Use agentless detection

Enable the service

1. Enable the service

   1. Log on to the Security Center console. In the top navigation bar, select the region where your assets are located: Chinese Mainland or Outside Chinese Mainland.

   2. In the navigation pane on the left, choose Protection Configuration > Host Protection > Agentless Detection. On the page that appears, click Activate Now and review the related agreements.

      Important

      Agentless detection uses a pay-as-you-go billing method.

2. Complete service authorization (for first-time users)

   The first time you use this feature, you are prompted to authorize a service role. Click Authorize Now.

   Note

   After you grant the authorization, Security Center automatically creates the service-linked roles AliyunServiceRoleForSas and AliyunServiceRoleForSasAgentless. These roles are described in Security Center service-linked role.

3. Authorize agentless detection for Alibaba Cloud ECS encrypted disks (for first-time users)

   If your ECS instances use encrypted disks (encrypted system disks or data disks) and you want to perform agentless detection security scans on them, complete the authorization by following the instructions in Authorize Agentless detection for ECS encrypted disks.

Create and run a detection task

Manage detection tasks

Analyze and handle risks

After a task completes, view and handle detected risks on the Agentless Detection page.

1. View risk details

   On the Agentless Detection page, go to the tab for the detection policy, such as Server Check, and then the tab for the risk type, such as Vul Risk. In the list, find the risk item and click View or Details in the Actions column to view its details.

2. Handle risk alerts

   Vulnerabilities

   • Operation: Locate the target vulnerability and click Add to Whitelist in the Actions column.

     Warning

     Agentless detection does not support vulnerability fixing.

   • Supported actions: Add to whitelist.

     Important

     • Whitelisting a vulnerability prevents future alerts for it. Use with caution.

     • After you add an entry to the whitelist, the system automatically syncs the entry to the Scan Configuration > Manage Whitelist > Vulnerability Whitelist tab, where you can view it.

   Baseline checks

   • Operation: In the check item list, locate the check item that requires handling and click Add to Whitelist in the Actions column.

   • Supported actions: Add to whitelist.

     Important

     • After you add a check item to the whitelist, new servers will no longer be scanned for this item. Use this feature with caution.

     • After you add an item to the whitelist, the system automatically syncs the configuration to the Scan Configuration > Manage Whitelist > Baseline Whitelist tab, where you can view the added whitelist items.

   Malicious samples

   • Operation: In the alert list, locate the alert item that you want to handle and click Change Status or Handle in the Actions column.

   • Supported actions:

     • Add to Whitelist: If you confirm that an alert does not involve malicious behavior, you can add the alert to the whitelist based on the whitelist rule and its application scope.

       Important

       • If you whitelist an alert, future occurrences are automatically moved to the handled list without notifications. Use with caution.

       • You can handle identical alerts in batches. The supported actions vary based on the alert type. For more information, see the console page.

       • After you add an entry to the whitelist, the system automatically syncs it to the Scan Configuration > Manage Whitelist > Malicious Sample Whitelist tab, where you can view the added whitelist entries.

     • Manually Handled: If you have handled the risk offline, you can mark the alert as Manually Handled.

     • Mark as False Positive: You can mark this alert as a false positive. Security Center uses your feedback to continuously optimize its scanning capabilities.

     • Ignore: Ignores only the current alert. If the system detects the issue again, it will generate another alert.

   Sensitive files

   • Operation:

     1. In the sensitive file alert list, locate the alert that you want to process and click Details in the Actions column to view the detailed description and reinforcement suggestions.

     2. In the Actions column of the threat list on the Details panel, click Handle, select a method to handle the alert in the dialog box, and click OK.

   • Supported actions:

     • Add to Whitelist: If you confirm that an alert is not malicious, you can add it to the whitelist based on whitelist rules. The following rules apply:

       Important

       • If you whitelist an alert, future occurrences are automatically moved to the handled list without notifications. Use with caution.

       • You can configure multiple rules. All rules are combined with a logical AND. This means an alert is added to the whitelist only if it meets all rule conditions.

       • After an entry is added to the whitelist, it is automatically synced to the Scan Configuration > Manage Whitelist > Sensitive File Whitelist tab, where you can view the added entries.

       • MD5: The wildcard character supports only equals. Then, enter the file's MD5 hash.

       • Path: The wildcard character supports contains, starts with, and ends with. Then, enter the specific path.

     • Manually Handled: If you have handled the risk offline that caused this alert, you can mark this alert as Manually Handled.

     • Mark as False Positive: You can mark this alert as a false positive. Security Center uses your feedback to continuously optimize its scanning capabilities.

     • Ignore: Ignores only the current alert. If the issue is detected again and hits the detection policy, an alert is still generated.

Configure whitelists

1. On the Agentless Detection page, click Scan Configuration, and go to the Manage Whitelist tab.

2. Based on the threat type, click Create Rule under the corresponding tab.

3. Configure the whitelist rule as described below.

   Important

   The following whitelist configurations are effective for all assets.

   Vulnerability Whitelist

   • Vulnerability Type: Linux Software Vulnerability, Windows System Vulnerability, or Application Vulnerability.

   • Vulnerability Name: Retrieves the latest vulnerability data based on the selected Vulnerability Type.

   Malicious Sample Whitelist

   • Alert Name: defaults to ALL, which means the whitelist rule applies to all alert types. This field cannot be modified.

   • Allowlist Field: The default value is fileMd5, which matches files by their MD5 hash. This field cannot be modified.

   • Wildcard Character: Only Equals is supported.

   • Rule Content: The MD5 hash of the file.

   Baseline Whitelist

   • Check Item Type: Specifies the baseline check items to ignore.

   • Check Item: Retrieves the specific check items based on the selected Check Item Type.

   Sensitive File Whitelist

   • Check Item for Sensitive Files: Specify the items that do not need to be scanned.

   • Configure Whitelist Conditions:

     Note

     You can configure multiple rules. All rules are combined with a logical AND. This means an alert is added to the whitelist only if it meets all rule conditions.

     • MD5: The wildcard character supports only equals. Then, enter the file's MD5 hash.

     • Path: The wildcard character supports contains, starts with, and ends with. Then, enter the specific path.

Connect and scan multicloud assets

Connect to Amazon Web Services (AWS) or Azure for agentless detection:

Going live

• Performance impact: Scanning does not consume resources on the target server.

• Cost control: Fees for the agentless detection feature consist of scanning fees and snapshot/image storage fees. To control costs, when you create a task and configure the Snapshot/Image Storage Time setting, select the Retain Only At-risk Snapshots or Images option. You can also periodically delete snapshots that are no longer needed.

Quotas and limits

• Disk specifications: A single cloud disk supports a maximum of 1 TiB. A maximum of 20,000,000 files can be scanned on a single disk. Any files beyond this limit will not be scanned.

• Server limits: Each server supports scanning a maximum of 15 cloud disks. Any disks beyond this limit will not be scanned.

• Result retention: Detection results are retained for 30 days and automatically cleared upon expiration. For multiple scans of the same asset, only the most recent results are retained.

• Remediation capability: This feature supports only detection and alerting, not automatic remediation. Handle risk items based on the risk details page.

• Compressed file limits: Only JAR files are supported. Only the first layer is decompressed for scanning.

• File system limits: ext2, ext3, ext4, XFS, and NTFS are supported. For NTFS, check items that rely on file permission information are not supported.

• Storage and disk limits: For all hosts (Alibaba Cloud and non-Alibaba Cloud), scanning data disks that use LVM, RAID arrays, or the ReFS file system is not supported.

Billing

The fees generated using the agentless detection feature are as follows:

• Agentless detection scan fee

  • Billing method: Pay-as-you-go.

  • Billing cycle: Daily.

  • Unit price: CNY 0.2/GB.

  • Billable usage: Calculated based on the actual data volume of the scanned snapshots or images, not the total disk capacity.

• ECS resource usage fees

  Important

  We recommend that when you configure host detection tasks, you select Retain Only At-risk Snapshots or Images. The system then automatically deletes risk-free snapshots or images after the scan to reduce storage costs. For the specific procedure, see Retention time configuration.

  • Snapshot fees: You are charged for the snapshots created and retained during the detection process based on their usage capacity and duration. These fees are charged by ECS. For more information, see Snapshot billing.

  • Image fees: The detection task creates an image for the server. You are charged for the image based on its usage capacity and duration. These fees are charged by ECS. For more information, see Image billing.

  • Encrypted disk scanning resource fees: To scan ECS encrypted disks, we create the following resources in your account for each scan. Some resources incur a small fee and are released immediately after the scan completes.

    • ECS instance: When you select Service Key encryption for the ECS encrypted disks to be scanned, we create a preemptive ECS instance for encrypted disk scanning. These fees are charged by ECS. For more information, see Instance type billing.

    • VPC instance: A Virtual Private Cloud (VPC) instance named alibaba-cloud-security-scan-vpc. Creating this instance does not incur any fees.

    • vSwitch instance: A vSwitch instance named alibaba-cloud-security-scan-subnet. Creating this instance does not incur any fees.

FAQ

• What is the difference between agentless detection and anti-virus scanning?

  Comparison Item	Agentless Detection	Anti-virus Scanning
  Working mode	Scans offline snapshots, static analysis	Online real-time monitoring and scanning, dynamic + static analysis
  Server status	Can scan both running and stopped servers	Can only scan running servers with an online agent
  Detection scope	Vulnerabilities, baselines, malicious samples, sensitive files.	Viruses, webshells, intrusive behaviors, vulnerabilities, etc.
  Response capability	Supports detection, alerting, and whitelisting. Does not provide remediation.	Provides one-click isolation, quarantine, and remediation capabilities.
  Performance impact	None.	Slight (agent consumes a small amount of system resources).
  Billing model	Pay-as-you-go (per GB scanned)	Subscription (Anti-virus Edition and higher) or pay-as-you-go.
  Scan mode	Supports full disk scans.	Supports quick scans and custom directory scans.

• Can agentless detection automatically fix all risks?

  No. Agentless detection supports only detection, alerting, whitelisting, and ignoring. Handle risk items based on the instructions on the risk details page.

  Note

  Prioritize handling high-risk vulnerabilities and malware. Baseline optimizations can be implemented as needed.

• How can I use advanced detection features for non-Alibaba Cloud servers?

  Agentless detection supports connecting to Alibaba Cloud ECS, AWS EC2, and Azure servers.

  Important

  • Azure is supported for detection only in regions Outside Chinese Mainland. For more information, see Access and detect multicloud assets.

  • For servers from other cloud providers or in on-premises data centers, we recommend that you install the Security Center agent and purchase the Anti-virus Edition or a higher edition to obtain comprehensive security protection. For specific steps, see Purchase and Unsubscribe from Security Center and Install the agent.

• Why do some agentless detection alerts not display the asset IP address?

  When you use agentless detection, if the asset IP address is empty, the possible reasons are as follows:

  • The instance has been released

    When the instance that corresponds to an alert is released, Security Center can no longer retrieve the instance's IP information because the instance no longer exists.

  • Data cleanup mechanism

    Security Center may clean up records of released instances, which makes the related information unavailable.

Appendix