its progress in the session list on the left. Open the conversation panel to view the execution progress and intermediate results in real time.

Important

During execution, if sensitive operations such as handling, repair, or deletion are involved, the Agent prompts you for confirmation at key nodes. Confirm based on your actual business conditions before proceeding.

Scheduled tasks

For frequent inspections, reports, and reminder tasks, you can configure them as scheduled tasks so that the Agent executes them automatically on schedule.

  1. Log on to the Security Center console.

  2. In the left-side navigation pane, click SecOps Agent. In the upper-left corner of the console, select the region where the assets to be protected are located: Chinese Mainland or Outside Chinese Mainland.

  3. On the SecOps Agent page, click Scheduled Tasks in the left menu.

  4. On the Scheduled Tasks page, click Create Scheduled Task.

  5. Configure the following parameters and click OK.

    Parameter

    Description

    Select a common template (optional)

    The system provides common templates such as Daily High-Risk Vulnerability Scan, Weekly Operations Report, and Internet Exposure Detection for quick configuration.

    Task Name

    A custom task name.

    Task Description

    The task description that specifies the goals and requirements of the task.

    Run Type & Time


    Loop Task: Executes repeatedly based on the configured frequency (such as daily) and execution time (such as 15:30).
    One-Time Task: Executes once at the specified time and then stops.

    Run Target

    Select the target Agent to execute the task.
    Single Agent: An independent Agent without team routing.
    Team: Team mode. A Leader coordinates multiple roles to work collaboratively.
    Roles: A single role that directly executes the task.

    Agent Instructions

    Describe the task content in natural language. For example, "Inspect high-risk vulnerabilities and high-risk alerts in Security Center, sort by asset risk, and generate handling suggestions."

    Enable Channel Push

    After you enable this feature, task results are pushed to the specified user or group session upon completion. For instructions, see Configure notification channels.
    Channels: DingTalk, Lark, and WeCom.
    Session mode: Single Chat or Group Chat.
    Chat ID: The session ID.

  6. After you create the task, confirm that the Next run time in the scheduled task list matches your expectations. Use the switch in the task list to enable or disable the task. After the task is enabled, you can view the execution status in the Last run time and Run count columns.

View and manage tasks

View and download task results

After a task runs, you can view the execution results and download the report from the session list or the task list.

View from the session list

  1. On the SecOps Agent page, view the session area below the left menu bar.

  2. Expand the Scheduled Tasks or Session History list and click the target session.

  3. In the task conversation panel on the right, review the conversation content and task execution information:

    • Execution Plan: Displays the Agent Instructions initiated for this task.

    • Skills: The skills used during task execution.

    • Output: The task execution report. Hover over the report to view and download it.

  4. Manage the report:

    • Click image to view the report content online.

    • Click image to download the report to your local machine.

View from the task list

  1. In the left-side navigation pane, click Task History.

  2. Find the target task and click Details under image in the Actions column.

    You can also click Go to Chat to open the task session page and review the conversation content and task execution information.

Delete tasks

Warning

After you delete a task conversation, the report data generated by the task is also deleted and cannot be recovered. Proceed with caution.

Delete from the session list

  1. On the SecOps Agent page, view the session area below the left menu bar.

  2. Expand the Scheduled Tasks or Session History list and hover over the target session.

  3. Click the image icon to delete the current task conversation.

Delete from the task list

  1. In the left-side navigation pane, click Task History.

  2. Find the target task and click Delete under image in the Actions column.

Manage scheduled tasks

After you create a scheduled task, you can trigger it on demand, modify its configuration, or remove it.

  1. On the SecOps Agent page, click Scheduled Tasks in the left menu.

  2. On the Scheduled Tasks page, find the target task. In the task panel, you can perform the following operations:

    • Run immediately: Click image to trigger the task to run once immediately. This execution does not affect the execution schedule of subsequent scheduled tasks.

    • Delete task: Click image to delete the current task.

      Note

      After you delete a scheduled task, the historical task data that has already been executed is retained.

    • Modify task: Click image to modify the task configuration. For configuration descriptions, see Create tasks - Scheduled tasks.

View and manage skills

A skill is a capability unit that SecOps Agent uses to execute tasks. SecOps Agent provides verified Official skills and also supports Custom skills. After you enable a skill, it can be automatically called during conversations.

Official skills cover scenarios such as alert triage and handling, vulnerability management, asset inventory query, security event management, CSPM (Cloud Security Posture Management) configuration checks, multi-account discovery and orchestration, and security weekly report generation. More skills will be added over time.

  • Enable or disable skills: In the left-side navigation pane, click Skills. In the skill list, turn on or turn off the switch in the lower-right corner of the target skill card.

  • Add custom skills: Click Add Skill at the top of the page to upload a .zip package containing a SKILL.md file. The system performs a security scan on the skill package. The skill becomes available after the scan passes.

  • View skill details: Click a skill card to view the functional description of the skill in the Description section.

View teams and roles

SecOps Agent supports a multi-agent team collaboration mode. A Leader Agent receives tasks and dispatches them to member roles with different skills. Different roles have access to different skill sets.

Note

Currently, you cannot create or modify Team or Roles definitions.

  • Team: In the left-side navigation pane, click Teams to view the team's Leader, member role composition, and status. A team can contain multiple roles that are coordinated by a single Leader. Currently, only the sas_security_team team is supported.

    • Supported capabilities: Alibaba Cloud Security Operations team, covering Security Center (SAS) security posture overview, alert handling, threat analysis, and multi-account compliance reports.

    • Team members: sas_compliance_engineer, sas_report_writer, sas_alert_handler, and sas_threat_analyst.

  • Roles: In the left-side navigation pane, click Roles to manage role definitions and access policies. Each role is bound to a set of skills.

    For the skills bound to each role, go to the View skill details.

Role name

Role description

Supported skills

sas_security_lead

Alibaba Cloud Security Operations lead responsible for coordinating Security Center (SAS) security posture overview and team scheduling.

—

sas_compliance_engineer

Alibaba Cloud Security Compliance engineer responsible for multi-account management and batch export of baseline/vulnerability reports.

alibabacloud-sas-multiaccount-discover: Cross-account management. Discovers resource directory member accounts and batch exports vulnerability, baseline, and CSPM reports.
alibabacloud-sas-cspm-skill: CSPM configuration management. Supports check policy (frequency, compliance standards) and scan scope configuration.
sas-vuln-manager: Vulnerability management. Supports vulnerability query, filtering, repair, verification, and trend statistics.
sas-asset-inventory: Asset inventory query. Supports multi-dimensional search, risk correlation, and fingerprint analysis.

sas_report_writer

Alibaba Cloud Security Report writer responsible for security operations work reports and security report generation.

sas-secops-work-report: Security O&M weekly report. Supports alert, vulnerability, and baseline handling statistics and trend analysis. Generates weekly and monthly reports.
sas-security-reporter: Generates security score, operations statistics, and security weekly/monthly reports.

sas_alert_handler

Alibaba Cloud Security Alert handler responsible for querying, analyzing, and handling security alerts from host security (SAS), WAF, and Cloud Firewall intrusion prevention system.

alibabacloud-sas-alert-handler: Host security alert handling. Supports querying, analyzing, and handling security alerts.
sas-alert-triage: Intelligent alert triage. Supports true/false positive diagnosis, alert noise reduction, root cause analysis, and ATT&CK mapping.

sas_threat_analyst

Alibaba Cloud Security Threat analyst responsible for Cloud SIEM security events, exposure detection, and threat trend analysis.

alibabacloud-sas-incident-manage: Alibaba Cloud Security Center security management skill for querying security events, threat trends, and event details.

System settings

Configure permissions

Configure the execution role of SecOps Agent to grant it permissions to call cloud service capabilities such as Security Center, Cloud Firewall, and ECS snapshots. The Agent reuses the Alibaba Cloud RAM, resource group, and Security Center permission systems. The following table describes the authorization scope and constraints of each role.

  1. In the lower part of the left-side navigation pane, click Settings.

  2. In the Permissions area, click Configure.

  3. On the Permission Configuration page, select a role.

    Important

    We recommend that you use the default least privilege role first, and grant the FullAccess role only when you need a complete automated closed loop.

    Item

    AliyunSasClawFullAccessRole (full permissions)

    AliyunSasClawDefaultRole (default role, least privilege)

    Authorization mode

    Full access authorization

    Least privilege authorization

    Authorization scope

    • Security Center: Read and write access.

    • Cloud Firewall: Read-only query access.

    • ECS asset read access.

    • Report generation.

    Execution constraints

    All operations are allowed.

    High-risk operations such as vulnerability fixing, snapshot creation, asset isolation, and security policy changes are not allowed.

    Audit records

    All skill calls, parameters, approval results, and execution results are written to Audit.

    All skill calls, parameters, approval results, and execution results are written to Audit.

    Recommended scenario

    Full-stack automated closed loop. Suitable for scenarios that require complete O&M processes such as automatic fixing and policy adjustment.

    Routine inspection, risk analysis, report generation, and read-only operations tasks. Suitable for scenarios that require only monitoring and analysis without active intervention.

    Remarks

    —

    Permissions are limited and some advanced features may be unavailable. We recommend that you use the FullAccess role to obtain full feature support.

Adjust role permissions

If the permissions of a preset role do not meet your requirements (for example, the Agent reports insufficient permissions or cannot call the API operation of a cloud service), you can attach additional permission policies to the execution role that is in use in the RAM console to expand the range of cloud service API operations that the Agent can call.

  1. Log on to the Roles page of the RAM console, and then search for and click the name of the role that you want to modify: AliyunSasClawDefaultRole or AliyunSasClawFullAccessRole.

  2. In the Actions column of the role, click Grant Permission to attach the permission policies of the cloud services that the Agent needs to call.

  3. Return to the Permission Configuration page of SecOps Agent in the Security Center console and confirm that the current role is authorized.

Note

  • Attaching additional permission policies expands the range of cloud resources on which the Agent can operate. Follow the principle of least privilege and grant only the permission policies that are actually required.

  • Regardless of which role is used, all skill calls, parameters, approval results, and execution results are written to Audit records.

Configure notification channels

Configure DingTalk, Lark, and WeCom bots in a unified manner to receive conversations, reply results, and pushed task notifications.

  1. In the lower part of the left-side navigation pane, click Settings.

  2. In the Channel area, click Configure.

  3. On the Channel Configuration page, turn on the switch of the channel that you want to enable.

  4. Configure Connection Credentials by referring to the following per-channel instructions.

    DingTalk

    • Obtain credentials on the platform side

      1. Open the DingTalk Open Platform and log on with an enterprise administrator or application administrator account.

      2. Create or open an enterprise internal bot application. In the Credentials and Basic Information area on the application details page, copy and save the AppKey and AppSecret.

        Note

        Depending on the console version, the fields may be displayed as application credentials or Client ID/Secret.

      3. Enable the bot capability for the application. In the bot/event subscription configuration, select the Stream long connection to receive bot messages.

      4. Confirm that the bot is published or available, and add the bot to the groups that need to interact with it.

    • Fill in the Security Operations console

      Platform credential name

      Console configuration field

      AppKey (or Client ID)

      Client ID / App Key

      AppSecret (or Client Secret)

      Client Secret / App Secret

    Lark

    • Obtain credentials on the platform side and configure message receiving permissions

      1. Open the Lark Open Platform App Management. For overseas tenants, use Lark Open Platform.

      2. Create an enterprise self-built application. In the Basic Information > Credentials and Basic Information area on the application details page, copy and save the App ID and App Secret. For more information, see Common Parameters.

      3. In Application Capabilities > Add Application Capabilities, add Bot. For more information, see Bot Overview and Bot Application Configuration.

      4. On the Development Configuration > Permission Management > API Permissions page, enable the following permissions:

        • Message receiving permissions (select one based on your business scenario). For more information about permissions, see Receive Messages.

          • Read messages sent to the bot in one-on-one chats: im:message.p2p_msg:readonly

          • Receive messages that @mention the bot in group chats: im:message.group_at_msg:readonly

          • Get all messages in groups: im:message.group_msg

        • Permission required for sending messages: Permission to send messages as the application im:message:send_as_bot. This permission is used to call the Send Message API and other APIs to enable the bot to send messages.

      5. On the Development Configuration > Events & Callbacks > Event Configuration page:

        • Configure the subscription method: Select Use long connections to receive events.

        • In the Added Events area, add the im.message.receive_v1 (Receive Message v2.0) event. For more information, see Event Subscription Overview.

    • Fill in the Security Operations console

      Platform credential name

      Console configuration field

      App ID

      App ID

      App Secret

      App Secret

    WeCom

    WeCom supports three capability combinations. Fill in the credentials for the combinations you need.

    Capability type

    Usage

    Intelligent bot WebSocket

    Receive messages (inbound)

    Custom app API

    Send messages (outbound)

    Group bot Webhook

    Push notifications to groups (outbound)

    • Intelligent bot WebSocket: For detailed steps, see Configuration Reference.

      1. Obtain credentials on the platform side

        1. Open the WeCom client. Go to Workbench > Intelligent Bot and click Create Bot > Manual Creation.

        2. On the creation page, select API Mode Creation.

        3. On the API Configuration page, set Connection Method to Use long connections.

        4. After the configuration is complete, the page automatically generates and displays the Bot ID and Secret. Keep them safe.

      2. Fill in the Security Operations console

        Platform credential name

        Console configuration field

        Bot ID

        Bot ID

        Secret

        Bot Secret

    • Custom app API: For detailed steps, see How to Create/Set Custom App Permissions.

      1. Obtain credentials on the platform side

        1. Log on to the WeCom Admin Console. In My Enterprise > Enterprise Information, view and save the enterprise ID.

        2. In Application Management > Custom Apps, go to the target application details page. Copy the AgentId and application Secret separately.

      2. Fill in the Security Operations console

        Platform credential name

        Console configuration field

        Enterprise ID

        Corp ID

        AgentId

        Agent ID

        Secret

        App Secret

    • Group bot Webhook

      • Obtain credentials on the platform side: In a WeCom group, open Group Settings > Group Bot > Add Bot and copy the Webhook URL.

      • Fill in the Security Operations console: Paste the Webhook URL into the Webhook URL field.

Configure an allowlist (optional)

To restrict the Agent to push messages only to specified users or group chats, enable the allowlist mode on the corresponding notification channel.

  1. In the configuration panel of the target notification channel, find the Access Control area and enable Whitelist Mode.

  2. In the Whitelist ID input box, enter the user IDs or group chat IDs that are allowed to receive messages. Separate multiple IDs with commas.

Platform

Required ID type

How to obtain

DingTalk

User ID or group chat ID

In the chat window with the bot, send /id. The bot returns the ID of the current session.

Lark

User open_id or group chat chat_id

In the chat window with the bot, send /id to obtain the ID.
In group chat scenarios, you can directly copy the group chat ID.

WeCom

User ID or group chat ID

In the chat window with the intelligent bot, send /id to obtain the ID.

Upgrade the version

You can view the current running status, current version, and available versions of the Agent. When a new version is available, you can review the update content and upgrade the Agent.

  1. In the lower part of the left-side navigation pane, click Settings.

  2. In the upper-right corner of the page, click Update Now.

  3. On the upgrade confirmation page, review the Update Content, Service Impact, and Data Retention sections, and then click OK.

Important

During the upgrade, the SecOps Agent console is unavailable. Wait until the upgrade is complete.

View credits usage and expiration

In the left-side navigation pane, click Usage to view session and Credits usage statistics.

  • Overall usage: The top of the page displays the subscription package Credits Used as (subscription quota + excess quota) / subscription quota, along with the expiration time of the complimentary Credits. For detailed billing information, go to Expenses and Costs - Billing Details.

  • Task details: In the Credits Consumed column of the task list, view the Credits consumed by each task.

    For the billing rules and pricing details of SecOps Agent, see Purchase and activate SecOps Agent.

Previous：Purchase and activate the serviceNext：Risk Governance