Features

Dashboard

You can check the security score, risks, and protection overview of all your assets in real time, including servers and containers.

√

√

√

√

√

√

Assets

Collect statistics on asset status and usage of all servers, including the agent status, protection status, quota status, and asset fingerprint.

√

√

√

√

√

√

Servers & Quota

Manage all server assets, including their protection statuses, quotas, and policies. You can install agents on all the Linux servers in batches.

√

√

√

√

√

√

Container node management

Manage all container nodes. You can enable or disable protection for container nodes and deploy protection policies.

√

√

√

√

√

√

Container

Check container instance information and isolate or stop insecure container instances.

×

×

×

×

×

√

Accounts

Check and manage accounts in the current system all in one place.

Supported OSs: Linux and Windows.

Scan time: automatic scan every hour.

×

×

√

√

√

√

Open ports

Check open ports all in one place and identify high-risk and unknown ports.

Supported OSs: Linux and Windows.

Scan time: automatic scan every 30s.

×

×

√

√

√

√

Processes

Check running applications all in one place and identify malicious applications.

Supported OSs: Linux and Windows.

Scan time: automatic scan every hour.

×

×

√

√

√

√

Software

Check and manage server software all in one place and identify insecure versions.

Supported OSs: Linux and Windows.

Scan time: automatic scan every day.

×

×

√

√

√

√

Auto-started items

Check auto-started items and collect statistics on their changes in a timely manner.

Supported OSs: Linux and Windows.

Scan time: automatic scan every hour.

×

×

√

√

√

√

Web applications

You can check details about software used for web content push and release, including versions, paths, configuration files, and associated processes of all software.

The following types of web applications support data collection:

• Linux: PHPMailer, PHPMyadmin, DedeCMS, WordPress, ThinkPHP, BigTree, JPress, Jenkins, Zabbix, Discuz!, and ThinkCMF.
• Windows: Chanjet

Supported OSs: Linux and Windows.

Scan time: once a week (04:10 a.m. every Monday).

×

×

√

√

√

√

Web services

Check details about the software used for web content access, including versions, paths, configuration files, and associated processes of all software.

The following types of web services support data collection:

• Linux: Apache, Nginx, Tomcat, Weblogic, WebSphere, JBoss, Wildfly, and Jetty
• Windows: Tomcat

Supported OSs: Linux, Windows

Scan time: once a week (04:10 a.m. every Monday).

×

×

√

√

√

√

Web frameworks

Check statistics about frameworks used for web content presentation, including their versions, paths, and associated processes.

The following types of web frameworks based on Linux support data collection:

• Java language framework: Struts, struts2, spring, hibernate, webwork, quartz, velocity, turbine, FreeMarker, flexive, stripes, vaadin, vertx, wicket, zkoss, jackson, fastjson, shiro, MyBatis, Jersey and JFinal.
• Python framework: Django, Flask, Tornado, web.py, and web2py.
• PHP language framework: Webasyst, KYPHP, CodeIgniter, InitPHP, SpeedPHP, ThinkPHP, and OneThink
• Go framework: Gin, Beego, Fasthttp, Iris, and Echo.

Supported OSs: Linux.

Scan time: once a week (04:10 a.m. every Monday).

×

×

√

√

√

√

Websites

Check statistics about web directories and sites that can be accessed from the Internet. You can view the directories and permissions, access paths, external ports, and key processes of websites.

Information about the following websites can be collected: Linux-based Apache, Nginx, and Tomcat.

Supported OSs: Linux.

Scan time: once a week (04:10 a.m. every Monday).

×

×

√

√

√

√

Middleware

Check information about servers, versions, paths, and processes associated with middleware.

Supported OSs: Linux and Windows.

Scan time: once a week (04:10 a.m. every Monday).

×

×

√

√

√

√

Databases

You can check details about the software that provides data storage, including versions, paths, configuration files, and associated processes of all software.

Information about the following types of databases can be collected:

• Linux: MySQL, Redis, Oracle, MongoDB, Memcache, PostgreSQL, HBase, DB2, Sybase, Dameng database management system, and KingbaseES database management system.
• Windows: MySQL

Supported OSs: Linux and Windows (MySQL only).

Scan time: once a week (04:10 a.m. every Monday).

×

×

√

√

√

√

Kernel modules

Check information about all the program module files running in kernels, including associated servers, version numbers, module descriptions, driver file paths, file permissions, and file hashes.

Supported OSs: Linux.

Scan time: once a week (04:10 a.m. every Monday).

×

×

√

√

√

√

Clusters

Check statistics and details about clusters, workloads, services, and pods.

Supported OSs: Linux.

Scan time: manual scan at any time.

×

×

×

×

×

√

Nodes

Check details about cluster nodes and independent nodes.

Supported OSs: Linux.

Scan time: manual scan at any time.

×

×

×

×

×

√

Containers

Check details about container instances.

Supported OSs: Linux.

Scan time: manual scan at any time.

×

×

×

×

×

√

Images

Check information about local images, repository images, and CI/CD images.

Supported OSs: Linux.

Scan time: manual scan at any time.

×

×

×

×

×

√

Accounts

Check and manage container accounts all in one place.

Supported OSs: Linux.

Scan time: automatic scan every hour.

×

×

×

×

×

√

Open ports

Check container open ports all in one place and identify high-risk and unknown ports.

Supported OSs: Linux.

Scan time: automatic scan every 30s.

×

×

×

×

×

√

Processes

Check running applications all in one place and identify malicious applications.

Supported OSs: Linux.

Scan time: automatic scan every hour.

×

×

×

×

×

√

Installed software

Check and manage container software all in one place and identify insecure versions.

Supported OSs: Linux.

Scan time: automatic scan every day.

×

×

×

×

×

√

Auto-started items

Check auto-started items and collect statistics on their changes in a timely manner.

Supported OSs: Linux.

Scan time: automatic scan every hour.

×

×

×

×

×

√

Web applications

Check details about software used for web content push and release, including versions, paths, configuration files, and associated processes of all software.

Data can be collected from the following web applications: PHPMailer, PHPMyadmin, DedeCMS, WordPress, ThinkPHP, BigTree, JPress, Jenkins, Zabbix, Discuz!, and ThinkCMF.

Supported OSs: Linux.

Scan time: once a week (04:10 a.m. every Monday).

×

×

×

×

×

√

Web services

Check details about the software used for web content access, including versions, paths, configuration files, and associated processes of all software.

Data can be collected from the following web services: Apache, Nginx, Tomcat, WebLogic, WebSphere, JBoss, Wildfly, and Jetty.

Supported OSs: Linux.

Scan time: once a week (04:10 a.m. every Monday).

×

×

×

×

×

√

Web frameworks

Check information about frameworks used for web content display, including their versions, paths, and associated processes.

The following types of web frameworks support data collection:

• Java language framework: Struts, struts2, spring, hibernate, webwork, quartz, velocity, turbine, FreeMarker, flexive, stripes, vaadin, vertx, wicket, zkoss, jackson, fastjson, shiro, MyBatis, Jersey and JFinal.
• Python framework: Django, Flask, Tornado, web.py, and web2py.
• PHP language framework: Webasyst, KYPHP, CodeIgniter, InitPHP, SpeedPHP, ThinkPHP, and OneThink
• Go framework: Gin, Beego, Fasthttp, Iris, and Echo.

Supported OSs: Linux.

Scan time: once a week (04:10 a.m. every Monday).

×

×

×

×

×

√

Websites

Check information about web directories and sites that can be accessed from the Internet. You can view the directories and permissions, access paths, external ports, and key processes of websites.

The following websites support data collection: Apache, Nginx, and Tomcat.

Supported OSs: Linux.

Scan time: once a week (04:10 a.m. every Monday).

×

×

×

×

×

√

Middleware

Check information about servers, versions, paths, and processes associated with middleware.

Supported OSs: Linux.

Scan time: once a week (04:10 a.m. every Monday).

×

×

×

×

×

√

Databases

Check details about the software that provides data storage, including versions, paths, configuration files, and associated processes of all software.

Data can be collected from the following types of databases: MySQL, Redis, Oracle, MongoDB, Memcache, PostgreSQL, HBase, DB2, Sybase, Dameng database management system, and KingbaseES database management system.

Supported OSs: Linux.

Scan time: once a week (04:10 a.m. every Monday).

×

×

×

×

×

√

Linux vulnerability detection

Based on the vulnerability database, check and handle vulnerabilities in the software (such as kernel, OpenSSL, vim, glibc) you obtained from official Linux sources and have not compiled.

Supported OSs: Linux.

Scan time: automatic scan (every day by default), scheduled scan (once a week by default, not supported in the basic edition), and manual scan at any time (not supported in the basic edition).

√

√

√

√

√

√

Windows vulnerability detection

Detect vulnerabilities in Windows OS based on the official patch releases of Microsoft.

Supported OSs: Windows.

Scan time: automatic scan (every day by default), scheduled scan (once a week by default, not supported in the basic edition), and manual scan at any time (not supported in the basic edition).

√

√

√

√

√

×

Web-CMS vulnerability detection

Scan for Web-CMS vulnerabilities in web directories and files.

Supported OSs: Linux and Windows.

Scan time: automatic scan (every day by default), scheduled scan (once a week by default), and manual scan at any time.

×

√

√

√

√

√

Application vulnerability detection

Detect vulnerabilities in JAR packages, ELF files, and other files of open source software, such as Log4j and spring-core.

Supported OSs: Linux and Windows.

Scan time: automatic scan (every Monday by default), scheduled scan (once a week by default), and manual scan at any time.

×

×

√

√

√

√

Emergency vulnerability detection

Checks whether the software and any dependencies running on the server have vulnerabilities through version comparison and POC verification. Reports risky vulnerabilities to the console and provides vulnerability alarms for you.

Supported OSs: Linux and Windows.

Scan time: scheduled scan (which needs to be manually enabled) and manual scan at any time.

×

√

√

√

√

√

Password complexity policies

Check password complexity policies and modify them based on suggestions provided by HSS to improve password security.

Supported OSs: Linux.

Scan time: automatic scan in the early morning every day and manual scan at any time.

√

√

√

√

√

√

Common weak passwords

Change weak passwords to stronger ones based on HSS scan results and suggestions.

Supported OSs: Linux and Windows.

Scan time: automatic scan in the early morning every day and manual scan at any time.

√

√

√

√

√

√

Baseline check

Check the unsafe Tomcat, Nginx, and SSH login configurations found by HSS.

Supported OSs: Linux and Windows.

Scan time: automatic scan in the early morning every day and manual scan at any time.

×

×

√

√

√

√

CI/CD image security scan

Image security scans can be integrated into the CI/CD build pipeline of the Jenkins Pipeline project. It can implement security scan in the image build phase; identify 10+ risks, including system vulnerabilities, application vulnerabilities, abnormal system configurations, malicious files, and sensitive files in images; and shift security left to the DevOps phase, helping you eliminate security risks as early as possible and preventing unsafe images from being deployed in the production environment.

Supported OSs: Linux.

Scan time: An image scan is triggered when a project is built.

×

×

×

×

×

×

√

Repository image security scan

Image scans check for image risks, including system vulnerabilities, application vulnerabilities, malicious files, unsafe settings, weak passwords, sensitive information, and software compliance; and provide suggestions to help you reduce risks.

Supported OSs: Linux.

Scan time: manual scans and scheduled scans (manual configuration required)

×

×

×

×

×

×

√

Local image security scan

Image scans check for system vulnerabilities, application vulnerabilities, and software information risks in images; and provide suggestions to help you reduce risks.

Supported OSs: Linux.

Scan time: manual scan at any time.

×

×

×

×

×

√

×

System vulnerabilities

Vulnerabilities at the OS layer of the core components in the control plane, data plane, and image repositories of Kubernetes clusters.

Supported OSs: Linux.

Scan time: manual scan at any time.

×

×

×

×

×

√

Application vulnerabilities

Application software vulnerabilities in the core components of the Kubernetes cluster control plane, data plane, and image repositories.

Supported OSs: Linux.

Scan time: manual scan at any time.

×

×

×

×

×

√

Emergency vulnerabilities

High-risk security vulnerabilities, such as 0-day vulnerabilities, in containers, container runtime components, and dependency packages.

Supported OSs: Linux.

Scan time: manual scan at any time.

×

×

×

×

×

√

Unsafe settings

Whether Kubernetes cluster settings, workloads, network policies, and RBAC permissions comply with security best practices.

Supported OSs: Linux.

Scan time: manual scan at any time.

×

×

×

×

×

√

Security and compliance

Whether Kubernetes cluster settings, workloads, network policies, and RBAC permissions comply with industry standards and regulations.

Supported OSs: Linux.

Scan time: manual scan at any time.

×

×

×

×

×

√

IaC risks

Risks in infrastructure as code (IaC).

Supported OSs: Linux.

Scan time: manual scan at any time.

×

×

×

×

×

√

SQL injection

Detect and defend against SQL injection attacks, and check web applications for related vulnerabilities.

Supported OSs: Linux and Windows

Scan time: real-time detection.

×

×

×

√

√

√

OS command injection

Detect and defend against remote OS command injection attacks and check web applications for related vulnerabilities.

Supported OSs: Linux and Windows

Scan time: real-time detection.

×

×

×

√

√

√

XSS

Detect and defend against stored cross-site scripting (XSS) injection attacks.

Supported OSs: Linux and Windows

Scan time: real-time detection.

×

×

×

√

√

√

Log4j RCE vulnerability

Detect and defend against remote code execution and intercept attacks.

Supported OSs: Linux and Windows

Scan time: real-time detection.

×

×

×

√

√

√

Web shell upload

Detect and defend against attacks that upload dangerous files, change file names, or change file name extension types; and check web applications for related vulnerabilities.

Supported OSs: Linux and Windows

Scan time: real-time detection.

×

×

×

√

√

√

Memory injection

Detect and defend against memory injection attacks.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

×

×

×

√

√

√

XXE

Detect and defend against XML External Entity Injection (XXE) attacks, and check web applications for related vulnerabilities.

Supported OSs: Linux and Windows

Scan time: real-time detection.

×

×

×

√

√

√

Deserialization input

Detect deserialization attacks that exploit unsafe classes.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

×

×

×

√

√

√

File directory traversal

Check whether sensitive directories or files are accessed.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

×

×

×

√

√

√

Struts2 OGNL

Detect OGNL code execution.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

×

×

×

√

√

√

Command execution using JSP

Detect command execution using JSP.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

×

×

×

√

√

√

File deletion using JSP

Detect file deletion using JSP.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

×

×

×

√

√

√

Database connection exception

Detect authentication and communication exceptions thrown by database connections.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

×

×

×

√

√

√

0-day vulnerability

Check whether the stack hash of a command is in the whitelist of the web application.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

×

×

×

√

√

√

SecurityManager permission exception

Detect exceptions thrown by SecurityManager.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

×

×

×

√

√

√

JNDI injection

Detect and defend against JNDI injection attacks, and check web applications for related vulnerabilities.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

×

×

×

√

√

√

Expression injection

Detect and defend against expression injection attacks, and check web applications for related vulnerabilities.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

×

×

×

√

√

√

Static WTP

Protect the static web page files on website servers from being tampered with.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

×

×

×

×

√

×

Dynamic WTP

Provide dynamic web tamper protection for Tomcat. Protect the dynamic web pages in website databases from being tampered with.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

√

×

Ransomware prevention

Help you identify some unknown ransomware attacks by using static and dynamic honeypot files.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

×

×

×

√

√

√

Application Process Control

Learn the characteristics of application processes on servers and manage their running. Suspicious and trusted processes are allowed to run, and alarms are generated for malicious processes.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

×

×

×

√

√

√

File integrity monitoring

Check the key files of the Linux system to detect the changes that may be exploited by attacks in a timely manner.

Supported OSs: Linux.

Scan time: real-time detection.

×

√

√

√

√

√

Virus scan

The function uses the virus detection engine to scan virus files on the server. The scanned file types include executable files, compressed files, script files, documents, images, and audio and video files. Users can perform quick scan and full-disk scan on the server as required. Customize scan tasks and handle detected virus files in a timely manner to enhance the virus defense capability of the service system.

Supported OSs: Linux and Windows.

Scan time: manual scan at any time.

×

√ (Only quick scan is supported.)

√

√

√

√

Dynamic port honeypot

The dynamic port honeypot function is a deception trap. It uses a real port as a honeypot port to induce attackers to access the network. In the horizontal penetration scenario, the function can effectively detect attackers' scanning, identify faulty servers, and protect real resources of the user.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

×

×

×

√

√

√

Container firewall

Control and intercept network traffic inside and outside a container cluster to prevent malicious access and attacks.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

×

√

Container cluster protection

Check for non-compliance baseline issues, vulnerabilities, and malicious files when a container image is started and report alarms on or block container startup that has not been unauthorized or may incur high risks.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

×

√

Unclassified malware

Check and handle detected malicious programs all in one place, including web shells, Trojan, mining software, worms, and viruses.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

×

√

√

√

√

√

Virus

Check servers in real time and report alarms for viruses detected on servers.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

×

√

√

√

√

√

Worm

Detect and kill worms on servers and report alarms.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

×

√

√

√

√

√

Trojan

Detect programs that are hidden in normal programs and have special functions such as damaging and deleting files, sending passwords, and recording keyboards. If a program is detected, an alarm is reported immediately.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

×

√

√

√

√

√

Botnet

Detect whether zombie programs that have been spread exist in servers and report alarms immediately after detecting them.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

×

√

√

√

√

√

Backdoor

Detect backdoors in the server system in real time and report alarms immediately after detecting them.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

×

√

√

√

√

√

Rootkit

Detect server assets and report alarms for suspicious kernel modules, files, and folders.

Supported OSs: Linux.

Scan time: real-time detection.

×

√

√

√

√

√

Ransomware

Check for ransomware in web pages, software, emails, and storage media.

Ransomware can encrypt and control your data assets, such as documents, emails, databases, source code, images, and compressed files, to leverage victim extortion.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

×

×

×

√

√

√

Hacker tool

Check whether non-standard tool used to control the server exist and report alarms immediately after detecting them.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

×

×

√

√

√

√

Web shell

Check whether the files (often PHP and JSP files) detected by HSS in your web directories are web shells.

• Web shell information includes the Trojan file path, status, first discovery time, and last discovery time. You can choose to ignore warning on trusted files.
• You can use the manual detection function to detect web shells on servers.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

×

√

√

√

√

√

Mining software

Detect whether mining software exists on servers in real time and report alarms for the detected software.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

×

√

√

√

√

√

Remote code execution

Check whether the server is remotely called in real time and report an alarm immediately once remote code execution is detected.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

×

×

√

√

√

√

Redis vulnerability exploit

Detect the modifications made by the Redis process on key directories in real time and report alarms.

Supported OSs: Linux.

Scan time: real-time detection.

×

√

√

√

√

√

Hadoop vulnerability exploit

Detect the modifications made by the Hadoop process on key directories in real time and report alarms.

Supported OSs: Linux.

Scan time: real-time detection.

×

√

√

√

√

√

MySQL vulnerability exploit

Detect the modifications made by the MySQL process on key directories in real time and report alarms.

Supported OSs: Linux.

Scan time: real-time detection.

×

√

√

√

√

√

Reverse shell

Monitor user process behaviors in real time to report alarms on and block reverse shells caused by invalid connections.

Reverse shells can be detected for protocols including TCP, UDP, and ICMP.

Currently, the following types of reverse shells can be blocked: exec reverse shell, Perl reverse shell, AWK reverse shell, Python reverse shell.b, Python reverse shell.a, Lua reverse shell, mkfifo/openssl reverse shell, PHP reverse shell, Ruby reverse shell, rssocks reverse proxy, Bash reverse shell, Ncat reverse shell, exec redirection reverse shell, Node reverse shell, Telnet dual-port reverse shell, nc reverse shell, Socat reverse shell, rm/mkfifo/sh/nc reverse shell, and socket/tchsh reverse shell.

Supported OSs: Linux.

Scan time: real-time detection.

×

√

√

√

√

√

File privilege escalation

Check the file privilege escalations in your system.

Supported OSs: Linux.

Scan time: real-time detection.

×

√

√

√

√

√

Process privilege escalation

Supported OSs: Linux.

Scan time: real-time detection.

×

√

√

√

√

√

Important file change

Receive alarms when critical system files are modified.

Supported OSs: Linux.

Scan time: real-time detection.

×

√

√

√

√

√

File/Directory change

Monitor system files and directories in real time and generate alarms if such files are created, deleted, moved, or if their attributes or content are modified.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

×

√

√

√

√

√

Abnormal process behavior

Check the processes on servers, including their IDs, command lines, process paths, and behavior.

Send alarms on unauthorized process operations and intrusions.

The following abnormal process behavior can be detected:

• Abnormal CPU usage
• Processes accessing malicious IP addresses
• Abnormal increase in concurrent process connections

Supported OSs: Linux and Windows.

Scan time: real-time detection.

×

×

√

√

√

√

High-risk command execution

Check executed commands in real time and generate alarms if high-risk commands are detected.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

×

√

√

√

√

√

Abnormal shell

Detect actions on abnormal shells, including moving, copying, and deleting shell files, and modifying the access permissions and hard links of the files.

Supported OSs: Linux.

Scan time: real-time detection.

×

√

√

√

√

√

Sensitive file access

Detect the unauthorized access to or modifications of sensitive files.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

×

√

√

√

√

√

Suspicious crontab task

Check and list auto-started services, scheduled tasks, pre-loaded dynamic libraries, run registry keys, and startup folders.

You can get notified immediately when abnormal automatic auto-start items are detected and quickly locate Trojans.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

×

×

×

√

√

√

System protection disabling

Detect the preparations for ransomware encryption: Disable the Windows defender real-time protection function through the registry. Once the function is disabled, an alarm is reported immediately.

Supported OSs: Windows.

Scan time: real-time detection.

×

×

√

√

√

×

Backup deletion

Detect the preparations for ransomware encryption: Delete backup files or files in the Backup folder. Once backup deletion is detected, an alarm is reported immediately.

Supported OSs: Windows.

Scan time: real-time detection.

×

×

√

√

√

√

Suspicious registry operation

Detect operations such as disabling the system firewall through the registry and using the ransomware Stop to modify the registry and write specific strings in the registry. An alarm is reported immediately when such operations are detected.

Supported OSs: Windows.

Scan time: real-time detection.

×

×

√

√

√

√

System log deletion

An alarm is generated when a command or tool is used to clear system logs.

Supported OSs: Windows.

Scan time: real-time detection.

×

×

√

√

√

×

Suspicious command execution

• Check whether a scheduled task or an automated startup task is created or deleted by running commands or tools.
• Detect suspicious remote command execution.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

×

×

√

√

√

√

Suspicious process execution

Detect and report alarms on unauthenticated or unauthorized application processes.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

×

×

√

√

√

√

Suspicious process file access

Detect and report alarms on the unauthenticated or unauthorized application processes accessing specific directories.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

×

×

√

√

√

√

Kernel module loading

Check for kernel module loading and report an alarm immediately when loading is detected.

Supported OSs: Linux.

×

×

√

√

√

√

Brute-force attack

Check for brute-force attack attempts and successful brute-force attacks.

• Detect password cracking attacks on accounts and block attacking IP addresses to prevent server intrusion.
• Trigger an alarm if a user logs in to the server by a brute-force attack.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

√

√

√

√

√

√

Abnormal login

Check and handle remote logins.

If a user's login location is not any common login location you set, an alarm will be triggered.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

√

√

√

√

√

√

Invalid account

Scan accounts on servers and list suspicious accounts in a timely manner.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

×

√

√

√

√

√

User account added

Detect the commands used to create hidden accounts. Hidden accounts cannot be found in the user interaction interface or be queried by commands.

Supported OSs: Windows.

Scan time: real-time detection.

×

×

√

√

√

√

Password theft

Detect the abnormal obtaining of hash value of system accounts and passwords on servers and report alarms.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

×

×

√

√

√

√

Unknown network access

Detect access to ports that are not listened on by the server.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

×

×

×

√

√

√

Cloud honeypot

An alarm is reported if a connection to the honeypot port of a server is detected.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

×

×

×

√

√

√

Abnormal outbound connection

Report alarms on suspicious IP addresses that initiate outbound connections.

Supported OSs: Linux (kernel 5.10 or later).

Scan time: real-time detection.

×

√

√

√

√

√

Port forwarding

Report alarms on port forwarding using suspicious tools.

Supported OSs: Linux.

Scan time: real-time detection.

×

√

√

√

√

√

Suspicious download request

An alarm is generated when a suspicious HTTP request that uses system tools to download programs is detected.

Supported OSs: Windows.

Scan time: real-time detection.

×

×

√

√

√

×

Suspicious HTTP request

An alarm is generated when a suspicious HTTP request that uses a system tool or process to execute a remote hosting script is detected.

Supported OSs: Windows.

Scan time: real-time detection.

×

×

√

√

√

×

Port scan

Detect scanning or sniffing on specified ports and report alarms.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

√

√

√

Server scan

Detect the network scan activities based on server rules (including ICMP, ARP, and nbtscan) and report alarms.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

√

√

√

Process injection

Scan for malicious code injection into running processes and report alarms.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

√

√

√

Dynamic library injection

Scan for the payloads injected by hijacking functions in the dynamic link library (DLL) and report alarms.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

√

√

√

Memory file process

Scan for the behaviors of creating an anonymous malicious file that exists only in the RAM through the memfd_create system call and executing the file, and report alarms on such behaviors.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

√

√

√

VDSO hijacking

Scan for the attacks that exploit specific vulnerabilities (for example, Dirty COW). Such attacks overwrite the original code of VDSO with malicious code. If the root process calls the code of the VDSO, the malicious code will be executed and privilege escalation will be performed. An alarm will be reported immediately if such an attack is detected.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

√

√

√

Windows tool exploit

Scan for the attacks that exploit the legitimate built-in tools and functions in the OS to perform malicious operations that can bypass the traditional security defense mechanism. An alarm will be reported immediately if such an attack is detected.

Supported OSs: Windows.

Scan time: real-time detection.

×

×

×

√

√

√

Malicious registry injection

Scan for the attacks that insert malicious code or scripts into the Windows registry, which enables malware to automatically run when the system is started and bypass the common file detection mechanism. An alarm will be reported immediately if such an attack is detected.

Supported OSs: Windows.

Scan time: real-time detection.

×

×

×

√

√

√

Unclassified malware

Check and handle malicious programs in a container, including web shells, Trojan, mining software, worms, and viruses.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

×

√

Virus

Check containers in real time and report alarms for viruses detected in the container runtime.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

×

√

Worm

Detect and kill worms in container runtime and report alarms.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

×

√

Trojan

Detect programs that are hidden in normal programs and have special functions such as damaging and deleting files, sending passwords, and recording keyboards. If a suspicious program is detected, an alarm is reported immediately.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

×

√

Botnet

Check for zombie programs spreading in the container runtime and report alarms immediately after detecting them.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

×

√

Backdoor

Detect backdoors in the container runtime in real time and report alarms immediately after detecting them.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

×

√

Rootkit

Check the container runtime and report alarms for suspicious kernel modules, files, and folders.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

×

√

Ransomware

Check and handle alarms on ransomware in containers.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

×

√

Hacker tool

Check for non-standard tools used to control containers in the container runtime, and report alarms immediately after detecting them.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

√

√

√

√

Web shell

Check whether the files (often PHP and JSP files) in the web directories on containers are web shells.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

×

√

Mining software

Check for mining software in the container runtime in real time and report alarms for the detected software.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

×

√

Vulnerability escape detection

An escape alarm is reported if a container process behavior that matches the behavior of known vulnerabilities is detected.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

×

√

File escape detection

An alarm is reported if a container process is found accessing a key file directory (for example, /etc/shadow or /etc/crontab). Directories that meet the container directory mapping rules can also trigger such alarms.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

×

√

Reverse shell

Monitor user process behaviors in a container environment in real time to detect reverse shells caused by invalid connections. Reverse shells can be detected for protocols including TCP, UDP, and ICMP.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

×

√

File privilege escalation

Check the file privilege escalations in the container system.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

×

√

Process privilege escalation

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

×

√

Important file change

Receive alarms when critical system files are modified.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

×

√

File/Directory change

Monitor system files and directories in real time and generate alarms if such files are created, deleted, moved, or if their attributes or content are modified.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

×

√

Abnormal process behavior

Check the processes on servers in a container environment, including their IDs, command lines, process paths, and behavior.

Send alarms on unauthorized process operations and intrusions.

The following abnormal process behavior can be detected:

• Abnormal CPU usage
• Processes accessing malicious IP addresses
• Abnormal increase in concurrent process connections

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

×

√

Abnormal container process

• Malicious container program detection

  Monitor container process behavior and process file fingerprints. An alarm is reported if it detects a process whose behavior characteristics match those of a predefined malicious program.

• Abnormal processes

  The service reports an alarm if it detects that a process not in the whitelist is running in the container.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

×

√

Abnormal container startup

The service monitors container startups and reports an alarm if it detects that a container with too many permissions is started.

Container check items include:

• Privileged container startup (privileged:true)
• Too many container capabilities (capability:[xxx])
• Seccomp not enabled (seccomp=unconfined)
• Container privilege escalation (no-new-privileges:false)
• High-risk directory mapping (mounts:[...])

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

×

√

High-risk command execution

Check executed commands in containers and generate alarms if high-risk commands are detected.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

×

√

High-risk system call

You can run tasks in kernels by Linux system calls. The container edition reports an alarm if it detects a high-risk call.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

×

√

Abnormal shell

Check containers for actions on abnormal shells, including moving, copying, and deleting shell files, and modifying the access permissions and hard links of the files.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

×

√

Sensitive file access

The service monitors the container image files associated with file protection policies, and reports an alarm if the files are modified.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

×

√

Container image blocking

If a container contains insecure images specified in Suspicious Image Behaviors, an alarm will be generated and the insecure images will be blocked before a container is started in Docker.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

×

√

Suspicious command execution

• Check whether a scheduled task or an automated startup task is created or deleted by running commands or tools.
• Detect suspicious remote command execution.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

×

√

Abnormal runtime behavior

Detect container escapes at the levels of networks, servers, pods, containers, processes, and system calls. Five types of abnormal runtime behaviors (processes, files, network activities, process capabilities, and system calls) can be detected, reported, and blocked to prevent container escape and protect container runtime.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

×

√

Brute-force attack

Detect and report alarms for brute-force attack behaviors, such as brute-force attack attempts and successful brute-force attacks, on containers.

Detect SSH, web, and Enumdb brute-force attacks on containers.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

×

√

Invalid account

Detect suspicious accounts and report alarms.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

×

√

Password theft

Detect the abnormal obtaining of hash value of system accounts and passwords on servers in a container environment and report alarms.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

×

√

Abnormal outbound connection

Report alarms on suspicious IP addresses in a container environment that initiate outbound connections.

Supported OSs: Linux (kernel 5.10 or later).

Scan time: real-time detection.

×

×

×

×

×

√

Port forwarding

Report alarms on port forwarding using suspicious tools in a container environment.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

×

√

Kubernetes event deletion

Detect the deletion of Kubernetes events and report alarms.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

×

√

Abnormal pod behavior

Detect abnormal operations such as creating privileged pods, static pods, and sensitive pods in a cluster and abnormal operations performed on existing pods and report alarms.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

×

√

User information enumeration

Detect the operations of enumerating the permissions and executable operation list of cluster users and report alarms.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

×

√

Binding cluster role

Detect operations such as binding or creating a high-privilege cluster role or service account and report alarms.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

×

√

Process injection

Scan for malicious code injection into running processes and report alarms.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

×

√

Dynamic library injection

Scan for the payloads injected by hijacking functions in the dynamic link library (DLL) and report alarms.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

×

√

Memory file process

Scan for the behaviors of creating an anonymous malicious file that exists only in the RAM through the memfd_create system call and executing the file, and report alarms on such behaviors.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

×

√

Alarm whitelist

You can add an alarm to the whitelist when handling it.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

√

√

√

√

√

√

Login Whitelist

Add IP addresses and usernames to the Login Whitelist as needed. HSS will not report alarms on the access behaviors of these IP addresses and users.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

√

√

√

√

√

√

System user whitelist

Users (non-root users) that are newly added to the root user group on a server can be added to the system user whitelist. HSS will not report risky account alarms for them.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

√

√

√

√

√

√

Policy Management

You can define and issue different detection policies for different servers or server groups, implementing refined security operations.

• Check the policy group list.
• Create a policy group based on default and existing policy groups.
• Define a policy.
• Edit or delete a policy.
• Modify or disable policies in a group.
• Apply policies to servers in batches on the Servers & Quota page.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

×

√ (Only the default professional policy group is supported.)

√ (Only the default enterprise policy group is supported.)

√

√

√

Handling history

Check historical vulnerability, virus, and alarm handling records, including the handling time and handlers.

×

√

√

√

√

√

Security Report

Check weekly or monthly server security trend, key security events, and risks.

×

√

√

√

√

√

Container audit

Keep track of the operations and activities in your container clusters, gaining insight into every phase of the container lifecycle, including creating, starting, stopping, and destroying containers; as well as the communication and transmission between containers. Find and handle security problems through audit and analysis in a timely manner, ensuring the security and stability of container clusters.

Supported OSs: Linux.

Scan time: real-time detection.

×

×

×

×

×

√

Agent management

You can view the agent status of all servers and upgrade, uninstall, and install agents.

Supported OSs: Linux and Windows.

√

√

√

√

√

√

Common login location

For each server, you can configure the locations where users usually log in from. The service will generate alarms on logins originated from locations other than the configured common login locations. A server can be added to multiple login locations.

Supported OSs: Linux and Windows.

√

√

√

√

√

√

Common login IP address

For each server, you can configure the IP addresses where users usually log in from. The service will generate alarms on logins originated from IP addresses other than the configured common IP addresses.

Supported OSs: Linux and Windows.

√

√

√

√

√

√

Configuring an SSH Login IP Address Whitelist

The SSH login whitelist controls SSH access to servers to prevent account cracking.

After you configure the whitelist, SSH logins will be allowed only from whitelisted IP addresses.

Supported OSs: Linux.

√

√

√

√

√

√

Malicious program isolation and removal

HSS automatically isolates and kills identified malicious programs, such as web shells, Trojans, and worms, removing security risks.

Supported OSs: Linux and Windows.

Scan time: real-time detection.

×

√

√

√

√

√

Two-factor Authentication (2FA)

Prevent brute-force attacks by using password and SMS/email authentication.

Supported OSs: Linux and Windows.

Pay per use: ×

Yearly/Monthly: √

√

√

√

√

√

Plug-in management

Install, uninstall, upgrade, and manage plug-ins in a unified manner.

Supported OSs: Linux.

×

×

×

×

×

√

Container installation and configuration

Connect your clusters to HSS. Upgrade or uninstall the agent in your clusters or independent containers.

Supported OSs: Linux.

√

√

√

√

√

√

Windows self-protection

Prevent malicious programs from uninstalling the agent, tampering with HSS files, or stopping HSS processes.

Supported OSs: Windows.

×

√

√

√

√

×

Linux self-protection

Prevent malicious programs from stopping the HSS process and uninstalling the agent.

Supported OSs: Linux.

×

√

√

√

√

√