Back to Checks
alibabacloud

Notifications are enabled for all high-risk items in Security Center

securitycenter_notification_enabled_high_risk
Service: securitycenterSeverity: medium
OfficialBuilt-inVerified
Categories:forensics-ready
Resource Type:ALIYUN::SAS::Instance

Alibaba Cloud Security Center should have all risk item notifications enabled across Vulnerability, Baseline Risks, Alerts, and AccessKey Leak event detection categories. This ensures that relevant security operators receive notifications as soon as critical security events occur, enabling timely incident response.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

Without notifications enabled for high-risk items in Security Center, security operators may not be aware of critical security events such as vulnerability discoveries, baseline violations, intrusion alerts, and AccessKey leaks in a timely manner. This leads to delayed incident response and prolonged security exposure, increasing the potential impact of threats.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks securitycenter_notification_enabled_high_risk

Recommendation

Enable notifications for all high-risk items in Security Center including vulnerabilities, baseline risks, alerts, and AccessKey leak detection to ensure timely incident response.

Remediation

CLI

aliyun sas ModifyNoticeConfig --Project <project_name> --Route <route_value>

Other

1Log on to the **Security Center Console**
2Select **Settings**
3Click **Notification**
4Enable all high-risk items on Notification setting
5Route values: `1`=text message, `2`=email, `3`=internal message, `4`=text+email, `5`=text+internal, `6`=email+internal, `7`=all methods

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.securitycenter.securitycenter_client import (
    securitycenter_client,
)


class securitycenter_notification_enabled_high_risk(Check):
    """Check if notification is enabled on all high risk items."""

    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []

        # High-risk categories based on CIS benchmark:
        # - Vulnerability: sas_vulnerability, yundun_sas_vul_Emergency
        # - Baseline Risks: sas_healthcheck
        # - Alerts: sas_suspicious, suspicious, remotelogin, webshell, bruteforcesuccess
        # - Accesskey Leak: yundun_sas_ak_leakage
        high_risk_projects = [
            "sas_vulnerability",  # Vulnerability
            "yundun_sas_vul_Emergency",  # Emergency vulnerabilities
            "sas_healthcheck",  # Baseline Risks
            "sas_suspicious",  # Alerts - Suspicious
            "suspicious",  # Alerts - Suspicious
            "remotelogin",  # Alerts - Remote login
            "webshell",  # Alerts - Webshell
            "bruteforcesuccess",  # Alerts - Brute force success
            "yundun_sas_ak_leakage",  # Accesskey Leak
        ]

        notice_configs = securitycenter_client.notice_configs

        # Check each high-risk project
        for project in high_risk_projects:
            config = notice_configs.get(project)

            report = CheckReportAlibabaCloud(
                metadata=self.metadata(), resource=config if config else {}
            )
            report.region = securitycenter_client.region
            report.resource_id = project
            report.resource_arn = f"acs:sas::{securitycenter_client.audited_account}:notice-config/{project}"

            if not config:
                # Configuration not found - may not be available or not configured
                report.status = "MANUAL"
                report.status_extended = (
                    f"Notification configuration for high-risk item '{project}' "
                    "could not be determined. Please check Security Center Console manually."
                )
            elif config.notification_enabled:
                # Route != 0 means notification is enabled
                report.status = "PASS"
                report.status_extended = (
                    f"Notification is enabled for high-risk item '{project}'."
                )
            else:
                # Route == 0 means notification is disabled
                report.status = "FAIL"
                report.status_extended = (
                    f"Notification is not enabled for high-risk item '{project}'."
                )

            findings.append(report)

        return findings

References