Vulnerability scanning

Subscription

Pay-as-you-go

Manual scan

1. In the left navigation pane, choose Risk Governance > Vulnerabilities. In the upper-left corner of the console, select the region where the assets to be protected are located: Chinese Mainland or Outside Chinese Mainland.

2. On the Vulnerabilities page, click Quick Scan (All Servers). In the Vulnerability Scan dialog box, select the vulnerability types to scan, and then click OK.

   Note

   To scan specific servers instead of all servers, go to the Host page, select the target servers, click Security Check at the bottom of the page, and then select Vulnerabilities in the dialog box.

Automatic (periodic) scan

Automatic scanning uses two scheduling approaches depending on the vulnerability type:

• Default cycle (not configurable):

  • Applies to Linux Software Vulnerability and Windows System Vulnerability.

  • Default scan frequency:

    • Subscription:

      • Advanced, Enterprise, Ultimate — once per day;

      • Basic, Value-added Plan, Anti-virus — once every two days.

    • Pay-as-you-go:

      • Host Protection, Hosts and Container Protection — once per day;

      • Unprotected, Antivirus — once every two days.

• User-defined cycle:

  • Applies to Application Vulnerability and Urgent Vulnerability.

  • Available for Subscription (Advanced,Enterprise,Ultimate) and Pay-as-you-go (Host Protection,Hosts and Container Protection).

To configure automatic scanning:

1. In the left navigation pane, choose Risk Governance > Vulnerabilities. In the upper-left corner of the console, select the region where the assets to be protected are located: Chinese Mainland or Outside Chinese Mainland.

2. In the Vulnerabilities page, click Vulnerability Settings. Configure the following settings as needed:

   Parameter	Description
   Vulnerability scan switch	Enables or disables scanning for various vulnerability types (Linux Software Vulnerability, Windows System Vulnerability, Web-CMS Vulnerability, Application Vulnerability, and Urgent Vulnerability). After you enable a scan, you can click Manage to specify the servers to which the scan applies.
   YUM/APT Source Configuration	When enabled, Alibaba Cloud official YUM/APT sources take priority for fixing Linux vulnerabilities, which significantly improves the remediation success rate.
   Urgent Vulnerability Scan Cycle	Sets the execution frequency for urgent vulnerability scan tasks. Default scan window: Chinese Mainland: 00:00:00 (UTC+8) to 07:00:00 (UTC+8). Outside Chinese Mainland: 00:00:00 (UTC+7) to 07:00:00 (UTC+7). Available editions/protection levels: Subscription: Advanced, Enterprise, and Ultimate. Pay-as-you-go: Host Protection and Hosts and Container Protection.
   Application Vulnerability Scan Cycle	Sets the execution frequency for application vulnerability scan tasks. Default scan window: Chinese Mainland: 00:00:00 (UTC+8) to 07:00:00 (UTC+8). Outside Chinese Mainland: A staggered scheduling mechanism runs scans at different times within a 24-hour period. Available editions/protection levels: Subscription: Enterprise and Ultimate. Pay-as-you-go: Host Protection and Hosts and Container Protection.
   System Vulnerabilities Scanned At	Sets a specific time for Linux Software Vulnerability and Windows System Vulnerability scan tasks to run.
   Retain Invalid Vulnerabilities For	Sets the data cleanup period for stale vulnerabilities. The system considers vulnerabilities that are not re-detected or handled for an extended period to be stale. Stale vulnerabilities are automatically archived to the "Handled" list. After the period you configured in Retain Invalid Vulnerabilities For expires, the system permanently deletes them to reduce clutter. Note If Security Center detects the same type of vulnerability again in the future, a new alert is generated.
   Vulnerability Scan Level	Sets the risk levels of vulnerabilities to scan for. The system scans for and reports only the vulnerabilities that match the selected levels.
   Vulnerability Whitelist Settings	Add vulnerabilities that you decide not to fix (for example, due to business requirements or acceptable risk) to a whitelist. These vulnerabilities are then ignored in future scans. Note After you add a vulnerability whitelist rule, you can manage it (edit or delete) on the Vulnerability Whitelist Settings tab in the Vulnerability Settings panel.

Scan behavior and results

• Why are multiple instances of the same vulnerability reported for a single server?

  Application vulnerability detection targets specific running process instances. If a server runs multiple instances of a process with the same vulnerability, such as two identical Tomcat services on different ports, the system reports a separate vulnerability for each instance. If the vulnerable software is installed but its corresponding process is not running, the vulnerability is not detected.

• Why do scan results for vulnerabilities like Fastjson sometimes vary?

  The detection of such vulnerabilities depends on whether their components, such as JAR packages, are loaded into a "runtime" state during the scan. In a dynamic loading model, the system identifies the vulnerability only when business logic calls the vulnerable component. Therefore, scan results may differ at different times.

  Note

  To improve detection accuracy for these types of vulnerabilities, we recommend that you run periodic or multiple scans.

• Why do vulnerability records for a host remain on the console after its agent goes offline?

  When an agent goes offline, its previously detected vulnerability records are retained on the console. However, these records automatically become stale, and you cannot act on them (for example, remediate, verify, or delete them). Vulnerabilities automatically become stale after the following periods:

  Important

  All data is permanently deleted only if the Security Center service expires and is not renewed within 7 days.

  • Linux Software Vulnerability and Windows System Vulnerability: 3 days.

  • Web-CMS Vulnerability: 7 days.

  • Application Vulnerability: 30 days.

  • Urgent Vulnerability: 90 days.

Performance impact and security

• Do vulnerability scans or POCs for urgent vulnerabilities affect business systems?

  Typically, no. The POCs from Security Center send only one or two harmless probe requests and do not perform any attacks or destructive actions. However, in rare cases where an application handles unexpected input poorly, a minimal, unknown risk might exist.

• Why can a vulnerability scan trigger an out-of-memory (OOM) error?

  The Security Center agent has a default memory limit of 200 MB. If memory usage during a scan exceeds this limit, the system's OOM mechanism terminates the detection process (ALiSecCheck) to conserve resources.

  Note

  • This limit is typically managed by a control group (cgroup) named aegisRtap0. You can find related OOM information in the dmesg logs.

  • This is normal behavior and does not indicate a system-wide memory shortage. No user intervention is required.

  • This type of Out of Memory (OOM) error results from a cgroup memory limit, not a system-wide memory shortage.

Scan scope and capabilities

1. What does the vulnerability scan cover?

   Scanning covers both the system and application layers:

   • System layer: Linux Software Vulnerability and Windows System Vulnerability.

     Important

     Windows System Vulnerability scanning supports only monthly security update patches.

   • Application layer: Web-CMS Vulnerability, Application Vulnerability, and Urgent Vulnerability.

2. How do I view the list of vulnerabilities that Security Center can detect?

   1. Log on to the Security Center console.

   2. In the left-side navigation pane, choose Vulnerabilities > Vulnerabilities. In the overview section, find the Disclosed Vulnerabilities card.

   3. Click the total number of vulnerabilities on the card to view a list of all detectable vulnerabilities and their details.

3. Is detection for specific vulnerabilities like Elasticsearch supported?

   Yes. You can view detection results for services like Elasticsearch on the Application Vulnerability page in the console.

   Note

   This feature is available only for Subscription (Enterprise and Ultimate editions) and Pay-as-you-go (Host Protection and Hosts and Container Protection). If your current edition does not support this feature, upgrade your service.