Overview¶
If policies such as asset collection, baseline check, and intrusion detection do not meet your server protection requirements, you can manage these policies.
Table 1 lists the policies that can be managed by each HSS edition. For details about how to configure policies, see Configuring Policies.
If you have different protection requirements, you can create a custom policy group to deploy different protection policies for different servers. For details, see Creating a Policy Group.
Function Type | Policy | Action | Supported OS | Enterprise Edition | Premium Edition | WTP Edition | Container Edition |
---|---|---|---|---|---|---|---|
Assets | Asset discovery | Scan and display all software in one place, including software name, path, and major applications, helping you identify abnormal assets. | Linux and Windows | x | Y | Y | Y |
Baseline Inspection | Weak password detection | Change weak passwords to stronger ones based on HSS scan results and suggestions. | Linux | Y | Y | Y | Y |
Configuration Check | Check the unsafe Tomcat, Nginx, and SSH login configurations found by HSS. | Linux and Windows | x | Y | Y | Y | |
Intrusions | AV detection | Check server assets and report, isolate, and kill the detected viruses. The generated alarms are displayed under Detection > Alarms > Server Alarms > Event Types > Malware. After AV detection is enabled, the resource usage is as follows: The CPU usage does not exceed 40% of a single vCPU. The actual CPU usage depends on the server status. | Windows | Y | Y | Y | x |
Container Information Collection | Collect information about all containers on a server, including ports and directories, and report alarms for risky information. | Linux | x | x | x | Y | |
Cluster Intrusion Detection | Detect container high-privilege changes, creation in key information, and virus intrusion. | Linux | x | x | x | Y | |
Web Shell Detection | Scan web directories on servers for web shells. | Linux and Windows | Y | Y | Y | Y | |
Container File Monitoring | Detect file access that violates security policies. Security O&M personnel can check whether hackers are intruding and tampering with sensitive files. | Linux | x | x | x | Y | |
Container Process Whitelist | Check for process startups that violate security policies. | Linux | x | x | x | Y | |
Suspicious Image Behaviors | Configure the blacklist and whitelist and customize permissions to ignore abnormal behaviors or report alarms. | Linux | x | x | x | Y | |
HIPS Detection | Check registries, files, and processes, and report alarms for operations such as abnormal changes. | Windows | Y | Y | Y | Y | |
File Protection | Check the files in the Linux OS, applications, and other components to detect tampering. | Linux | Y | Y | Y | Y | |
Login Security Check | Detect brute-force attacks on SSH, FTP, and MySQL accounts. If the number of brute-force attacks (consecutive incorrect password attempts) from an IP address reaches 5 within 30 seconds, the IP address will be blocked. By default, suspicious SSH attackers are blocked for 12 hours. Other types of suspicious attackers are blocked for 24 hours. You can check whether the IP address is trustworthy based on its attack type and how many times it has been blocked. You can manually unblock the IP addresses you trust. | Linux and Windows | Y | Y | Y | Y | |
Malicious File Detection |
| Linux | Y | Y | Y | Y | |
Port Scan Detection | Detect scanning or sniffing on specified ports and report alarms. | Linux | x | Y | Y | Y | |
Abnormal process behaviors | All the running processes on all your servers are monitored for you. You can create a process whitelist to ignore alarms on trusted processes, and can receive alarms on unauthorized process behavior and intrusions. | Linux | x | Y | Y | Y | |
Root privilege escalation | Detect the root privilege escalation for files in the current system. | Linux | Y | Y | Y | Y | |
Real-time Process | Monitor the executed commands in real time and generate alarms if high-risk commands are detected. | Linux and Windows | Y | Y | Y | Y | |
Rootkit Detection | Detect server assets and report alarms for suspicious kernel modules, files, and folders. | Linux | Y | Y | Y | Y |