Specifications of Different Editions
HSS provides Basic, Professional, Enterprise, Premium, Web Tamper Protection, and Container editions. It provides the following functions: Overview, Asset Overview, Host Management, Container Management, Asset Fingerprint, Vulnerability Management, Baseline Check, Container Image Security, Application Protection, Web Tamper Protection, Ransomware Protection, File Integrity Management, Virus Scanning, Container Firewall, Application Process Control, Container Cluster Protection, Host Intrusion Detection, Container Intrusion Detection, Whitelist Management, Policy Management, Historical Handling Records, Security Reports, and Security Configurations. The functions supported by each edition are different. You can select a proper edition based on your service requirements.
- To protect test servers or individual users' servers, use the basic edition. It can protect any number of servers, but only part of the security scan capabilities are available. This edition does not provide protection capabilities, nor does it provide support for DJCP Multi-level Protection Scheme (MLPS) certification. For a server that uses the basic edition for the first time, this edition is free of charge for 30 days.
- If you need to obtain the DJCP MLPS L2 certification, purchase the enterprise edition.
- If you need to obtain the DJCP MLPS L3 certification, purchase the premium edition.
- If you need to obtain the DJCP MLPS certification for a website, you are advised to purchase the Web Tamper Protection edition.
- For servers that need to protect websites and key systems from tampering, the WTP edition is recommended.
- For containers that need to enhance image security, container runtime security, and to comply with security regulations, container edition is recommended.
- If your servers store important data assets, have high security risks, use publicly available EIPs, or there are databases running on your servers, you are advised to use the premium or Web Tamper Protection edition.
- You are advised to deploy HSS on all your servers so that if a virus infects one of them, it will not be able to spread to others and damage your entire network.
- After you purchase a protection quota edition, you can upgrade or switch the edition. For details, see Upgrading Protection Quotas and Switching the HSS Quota Edition.
- The meanings of the symbols in the table are as follows:
- √: supported
- ×: not supported
Dashboard
Dashboard displays the overall security score and protection configuration of assets on the cloud, helping you learn about asset security status.
Function |
Description |
Basic Edition |
Professional Edition |
Enterprise Edition |
Premium Edition |
WTP Edition |
Container Edition |
Supported OSs |
Check Frequency |
---|---|---|---|---|---|---|---|---|---|
Dashboard |
You can check the security score, risks, and protection overview of all your assets in real time, including servers and containers. |
√ |
√ |
√ |
√ |
√ |
√ |
Linux and Windows |
Real-time check |
Assets
Asset Management displays the asset status and their statistics.
Function |
Description |
Basic Edition |
Professional Edition |
Enterprise Edition |
Premium Edition |
WTP Edition |
Container Edition |
Supported OSs |
Check Frequency |
---|---|---|---|---|---|---|---|---|---|
Assets |
Collect statistics on asset status and usage of all servers, including the agent status, protection status, quota status, and asset fingerprint. |
√ |
√ |
√ |
√ |
√ |
√ |
Linux and Windows |
Real-time check |
Servers & Quota
Server management allows users to view and manage target servers by server.
Function |
Description |
Basic Edition |
Professional Edition |
Enterprise Edition |
Premium Edition |
WTP Edition |
Container Edition |
Supported OSs |
---|---|---|---|---|---|---|---|---|
Servers & Quota |
Manage all server assets, including their protection statuses, quotas, and policies. You can install agents on all the Linux servers in batches. |
√ |
√ |
√ |
√ |
√ |
√ |
Linux and Windows Note: Only Linux agents can be installed in batches. |
Containers & Quota
Container management allows you to view and manage target servers by container.
Function |
Description |
Basic Edition |
Professional Edition |
Enterprise Edition |
Premium Edition |
WTP Edition |
Container Edition |
Supported OSs |
---|---|---|---|---|---|---|---|---|
Containers & Quota |
Manage container nodes and images (private image repositories and local images). |
× |
× |
× |
× |
× |
√ |
Linux |
Asset Fingerprints
The function collects and displays statistics of Server fingerprints and Container fingerprints.
Function |
Description |
Basic Edition |
Professional Edition |
Enterprise Edition |
Premium Edition |
WTP Edition |
Container Edition |
Supported OSs |
Check Frequency |
---|---|---|---|---|---|---|---|---|---|
Account |
Check and manage server accounts all in one place. |
× |
× |
√ |
√ |
√ |
√ |
Linux and Windows |
Automatic check every hour |
Open ports |
Check open ports all in one place and identify high-risk and unknown ports. |
× |
× |
√ |
√ |
√ |
√ |
Linux and Windows |
Automated check every 30 seconds |
Process |
Check running applications all in one place and identify malicious applications. |
× |
× |
√ |
√ |
√ |
√ |
Linux and Windows |
Automatic check every hour |
Installed software |
Check and manage server software all in one place and identify insecure versions. |
× |
× |
√ |
√ |
√ |
√ |
Linux and Windows |
Automatic check every day |
Auto-started items |
Check auto-startup entries and collect statistics on entry changes in a timely manner. |
× |
× |
√ |
√ |
√ |
√ |
Linux and Windows |
Automatic check every hour |
Web application |
You can check details about software used for web content push and release, including versions, paths, configuration files, and associated processes of all software. |
× |
× |
√ |
√ |
√ |
√ |
Linux and Windows (only Tomcat is supported) |
Once a week (04:10 a.m. every Monday) |
Web service |
You can check details about the software used for web content access, including versions, paths, configuration files, and associated processes of all software. |
× |
× |
√ |
√ |
√ |
√ |
Linux |
Once a week (04:10 a.m. every Monday) |
Web frameworks |
You can check statistics about frameworks used for web content presentation, including their versions, paths, and associated processes. |
× |
× |
√ |
√ |
√ |
√ |
Linux |
Once a week (04:10 a.m. every Monday) |
Website |
Check statistics about web directories and sites that can be accessed from the Internet. You can view the directories and permissions, access paths, external ports, and key processes of websites. |
× |
× |
√ |
√ |
√ |
√ |
Linux |
Once a week (04:10 a.m. every Monday) |
Middleware |
You can also check information about servers, versions, paths, and processes associated with middleware. |
× |
× |
√ |
√ |
√ |
√ |
Linux and Windows |
Once a week (04:10 a.m. every Monday) |
Database |
You can check details about software that provides data storage, including versions, paths, configuration files, and associated processes of all software. |
× |
× |
√ |
√ |
√ |
√ |
Linux and Windows (only MySQL is supported) |
Once a week (04:10 a.m. every Monday) |
Vulnerability Management
Vulnerability management detects Linux software vulnerabilities, Windows system vulnerabilities, Web-CMS vulnerabilities, application vulnerabilities and emergency vulnerabilities, helping users identify potential risks.
Function |
Description |
Basic Edition |
Professional Edition |
Enterprise Edition |
Premium Edition |
WTP Edition |
Container Edition |
Supported OSs |
Check Frequency |
---|---|---|---|---|---|---|---|---|---|
Linux vulnerability detection |
Based on the vulnerability database, check and handle vulnerabilities in the software (such as kernel, OpenSSL, vim, glibc) you obtained from official Linux sources and have not compiled. |
√ |
√ |
√ |
√ |
√ |
√ |
Linux |
|
Windows vulnerability detection |
Detect vulnerabilities in Windows OS based on the official patch releases of Microsoft. |
√ |
√ |
√ |
√ |
√ |
× |
Windows |
|
Web-CMS vulnerability detection |
Scan for Web-CMS vulnerabilities in web directories and files. |
× |
√ |
√ |
√ |
√ |
√ |
Linux and Windows |
|
Application vulnerability detection |
Detect vulnerabilities in JAR packages, ELF files, and other files of open source software, such as Log4j and spring-core. |
× |
× |
√ |
√ |
√ |
√ |
Linux and Windows |
|
Emergency vulnerability detection |
Checks whether the software and any dependencies running on the server have vulnerabilities through version comparison and POC verification. Reports risky vulnerabilities to the console and provides vulnerability alarms for you. |
× |
√ |
√ |
√ |
√ |
√ |
Linux |
|
Baseline Inspection
Baseline inspection can scan risky configurations, weak passwords, and password complexity policies of server systems and key software. The supported detection baselines include security practices and DJCP MLPS compliance baseline. You can customize sub-baseline items and fix vulnerability risks.
Function |
Description |
Basic Edition |
Professional Edition |
Enterprise Edition |
Premium Edition |
WTP Edition |
Container Edition |
Supported OSs |
Check Frequency |
---|---|---|---|---|---|---|---|---|---|
Password complexity policies |
Check password complexity policies and modify them based on suggestions provided by HSS to improve password security. |
√ |
√ |
√ |
√ |
√ |
√ |
Linux |
|
Common weak passwords |
Change weak passwords to stronger ones based on HSS scan results and suggestions. |
√ |
√ |
√ |
√ |
√ |
√ |
Linux and Windows |
|
Unsafe configuration |
Check the unsafe Tomcat, Nginx, and SSH login configurations found by HSS. |
× |
× |
√ |
√ |
√ |
√ |
Linux and Windows |
|
Container Image Security
Container image security allows you to scan the image repository and running container images, detect vulnerabilities and malicious files in the images, and provide repair suggestions, helping you obtain secure images.
Function |
Description |
Basic Edition |
Professional Edition |
Enterprise Edition |
Premium Edition |
WTP Edition |
Container Edition |
Supported OSs |
Check Frequency |
---|---|---|---|---|---|---|---|---|---|
SWR image repository vulnerabilities |
Detect system and application vulnerabilities in SWR image repository based on a vulnerability database and handle critical vulnerabilities in a timely manner. |
× |
× |
× |
× |
× |
√ |
Linux |
|
Viewing Malicious File Detection Results |
Scan images for malicious files (such as Trojans, worms, viruses, and adware) and identify risks. |
× |
× |
× |
× |
× |
√ |
Linux |
Real-time check |
Application protection
Application protection provides security defense for running applications. you simply need to add probes to them, without having to modify application files. Currently, only Linux servers are supported, and only Java applications can be connected.
Function |
Description |
Basic Edition |
Professional Edition |
Enterprise Edition |
Premium Edition |
WTP Edition |
Container Edition |
Supported OSs |
Check Frequency |
---|---|---|---|---|---|---|---|---|---|
SQL injection |
Detect and defend against SQL injection attacks, and check web applications for related vulnerabilities. |
× |
× |
× |
√ |
√ |
√ |
Linux |
Real-time check |
OS command injection |
Detect and defend against remote OS command injection attacks and check web applications for related vulnerabilities. |
× |
× |
× |
√ |
√ |
√ |
Linux |
Real-time check |
XSS |
Detect and defend against stored cross-site scripting (XSS) injection attacks. |
× |
× |
× |
√ |
√ |
√ |
Linux |
Real-time check |
Log4jRCE vulnerability |
Detect and defend against remote code execution. |
× |
× |
× |
√ |
√ |
√ |
Linux |
Real-time check |
Web shell upload |
Detect and defend against attacks that upload dangerous files, change file names, or change file name extension types; and check web applications for related vulnerabilities. |
× |
× |
× |
√ |
√ |
√ |
Linux |
Real-time check |
XML External Entity Injection |
Detect and defend against XML External Entity Injection (XXE) attacks, and check web applications for related vulnerabilities. |
× |
× |
× |
√ |
√ |
√ |
Linux |
Real-time check |
Deserialization input |
Detect deserialization attacks that exploit unsafe classes. |
× |
× |
× |
√ |
√ |
√ |
Linux |
Real-time check |
File directory traversal |
Check whether sensitive directories or files are accessed. |
× |
× |
× |
√ |
√ |
√ |
Linux |
Real-time check |
Struts2 OGNL |
Detect OGNL code execution. |
× |
× |
× |
√ |
√ |
√ |
Linux |
Real-time check |
Command execution using JSP |
Detect command execution using JSP. |
× |
× |
× |
√ |
√ |
√ |
Linux |
Real-time check |
File deletion using JSP |
Detects file deletion using JSP. |
× |
× |
× |
√ |
√ |
√ |
Linux |
Real-time check |
Database connection exception |
Detect authentication and communication exceptions thrown by database connections. |
× |
× |
× |
√ |
√ |
√ |
Linux |
Real-time check |
0-day vulnerability |
Check whether the stack hash of a command is in the whitelist of the web application. |
× |
× |
× |
√ |
√ |
√ |
Linux |
Real-time check |
SecurityManager permission exception |
Detect exceptions thrown by SecurityManager. |
× |
× |
× |
√ |
√ |
√ |
Linux |
Real-time check |
Web Tamper Protection (WTP)
WTP can detect and prevent tampering of files in specified directories, including web pages, documents, and images, and quickly restore them using valid backup files.
Function |
Description |
Basic Edition |
Professional Edition |
Enterprise Edition |
Premium Edition |
WTP Edition |
Container Edition |
Supported OSs |
Check Frequency |
---|---|---|---|---|---|---|---|---|---|
Static WTP |
Protect the static web page files on website servers from being tampered with. |
× |
× |
× |
× |
√ |
× |
Linux and Windows |
Real-time check |
Dynamic WTP |
Provide dynamic web tamper protection for Tomcat. Protect the dynamic web pages in website databases from being tampered with. |
× |
× |
× |
× |
√ |
× |
Linux |
Real-time check |
Ransomware prevention
Ransomware protection supports user-defined ransomware backup and restoration policies. Help you identify some unknown ransomware attacks by using static and dynamic honeypot files.
Function |
Description |
Basic Edition |
Professional Edition |
Enterprise Edition |
Premium Edition |
WTP Edition |
Container Edition |
Supported OSs |
Check Frequency |
---|---|---|---|---|---|---|---|---|---|
Ransomware prevention |
Help you identify some unknown ransomware attacks by using static and dynamic honeypot files. |
× |
× |
× |
√ |
√ |
√ |
Linux and Windows |
Real-time check |
Application Process Control
Application process control can detect malicious processes and generate alarms.
Function |
Description |
Basic Edition |
Professional Edition |
Enterprise Edition |
Premium Edition |
WTP Edition |
Container Edition |
Supported OSs |
Check Frequency |
---|---|---|---|---|---|---|---|---|---|
Application Process Control |
Learn the characteristics of application processes on servers and manage their running. Suspicious and trusted processes are allowed to run, and alarms are generated for malicious processes. |
× |
× |
× |
√ |
√ |
√ |
Linux and Windows |
Real-time check |
Checking File Integrity
File integrity management checks and records changes to key files.
Function |
Description |
Basic Edition |
Professional Edition |
Enterprise Edition |
Premium Edition |
WTP Edition |
Container Edition |
Supported OSs |
Check Frequency |
---|---|---|---|---|---|---|---|---|---|
Monitor file integrity |
Check the files in the Linux OS, applications, and other components to detect tampering. |
× |
× |
× |
√ |
√ |
√ |
Linux |
Real-time check |
Virus Scan
Virus scan can detect virus files on the server, helping users eliminate potential malicious threats.
Function |
Description |
Basic Edition |
Professional Edition |
Enterprise Edition |
Premium Edition |
WTP Edition |
Container Edition |
Supported OSs |
---|---|---|---|---|---|---|---|---|
Virus scan |
The function uses the virus detection engine to scan virus files on the server. The scanned file types include executable files, compressed files, script files, documents, images, and audio and video files. Users can perform quick scan and full-disk scan on the server as required. Customize scan tasks and handle detected virus files in a timely manner to enhance the virus defense capability of the service system. |
× |
√ (Only quick scan is supported.) |
√ |
√ |
√ |
√ |
Linux and Windows |
Container Firewalls
Container firewalls provides services for container runtime.
Function |
Description |
Basic Edition |
Professional Edition |
Enterprise Edition |
Premium Edition |
WTP Edition |
Container Edition |
Supported OSs |
Check Frequency |
---|---|---|---|---|---|---|---|---|---|
Container Firewalls |
Control and intercept network traffic inside and outside a container cluster to prevent malicious access and attacks. |
× |
× |
× |
× |
× |
√ |
Linux |
Real-time check |
Container Cluster Protection
Container cluster protection can detect non-compliant baselines issues, vulnerabilities, and malicious files in images to prevent insecure container images from being deployed in clusters.
Function |
Description |
Basic Edition |
Professional Edition |
Enterprise Edition |
Premium Edition |
WTP Edition |
Container Edition |
Supported OSs |
Check Frequency |
---|---|---|---|---|---|---|---|---|---|
Container cluster protection |
Check for non-compliance baseline issues, vulnerabilities, and malicious files when a container image is started and report alarms on or block container startup that has not been unauthorized or may incur high risks. |
× |
× |
× |
× |
× |
√ |
Linux |
Real-time check |
Intrusion detection
Server intrusion detection identifies and prevents intrusion to servers, discover risks in real time, detect and kill malicious programs, and identify web shells and other threats.
Function |
Description |
Basic Edition |
Professional Edition |
Enterprise Edition |
Premium Edition |
WTP Edition |
Container Edition |
Supported OSs |
Check Frequency |
---|---|---|---|---|---|---|---|---|---|
Unclassified malware |
Check and handle detected malicious programs all in one place, including web shells, Trojan, mining software, worms, and viruses. |
× |
√ |
√ |
√ |
√ |
√ |
Linux and Windows |
Real-time check |
Viruses |
Check servers in real time and report alarms for viruses detected on servers. |
× |
√ |
√ |
√ |
√ |
√ |
Linux and Windows |
Real-time check |
Worms |
Detect and kill worms on servers and report alarms. |
× |
√ |
√ |
√ |
√ |
√ |
Linux and Windows |
Real-time check |
Trojans |
Detect programs that are hidden in normal programs and have special functions such as damaging and deleting files, sending passwords, and recording keyboards. If a program is detected, an alarm is reported immediately. |
× |
√ |
√ |
√ |
√ |
√ |
Linux and Windows |
Real-time check |
Botnets |
Detect whether zombie programs that have been spread exist in servers and report alarms immediately after detecting them. |
× |
√ |
√ |
√ |
√ |
√ |
Linux and Windows |
Real-time check |
Backdoors |
Detect web shell attacks in the server system in real time and report alarms immediately after detecting them. |
× |
√ |
√ |
√ |
√ |
√ |
Linux and Windows |
Real-time check |
Rootkits |
Detect server assets and report alarms for suspicious kernel modules, files, and folders. |
× |
√ |
√ |
√ |
√ |
√ |
Linux |
Real-time check |
Ransomware |
Check for ransomware in web pages, software, emails, and storage media. Ransomware can encrypt and control your data assets, such as documents, emails, databases, source code, images, and compressed files, to leverage victim extortion. |
× |
× |
× |
√ |
√ |
√ |
Linux and Windows |
Real-time check |
Hacker tools |
Check whether non-standard tool used to control the server exist and report alarms immediately after detecting them. |
× |
× |
√ |
√ |
√ |
√ |
Linux and Windows |
Real-time check |
Webshell |
Check whether the files (often PHP and JSP files) detected by HSS in your web directories are web shells.
|
× |
√ |
√ |
√ |
√ |
√ |
Linux and Windows |
Real-time check |
Mining |
Detect whether mining software exists on servers in real time and report alarms for the detected software. |
× |
√ |
√ |
√ |
√ |
√ |
Linux and Windows |
Real-time check |
Remote code execution |
Check whether the server is remotely called in real time and report an alarm immediately once remote code execution is detected. |
× |
× |
√ |
√ |
√ |
√ |
Linux and Windows |
Real-time check |
Redis vulnerability exploits |
Detect the modifications made by the Redis process on key directories in real time and report alarms. |
× |
√ |
√ |
√ |
√ |
√ |
Linux |
Real-time check |
Hadoop vulnerability exploits |
Detect the modifications made by the Hadoop process on key directories in real time and report alarms. |
× |
√ |
√ |
√ |
√ |
√ |
Linux |
Real-time check |
MySQL vulnerability exploits |
Detect the modifications made by the MySQL process on key directories in real time and report alarms. |
× |
√ |
√ |
√ |
√ |
√ |
Linux |
Real-time check |
Reverse shells |
Monitor user process behaviors in real time to detect and block reverse shells caused by invalid connections. Reverse shells can be detected for protocols including TCP, UDP, and ICMP.
NOTE:
To enable automatic reverse shell blocking, perform the following operations:
|
× |
√ |
√ |
√ |
√ |
√ |
Linux |
Real-time check |
File privilege escalation |
Check the file privilege escalations in your system. |
× |
√ |
√ |
√ |
√ |
√ |
Linux |
Real-time check |
Process privilege escalations |
The following process privilege escalation operations can be detected:
|
× |
√ |
√ |
√ |
√ |
√ |
Linux |
Real-time check |
Important file changes |
Receive alarms when critical system files are modified. |
× |
√ |
√ |
√ |
√ |
√ |
Linux |
Real-time check |
File/Directory change |
Monitor system files and directories in real time and generate alarms if such files are created, deleted, moved, or if their attributes or content are modified. |
× |
√ |
√ |
√ |
√ |
√ |
Linux and Windows |
Real-time check |
Abnormal process behaviors |
Check the processes on servers, including their IDs, command lines, process paths, and behavior. Send alarms on unauthorized process operations and intrusions. The following abnormal process behavior can be detected:
|
× |
× |
√ |
√ |
√ |
√ |
Linux and Windows |
Real-time check |
High-risk command executions |
Check executed commands in real time and generate alarms if high-risk commands are detected. |
× |
√ |
√ |
√ |
√ |
√ |
Linux and Windows |
Real-time check |
Abnormal shells |
Detect actions on abnormal shells, including moving, copying, and deleting shell files, and modifying the access permissions and hard links of the files. |
× |
√ |
√ |
√ |
√ |
√ |
Linux |
Real-time check |
Suspicious crontab tasks |
Check and list auto-started services, scheduled tasks, pre-loaded dynamic libraries, run registry keys, and startup folders. You can get notified immediately when abnormal automatic auto-start items are detected and quickly locate Trojans. |
× |
× |
× |
√ |
√ |
√ |
Linux and Windows |
Real-time check |
System protection disabling |
Detect the preparations for ransomware encryption: Disable the Windows defender real-time protection function through the registry. Once the function is disabled, an alarm is reported immediately. |
× |
× |
√ |
√ |
√ |
× |
Windows |
Real-time check |
Backup deletion |
Detect the preparations for ransomware encryption: Delete backup files or files in the Backup folder. Once backup deletion is detected, an alarm is reported immediately. |
× |
× |
√ |
√ |
√ |
√ |
Windows |
Real-time check |
Suspicious registry operation |
Detect operations such as disabling the system firewall through the registry and using the ransomware Stop to modify the registry and write specific strings in the registry. An alarm is reported immediately when such operations are detected. |
× |
× |
√ |
√ |
√ |
√ |
Windows |
Real-time check |
System log deletion |
An alarm is generated when a command or tool is used to clear system logs. |
× |
× |
√ |
√ |
√ |
× |
Windows |
Real-time check |
Suspicious command executions |
|
× |
× |
√ |
√ |
√ |
√ |
Linux and Windows |
Real-time check |
Suspicious process execution |
Detect and report alarms on unauthenticated or unauthorized application processes. |
× |
× |
√ |
√ |
√ |
× |
Linux and Windows |
Real-time check |
Suspicious process file access |
Detect and report alarms on the unauthenticated or unauthorized application processes accessing specific directories. |
× |
× |
√ |
√ |
√ |
× |
Linux and Windows |
Real-time check |
Brute-force attacks |
Check for brute-force attack attempts and successful brute-force attacks.
|
√ |
√ |
√ |
√ |
√ |
√ |
Linux and Windows |
Real-time check |
Abnormal logins |
Check and handle remote logins. If a user's login location is not any common login location, an alarm will be triggered. |
√ |
√ |
√ |
√ |
√ |
√ |
Linux and Windows |
Real-time check |
Invalid accounts |
Scan accounts on servers and list suspicious accounts in a timely manner. |
× |
√ |
√ |
√ |
√ |
√ |
Linux and Windows |
Real-time check |
User account added |
Detect the commands used to create hidden accounts. Hidden accounts cannot be found in the user interaction interface or be queried by commands. |
× |
× |
√ |
√ |
√ |
√ |
Windows |
Real-time check |
Password thefts |
Detect the abnormal obtaining of hash value of system accounts and passwords on servers and report alarms. |
× |
× |
√ |
√ |
√ |
√ |
Linux and Windows |
Real-time check |
Abnormal outbound connections |
Report alarms on suspicious IP addresses that initiate outbound connections. |
× |
√ |
√ |
√ |
√ |
√ |
Linux |
Real-time check |
Port forwarding |
Report alarms on port forwarding using suspicious tools. |
× |
√ |
√ |
√ |
√ |
√ |
Linux |
Real-time check |
Suspicious download request |
An alarm is generated when a suspicious HTTP request that uses system tools to download programs is detected. |
× |
× |
√ |
√ |
√ |
× |
Windows |
Real-time check |
Suspicious HTTP request |
An alarm is generated when a suspicious HTTP request that uses a system tool or process to execute a remote hosting script is detected. |
× |
× |
√ |
√ |
√ |
× |
Windows |
Real-time check |
Port scan |
Detect scanning or sniffing on specified ports and report alarms. |
× |
× |
× |
√ |
√ |
√ |
Linux |
Real-time check |
Host scan |
Detect the network scan activities based on server rules (including ICMP, ARP, and nbtscan) and report alarms. |
× |
× |
× |
√ |
√ |
√ |
Linux |
Real-time check |
Container Intrusion Detection
Container intrusion detection can detect intrusion behaviors of Docker and Containerd engines. Scan running containers for malicious programs including miners and ransomware; detect non-compliant security policies, file tampering, and container escape; and provide suggestions.
Function |
Description |
Basic Edition |
Professional Edition |
Enterprise Edition |
Premium Edition |
WTP Edition |
Container Edition |
Supported OSs |
Check Frequency |
---|---|---|---|---|---|---|---|---|---|
Unclassified malware |
Check and handle malicious programs in a container, including web shells, Trojan, mining software, worms, and viruses. |
× |
× |
× |
× |
× |
√ |
Linux |
Real-time check |
Ransomware |
Check and handle alarms on ransomware in containers. |
× |
× |
× |
× |
× |
√ |
Linux |
Real-time check |
Webshell |
Check whether the files (often PHP and JSP files) in the web directories on containers are web shells. |
× |
× |
× |
× |
× |
√ |
Linux |
Real-time check |
Vulnerability escape detection |
An escape alarm is reported if a container process behavior that matches the behavior of known vulnerabilities is detected. |
× |
× |
× |
× |
× |
√ |
Linux |
Real-time check |
File escape detection |
An alarm is reported if a container process is found accessing a key file directory (for example, /etc/shadow or /etc/crontab). Directories that meet the container directory mapping rules can also trigger such alarms. |
× |
× |
× |
× |
× |
√ |
Linux |
Real-time check |
Reverse shells |
Monitor user process behaviors in real time to detect reverse shells caused by invalid connections. Reverse shells can be detected for protocols including TCP, UDP, and ICMP. |
× |
× |
× |
× |
× |
√ |
Linux |
Real-time check |
File privilege escalation |
Check the file privilege escalations in your system. |
× |
√ |
√ |
√ |
√ |
√ |
Linux |
Real-time check |
Process privilege escalations |
The following process privilege escalation operations can be detected:
|
× |
× |
× |
× |
× |
√ |
Linux |
Real-time check |
Important file changes |
Receive alarms when critical system files are modified. |
× |
√ |
√ |
√ |
√ |
√ |
Linux |
Real-time check |
Abnormal process behaviors |
Check the processes on servers, including their IDs, command lines, process paths, and behavior. Send alarms on unauthorized process operations and intrusions. The following abnormal process behavior can be detected:
|
× |
× |
√ |
√ |
√ |
√ |
Linux and Windows |
Real-time check |
Abnormal container processes |
|
× |
× |
× |
× |
× |
√ |
Linux |
Real-time check |
Abnormal container startup detection |
The service monitors container startups and reports an alarm if it detects that a container with too many permissions is started. Container check items include:
|
× |
× |
× |
× |
× |
√ |
Linux |
Real-time check |
High-risk command executions |
Check executed commands in containers and generate alarms if high-risk commands are detected. |
× |
× |
× |
× |
× |
√ |
Linux |
Real-time check |
High-risk system calls |
You can run tasks in kernels by Linux system calls. The container edition reports an alarm if it detects a high-risk call. |
× |
× |
× |
× |
× |
√ |
Linux |
Real-time check |
Sensitive file access detection |
The service monitors the container image files associated with file protection policies, and reports an alarm if the files are modified. |
× |
× |
× |
× |
× |
√ |
Linux |
Real-time check |
Container image blocking |
If a container contains insecure images specified in Suspicious Image Behaviors, an alarm will be generated and the insecure images will be blocked before a container is started in Docker.
NOTE:
You need to install the Docker plug-in. |
× |
× |
× |
× |
× |
√ |
Linux |
Real-time check |
Suspicious command executions |
|
× |
× |
√ |
√ |
√ |
√ |
Linux and Windows |
Real-time check |
Brute-force attacks |
Detect and report alarms for brute-force attack behaviors, such as brute-force attack attempts and successful brute-force attacks, on containers. Detect SSH, web, and Enumdb brute-force attacks on containers.
NOTE:
Currently, brute-force attacks can be detected only in the Docker runtime. |
× |
× |
× |
× |
× |
√ |
Linux |
Real-time check |
Invalid accounts |
Detect suspicious accounts and report alarms. |
× |
× |
× |
× |
× |
√ |
Linux |
Real-time check |
Password thefts |
Detect the abnormal obtaining of hash value of system accounts and passwords on servers and report alarms. |
× |
× |
√ |
√ |
√ |
√ |
Linux and Windows |
Real-time check |
Abnormal outbound connections |
Report alarms on suspicious IP addresses that initiate outbound connections. |
× |
√ |
√ |
√ |
√ |
√ |
Linux |
Real-time check |
Port forwarding |
Report alarms on port forwarding using suspicious tools. |
× |
√ |
√ |
√ |
√ |
√ |
Linux |
Real-time check |
Kubernetes event deletions |
Detect the deletion of Kubernetes events and report alarms. |
× |
× |
× |
× |
× |
√ |
Linux |
Real-time check |
Abnormal pod behaviors |
Detect abnormal operations such as creating privileged pods, static pods, and sensitive pods in a cluster and abnormal operations performed on existing pods and report alarms. |
× |
× |
× |
× |
× |
√ |
Linux |
Real-time check |
User information enumerations |
Detect the operations of enumerating the permissions and executable operation list of cluster users and report alarms. |
× |
× |
× |
× |
× |
√ |
Linux |
Real-time check |
Binding cluster roles |
Detect operations such as binding or creating a high-privilege cluster role or service account and report alarms. |
× |
× |
× |
× |
× |
√ |
Linux |
Real-time check |
Whitelist Management
The whitelist function includes Alarm whitelist, Login whitelist and System user whitelist. To reduce false alarms, import events to and export events from the whitelist.
Function |
Description |
Basic Edition |
Professional Edition |
Enterprise Edition |
Premium Edition |
WTP Edition |
Container Edition |
Supported OSs |
Check Frequency |
---|---|---|---|---|---|---|---|---|---|
Alarm whitelist |
You can add an alarm to the whitelist when handling it. |
√ |
√ |
√ |
√ |
√ |
√ |
Linux and Windows |
Real-time check |
Login Whitelist |
Add IP addresses and usernames to the Login Whitelist as needed. HSS will not report alarms on the access behaviors of these IP addresses and users. |
√ |
√ |
√ |
√ |
√ |
√ |
Linux and Windows |
Real-time check |
System user whitelist |
Users (non-root users) that are newly added to the root user group on a server can be added to the system user whitelist. HSS will not report risky account alarms for them. |
√ |
√ |
√ |
√ |
√ |
√ |
Linux and Windows |
Real-time check |
Policy Management
You can configure Policy management and group policies and servers to batch apply policies to servers, easily adapting to your business scenarios.
Function |
Description |
Basic Edition |
Professional Edition |
Enterprise Edition |
Premium Edition |
WTP Edition |
Container Edition |
Supported OSs |
Check Frequency |
---|---|---|---|---|---|---|---|---|---|
Policy Management |
You can define and issue different detection policies for different servers or server groups, implementing refined security operations.
|
× |
√ (Only the default professional policy group is supported.) |
√ (Only the default enterprise policy group is supported.) |
√ |
√ |
√ |
Linux and Windows |
Real-time check |
Viewing the Handling History
Handling history displays the handling history of vulnerabilities and security alarms.
Function |
Description |
Basic Edition |
Professional Edition |
Enterprise Edition |
Premium Edition |
WTP Edition |
Container Edition |
Supported OSs |
---|---|---|---|---|---|---|---|---|
Handling history |
Check historical vulnerability and alarm handling records, including the handling time and handlers. |
× |
√ |
√ |
√ |
√ |
√ |
Linux and Windows |
Security Report
The HSS can generate Security reports on user assets on a daily, weekly, or monthly basis.
Function |
Description |
Basic Edition |
Professional Edition |
Enterprise Edition |
Premium Edition |
WTP Edition |
Container Edition |
Supported OSs |
---|---|---|---|---|---|---|---|---|
Security Report |
Check weekly or monthly server security trend, key security events, and risks. |
× |
√ |
√ |
√ |
√ |
√ |
Linux and Windows |
Security Configurations
Security configuration allows you to configure common login locations, common login IP addresses, the SSH login IP address whitelist, and automatic isolation and killing of malicious programs.
Function |
Description |
Basic Edition |
Professional Edition |
Enterprise Edition |
Premium Edition |
WTP Edition |
Container Edition |
Supported OSs |
Check Frequency |
---|---|---|---|---|---|---|---|---|---|
Agent management |
You can view the agent status of all servers and upgrade, uninstall, and install agents. |
√ |
√ |
√ |
√ |
√ |
√ |
Linux and Windows |
Real-time check |
Common login location |
For each server, you can configure the locations where users usually log in from. The service will generate alarms on logins originated from locations other than the configured common login locations. A server can be added to multiple login locations. |
√ |
√ |
√ |
√ |
√ |
√ |
Linux and Windows |
Real-time check |
Common login IP address |
For each server, you can configure the IP addresses where users usually log in from. The service will generate alarms on logins originated from IP addresses other than the configured common IP addresses. |
√ |
√ |
√ |
√ |
√ |
√ |
Linux and Windows |
Real-time check |
Configuring an SSH Login IP Address Whitelist |
The SSH login whitelist controls SSH access to servers to prevent account cracking. After you configure the whitelist, SSH logins will be allowed only from whitelisted IP addresses. |
√ |
√ |
√ |
√ |
√ |
√ |
Linux |
Real-time check |
Malicious program isolation and removal |
HSS automatically isolates and kills identified malicious programs, such as web shells, Trojans, and worms, removing security risks. |
× |
√ |
√ |
√ |
√ |
√ |
Linux and Windows |
Real-time check |
Two-factor Authentication (2FA) |
Prevent brute-force attacks by using password and SMS/email authentication. |
Pay per use: × Yearly/Monthly: √ |
√ |
√ |
√ |
√ |
√ |
Linux and Windows |
- |
Alarm configurations |
After alarm notification is enabled, you can receive alarm notifications sent by HSS to learn about security risks facing your servers, containers, and web pages. |
√ |
√ |
√ |
√ |
√ |
√ |
Linux and Windows |
- |
Plug-in management |
Install, uninstall, upgrade, and manage plug-ins in a unified manner. |
× |
× |
× |
× |
× |
√ |
Linux |
- |
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.