Back to Checks
alibabacloud

All assets have the Security Center agent installed

securitycenter_all_assets_agent_installed
Service: securitycenterSeverity: high
OfficialBuilt-inVerified
Categories:forensics-ready
Resource Type:ALIYUN::SAS::Instance

Alibaba Cloud Security Center requires an agent to be installed on each endpoint to provide comprehensive endpoint intrusion detection and protection capabilities. The agent enables remote logon detection, webshell detection and removal, anomaly detection of abnormal process behaviors and network connections, and monitoring of changes to key files and suspicious accounts.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

Assets without the Security Center agent installed become blind spots in security monitoring, as they are not protected by endpoint intrusion detection capabilities. This leaves them vulnerable to malware infections, unauthorized access, webshell attacks, and anomalous process execution without any alerts being generated.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks securitycenter_all_assets_agent_installed

Recommendation

Install the Security Center agent on all assets to enable comprehensive endpoint intrusion detection and protection, including webshell detection, anomaly detection, and remote logon monitoring.

Remediation

CLI

aliyun sas InstallUninstallAegis --InstanceIds <instance_id_1>,<instance_id_2>

Other

1Log on to the **Security Center Console**
2Select **Settings**
3Click **Agent**
4On the `Client to be installed` tab, select all items on the list
5Click **One-click installation** to install the agent on all assets

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.securitycenter.securitycenter_client import (
    securitycenter_client,
)


class securitycenter_all_assets_agent_installed(Check):
    """Check if all assets are installed with security agent."""

    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []

        uninstalled_machines = securitycenter_client.uninstalled_machines

        if not uninstalled_machines:
            # All assets have the agent installed
            report = CheckReportAlibabaCloud(metadata=self.metadata(), resource={})
            report.region = securitycenter_client.region
            report.resource_id = securitycenter_client.audited_account
            report.resource_arn = (
                f"acs:sas::{securitycenter_client.audited_account}:security-center"
            )
            report.status = "PASS"
            report.status_extended = "All assets have Security Center agent installed."
            findings.append(report)
        else:
            # Report each uninstalled machine
            for machine in uninstalled_machines:
                report = CheckReportAlibabaCloud(
                    metadata=self.metadata(), resource=machine
                )
                report.region = machine.region
                report.resource_id = machine.instance_id
                report.resource_arn = (
                    f"acs:ecs:{machine.region}:{securitycenter_client.audited_account}:instance/{machine.instance_id}"
                    if machine.instance_id.startswith("i-")
                    or "ecs" in machine.instance_id.lower()
                    else f"acs:sas:{machine.region}:{securitycenter_client.audited_account}:machine/{machine.instance_id}"
                )
                report.status = "FAIL"
                report.status_extended = (
                    f"Asset {machine.instance_name if machine.instance_name else machine.instance_id} "
                    f"({machine.instance_id}) does not have Security Center agent installed. "
                    f"Region: {machine.region}, OS: {machine.os if machine.os else 'Unknown'}."
                )
                findings.append(report)

        return findings

References