Purchase Security Center

Anti-ransomware

• Description: Provides anti-ransomware backup and recovery capabilities. Use backup files to restore servers and databases after a ransomware attack.

• Purchase notes:

  • The purchase quantity represents anti-ransomware capacity, which is related to the size of files to be backed up and the backup retention period, not the number of servers.

  • Available only in select regions. Set the protected data volume as needed. For supported regions, see Supported regions for anti-ransomware.

  • If you select Set Recommended Policy, the system automatically performs regular backups of important file paths on existing servers. To adjust the strategy, go to the anti-ransomware page. For details, see Modify server anti-ransomware policies.

CSPM (CSPM)

• Description: Provides identity and permission management, automated compliance checks, and cloud product configuration baseline detection for centralized management of multi-cloud configuration risks.

• Purchase notes: Billed by the number of cloud product instances scanned, verified, and remediated.

  Note

  Unused quota is cleared at the end of each month. For more billing details, see CSPM billing overview.

Agentic SOC (Legacy)

• Description:

  • Agentic SOC (Legacy): Supports unified log ingestion across clouds, accounts, and products (such as Web Application Firewall, Cloud Firewall, and VPC) for closed-loop security alert detection, event response, and incident handling. Helps improve security operations efficiency and meet MLPS compliance log audit requirements.

  • Security Operations Agent: A premium value-added service powered by Agentic AI that integrates deeply with Alibaba Cloud native security data and infrastructure. Uses Agent autonomous perception, reasoning, and execution capabilities to independently evaluate security events and enable rapid incident response.

• Purchase notes:

  • Modular billing: billing items vary based on purchase options. For details, see Agentic SOC - Subscription.

    • Agentic SOC (Legacy): Billed separately by Log Ingestion Traffic and Agentic SOC ( Log Storage Capacity ). Purchase based on your actual needs.

      Log ingestion traffic (GB/day)

      • Use: For real-time threat detection, attack tracing, alert analysis, and other core security operations. After purchase, access most core Agentic SOC features such as threat detection and investigation response.

      • Estimating capacity:

        • Based on existing log volume

          Daily traffic (GB) = Total log storage capacity (GB) / Log retention days (TTL).

          Example: If you currently have 10,000 GB of logs retained for 90 days, daily traffic is approximately 10000 / 90 ≈ 111 GB. We recommend purchasing 200 GB/day.

        • Based on log generation rate (EPS)

          Daily traffic (GB) = EPS (log entries per second) × 86400 × Average log size (KB) / 1024

          • EPS: Log entries generated per second.

          • Average log size: Typically between 3 KB and 7 KB.

      Log storage capacity (GB)

      • Use: For long-term storage, query, and audit of logs to meet compliance requirements such as the Cybersecurity Law and MLPS 2.0, which require log retention of no less than 180 days. Also supports retrospective analysis of historical events. The log storage capacity you purchase here is the same capacity entitlement that the Log module displays and uses—these are not two separate capacity pools. Before purchasing Agentic SOC, access the Log module via Detection and Response > Log. After purchasing Agentic SOC, the entry changes to Agentic SOC > Log; this entry change does not affect your purchased capacity entitlement.

      • Estimating capacity:

        • By server count: We recommend 120 GB of log storage capacity per server.

        • By existing log analysis capacity: Set to 3 times the purchased capacity in the Security Center - Log Analysis feature.

    • Security Operations Agent: In addition to Agentic SOC, you must also purchase Intelligent Usage Analysis and Number of Managed Instances.

      • Intelligent Usage Analysis: The analysis usage consumed by Security Operations Agent for alert evaluation, event investigation, tracing, attribution, and security report generation. The purchase quantity does not support auto-fill and must match the Log Ingestion Traffic quantity.

        Note

        Intelligent Usage Analysis is cleared daily. Exceeding the limit results in automatic throttling.

      • Number of Managed Instances: Security Operations Agent supports cross-instance security operations and automated handling. Billing is based on the number of managed instances. Each invoked instance is charged, including ECS, WAF, ALB, cross-cloud products, and on-premises security vendor products.

        Note

        Cleared monthly. Each instance is counted only once with automatic deduplication.

  • If you select Access Policy, log sources from your current Alibaba Cloud account for Security Center, Web Application Firewall, Cloud Firewall, and ActionTrail are automatically ingested.

Vulnerability Fixing

• Description: Enables one-click remediation of Linux Software Vulnerability and Windows System Vulnerability on servers from the console.

• Purchase notes: Enter the number of vulnerability remediation attempts to purchase based on the monthly number of vulnerabilities to be remediated.

  Note

  The number of remediation attempts equals the total number of vulnerabilities remediated across all servers. For example, if 10 servers have the same named vulnerability and you use Security Center to remediate it, 10 remediation attempts are consumed.

Image Security Scan

• Description: One-click scanning of images for system vulnerabilities, application vulnerabilities, viruses, and malicious samples, with remediation recommendations.

• Purchase notes:

  • Enter the number of scan authorizations to purchase based on your monthly needs.

    Note

    Scan authorization: Consumes 1 authorization when an image digest is scanned for the first time. Subsequent scans of the same digest do not consume authorizations. If the image digest changes, authorization must be consumed again.

  • Available only when the edition is Advanced Edition, Enterprise Edition, Ultimate Enterprise, or Value-added Plan.

File Tamper-Proofing

• Description: File tamper-proofing uses real-time monitoring to comprehensively track file system activities, automatically intercept unauthorized write and delete operations, and log all access behavior to form a complete audit chain, ensuring the integrity of critical files.

• Purchase notes: Select the number of servers to protect.

Malicious File Detection

• Description: Deep scanning and detection of malicious software, web shells, viruses, and other potential risk files hidden in server file systems.

• Purchase notes: Set the purchase quantity to the number of files to be scanned per month.

RASP (RASP)

• Description: Application protection is based on RASP technology, enabling applications to protect themselves at runtime by detecting and blocking attacks in real time.

• Purchase notes: We recommend setting the purchase quantity to the total number of Java processes to protect.

  Note

  Example: If you have 2 servers each running 3 Java applications to protect, purchase 6 authorizations.

Cloud Honeypot

• Description: Efficiently captures and traps attacker behavior, enhancing detection and protection of core assets in attack-defense scenarios.

• Purchase notes: Cloud honeypots are billed by the number of probes. Minimum purchase: 20 probes. Maximum: 500 probes.

  Note

  For more than 500 probes, contact technical support for capacity expansion.

Security Dashboard

• Description: Provides multiple visual dashboards for macro-level monitoring of asset security posture.

• Available only when the edition is Advanced Edition, Enterprise Edition, or Ultimate Enterprise.

Log Analysis

• Description: Aggregates security logs from cloud assets (including hosts and security events), provides powerful SQL search and visual reports for easy event tracing, attack investigation, and compliance auditing.

  Important

  If you also purchase the Agentic SOC ( Log Storage Capacity ) pay-as-you-go service, Security Center logs are stored twice. To avoid duplicate charges, evaluate your needs and turn off the relevant log delivery switches in the Log Analysis module from the Security Center console.

• Purchase notes: Logs must be stored for at least 180 days as required by the Cybersecurity Law. We recommend no less than 50 GB of storage capacity per server.

Host and Container Security

• Description: Provides comprehensive detection and protection for host and container assets. After purchase, you must bind a protection level to your assets. Protection levels are described in the following table.

  Protection level	Description	Monthly cost (30-day estimate)
  Unprotected	Basic security detection capabilities only (e.g., anomalous login detection, DDoS, common server vulnerabilities, and security posture issues for select cloud services). No active protection features.	Free
  Antivirus	Detects and removes common viruses on hosts.	CNY 7.5/core/month
  Advanced	No longer available for new purchases or modifications.	CNY 90/server/month
  Comprehensive Host Protection	Meets classified protection compliance requirements (Dengbao) and addresses host intrusion prevention, identity authentication, and security auditing requirements.	CNY 225/server/month
  Hosts and Container Protection	Provides full-stack security protection for hosts, containers, and intelligent computing servers, including Kubernetes (K8s) threat detection, K8s, container asset visibility, security alerts, virus detection, vulnerability detection, asset fingerprinting, and attack chain analysis.	CNY 225/server/month + CNY 7.5/core/month

  Key protection capabilities by level:

  Protection capability	Unprotected	Antivirus	Comprehensive Host Protection	Hosts and Container Protection
  Malware and cloud product threat detection	Supported	Supported	Supported	Supported
  Virus detection and host intrusion detection	Unsupported	Supported	Supported	Supported
  Brute-force attack prevention	Unsupported	Unsupported	Supported	Supported
  Host behavior defense	Unsupported	Supported Note Only supports blocking malicious MD5 processes.	Supported	Supported
  Malicious network behavior defense	Unsupported	Unsupported	Supported	Supported
  Attack tracing	Unsupported	Unsupported	Supported	Supported
  Application vulnerability detection	Unsupported	Unsupported	Supported	Supported
  Container security	Unsupported	Unsupported	Unsupported	Supported

• Purchase notes: After enabling this feature, you must authorize it on specific assets for it to take effect. Custom asset binding is supported during purchase.

  Important

  Default binding rules:

  • Servers running container environments (including Alibaba Cloud ACK cluster nodes, intelligent computing servers, and servers connected via self-managed Kubernetes clusters): Hosts and Container Protection.

  • Other assets: Comprehensive Host Protection.

  • Newly added servers: Hosts and Container Protection.

CSPM (CSPM)

• Description: Provides identity and permission management, automated compliance checks, and cloud product configuration baseline detection for centralized management of multi-cloud configuration risks.

• Purchase notes: Billed by the number of cloud product instances scanned, verified, and remediated.

Vulnerability Fixing

• Description: Enables one-click remediation of Linux Software Vulnerability and Windows System Vulnerability on servers from the console.

• Purchase notes: Enter the number of vulnerability remediation attempts to purchase based on the monthly number of vulnerabilities to be remediated.

  Note

  The number of remediation attempts equals the total number of vulnerabilities remediated across all servers. For example, if 10 servers have the same named vulnerability and you use Security Center to remediate it, 10 remediation attempts are consumed.

Image Security Scan

• Description: Scans images for system vulnerabilities, application vulnerabilities, viruses, and malicious samples, and provides remediation recommendations.

• Purchase notes: Billed per scan. CNY 0.75/scan. The first scan of a unique image digest consumes one authorization; subsequent scans of the same digest are free. If the image digest changes, a new authorization is required.

• This feature is available only when the edition is Advanced Edition, Enterprise Edition, Value-added Plan, or Ultimate Enterprise.

Agentic SOC (Legacy)

• Description:

  • Agentic SOC (Legacy): Supports unified log ingestion across clouds, accounts, and products (such as Web Application Firewall, Cloud Firewall, and VPC) for closed-loop security alert detection, event response, and incident handling. Helps improve security operations efficiency and meet MLPS compliance log audit requirements.

  • Security Operations Agent: A premium value-added service powered by Agentic AI that integrates deeply with Alibaba Cloud native security data and infrastructure. Uses Agent autonomous perception, reasoning, and execution capabilities to independently evaluate security events and enable rapid incident response.

• Purchase notes:

  • Billing items vary based on your selection. For details, see Agentic SOC - Pay-as-you-go.

    • Agentic SOC (Legacy): Tiered pricing based on Log Ingestion Traffic. The higher the volume, the lower the unit price.

      Important

      In pay-as-you-go mode, Agentic SOC ( Log Storage Capacity ) is not supported, so query and audit logs cannot be stored.

    • Security Operations Agent: In addition to the Log Ingestion Traffic base fee for Agentic SOC (Legacy), additional charges for Intelligent Usage Analysis and Number of Managed Instances apply.

      • Intelligent Usage Analysis: Analysis consumption incurred by Security Operations Agent for alert triage, incident investigation, tracing, attribution, and security report generation.

      • Number of Managed Instances: Security Operations Agent supports cross-instance security operations and automated remediation. Billing is based on the number of managed instances. Each invoked instance (e.g., ECS, WAF, ALB, cross-cloud products, on-premises security vendor products) is counted.

        Note

        Each instance is counted only once (deduplicated).

  • If you select Access Policy, logs from Security Center, Web Application Firewall, Cloud Firewall, and ActionTrail under the current Alibaba Cloud account are automatically connected.

Anti-ransomware

• Description: Provides anti-ransomware backup and recovery capabilities. Restore servers and databases using backup files after a ransomware attack.

• Purchase notes:

  • Billed based on backup file size and data retention period. For pricing details, see Anti-Ransomware Service - Pay-as-you-go.

  • Available only in select regions. Configure the protection data volume as needed. For supported regions, see Anti-Ransomware supported regions.

  • If you select Set Recommended Policy, important file paths on existing servers are automatically backed up on a regular schedule. To adjust, go to the anti-ransomware page and modify the policy; see Modify Server Anti-Ransomware.

File Tamper-Proofing

• Description: File tamper-proofing uses real-time monitoring to comprehensively track file system activities, automatically intercept unauthorized write and delete operations, and log all access behavior to form a complete audit chain, ensuring the integrity of critical files.

• Purchase notes: Billed based on actual protection duration (seconds) multiplied by the number of protected servers. Servers meeting the following criteria are automatically counted:

  • Servers bound to interception protection rules.

  • Servers bound to alerting protection rules where the server protection edition is below Advanced or the protection level is below Comprehensive Host Protection.

Application Protection

• Description: Application protection is based on RASP technology, enabling applications to protect themselves at runtime by detecting and blocking attacks in real time.

• Purchase notes: Authorize this feature on specific assets after enabling for it to take effect. Custom asset binding is supported during purchase.

  Important

  By default, full protection is enabled with slow-rate connection.

Agentless Detection

• Description: Perform vulnerability scanning and comprehensive risk checks without installing an agent on your servers.

• Purchase notes: Billed based on the volume of scanned data.

Serverless Assets

• Provides intrusion detection and vulnerability scanning for Serverless assets (such as Elastic Container Instances). For more information, see Serverless security - Pay-as-you-go.

• Purchase notes: After enabling this feature, you must authorize it on specific assets for it to take effect. Custom asset binding is supported during purchase.

  Important

  By default, Serverless Assets protection is enabled for all Serverless assets.

Malicious File Detection

• Description: File tamper-proofing uses real-time monitoring to comprehensively track file system activities, automatically intercept unauthorized write and delete operations, and log all access behavior to form a complete audit chain, ensuring the integrity of critical files.

• Purchase notes: Billed based on the number of scanned files. For pricing details, see Malicious File Detection - Pay-as-you-go.

Log Management

• Description: Log Management is built on Alibaba Cloud Log Service (SLS) and provides log auditing and analysis capabilities. Leveraging Security Center's detection and defense capabilities and the Agentic SOC module, it offers unified log auditing, built-in security reports, SQL-based analysis and tracing, and flexible storage policies.

  Important

  If you have also purchased the subscription-based Log Analysis service, Security Center logs will be stored twice. To avoid duplicate charges, evaluate your needs and disable the relevant log delivery switches in the Log Analysis module from the Security Center console.

• Purchase notes: You must configure a log storage region.

Agentic EDR

• Description: Provides hosts with intelligent business profiling, behavior baseline establishment, baseline deviation alerts, intelligent detection/alert analysis, and automated response capabilities.

• Purchase notes: Each host binding consumes one seat authorization. No unsubscription required. For pricing details, see Agentic EDR - Pay-as-you-go.

Attack Management

• Description: Provides hosts with intelligent business profiling, behavior baseline establishment, baseline deviation alerts, intelligent detection/alert analysis, and automated response capabilities.

• Purchase notes: Billed based on the number of protected assets and scanning Credits consumed. For pricing details, see Attack Surface Management - Pay-as-you-go.