Editions and Features¶
HSS comes in the enterprise, premium, Web Tamper Protection (WTP), and container editions, providing asset management, vulnerability management, baseline check, intrusion detection, ransomware protection, web tamper protection, and container image security functions. For details about the features of the editions, see Edition Details.
Features¶
HSS provides asset management, baseline check, ransomware prevention, and intrusion detection features, enhancing server security in all aspects. For details about the features of different editions, see Edition Details.
Feature | Description |
---|---|
Asset management | Provide centralized asset overview, asset fingerprint management, server management, and container management. You can check your asset running status, asset fingerprints, and asset types; and manage assets by server or container. |
Vulnerability management | Detect vulnerabilities and risks in Linux, Windows, Web content management systems (Web-CMS), and applications. |
Baseline check | Scan for unsafe settings, weak passwords, and password complexity policies in server OS and key software. A security practice baseline can be used for scans. You can customize baseline sub-items used in scan. You can repair and verify the detected risks. |
Container image security | Scan the images that are running or displayed in your image list, and provide suggestions on how to fix vulnerabilities and malicious files. |
Application protection | Protect running applications. You simply need to add probes to applications, without having to modify application files. Currently, only Linux servers are supported, and only Java applications can be connected. |
Web page tampering prevention | Detect and prevent tampering of files in specified directories, including web pages, documents, and images, and quickly restore them using valid backup files. |
Ransomware prevention | Detect known ransomware and support user-defined ransomware backup and restoration policies. |
File integrity monitoring | Check the files in the Linux OS, applications, and other components to detect tampering. |
Intrusion detection | Identify and prevent intrusion to servers, discover risks in real time, detect and kill malicious programs, and identify web shells and other threats. |
Container intrusion detection | Scan running containers for malicious programs including miners and ransomware; detect non-compliant security policies, file tampering, and container escape; and provide suggestions. |
Whitelist management | To reduce false alarms, import events to and export events from the whitelist. Whitelisted events will not trigger alarms. |
Policy management | You can group policies and servers to batch apply policies to servers, easily adapting to your business scenarios. |
Security report | Check weekly or monthly server security trend, key security events, and risks. |
Security configuration | Configure common login locations, common login IP addresses, the SSH login IP address whitelist, and automatic isolation and killing of malicious programs. |
Recommended Editions¶
If your servers store important data assets, have high security risks, use publicly available EIPs, or there are databases running on your servers, you are advised to enable the premium or Web Tamper Protection edition.
For servers that need to protect websites and applications from tampering, the WTP edition is recommended.
For containers that need to enhance image security, container runtime security, container edition is recommended.
Important
You are advised to deploy HSS on all your servers so that if a virus infects one of them, it will not be able to spread to others and damage your entire network.
Edition Details¶
Function | Item | Description | Enterprise | Premium | WTP | Container | Supported OS | Check Frequency |
---|---|---|---|---|---|---|---|---|
Assets | Collect statistics on asset status and usage of all servers. | Y | Y | Y | Y | Linux and Windows | Real-time check | |
Servers & Quota | Manage all server assets, including their protection status, quotas, and policy allocation. | Y | Y | Y | Y | Linux and Windows Note: Only Linux agents can be installed in batches. |
| |
Containers & Quota | Manage container nodes and container images. | x | x | x | Y | Linux |
| |
Asset Fingerprints | Account | Check and manage server accounts all in one place. | Y | Y | Y | Y | Linux and Windows | Automatic check every hour |
Open ports | Check open ports all in one place and identify high-risk and unknown ports. | Y | Y | Y | Y | Linux and Windows | Automated check every 30 seconds | |
Processes | Check running applications all in one place and identify malicious applications. | Y | Y | Y | Y | Linux and Windows | Automatic check every hour | |
Installed software | Check and manage server software all in one place and identify insecure versions. | Y | Y | Y | Y | Linux and Windows | Automatic check every day | |
Auto-startup | Check auto-startup entries and collect statistics on entry changes in a timely manner. | Y | Y | Y | Y | Linux and Windows | Automatic check every hour | |
Web applications | Check details about software used for web content push and release, including versions, paths, configuration files, and associated processes of all software. | Y | Y | Y | Y | Linux | Once a week (04:10 a.m. every Monday) | |
Web services | Check details about the software used for web content access, including versions, paths, configuration files, and associated processes of all software. | Y | Y | Y | Y | Linux | Once a week (04:10 a.m. every Monday) | |
Web framework | Check statistics about frameworks used for web content presentation, including their versions, paths, and associated processes. | Y | Y | Y | Y | Linux | Once a week (04:10 a.m. every Monday) | |
Websites | You can check statistics about web directories and sites that can be accessed from the Internet. You can view the directories and permissions, access paths, external ports, and key processes of websites. | Y | Y | Y | Y | Linux | Once a week (04:10 a.m. every Monday) | |
Middleware | Check information about servers, versions, paths, and processes associated with middleware. | Y | Y | Y | Y | Linux | Once a week (04:10 a.m. every Monday) | |
Databases | Check details about software that provides data storage, including versions, paths, configuration files, and associated processes of all software. | Y | Y | Y | Y | Linux | Once a week (04:10 a.m. every Monday) | |
Kernel module | Check information about all the program module files running in kernels, including associated servers, version numbers, module descriptions, driver file paths, file permissions, and file hashes. | Y | Y | Y | Y | Linux | Once a week (04:10 a.m. every Monday) | |
Vulnerability Management | Linux vulnerability detection | Based on the vulnerability database, check and handle vulnerabilities in the software (such as kernel, OpenSSL, vim, glibc) you obtained from official Linux sources and have not compiled. | Y | Y | Y | Y | Linux |
|
Windows vulnerability detection | Detect vulnerabilities in Windows OS based on the official patch releases of Microsoft. | Y | Y | Y | Y | Windows |
| |
Web-CMS vulnerability detection | Scan for Web-CMS vulnerabilities in web directories and files. | Y | Y | Y | Y | Linux and Windows |
| |
Application vulnerability detection | Detect vulnerabilities in JAR packages, ELF files, and other files of open source software, such as Log4j and spring-core. | Y | Y | Y | Y | Linux |
| |
Unsafe settings check | Password policy check | Check password complexity policies and modify them based on suggestions provided by HSS to improve password security. | Y | Y | Y | Y | Linux |
|
Weak password check | Change weak passwords to stronger ones based on HSS scan results and suggestions. | Y | Y | Y | Y | Linux |
| |
Unsafe configurations | Check the unsafe Tomcat, Nginx, and SSH login configurations found by HSS. | Y | Y | Y | Y | Linux and Windows |
| |
Container image security | Container image vulnerability management | Detect and manage vulnerabilities in local images and private image repositories based on a vulnerability database, and handle critical vulnerabilities in a timely manner. | x | x | x | Y | Linux |
|
Malicious image file detection | Scan images for malicious files (such as Trojans, worms, viruses, and adware) and identify risks. | x | x | x | Y | Linux | Real-time check | |
Image baseline check | Check for insecure configurations based on 18 types of container baselines. | x | x | x | Y | Linux | Real-time check | |
Application protection | SQL injection | Detect and defend against SQL injection attacks, and check web applications for related vulnerabilities. | x | Y | Y | Y | Linux | Real-time check |
OS command injection | Detect and defend against remote OS command injection attacks and check web applications for related vulnerabilities. | x | Y | Y | Y | Linux | Real-time check | |
XSS | Detect and defend against stored cross-site scripting (XSS) injection attacks. | x | Y | Y | Y | Linux | Real-time check | |
Log4jRCE vulnerability | Detect and defend against remote code execution. | x | Y | Y | Y | Linux | Real-time check | |
Web shell upload | Detect and defend against attacks that upload dangerous files, change file names, or change file name extension types; and check web applications for related vulnerabilities. | x | Y | Y | Y | Linux | Real-time check | |
XXE attack | Detect and defend against XML External Entity Injection (XXE) attacks, and check web applications for related vulnerabilities. | x | Y | Y | Y | Linux | Real-time check | |
Deserialization input | Detect deserialization attacks that exploit unsafe classes. | x | Y | Y | Y | Linux | Real-time check | |
File directory traversal | Check whether sensitive directories or files are accessed. | x | Y | Y | Y | Linux | Real-time check | |
Struts2 OGNL | Detect OGNL code execution. | x | Y | Y | Y | Linux | Real-time check | |
Command execution using JSP | Detect command execution using JSP. | x | Y | Y | Y | Linux | Real-time check | |
File deletion using JSP | Detects file deletion using JSP. | x | Y | Y | Y | Linux | Real-time check | |
Database connection exception | Detect authentication and communication exceptions thrown by database connections. | x | Y | Y | Y | Linux | Real-time check | |
0-day vulnerability | Check whether the stack hash of a command is in the whitelist of the web application. | x | Y | Y | Y | Linux | Real-time check | |
SecurityManager permission exception | Detect exceptions thrown by SecurityManager. | x | Y | Y | Y | Linux | Real-time check | |
Web page tampering prevention | Static WTP | Protect the static web page files on your website servers from malicious modification. | x | x | Y | x | Linux and Windows | Real-time check |
Dynamic WTP | Protect the dynamic web page files in your website databases from malicious modification. | x | x | Y | x | Linux | Real-time check | |
Ransomware prevention | Ransomware prevention | Help you identify and detect known ransomware attacks and restore services using ransomware backups. | x | Y | Y | Y | Linux and Windows | Real-time check |
File integrity monitoring | File Integrity | Check the files in the Linux OS, applications, and other components to detect tampering. | x | Y | Y | Y | Linux | Real-time check |
Intrusion detection | Malicious program | Check and handle detected malicious programs all in one place, including web shells, Trojan, mining software, worms, and viruses. | Y | Y | Y | Y | Linux and Windows | Real-time check |
Virus | Check servers in real time and report alarms for viruses detected on servers. | Y | Y | Y | Y | Linux and Windows | Real-time check | |
Trojan | Detect programs that are hidden in normal programs and have special functions such as damaging and deleting files, sending passwords, and recording keyboards. If a program is detected, an alarm is reported immediately. | Y | Y | Y | Y | Linux and Windows | Real-time check | |
Botnet | Detect whether zombie programs that have been spread exist in servers and report alarms immediately after detecting them. | Y | Y | Y | Y | Linux and Windows | Real-time check | |
Web shell | Detect web shell attacks in the server system in real time and report alarms immediately after detecting them. | Y | Y | Y | Y | Linux and Windows | Real-time check | |
Rootkit | Detect server assets and report alarms for suspicious kernel modules, files, and folders. | Y | Y | Y | Y | Linux | Real-time check | |
Ransomware | Check ransomware embedded in media such as web pages, software, emails, and storage media. Ransomware is used to encrypt and control your data assets, such as documents, emails, databases, source code, images, and compressed files, to leverage victim extortion. | x | Y | Y | Y | Linux and Windows | Real-time check | |
Hacker tool | Check whether non-standard tool used to control the server exist and report alarms immediately after detecting them. | Y | Y | Y | Y | Linux and Windows | Real-time check | |
Web shell | Check whether the files (often PHP and JSP files) detected by HSS in your web directories are web shells.
| Y | Y | Y | Y | Linux and Windows | Real-time check | |
Mining | Detect whether mining software exists on servers in real time and report alarms for the detected software. | Y | Y | Y | Y | Linux and Windows | Real-time check | |
Remote code execution | Check whether the server is remotely called in real time and report an alarm immediately once remote code execution is detected. | Y | Y | Y | Y | Linux and Windows | Real-time check | |
Reverse shell | Monitor user process behaviors in real time to detect reverse shells caused by invalid connections. Reverse shells can be detected for protocols including TCP, UDP, and ICMP. | Y | Y | Y | Y | Linux | Real-time check | |
File privilege escalation | Check the file privilege escalations in your system. | Y | Y | Y | Y | Linux | Real-time check | |
Process privilege escalation | The following process privilege escalation operations can be detected:
| Y | Y | Y | Y | Linux | Real-time check | |
Change in critical file | Receive alarms when critical system files are modified. | Y | Y | Y | Y | Linux and Windows | Real-time check | |
File/Directory change | System files and directories are monitored. If a file or directory is modified, an alarm is generated, indicating that the file or directory may be tampered with. | Y | Y | Y | Y | Linux and Windows | Real-time check | |
Abnormal process behavior | Check the processes on servers, including their IDs, command lines, process paths, and behavior. Send alarms on unauthorized process operations and intrusions. The following abnormal process behavior can be detected:
| Y | Y | Y | Y | Linux and Windows | Real-time check | |
High-risk command execution | Receive real-time alarms on high-risk commands. | Y | Y | Y | Y | Linux and Windows | Real-time check | |
Abnormal shell | Detect actions on abnormal shells, including moving, copying, and deleting shell files, and modifying the access permissions and hard links of the files. | Y | Y | Y | Y | Linux | Real-time check | |
Suspicious crontab task | Check and list auto-started services, scheduled tasks, pre-loaded dynamic libraries, run registry keys, and startup folders. You can get notified immediately when abnormal automatic auto-start items are detected and quickly locate Trojans. | x | Y | Y | Y | Linux and Windows | Real-time check | |
Windows defender protection disabled | Detect the preparations for ransomware encryption: Disable the Windows defender real-time protection function through the registry. Once the function is disabled, an alarm is reported immediately. | Y | Y | Y | Y | Windows | Real-time check | |
Backup deletion | Detect the preparations for ransomware encryption: Delete backup files or files in the Backup folder. Once backup deletion is detected, an alarm is reported immediately. | Y | Y | Y | Y | Windows | Real-time check | |
Suspicious registry operation | Detect operations such as disabling the system firewall through the registry and using the ransomware Stop to modify the registry and write specific strings in the registry. An alarm is reported immediately when such operations are detected. | Y | Y | Y | Y | Windows | Real-time check | |
Brute-force attack defense | Check for brute-force attack attempts and successful brute-force attacks.
| Y | Y | Y | Y | Linux and Windows | Real-time check | |
Abnormal login | Check and handle remote logins. If a user's login location is not any common login location you set, an alarm will be triggered. | Y | Y | Y | Y | Linux and Windows | Real-time check | |
Invalid account | Scan accounts on servers and list suspicious accounts in a timely manner. | Y | Y | Y | Y | Linux and Windows | Real-time check | |
User account added | Detect the commands used to create hidden accounts. Hidden accounts cannot be found in the user interaction interface or be queried by commands. | Y | Y | Y | Y | Windows | Real-time check | |
Password theft | Detect the abnormal obtaining of hash value of system accounts and passwords on servers and report alarms. | Y | Y | Y | Y | Windows | Real-time check | |
Port scan | Detect scanning or sniffing on specified ports and report alarms. | x | Y | Y | Y | Linux | Real-time check | |
Host scan | Detect the network scan activities based on server rules (including ICMP, ARP, and nbtscan) and report alarms. | x | Y | Y | Y | Linux | Real-time check | |
Container intrusion detection | Vulnerability escape | An escape alarm is reported if a container process behavior that matches the behavior of known vulnerabilities is detected. | x | x | x | Y | Linux | Real-time check |
File escape | An alarm is reported if a container process is found accessing a key file directory (for example, /etc/shadow or /etc/crontab). Directories that meet the container directory mapping rules can also trigger such alarms. | x | x | x | Y | Linux | Real-time check | |
Abnormal container process |
| x | x | x | Y | Linux | Real-time check | |
Abnormal container startup | The service monitors container startups and reports an alarm if it detects that a container with too many permissions is started. Container check items include:
| x | x | x | Y | Linux | Real-time check | |
High-risk system call | You can run tasks in kernels by Linux system calls. The container edition reports an alarm if it detects a high-risk call. | x | x | x | Y | Linux | Real-time check | |
Container image blocking | If a container contains insecure images specified in the suspicious image behavior policy, before the container is started, an alarm will be generated and the insecure images will be blocked. | x | x | x | Y | Linux | Real-time check | |
Sensitive file access | The service monitors the container image files associated with file protection policies, and reports an alarm if the files are modified. | x | x | x | Y | Linux | Real-time check | |
Whitelist management | Alarm whitelist | You can add an alarm to the whitelist when handling it. | Y | Y | Y | Y | Linux and Windows | Real-time check |
Login Whitelist | Some alarms can be added to the alarm whitelist. | Y | Y | Y | Y | Linux and Windows | Real-time check | |
Policy management | Querying and editing rule configurations | You can define and issue different detection policies for different servers or server groups, implementing refined security operations.
| Y (Only the default enterprise policy group is supported.) | Y | Y | Y | Linux and Windows | Real-time check |
Security report | Server security report | Check weekly or monthly server security trend, key security events, and risks. | Y | Y | Y | Y | Linux and Windows |
|
Security configuration | Agent management | You can view the agent status of all servers and upgrade, uninstall, and install agents. | Y | Y | Y | Y | Linux and Windows | Real-time check |
Common login location | For each server, you can configure the locations where users usually log in from. The service will generate alarms on logins originated from locations other than the configured common login locations. A server can be added to multiple login locations. | Y | Y | Y | Y | Linux and Windows | Real-time check | |
Common login IP address | For each server, you can configure the IP addresses where users usually log in from. The service will generate alarms on logins originated from IP addresses other than the configured common IP addresses. | Y | Y | Y | Y | Linux and Windows | Real-time check | |
Configuring an SSH login IP address whitelist | The SSH login whitelist controls SSH access to servers to prevent account cracking. After you configure the whitelist, SSH logins will be allowed only from whitelisted IP addresses. | Y | Y | Y | Y | Linux | Real-time check | |
Malicious program isolation and removal | HSS automatically isolates and kills identified malicious programs, such as web shells, Trojans, and worms, removing security risks. | Y | Y | Y | Y | Linux and Windows | Real-time check | |
2FA | Prevent brute-force attacks by using password and SMS/email authentication. | Y | Y | Y | Y | Linux and Windows |
| |
Alarm configuration | After alarm notification is enabled, you can receive alarm notifications sent by HSS to learn about security risks facing your servers, containers, and web pages. | Y | Y | Y | Y | Linux and Windows |
|