CWPP (cloud workload protection platform) security incidents
Security Center generates various alerts based on asset protection rules configured for host protection and container protection, and displays them on the Cloud Workload Protection Platform (CWPP) tab of the security alerts page. Security Center uses graph computing technology to aggregate related CWPP alerts (such as those with the same MD5 hash or parent process ID) into security incidents. This topic describes the basic concepts of CWPP security incidents generated from alerts.
CWPP security incident concepts
Sources of CWPP security incidents
The asset protection rules configured for host protection and container protection in Security Center generate alert information. Security Center uses graph computing technology to aggregate related CWPP alerts (such as those with the same MD5 hash or parent process ID) into security incidents. The alert source displayed in the overview area of the incident details page is "Security Center".
You can view CWPP alert information on the CWPP tab under Detection and Response > Alert.
CWPP security incident generation rules
All CWPP alerts generate security incidents by default, except Precision Defense alerts. If a host-side alert has no relation to other alerts, a single alert generates one incident.
If you configure incident whitelisting rules, alerts that match a whitelisting rule do not generate security incidents.
Incident retention period
The Event Handling page displays only incidents from the last 180 days.
Security incident risk levels and handling instructions
| Risk level | Description | Handling instructions |
|---|---|---|
| Serious | The behavior described in this incident causes an interruption: key features are inaccessible or the network is completely down, severely affecting service availability with no workaround. Clear malicious behavior or entities were detected, confirming a definite intrusion that affects multiple servers. | Handle this incident immediately. |
| High Risk | The behavior described in this incident indicates clear malicious behavior or entities were detected. The incident is highly likely a successful intrusion that has affected your assets, such as an abnormal process behavior like a reverse shell. Generally affects a single server. | Handle this incident immediately. |
| Medium Risk | The behavior described in this incident indicates suspected malicious behavior or entities. The incident may be a successful intrusion that has affected your assets, or may be caused by unusual O&M operations, such as an abnormal logon. | This risk level indicates your assets may be under attack. Review the incident details to determine whether a threat exists and take appropriate action. |
| Low Risk | The behavior described in this incident indicates a possible successful intrusion, or your assets are under continuous attack probing from an external source, such as access from 106.11.XX.XX. | Monitor this incident if your assets have high security requirements. |
| Reminder | A large number of alerts received from job automation software. These alerts only inform you that certain jobs have run or reached a specific milestone. | Can be ignored. |
CWPP security incident handling objects
You can handle a security incident by processing the aggregated alerts and the extracted alert entities.
CWPP security alerts
CWPP security incidents are generated by aggregating CWPP security alerts through graph computing technology. When handling a CWPP security incident, if it is a false positive, you can add the incident to the whitelist or add the alerts to the whitelist.
The alert aggregation rules are as follows:
A single CWPP security incident can aggregate a maximum of 2,000 alerts.
For incidents in the Unhandled state, new alerts continue to be aggregated into the incident.
For incidents in the Handling, Handled, or Handling Failed state, new alerts are not aggregated into the existing incident. Instead, a new incident in the Unhandled state is created.
Entities
In a security incident, an entity is a specific object or actor associated with the security incident. Security Center extracts and aggregates entities from security alerts. Based on whether an entity carries malicious tags, entities are classified as malicious or non-malicious. You can view entity details, run playbooks, and query Alibaba Cloud threat intelligence.
Security Center identifies the following entity types:
Security Center does not currently support virus tracing. When a virus file is detected on a server, the system identifies the file path but cannot trace the source of the virus (such as which third-party software introduced it). We recommend that you analyze entity associations in the security incident and the alert context for a comprehensive investigation.
| Entity | Is asset entity | Can be identified as malicious |
|---|---|---|
| Host | Yes | No |
| IP address | Yes | Yes |
| Alibaba Cloud account | Yes | No |
| AccessKey pair | Yes | No |
| Domain name | Yes | Yes |
| File | No | Yes |
| Host process | No | Yes |
| Host account | No | No |
| URL | No | No |
| Registry | No | Yes |
| Container | Yes | No |
| Cluster | Yes | No |
| Object Storage Service (OSS) | Yes | No |
Security incident handling flowchart
More services
If you activate the Agentic SOC service, you can access more security incident analysis and handling services. The following table compares the services:
| Feature | With Agentic SOC value-added service | Without Agentic SOC value-added service |
|---|---|---|
| Supported incident types | Analyzes the context of multiple Agentic SOC security alerts and aggregates them into complete incidents using predefined or custom Agentic SOC rules. Security incidents generated from CWPP security alerts are migrated to Agentic SOC for handling. | CWPP security alerts, such as intrusion detection and defense alerts for Security Center hosts and containers, aggregated through graph computing. For more information, see . |
| Incident investigation reports and AI analysis | Supported. | Not supported. |
| Handling methods | Recommended handling policies (Agent Recommended Policy or System Recommended Policy); update incident status; add to whitelist. Important For incidents generated by predefined or custom Agentic SOC rules, only Agent Recommended Policy is supported. For CWPP incidents, both Agent Recommended Policy and System Recommended Policy are supported. | Recommended handling policies (System Recommended Policy); update incident status; add to whitelist. Important For CWPP incidents, only System Recommended Policy is supported. |