Back to Checks
alibabacloud

ECS instance has endpoint protection installed

ecs_instance_endpoint_protection_installed
Service: ecsSeverity: high
OfficialBuilt-inVerified
Categories:forensics-ready
Resource Type:ALIYUN::ECS::Instance

Alibaba Cloud Security Center provides endpoint protection for ECS instances with real-time detection and removal of malicious software. This check verifies the Security Center agent is installed and active on all ECS instances, ensuring alerts notify administrators when malicious software attempts to install or execute.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

ECS instances without endpoint protection are vulnerable to malware, viruses, webshells, and other security threats that can compromise confidentiality, integrity, and availability. Without real-time monitoring, security incidents may go undetected, allowing attackers to maintain persistent access and exfiltrate sensitive data.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks ecs_instance_endpoint_protection_installed

Recommendation

Install the Alibaba Cloud Security Center agent on all ECS instances to enable real-time endpoint protection, malware detection, and vulnerability scanning.

Remediation

CLI

aliyun sas InstallBackupClient --Uuid <instance_uuid>

Other

1Log on to the **Security Center Console**.
2Select **Settings**.
3Click **Agent**.
4On the Agent tab, select the virtual machines without Security Center agent installed.
5Click **Install**.

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.ecs.ecs_client import ecs_client
from prowler.providers.alibabacloud.services.securitycenter.securitycenter_client import (
    securitycenter_client,
)


class ecs_instance_endpoint_protection_installed(Check):
    """Check if endpoint protection for all Virtual Machines is installed."""

    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []

        # Check each ECS instance for Security Center agent
        for instance in ecs_client.instances:
            # Only check running instances
            if instance.status.lower() not in ["running", "starting"]:
                continue

            report = CheckReportAlibabaCloud(
                metadata=self.metadata(), resource=instance
            )
            report.region = instance.region
            report.resource_id = instance.id
            report.resource_arn = f"acs:ecs:{instance.region}:{ecs_client.audited_account}:instance/{instance.id}"

            # Check if Security Center agent is installed
            instance_key = f"{instance.region}:{instance.id}"
            agent = securitycenter_client.instance_agents.get(instance_key)

            if agent:
                if agent.agent_installed and agent.agent_status == "online":
                    report.status = "PASS"
                    report.status_extended = (
                        f"ECS instance {instance.name if instance.name else instance.id} "
                        "has Security Center agent installed and online."
                    )
                else:
                    report.status = "FAIL"
                    report.status_extended = (
                        f"ECS instance {instance.name if instance.name else instance.id} "
                        f"does not have Security Center agent installed or agent is {agent.agent_status}."
                    )

                findings.append(report)

        return findings

References