Configure and run check policies

How it works

The following diagram shows the workflow for configuring and using custom check items.

Create and publish a custom check item

1. Go to the creation page. Log in to Security Center console - Risk Governance - CSPM. In the top-left corner, select the region where your assets are located: Chinese Mainland or Outside Chinese Mainland. On the Cloud Service Configuration Risk tab, click Create Custom Check Item.

2. Configure basic information. On the Basic Information Settings tab, configure the following parameters and click Next.

   Parameter	Description
   Check Item Category Settings	Assign one or more categories for easier filtering in reports. Click Add to assign multiple categories.
   Use case	The detection scenario category. Select Compliance Risk, AISPM, or Security Risk.
   AISPM	Select a predefined option or enter a custom value.
   Check Item Description	Describe the check item: the service provider, target cloud service, and a brief rule explanation.
   Solution	Manual remediation steps for users when the check detects a risk.
   Help	URL of a related help document. Enter None if unavailable.
   Risk Level	Set the risk level: High, Medium, or Low. For how risk levels are determined, see Assess risk levels.

3. Define check item rules. On the Check Item Rule Settings tab, configure the following and click Next.

   • Check Item Target: Select the type of cloud service to check under the specified service provider, such as ECS-Instance or OSS-Bucket.

   • Associated Asset Settings (Optional): If the check logic involves related assets, click Add Associated Asset to link an asset type (such as a VPC) to the Check Item Target.

     Note

     If the Service Provider list is empty, the selected Check Item Target does not support asset association. Available options depend on what the console displays.

     Configure the following fields when adding an associated asset:

     Field	Description
     Associable Attribute	Property of the Check Item Target used to link to another asset.
     Associated Asset	Asset type to link.
     Associated Asset Property	Property of the associated asset that maps to the Associable Attribute.

   • Check Item Settings: Define the detection logic using conditions.

     Conditions follow AND/OR logic:

     Scope	Rule
     Within a group	Connect conditions with AND or OR. Each group supports up to 10 conditions.
     Between groups	Connect groups with AND or OR. Each check item supports up to 5 groups.

     Example: With three groups and the relationship "group1 AND group2 OR group3" — group1 uses AND internally, group2 uses OR, and group3 uses AND:

     Supported operators:

     Operator	Description
     In / NotIn	Checks whether a value exists in a specified set.
     Equals / NotEquals	Checks whether two values are equal.

     Note: Click the icon next to a parameter to view its data type, examples, and description.

     In the condition configuration area, click Add Condition, then use the multi-level selection panel to navigate the parameter path: first select the resource type (such as ACS_ECS_Instance), then select an attribute (such as PublicIpAddress), expand it, and select the target field under a sub-attribute (such as IpAddress). Set the logical operator to AND and the comparison method to Contains.

     1. Click Add Condition to expand the configuration area.

     2. Click Add Condition or Add Group to build the rule.

4. Test the rule.

   1. Click Test on the Check Item Rule Settings tab.

   2. In the Test area, select a matching instance from your account (such as an OSS bucket, ECS instance, or Log Service project), then click Test.

   3. If the message "This check item has passed." appears, the configuration parses data correctly. If the result is unexpected, review your conditions and test again.

   4. After the result is as expected, click Save.

   Note

   You can edit, publish, or delete a check item that is saved but not yet published.

5. Publish the check item. Click Publish on the Check Item Rule Settings tab. Alternatively, go to the custom check item list and click Publish in the Actions column.

   Important

   Only published check items appear in the check item list and are available for scans. Published check items cannot be modified. To edit a published item, deactivate it first.

Manage custom check items

In the Custom Check Item Management section in the upper-right corner of the CSPM Risk page, view, edit, publish, unpublish, or delete custom check items.

Create a whitelist rule

1. On the Risk Governance > Cloud Service Configuration Risk page, click Policy Management in the upper-right corner.

2. On the Whitelist Policy > By Check Item tab, click Create Whitelist Rule.

3. In the panel, configure the following and click OK:

   Important

   Exempting all instances is a high-risk operation — new security risks on future instances can go undetected. Use Specific Instances for precise whitelisting, and audit your whitelist rules periodically to confirm they are still necessary.

   Parameter	Description
   Check Item	The check items to exclude from scans. See check rules.
   Policy Effective Scope	The scope of the exemption.

   Option	Behavior
   All Instances	Exempts all existing and future instances of this cloud service from the check. Related risks are not displayed in the risk list.
   Specific Instances	Applies the exemption only to the selected instances. New instances are still scanned.

Manage whitelist rules

• Edit or delete rules: Whitelist rules you create appear in the Cloud Service Check Item Whitelist list. Click Edit to modify the scope, or Delete to remove the exemption.

• Automatic synchronization: When you manually mark a failed check item as handled or whitelisted while handling risks, the system automatically adds the corresponding rule to this list. For details, see Handle cloud services that fail check items.