Host intelligent behavior analysis uses AI models to learn normal process behaviors on servers, automatically identifies and handles abnormal processes, and implements zero-trust security protection.-Security Center(Security Center)-阿里云帮助中心

What is Agentic EDR

Host intelligent behavior (Agentic EDR) analysis uses AI models to learn normal process behaviors on servers and build process whitelists. When a server runs a process that is not in the whitelist, the system triggers a warning or takes control actions based on the current running mode to detect and handle potential security threats.

Abnormal process detection: When a server is implanted with malicious programs or cryptocurrency mining trojans, abnormal process behaviors trigger system alerts or are automatically blocked.
Compliance auditing: Records all process behaviors on servers to meet security compliance audit requirements.
Zero-trust protection: By default, only processes in the whitelist are allowed to run, blocking the execution of unknown programs at the source.

How it works

Workflow

Host intelligent behavior analysis consists of two phases:

Learning phase

After you create an analysis policy, the AI model records all process behaviors on the server. During the learning period, the system does not block any processes. The learning duration can be customized in the policy.

Protection phase

After the learning is complete, the system builds a whitelist based on the normal process behaviors it learned. When a server runs a process that is not in the whitelist, the system handles it based on the current running mode:

Alert mode (default): Generates an alert when an abnormal process is detected, without blocking the process.
Block mode: Directly blocks abnormal processes when detected and prevents them from running.

Warning
Control mode directly blocks abnormal processes. We recommend that you verify the completeness of the whitelist before switching to control mode to avoid blocking normal business processes.

Running statuses

Servers have the following running statuses in host intelligent behavior analysis:

Status	Description	Available actions
Learning	The model is learning the normal process behaviors of the server.	View details, Relearn, Switch Mode
Alerting	The model has completed learning. Alerts are triggered when abnormal process behaviors are detected.	View details, Start Incremental Learning, Relearn, Switch Mode
Enforcing	The model has completed learning. Abnormal process behaviors are directly blocked when detected.	View details, Start Incremental Learning, Relearn, Switch Mode

Scope of application

The Security Center agent is installed on the server.
The server operating system and kernel version meet the AliHips support requirements, and the AliHips process is running normally.

Enable Agentic EDR

To use the intelligent behavior analysis feature, you must first purchase and enable Agentic EDR.

Subscription

Go to the Agentic EDR or buy page and complete the following configurations:
- Intelligent Host Detection and Response: Select the number of regular authorization seats to purchase.
- Duration: The service duration.
  
  Note
  We recommend that you select "Auto-renewal upon expiration" to avoid service interruption or resource release due to expiration. After you enable auto-renewal, the renewal cycle is monthly, and the system automatically deducts fees at the real-time price before the instance expires. You can cancel auto-renewal at any time. Configure or cancel auto-renewal.
After the configuration is complete, click Buy Now.

Pay-as-you-go

Go to the Security Center console - Overview page.
In the Enable Pay-as-You-Go Service section, turn on the Agentic EDR switch.

Hybrid billing

Important

The hybrid billing mode (Burstable Protection) is currently in public preview. To enable it, contact your business manager.

Purchase the Agentic EDR subscription service.
Go to the Security Center console - Overview page.
In the Subscription section, turn on the Burstable Protection switch.

Bind server authorizations

You must bind EDR seat authorizations to servers before you can use Agentic EDR for learning and protection.

Go to the Security Center console - Overview page.
Go to the authorization page: The entry point varies based on the billing mode you purchased.
- Subscription/Hybrid billing: In the Subscription section, click Manage next to Agentic EDR.
- Pay-as-you-go: In the Enable Pay-as-You-Go Service section, click Quota Management next to Agentic EDR.
In the Quota Management dialog box, select a Select Server Location (Chinese Mainland or Outside Chinese Mainland) and then locate the target server.
In the Agentic EDR Seat column of the target server, turn on the switch.

Important
To automatically bind EDR seats to new servers, in the Automatically Add New Servers to Security Center section, select the Automatically Enable Agentic EDR for New Hosts checkbox.

Create an analysis policy

Before you enable host intelligent behavior analysis, you must create a protection policy to define the learning duration, whitelist mode, and target servers.

Access the Security Center console - Protection Settings - Host Protection - Intelligent Behavior Analysis. At the top of the left side of the page, select the region where the asset to be protected is located: Chinese Mainland or Outside Chinese Mainland.
On the intelligent behavior analysis page, click Agentic EDR Settings in the upper-right corner.
In the intelligent behavior analysis settings dialog box, click Create Policy.

On the new policy page, configure the following parameters:

Parameter	Description
Policy Name	Specify a custom policy name for easy identification and management.
Learning Duration	The number of learning days after the initial model is created. During the learning period, the system records all process behaviors. Note We recommend at least 7 days to ensure the complete business cycle is covered. If the server has strong periodic business patterns (such as weekly scheduled tasks), we recommend 14 days or more.
Automatic End	If no new behaviors are detected for N consecutive days, the intelligent analysis model automatically ends learning and enters the protection phase (Alert mode by default).
Whitelist Mode	The whitelist matching method. Process Path (default): Processes are matched by file path. Process Hash: Processes are matched by file hash (MD5).
Server selection	The servers to which the policy applies. You can select all assets or filter by asset group. You can search by server name, public IP address, or private IP address.

Click OK to complete the policy creation.
Return to the intelligent behavior analysis page and verify that the status of the target server in the server list is displayed as "Learning".

Note

After the policy is created, the selected servers enter the learning phase. We recommend that you create the policy during normal business hours to ensure the model learns the complete normal process behaviors.

Manage the process whitelist

After the learning phase is complete, the system generates a process behavior whitelist. You can view, add, or delete process paths in the whitelist.

View the whitelist

In the server list on the Agentic EDR page, click Details in the Actions column of the target server.
On the details page, view all process path whitelist entries for the server.

Note
You can use filters and search to locate the target process path.

Add a process to the whitelist

Method	Supported Whitelist Mode	Scenario
Batch add	Process Path, Process Hash	When you need to add trusted items to multiple servers at a time.
Single add	Only Process Path	When you need to add a specific path for a single server.

Batch add

In the server list on the Agentic EDR page, select one or more servers.
In the batch operation area at the bottom, click Add Process Behavior.
In the dialog box that appears, enter the Process Path or Process Hash information and click OK.

Single add

In the server list on the Agentic EDR page, click Details in the Actions column of the target server.
On the Process Path list page, click Add Process Path.
In the dialog box that appears, enter the Process Path and click OK.

Delete a process from the whitelist

In the server list on the Agentic EDR page, click Details in the Actions column of the target server.
On the details page, in the process path list, click Delete in the Actions column of the target process path.

Warning

After you delete a process path from the whitelist, the process is identified as an abnormal process. The system generates an alert, and in Block mode, the process is directly blocked. Proceed with caution.

Switch the protection mode

After the learning phase is complete, the default protection mode of the server is Alert. You can switch the protection mode.

Important

Before you switch from Alert mode to Block mode, we recommend that you verify on the details page that the whitelist covers all normal business processes to avoid false blocking.

In the server list, click Switch Mode in the Actions column of the target server.
In the switch mode dialog box, select Alert or Block mode.
Click OK to complete the switch.

View and handle alerts

If a server has processes that are not in the process whitelist, the system generates security alerts. You can view and handle the alerts in the Alerts feature of Security Center.

In the left-side navigation pane, choose Detection and Response > Alerts. In the upper-left corner of the console, select the region where the asset to be protected is located: Chinese Mainland or Outside Chinese Mainland.

Note
If you have activated the Agentic SOC service, the navigation entry on the left changes to Agentic SOC > Alerts.
On the CWPP tab, click the number under Host Abnormal Behavior Alert to go to the alert list.

Alert statuses:
- Alert mode: The alert status is To Be Handled, which requires manual review.
- Block mode: The system has automatically blocked the process, and the alert status is Blocked.

For each alert, you can take one of the following actions:

Dimension	Ignore	Add to Business Model
Current alert status	Changes to "Ignored".	No change.
Subsequent alerts	Alerts continue: When the same process runs next time, the system generates a new alert.	No more alerts: When the same process runs next time, it is directly allowed.
Whitelist change	No change.	The process is added to the process whitelist.
Scenario	Temporary tasks or suspicious behaviors that require continuous monitoring.	Confirmed normal business processes; you want to reduce duplicate alerts.

Relearn process behaviors

When the business processes on a server change, you need to relearn process behaviors and generate a new whitelist to avoid false blocking or invalid alerts. The system provides the following two methods:

Item	Start Incremental Learning	Relearn
Limits	Only available for servers in the Alerting or Enforcing state. Not available for servers in the Learning state.	No special limits.
Data processing	Continues learning new process behaviors based on the existing model. The existing whitelist is retained, and only new process behaviors are learned and added.	Clears all whitelist data and rebuilds the process whitelist from scratch.
Protection status	Blocking and alerting do not take effect.	Blocking and alerting do not take effect.
Scenario	Minor business adjustments, adding a small number of new processes or services, or routine iteration and maintenance.	Major business changes on the server (such as adding new services or upgrading software) where the original process behavior model is no longer applicable.

In the server list on the Agentic EDR page, click Relearn or Start Incremental Learning in the Actions column of the target server.
After the operation is complete, the Status changes to Learning.

Important
During Learning, blocking and alerting do not take effect.

Billing overview

Subscription:
- Billing method: You are billed based on the number of purchased seat quotas. Binding one host consumes one seat quota.
- Billing rules: CNY 50/quota/month.
Pay-as-you-go:
- Billing method: Billing is based on the number of seats × usage duration. Binding one server consumes one seat license. Servers without policy configuration are automatically excluded from billing.
- Billing cycle: Billed hourly, settled on a daily basis.
- Price: CNY 0.104167/seat/hour.
Hybrid billing:
- Billing method: Billing is based on the number of seat licenses purchased. Binding one server consumes one seat license.
- Billing rules: After Burstable Protection is enabled, if the actual number of bound seats exceeds the purchased subscription regular seats, the excess is charged based on the elastic protection seats pricing.
  - Agentic EDR regular seats: CNY 50/seat/month.
  - Agentic EDR elastic protection seats: CNY 0.104167/seat/hour.

Close and unsubscribe

If you no longer need the EDR service, refer to the following instructions based on the billing mode.

Close the entire service:
- Subscription: Go to the Unsubscription Management page or the , submit an unsubscription request, and select the EDR order. For more information, see Refund policy.
- Pay-as-you-go: In the Enable Pay-as-You-Go Service section of the Security Center console - Overview page, turn off Agentic EDR.
Disable elastic protection:
- Method 1: In the Subscription section of the Security Center console - Overview page, turn off the Burstable Protection switch.
- Method 2: After you unsubscribe from the Subscription service, Burstable Protection is automatically disabled.

Data cleanup

After you close the service, unsubscribe from Agentic EDR instances, or your account incurs overdue payments, the intelligent behavior analysis service stops immediately. Data retention is as follows:

Scenario		Data retention description
Subscription instances	Unsubscription	Elastic protection: Elastic protection immediately becomes invalid and stops billing. Elastic authorizations and credits consumed on the current day will be billed the next day. Data retention: Policies and baseline retention: Existing policies and host baselines are retained but no longer updated. Historical alert retention: Existing host abnormal behavior alerts are retained, but no new alerts are generated.
	Expiration
Pay-as-you-go instances	Closed	Policies and baseline retention: Existing policies and host baselines are retained but no longer updated. Historical alert retention: Existing host abnormal behavior alerts are retained, but no new alerts are generated.
	Overdue payments

FAQ

Does the expiration of my Security Center instance affect Agentic EDR?

No, it does not affect Agentic EDR. Reasons:
- Independent billing: Agentic EDR is an independent billing module and is billed separately from Security Center instances.
- Continuous availability: As long as the Agentic EDR instance is still within its validity period, you can continue to use features such as learning and server binding even if the Security Center instance has expired.
Why is the whitelist empty after learning is complete?

An empty whitelist may indicate that no process activity occurred on the server during the learning period. Verify the following and then click Relearn.
- Verify that the server is running properly and that the Security Center agent is online.
- Verify that the AliHips process is running properly. If not, check whether the server operating system and kernel version meet the AliHips support requirements.
- Verify that actual business traffic was generated on the server during the learning period.
How do I avoid false blocking of normal business processes in blocking mode?
- Before you switch to Block mode, make sure that the learning duration is sufficient and the whitelist covers all normal business processes.
- Run in Alert mode for a period of time and observe whether any normal business processes are flagged as false positives.
- When false blocking occurs, add the corresponding process path to the whitelist and then perform Relearn or incremental learning.
What is the difference between Start Incremental Learning and Relearn?
- Incremental learning: Retains the existing whitelist and only learns new process behaviors. Suitable for minor business adjustments or adding a small number of new processes. Lower risk; the existing whitelist is not affected.
- Restart learning: Clears all existing data and starts learning from scratch. Suitable for major business changes where the original model is no longer applicable. Higher risk.