Editions and Features

HSS comes in the enterprise, premium, Web Tamper Protection (WTP), and container security editions, providing asset management, vulnerability management, baseline check, intrusion detection, web tamper protection, and container image security functions. For details about the features of the editions, see Edition Details.

Features

HSS provides asset management, baseline check, and intrusion detection features, enhancing server security in all aspects. For details about the features of different editions, see Edition Details.

**Table 1** HSS functions and features
Feature	Description
Asset management	Provide centralized asset overview, asset fingerprint management, server management, and container management. You can check your asset running status, asset fingerprints, and asset types; and manage assets by server or container.
Vulnerability management	Detect vulnerabilities and risks in Linux, Windows, Web content management systems (Web-CMS), and applications.
Baseline check	Scan for unsafe settings, weak passwords, and password complexity policies in server OS and key software. A security practice baseline and a compliance standard baseline can be used for scans. You can customize baseline sub-items used in scan. You can repair and verify the detected risks.
Container image security	Scan the images that are running or displayed in your image list, and provide suggestions on how to fix vulnerabilities and malicious files.
Application protection	Protect running applications. You simply need to add probes to applications, without having to modify application files. Currently, only Linux servers are supported, and only Java applications can be connected.
Web page tampering prevention	Detect and prevent tampering of files in specified directories, including web pages, documents, and images, and quickly restore them using valid backup files.
File integrity monitoring	Check the files in the Linux OS, applications, and other components to detect tampering.
Intrusion detection	Identify and prevent intrusion to servers, discover risks in real time, detect and kill malicious programs, and identify web shells and other threats.
Container intrusion detection	Scan running containers for malicious programs including miners and ransomware; detect non-compliant security policies, file tampering, and container escape; and provide suggestions.
Whitelist management	To reduce false alarms, import events to and export events from the whitelist. Whitelisted events will not trigger alarms.
Policy management	You can group policies and servers to batch apply policies to servers, easily adapting to your business scenarios.
Handling history	Check historical vulnerability handling records, including the vulnerability handling time and handlers.
Security report	Check weekly or monthly server security trend, key security events, and risks.
Security configuration	Configure common login locations, common login IP addresses, the SSH login IP address whitelist, and automatic isolation and killing of malicious programs.
HSS self-protection	Protect HSS files, processes, and software from malicious programs, which may uninstall HSS agents, tamper with HSS files, or stop HSS processes.

Recommended Editions

If your servers store important data assets, have high security risks, use publicly available EIPs, or there are databases running on your servers, you are advised to enable the premium or Web Tamper Protection edition.
For servers that need to protect websites and applications from tampering, the WTP edition is recommended.
For containers that need to enhance image security, container runtime security, container edition is recommended.
- You are advised to deploy HSS on all your servers so that if a virus infects one of them, it will not be able to spread to others and damage your entire network.

Edition Details

**Table 2** Editions
Function	Item	Description	Enterprise Edition	Premium	WTP	Container Edition	Supported OS	Check Frequency
Assets		Collect statistics on asset status and usage of all servers.	√	√	√	√	Linux and Windows	Real-time check
Servers & Quota		Manage all server assets, including their protection status, quotas, and policy allocation.	√	√	√	√	Linux and Windows	-
Containers & Quota		Manage container nodes and images (private image repositories and local images).	×	×	×	√	Linux	-
Asset Fingerprints	Account	Check and manage server accounts all in one place.	√	√	√	√	Linux and Windows	Real-time check
	Open port	Check open ports all in one place and identify high-risk and unknown ports.	√	√	√	√	Linux and Windows	Real-time check
	Process	Check running applications all in one place and identify malicious applications.	√	√	√	√	Linux and Windows	Real-time check
	Installed software	Check and manage server software all in one place and identify insecure versions.	√	√	√	√	Linux and Windows	Automatic check in the early morning every day
	Auto-startup	Check auto-startup entries and collect statistics on entry changes in a timely manner.	√	√	√	√	Linux and Windows	Real-time check
	Web applications	Check details about software used for web content push and release, including versions, paths, configuration files, and associated processes of all software.	√	√	√	√	Linux and Windows (only Tomcat is supported)	Once a week (05:00 a.m. every Monday)
	Web service	Check details about the software used for web content access, including versions, paths, configuration files, and associated processes of all software.	√	√	√	√	Linux	Once a week (05:00 a.m. every Monday)
	Web framework	Check statistics about frameworks used for web content presentation, including their versions, paths, and associated processes.	√	√	√	√	Linux	Once a week (05:00 a.m. every Monday)
	Website check	Check statistics about web directories and sites that can be accessed from the Internet. You can view the directories and permissions, access paths, external ports, and key processes of websites.	√	√	√	√	Linux	Once a week (05:00 a.m. every Monday)
	Middleware	Check information about servers, versions, paths, and processes associated with middleware.	√	√	√	√	Linux	Once a week (05:00 a.m. every Monday)
	Database	Check details about software that provides data storage, including versions, paths, configuration files, and associated processes of all software.	√	√	√	√	Linux and Windows (only MySQL is supported)	Once a week (05:00 a.m. every Monday)
Vulnerability Management	Linux vulnerability detection	Based on the vulnerability database, check and handle vulnerabilities in the software (such as kernel, OpenSSL, vim, glibc) you obtained from official Linux sources and have not compiled.	√	√	√	√	Linux	Automatic check in the early morning every day Manual scan
	Windows vulnerability detection	Detect vulnerabilities in Windows OS based on the official patch releases of Microsoft.	√	√	√	√	Windows	Automatic check in the early morning every day Manual scan
	Web-CMS vulnerability detection	Scan for Web-CMS vulnerabilities in web directories and files.	√	√	√	√	Linux and Windows	Automatic check in the early morning every day Manual scan
	Application vulnerability detection	Detect vulnerabilities in JAR packages, ELF files, and other files of open source software, such as Log4j and spring-core.	√	√	√	√	Linux and Windows	Once a week (05:00 a.m. every Monday) Manual scan
Unsafe settings check	Password policy check	Check password complexity policies and modify them based on suggestions provided by HSS to improve password security.	√	√	√	√	Linux	Automatic check in the early morning every day Manual scan
	Weak password check	Change weak passwords to stronger ones based on HSS scan results and suggestions.	√	√	√	√	Linux	Automatic check in the early morning every day Manual scan
	Unsafe configurations	Check the unsafe Tomcat, Nginx, and SSH login configurations found by HSS.	√	√	√	√	Linux and Windows	Automatic check in the early morning every day Manual scan
Container image security	Container image vulnerability management	Detect and manage vulnerabilities in local images and private image repositories based on a vulnerability database, and handle critical vulnerabilities in a timely manner.	×	×	×	√	Linux	Automatic check in the early morning every day Manual scan
	Malicious image file detection	Scan images for malicious files (such as Trojans, worms, viruses, and adware) and identify risks.	×	×	×	√	Linux	Real-time check
	Image baseline check	Check for insecure configurations based on 18 types of container baselines.	×	×	×	√	Linux	Real-time check
Application protection	SQL injection	Detect and defend against SQL injection attacks, and check web applications for related vulnerabilities.	×	√	√	√	Linux	Real-time check
	OS command injection	Detect and defend against remote OS command injection attacks and check web applications for related vulnerabilities.	×	√	√	√	Linux	Real-time check
	XSS	Detect and defend against stored cross-site scripting (XSS) injection attacks.	×	√	√	√	Linux	Real-time check
	Log4jRCE vulnerability	Detect and defend against remote code execution.	×	√	√	√	Linux	Real-time check
	Web shell upload	Detect and defend against attacks that upload dangerous files, change file names, or change file name extension types; and check web applications for related vulnerabilities.	×	√	√	√	Linux	Real-time check
	XXE attack	Detect and defend against XML External Entity Injection (XXE) attacks, and check web applications for related vulnerabilities.	×	√	√	√	Linux	Real-time check
	Deserialization input	Detect deserialization attacks that exploit unsafe classes.	×	√	√	√	Linux	Real-time check
	File directory traversal	Check whether sensitive directories or files are accessed.	×	√	√	√	Linux	Real-time check
	Struts2 OGNL	Detect OGNL code execution.	×	√	√	√	Linux	Real-time check
	Command execution using JSP	Detect command execution using JSP.	×	√	√	√	Linux	Real-time checks
	File deletion using JSP	Detects file deletion using JSP.	×	√	√	√	Linux	Real-time check
	Database connection exception	Detect authentication and communication exceptions thrown by database connections.	×	√	√	√	Linux	Real-time check
	0-day vulnerability	Check whether the stack hash of a command is in the whitelist of the web application.	×	√	√	√	Linux	Real-time check
	SecurityManager permission exception	Detect exceptions thrown by SecurityManager.	×	√	√	√	Linux	Real-time check
Web page tampering prevention	Static WTP	Protect the static web page files on your website servers from malicious modification.	×	×	√	×	Linux and Windows	Real-time check
Web page tampering prevention	Dynamic WTP	Protect the dynamic web page files in your website databases from malicious modification.	×	×	√	×	Linux	Real-time check
Ransomware prevention	Ransomware prevention	Help you identify and detect known ransomware attacks and restore services using backups.	×	√	√	√	Linux and Windows	Real-time checks
File integrity monitoring	File Integrity	Check the files in the Linux OS, applications, and other components to detect tampering.	×	√	√	√	Linux	Real-time check
Intrusion detection	Unclassified malware	Check and handle detected malicious programs all in one place, including web shells, Trojan, mining software, worms, and viruses.	√	√	√	√	Linux and Windows	Real-time check
	Virus	Check servers in real time and report alarms for viruses detected on servers.	√	√	√	√	Linux and Windows	Real-time check
	Worm	Detect and kill worms on servers and report alarms.	√	√	√	√	Linux and Windows	Real-time check
	Trojan	Detect programs that are hidden in normal programs and have special functions such as damaging and deleting files, sending passwords, and recording keyboards. If a program is detected, an alarm is reported immediately.	√	√	√	√	Linux and Windows	Real-time check
	Botnet	Detect whether zombie programs that have been spread exist in servers and report alarms immediately after detecting them.	√	√	√	√	Linux and Windows	Real-time check
	Web shell	Detect web shell attacks in the server system in real time and report alarms immediately after detecting them.	√	√	√	√	Linux and Windows	Real-time check
	Rootkit	Detect server assets and report alarms for suspicious kernel modules, files, and folders.	√	√	√	√	Linux	Real-time check
	Ransomware	Check ransomware embedded in media such as web pages, software, emails, and storage media. Ransomware is used to encrypt and control your data assets, such as documents, emails, databases, source code, images, and compressed files, to leverage victim extortion.	×	√	√	√	Linux and Windows	Real-time check
	Hacker tool	Check whether non-standard tool used to control the server exist and report alarms immediately after detecting them.	√	√	√	√	Linux and Windows	Real-time check
	Web shell	Check whether the files (often PHP and JSP files) detected by HSS in your web directories are web shells. Web shell information includes the Trojan file path, status, first discovery time, and last discovery time. You can choose to ignore warning on trusted files. You can use the manual detection function to scan for web shells on servers.	√	√	√	√	Linux and Windows	Real-time check
	Mining	Detect whether mining software exists on servers in real time and report alarms for the detected software.	√	√	√	√	Linux and Windows	Real-time check
	Remote code execution	Check whether the server is remotely called in real time and report an alarm immediately once remote code execution is detected.	√	√	√	√	Linux and Windows	Real-time check
	Reverse shell	Monitor user process behaviors in real time to detect reverse shells caused by invalid connections. Reverse shells can be detected for protocols including TCP, UDP, and ICMP.	√	√	√	√	Linux	Real-time check
	File privilege escalation	Check the file privilege escalations in your system.	√	√	√	√	Linux	Real-time check
	Process privilege escalation	The following process privilege escalation operations can be detected: Root privilege escalation by exploiting SUID program vulnerabilities Root privilege escalation by exploiting kernel vulnerabilities	√	√	√	√	Linux	Real-time check
	Change in critical file	Receive alarms when critical system files are modified.	√	√	√	√	Linux and Windows	Real-time check
	File/Directory change	System files and directories are monitored. If a file or directory is modified, an alarm is generated, indicating that the file or directory may be tampered with.	√	√	√	√	Linux and Windows	Real-time check
	Abnormal process behavior	Check the processes on servers, including their IDs, command lines, process paths, and behavior. Send alarms on unauthorized process operations and intrusions. The following abnormal process behavior can be detected: Abnormal CPU usage Processes accessing malicious IP addresses Abnormal increase in concurrent process connections	√	√	√	√	Linux and Windows	Real-time check
	High-risk command execution	Receive real-time alarms on high-risk commands.	√	√	√	√	Linux and Windows	Real-time check
	Abnormal shell	Detect actions on abnormal shells, including moving, copying, and deleting shell files, and modifying the access permissions and hard links of the files.	√	√	√	√	Linux	Real-time check
	Suspicious crontab task	Check and list auto-started services, scheduled tasks, pre-loaded dynamic libraries, run registry keys, and startup folders. You can get notified immediately when abnormal automatic auto-start items are detected and quickly locate Trojans.	×	√	√	√	Linux and Windows	Real-time check
	System protection disabling	Detect the preparations for ransomware encryption: Disable the Windows defender real-time protection function through the registry. Once the function is disabled, an alarm is reported immediately.	√	√	√	×	Windows	Real-time check
	Backup deletion	Detect the preparations for ransomware encryption: Delete backup files or files in the Backup folder. Once backup deletion is detected, an alarm is reported immediately.	√	√	√	√	Windows	Real-time check
	Suspicious registry operation	Detect operations such as disabling the system firewall through the registry and using the ransomware Stop to modify the registry and write specific strings in the registry. An alarm is reported immediately when such operations are detected.	√	√	√	√	Windows	Real-time check
	System log deletion	An alarm is generated when a command or tool is used to clear system logs.	√	√	√	×	Windows	Real-time check
	Suspicious command execution	Check whether a scheduled task or an automated startup task is created or deleted by running commands or tools. Detect suspicious remote command execution.	√	√	√	×	Windows	Real-time check
	Brute-force attack defense	Check for brute-force attack attempts and successful brute-force attacks. Your accounts are protected from brute-force attacks. HSS will block the attacking servers when detecting such attacks. Trigger an alarm if a user logs in to the server by a brute-force attack.	√	√	√	√	Linux and Windows	Real-time check
	Abnormal login	Check and handle remote logins. If a user's login location is not any common login location you set, an alarm will be triggered.	√	√	√	√	Linux and Windows	Real-time check
	Invalid account	Scan accounts on servers and list suspicious accounts in a timely manner.	√	√	√	√	Linux and Windows	Real-time check
	User account added	Detect the commands used to create hidden accounts. Hidden accounts cannot be found in the user interaction interface or be queried by commands.	√	√	√	√	Windows	Real-time check
	Password theft	Detect the abnormal obtaining of hash value of system accounts and passwords on servers and report alarms.	√	√	√	√	Windows	Real-time check
	Suspicious download request	An alarm is generated when a suspicious HTTP request that uses system tools to download programs is detected.	√	√	√	×	Windows	Real-time check
	Suspicious HTTP request	An alarm is generated when a suspicious HTTP request that uses a system tool or process to execute a remote hosting script is detected.	√	√	√	×	Windows	Real-time check
	Port scan	Detect scanning or sniffing on specified ports and report alarms.	×	√	√	√	Linux	Real-time check
	Host scan	Detect the network scan activities based on server rules (including ICMP, ARP, and nbtscan) and report alarms.	×	√	√	√	Linux	Real-time check
Container intrusion detection	Unclassified malware	Check and handle malicious programs in a container, including web shells, Trojan, mining software, worms, and viruses.	×	×	×	√	Linux	Real-time check
	Ransomware	Check and handle alarms on ransomware in containers.	×	×	×	√	Linux	Real-time check
	Web shell	Check whether the files (often PHP and JSP files) in the web directories on containers are web shells.	×	×	×	√	Linux	Real-time check
	Vulnerability escape	An escape alarm is reported if a container process behavior that matches the behavior of known vulnerabilities is detected.	×	×	×	√	Linux	Real-time checks
	File escape	An alarm is reported if a container process is found accessing a key file directory (for example, /etc/shadow or /etc/crontab). Directories that meet the container directory mapping rules can also trigger such alarms.	×	×	×	√	Linux	Real-time check
	Reverse shell	Monitor user process behaviors in real time to detect reverse shells caused by invalid connections. Reverse shells can be detected for protocols including TCP, UDP, and ICMP.	×	×	×	√	Linux	Real-time check
	Process privilege escalation	The following process privilege escalation operations can be detected: Root privilege escalation by exploiting SUID program vulnerabilities Root privilege escalation by exploiting kernel vulnerabilities	×	×	×	√	Linux	Real-time check
	High-risk command execution	Check executed commands in containers and generate alarms if high-risk commands are detected.	×	×	×	√	Linux	Real-time check
	Abnormal container process	Malicious container program Monitor container process behavior and process file fingerprints. An alarm is reported if it detects a process whose behavior characteristics match those of a predefined malicious program. Abnormal process An alarm is reported if a process not in the whitelist is running in the container.	×	×	×	√	Linux	Real-time check
	Abnormal container startup	The service monitors container startups and reports an alarm if it detects that a container with too many permissions is started. Container check items include: Privileged container startup (privileged:true) Too many container capabilities (capability:[xxx]) Seccomp not enabled (seccomp=unconfined) Container privilege escalation (no-new-privileges:false) High-risk directory mapping (mounts:[...])	×	×	×	√	Linux	Real-time check
	High-risk system call	You can run tasks in kernels by Linux system calls. The container edition reports an alarm if it detects a high-risk call.	×	×	×	√	Linux	Real-time check
	Sensitive file access	The service monitors the container image files associated with file protection policies, and reports an alarm if the files are modified.	×	×	×	√	Linux	Real-time check
	Container Image blocking	If a container contains insecure images specified in , an alarm will be generated and the insecure images will be blocked before a container is started in Docker. NOTE: You need to .	×	×	×	√	Linux	Real-time check
	Brute-force attack	Detect and report alarms for brute-force attack behaviors, such as brute-force attack attempts and successful brute-force attacks, on containers. Detect SSH, web, and Enumdb brute-force attacks on containers. NOTE: Currently, brute-force attacks can be detected only in the Docker runtime.	×	×	×	√	Linux	Real-time check
	Invalid system user account	Detect suspicious accounts and report alarms.	×	×	×	√	Linux	Real-time check
	Abnormal pod behavior	Detect abnormal operations such as creating privileged pods, static pods, and sensitive pods in a cluster and abnormal operations performed on existing pods and report alarms.	×	×	×	√	Linux	Real-time check
	User information enumeration	Detect the operations of enumerating the permissions and executable operation list of cluster users and report alarms.	×	×	×	√	Linux	Real-time check
	Cluster role binding	Detect operations such as binding or creating a high-privilege cluster role or service account and report alarms.	×	×	×	√	Linux	Real-time check
	Kubernetes event deletion	Detect the deletion of Kubernetes events and report alarms.	×	×	×	√	Linux	Real-time check
Whitelist management	Alarm whitelist	You can add an alarm to the whitelist when handling it.	√	√	√	√	Linux and Windows	Real-time check
	Login whitelist	Some alarms can be added to the alarm whitelist.	√	√	√	√	Linux and Windows	Real-time check
	System user whitelist	Users (non-root users) that are newly added to the root user group on a server can be added to the system user whitelist. HSS will not report risky account alarms for them.	√	√	√	√	Linux and Windows	Real-time check
Policy management	Querying and editing rule configurations	You can define and issue different detection policies for different servers or server groups, implementing refined security operations. View the policy list. Create a policy group based on default and existing policy groups. Define a policy. Edit or delete a policy. Modify or disable policies in a group. Apply policies to servers in batches on the Servers & Quota page.	√ (Only the default enterprise policy group is supported.)	√	√	√	Linux and Windows	Real-time check
Handling history	Vulnerability handling history	Check historical vulnerability handling records, including the vulnerability handling time and handler.	√	√	√	√	Linux and Windows	-
Security report	Server security report	Check weekly or monthly server security trend, key security events, and risks.	√	√	√	√	Linux and Windows	-
Security configuration	Agent management	You can view the agent status of all servers and upgrade, uninstall, and install agents.	√	√	√	√	Linux and Windows	Real-time check
	Common login location	For each server, you can configure the locations where users usually log in from. The service will generate alarms on logins originated from locations other than the configured common login locations. A server can be added to multiple login locations.	√	√	√	√	Linux and Windows	Real-time check
	Common login IP address	For each server, you can configure the IP addresses where users usually log in from. The service will generate alarms on logins originated from IP addresses other than the configured common IP addresses.	√	√	√	√	Linux and Windows	Real-time check
	Configuring an SSH login IP address whitelist	The SSH login whitelist controls SSH access to servers to prevent account cracking. After you configure the whitelist, SSH logins will be allowed only from whitelisted IP addresses.	√	√	√	√	Linux	Real-time check
	Malicious program isolation and removal	HSS automatically isolates and kills identified malicious programs, such as web shells, Trojans, and worms, removing security risks.	√	√	√	√	Linux and Windows	Real-time check
	2FA	Prevent brute-force attacks by using password and SMS/email authentication.	√	√	√	√	Linux and Windows	-
HSS self-protection	HSS self-protection	Protect HSS files, processes, and software from malicious programs, which may uninstall HSS agents, tamper with HSS files, or stop HSS processes. Self-protection depends on antivirus detection, HIPS detection, and ransomware protection. It takes effect only when more than one of the three functions are enabled. Enabling the self-protection policy has the following impacts: The HSS agent cannot be uninstalled on the control panel of a server, but can be uninstalled on the HSS console. HSS process cannot be terminated. In the agent installation path C:\Program Files\HostGuard, you can only access the log and data directories (and the upgrade directory, if your agent has been upgraded).	×	√	√	×	Windows	-

Parent topic: Introduction

Previous topic: Scenarios

Next topic: HSS Permissions Management

Feedback

Was this page helpful?

Helpful Not helpful

Provide feedback

Thank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.

The system is busy. Please try again later.

Which of the following issues have you encountered?

Content is inconsistent with the product UI

Unclear descriptions

Lack of examples or code

Incorrect steps

Can't find what I need

Lack of best practices

Feedback (optional)

0/500

Select at least one type of issue, and enter your comments or suggestions.

Enter a maximum of 500 characters.

Submit Cancel

For any further questions, feel free to contact us through the chatbot.

Chatbot