DocsICP FilingConsole
Documentation
Home Page Security Center Detection and Protection Risk Governance Attack surface management Attack risks

View and handle attack risks

Updated at:
Copy as MD
Product
My Favorites

This topic describes how to analyze and remediate risks based on attack path graphs. You can view Internet exposure and lateral movement paths from an attacker's perspective, manage detection rules for specific risk paths using whitelist policies, and use AI-assisted analysis to obtain remediation suggestions.

Key concepts

  • Attack path: A potential attack sequence that Security Center deduces based on asset associations, network reachability, and vulnerabilities or risky configurations on your assets. An attack path represents a deduced potential risk, not an actual attack event.

    Note

    An attack path indicates a potential risk, not an active intrusion.

  • Start asset and destination asset:

    • Start asset: Usually an asset exposed to the Internet, such as an ECS instance with a public IP address. It serves as the attacker's entry point.

    • Destination asset: Usually a high-value internal asset, such as a core database or an internal application server. It is the target the attacker wants to control or extract data from.

Scope

Create risk scan tasks

Step 1: Add to whitelist (optional)

If you have deployed WAF, Cloud Firewall, or other access control policies in your network environment, add the Security Center scanning node IP address ranges to the whitelist.

  • Outside Chinese Mainland: 43.106.35.0/24

  • Chinese Mainland: 47.102.22.128/25

Step 2: Create a scan task

Note

Assets in Chinese Mainland and Outside Chinese Mainland require separate scan tasks.

  1. Log on to Security Center console. At the top of the left side of the page, select the region where the asset to be protected is located: Chinese Mainland or Outside Chinese Mainland, click in the left-side navigation pane Risk Governance > Attack Management.

  2. On the Attack Risk tab, choose a scan method based on your needs.

    Scan method

    Use case

    Quick Scan

    For immediate and comprehensive risk assessment, such as emergency response to security incidents or post-deployment checks for new services.

    Periodic scan

    For ongoing attack surface reduction and continuous asset monitoring. We recommend configuring it to run weekly or monthly.

    • Quick Scan: Click Quick Scan in the upper-right corner. The system immediately performs asset scanning and attack analysis on all supported Alibaba Cloud products.

    • Periodic scan: Click Scan Policy in the upper-right corner. On the Scan Policy Management tab, turn on the Scheduled Scan switch and configure the scan rules.

      • Scan Schedule Settings: Set the scan frequency. You can choose Every Day, Every Week (specify the day of the week), or Every Month (specify the date).

        Note

        To avoid impacting your business, we recommend scanning during off-peak hours.

      • Scan Time: To ensure scan stability, the system selects a time within the configured cycle (day/week/month) between 00:00 and 24:00 to start the scan. Specifying an exact scan time is not supported.

      • Scan Target Exclusion List: Set the start assets to exclude from scanning. Only Domain Name and IP Information of attributed assets can be excluded. If not set, all Attributed assets are scanned by default.

        Note

        During the first scan (when no Quick Scan or Scheduled Scan has been executed), Domain Name and IP Information are empty and the Scan Target Exclusion List cannot be configured.

      • Sensitive Assets: Set the asset scope to scan. For supported cloud products, see Supported cloud products.

  3. After configuring the scan task, Security Center executes the following subtasks in sequence:

    Note

    All subtasks take approximately 1 hour to complete. Please be patient.

    1. Refresh Cloud Assets (asset mapping): Discovers and updates Cloud Assets and associated Shadow Assets under your account.

    2. Cloud Product Exposure Analysis Task: Performs vulnerability scanning and asset exposure analysis on Attributed assets to identify security risks and vulnerabilities that may be exposed to the public internet.

    3. Attack Path Analysis: Analyzes access paths of discovered threats and generates Attack Risk data.

Step 3: View scan tasks

After starting a one-click or periodic scan task, you can view its execution status, including progress, subtask list, and scanned asset types. Follow these steps:

  1. Click Task Management in the upper-right corner of the Attack Management page.

  2. On the Task Management page, view the task execution status. Different task types correspond to different scan methods:

    Task type

    Scan method

    Manual Scan Task

    One-click scan

    System Scan Task

    Periodic scan

  3. Click Details in the Actions column of the main task to view the execution status of its three subtasks: Refresh Cloud Assets, Cloud Product Exposure Analysis Task, and Attack Path Analysis.

  4. In the subtask list, click Details in the Actions column to view the assets and instance information related to the task.

View attack risks

View the overall attack risk posture

The Attack Surface tab shows your environment's overall exposure.

  1. Log on to Security Center console. At the top of the left side of the page, select the region where the asset to be protected is located: Chinese Mainland or Outside Chinese Mainland, click in the left-side navigation pane Risk Governance > Attack Management.

  2. On the Attack Surface tab, review the following sections:

    • Top 5 Risk Paths: Lists the five highest-risk attack paths, ranked by a comprehensive risk score that factors in vulnerability severity, asset importance, and exposure scope. Preview an Attack Path inline, or click View Now to open the risk details page.

    • Attack Path Type: Shows the distribution of attack path types—such as intrusions from Internet exposure, lateral movement through cloud product access, and lateral movement through host vulnerabilities—so you can identify the dominant risk patterns in your environment.

    • Assets:

      • At-risk Asset Type: Breaks down the types of assets involved in active attack risks and their relative percentages.

      • Top10 Exposed Component: Lists the ten components with the highest exposure risk, helping you pinpoint specific sources of risk.

      • Exposure Method: Shows how assets are exposed—for example, directly via a public IP address or indirectly through Server Load Balancer (SLB). For more information, see Attack Surface Management overview.

View attack risk details

  1. Go to the Attack Risk tab, locate the target asset, and click Details in the Actions column.

  2. On the risk details page, two sections are available:

    • Paths: Lists all attack paths for the current risk. Each entry represents a complete attack chain from a start asset to a destination asset.

    • Attack Path:

      1. Click an attack name in Paths to display the corresponding attack path graphically.

      2. Click any path node to view its associated details, including Basic Basic Information, Exposed Component,Vulnerability Details, Alert Handling, Agentless Detection, and CSPM.

Handle attack risks

For each attack risk, review the path details and take appropriate action:

  • Remediate and reinforce: Remediating the root cause is the most effective way to handle attack risks. Click a path node in Attack Path and address each risk point:

    • Vulnerability Details: If a vulnerability is detected, click the vulnerability name or the handling button to go to the Vulnerability Management module. Follow the remediation suggestions to fix the vulnerability.

    • CSPM: If configuration risks or baseline violations are found, click the risk item to go to the Cloud Security Posture Management (CSPM) module and apply the recommended reinforcement.

    • Network exposure: If a security group opens vulnerable ports to the Internet, go to the ECS or VPC console and tighten the security group rules. Restrict access to specific trusted IP addresses.

  • AI Analysis: For complex attack paths, use the Security AI Assistant to get automated analysis and remediation suggestions.

    1. On the risk details page, click an attack name in Paths.

    2. In the expanded attack description section, click AI Analysis. The Alibaba Cloud Security Large Model analyzes the attack path and generates Remediation Suggestions, including:

      • Attack path overview: A summary of how the attack path was formed and the basis for its determination.

      • Attack path analysis: A detailed breakdown of the path formation and the evidence behind it.

      • Affected assets and risk assessment: An assessment of the affected instances and their risk levels.

      • Remediation suggestions: Step-by-step instructions for resolving the risk.

  • Add to Whitelist: Whitelisting does not fix the underlying risk. Use this option only for confirmed false positives or acceptable risks.

    Important

    After whitelisting, Security Center stops generating risk alerts for the attack path from the current Source Assets to Destination Assets.

    1. On the risk details page, click an attack name in Paths.

    2. In the expanded attack description section, click Handle. In the panel that appears, set Disposition to Add to Whitelist.

      • Effective Assets: Defaults to the start and destination assets of the current attack path.

      • Whitelist Policy Name: Enter a descriptive name that reflects your business context, for easier maintenance.

    3. To view and manage whitelisted entries, go to the Whitelist Policy tab under Scan Policy on the Attack Management page.

Manage whitelist policies

From the Attack Management page, click Scan Policy in the upper-right corner. On the Whitelist Policy tab, you can create, modify, and delete whitelist policies.

  • Create a policy:

    1. Click Create Policy above the list. Enter a name in the Whitelist Policy Name field.

    2. Select Source Assets and Destination Assets:

      1. Switch the list type to Asset List. From the Attributed assets, select the assets to include. You can select multiple assets.

      2. Switch the list type to Change List to confirm your selections.

  • Modify a policy:

    1. Click Edit in the Actions column of the target policy.

    2. Modify Source Assets or Destination Assets:

      1. In the Selected List view, review the assets currently saved in the policy.

      2. Switch to Asset List to add or remove assets by selecting or clearing them.

      3. Switch to Change List to confirm the changes.

        Note

        In the Change List view, selected items indicate assets newly added to the whitelist; cleared items indicate assets removed from it.

  • Delete a policy: Click Delete in the Actions column of the target policy. Deleting a policy has the following effects:

    • All previously whitelisted attack paths are included in the detection scope again.

    • If the related risks have not been fixed, Security Center regenerates the corresponding attack risk data.

Previous：Border Asset DiscoveryNext：Asset exposure analysis