View asset security posture-Security Center(Security Center)-阿里云帮助中心

Data overview

The Overview page displays security data for your cloud assets across our global data centers, covering your security score, security risks, security operation trends, and instance information. This page also offers quick access to upgrade, renew, or expand your service, helping you centrally manage your cloud asset security.

In the Security Center console, navigate to the Overview page to view the following information:

Module		Description	Actions
Security Score (① in the figure)		This module displays your security score and security management statistics, including fixed vulnerabilities, resolved baseline risks, and handled alerts.	Click the security score. In the Security Score Details panel, you can handle related risks or security alerts. Custom Security Score: Security Center assigns a default deduction value to each scoring item. You can customize these values based on your business priorities. For more information, see Customize your security score. Click Security Score Description to view detailed information about the security score.
Instance information overview (② in the figure)		Displays the edition, configuration details, expiration date, and protected asset statistics for your subscription-based Security Center service. It also shows the status of pay-as-you-go services. Note The information displayed may vary depending on your Security Center edition. The actual UI takes precedence.	Asset overview In the Total Assets section, click the number of assets to go to the Assets page for more details. For more information, see Server assets. In the Agent Not Installed section, click Install to install the Security Center agent on your unprotected assets. Click Scan to go to the agentless detection page and create a scan task. Subscription service You can perform operations such as Try Now, Buy Now, Change, and Renewal. Select the operation that suits your needs. For more information, see: Activate the 7-day free trial Purchase Security Center Upgrade and downgrade Subscription renewal After you purchase a , or subscription instance of Security Center, go to the Protected Servers section and click Manage to bind the license to a specific server. For more information, see Manage licenses for Container and Server Security. When your Anti-ransomware or Log Analysis capacity drops below 20%, an alert is triggered. You can then hover over the icon and click Scale Out to purchase more storage for anti-ransomware or log analysis. Pay-as-you-go service Click Activate or Deactivate to enable or disable all pay-as-you-go features at once. Important If your account has an overdue payment and services are suspended, we recommend using the Deactivate feature. This prevents new charges when the service is automatically re-enabled after you top up your account. Click View Bills to check your billing details in the Billing Management console. Click Learn More to learn about the billing methods for the pay-as-you-go service. The status of each pay-as-you-go service is displayed. Click the icon to quickly enable or disable a service. For more details on these services, see: Container and Server Security Vulnerability fixing Cloud Security Posture Management Agentic SOC Agentless detection Serverless Security


Security Operations (③ in the figure)	Risk Governance	Displays security risk data for your cloud assets, including urgent, application, and system vulnerabilities; weak passwords; cloud service and host baseline risks; API security risks; and data security risks. It also provides reminders for improperly connected security products, key feature configurations, and expiring services. Note The detection features may vary depending on your Security Center edition. The actual UI takes precedence.	Click Quick Check and then Detect Now in the dialog box to run a comprehensive risk scan. Click the number under Unhandled Urgent Vulnerability to view and fix the vulnerabilities. For more information, see View and manage vulnerabilities. Click the number under Unhandled Weak Password to view and handle baseline risks. For more information, see Baseline checks. Click the number for risk items such as Pending CSPM Risk, Unhandled Application Vulnerability, Core Feature Configurations, Unhandled Weak Password, and Unhandled System Vulnerability. In the corresponding panel, select a specific risk item and click Handle Now to go to the risk handling page for that item. You can then view the risk list and remediate the issue based on the provided details and recommendations. Note Refer to the Security Center documentation to handle security alerts promptly.
	Security Protection	Shows the real-time count of blocked attacks. This includes attacks blocked by DDoS scrubbing, Web Application Firewall (WAF), Cloud Firewall, Security Center host protection, and Real-person Authentication.	Click the number in each section, select a specific risk item, and click Handle Now.
	Security Response	Displays risks related to security alerts. We recommend that you handle these alerts promptly to minimize potential losses. This includes unhandled urgent, reminder, and suspicious alert events.	Click the number in the Pending Alerts section, select a specific risk item, and click Handle Now. For more information, see Evaluate and handle security alerts.
Security Operations Trend (④ in the figure)		Displays trend data for security operations, including the number of host assets, container assets, cloud services, and associated at-risk assets over time.	In the upper-right corner of the Security operation trend section, click Create Report or View Report to access the security report page for more details. For more information, see Security reports.
Quick Help (⑤ in the figure)		Provides quick links to key Security Center information and resources.	The links include the following: What is Security Center? Quick start Data overview Features
Release Notes (⑥ in the figure)		This module shows recent feature optimizations, new feature releases, and updates on new capabilities.	Click View More to go to the Product News page for more information about product updates.

Security score

The Security Center security score is a health index ranging from 0 to 100. It is dynamically calculated based on the real-time security status of your assets, such as alert events and configuration flaws. A higher score indicates a better security posture and reflects the effectiveness of your remediation efforts.

Improve your security score

Your asset risk level is categorized as High (below 69), Medium (70-84), At-risk (85-94), or Secure (95-100). To improve the security of your cloud assets, we recommend handling risk alerts promptly to raise your security score.

In the Security Score module, click the score value.
In the Security Score Details panel, review the specific deduction items. Click Handle Now next to an item to go to the corresponding risk handling page. There, you can view the risk list and resolve the risk based on the provided details or hardening recommendations.
Note
- The detection features may vary depending on your Security Center edition. The actual UI takes precedence.
- The Risk Governance, Security Response, and Security Protection panels consolidate all items that need to be handled. You can also refer to the categories in the Data Overview's Security operations module and follow the event handling priorities in the security score to address risk alerts promptly.

Customize your security score

By default, Security Center assigns a deduction value to each scoring item. You can customize these values based on your business priorities.

In the upper-right corner of the Security Score module, click Custom Security Score.
In the Custom Security Score panel, set the deduction value for each item, and then click OK.
- Scoring modules include Core Feature Configurations, Unhandled Alerts, and Unfixed Vulnerabilities. The deduction threshold for each module can be set from 0 to 100, and the sum of all module thresholds cannot exceed 100.
- Each module contains individual deduction items. The deduction value for each item can range from 0 to the module's deduction threshold. The sum of the deduction values for all items within a module cannot exceed that module's threshold.
Note
If you have previously modified and saved your security score settings, the Custom Security Score panel will display a Restore to Default Settings option. Click it to restore the deduction values to the system defaults.

Security visualization screen

The Security Visualization Screen displays security and attack data on a large screen, providing a comprehensive view of your network security posture. It helps you stay informed, quickly identify and resolve security issues, and improve management efficiency.

Enable the security dashboard

Log on to the Security Center console.
In the left-side navigation pane, click Overview. On the Overview page, click the Security Dashboard tab.
If you are using the Security Visualization Screen for the first time, click Buy Now.
On the Order Upgrade page, in the Security Dashboard section, select Yes, and then click Order Now and complete the payment.

Configure the security dashboard

We recommend using the latest version of Chrome to access the Security Visualization Screen.

Note

After configuring logon-free access, you can use the logon-free URL to quickly access the Security Visualization Screen. For more information, see Set up logon-free access.

On the Security Dashboard tab, hover over the Security Dashboard area and click Direct Access to enter the dashboard.
(Optional) Select the data to display and configure the dashboard information.
1. In the upper-right corner of the Security Visualization Screen page, click the icon.
2. On the Container Image Signing tab, set the title text, title image, and other information to display on the screen.
3. To change the data displayed in a module, click Select Data. On the Select Data tab, choose the data category, business components, and time range to display.
4. At the top of the page, click Save Settings.

Set up logon-free access

After configuring logon-free access, you can use a logon-free URL to quickly access the Security Visualization Screen.

Note

You still need to log on to your Alibaba Cloud account before using the logon-free URL to access the dashboard.

Log on to the Security Center console.
In the left-side navigation pane, click Overview. On the Overview page, click the Security Dashboard tab.
On the Security Dashboard tab, hover over the Security Dashboard area and click Logon-free Configuration.
If you are using this for the first time, you need to grant permissions. Follow the on-screen prompts to complete the authorization.
In the Logon-free Configuration dialog box, on the Create Logon-free URL tab, set the validity period in days and click Obtain Token.
Once successful, Security Center automatically generates a logon-free token and a logon-free dashboard URL. You can use this URL to directly access the Security Visualization Screen.

Note
You can create up to five logon-free URLs. In the Logon-free Configuration dialog box, on the Existing Logon-free Tokens tab, you can view existing tokens, access the dashboard directly via the logon-free URLs, and delete tokens.

Customize the dashboard

The Security Visualization Screen supports custom scenarios to meet diverse business requirements. You can create multiple dashboard scenarios based on your needs.

In the upper-right corner of the Security Visualization Screen page, click the icon.
On the Scenario List page, click Add Scenario.
On theContent Configurationtab, set information such as the title text and title image to be displayed on the dashboard.
On the module for which you want to modify the display data on the dashboard, clickSelect Data, and then in theSelect Datatab to select the data category, business component, and time range to display.
At the top of the page, click Save Settings.
After adding a scenario, it is enabled by default. If you need to display a different scenario, go to the Existing Logon-free Tokens page, find the desired scenario, and click Enable Now.

FAQ

Event handling priority

The following table lists the priority for handling events that affect your security score. A lower number indicates a higher priority, with 1 being the highest.

Priority	Event
1	Key features are configured or enabled, including: Enable web tamper proofing. Configure brute-force protection rules. Authorize one-click installation of the Security Center agent. Authorize Cloud Security Posture Management (CSPM). Enable log analysis. Enable malicious host behavior defense. Create an anti-ransomware policy. Enable periodic scanning for virus detection. Configure the scope for container image security scanning. Enable container Kubernetes threat detection.
2	Handle AccessKey pair leak events.
3	Address cloud platform configuration risks.
4	Remediate baseline check issues.
5	Handle security alerts.
6	Fix vulnerabilities.

Vulnerability attention level and security score

If you want to focus on high- and medium-risk vulnerabilities and have the security score calculation ignore low-risk ones, follow these steps.

Go to the Risk Governance > Vulnerabilities page and click Vulnerability Settings in the upper-right corner. In the Vulnerability Settings panel, set the Vulnerability Scan Level. For more information, see Scan for vulnerabilities.

Baseline attention level and security score

If you want to focus on high- and medium-risk baselines and have the security score calculation ignore low-risk ones, follow these steps.

Go to the Risk Governance > CSPM page and click Policy Management in the upper-right corner. On the Baseline Check Policy tab, select the Baseline Check Level. For more information, see Baseline checks.