Service specifications Applicable scene Service Content MDR Basic Edition Only security consulting and daily security monitoring services are required. Security product monitoring Security status monitoring of cloud security center, cloud firewall, web application firewall, and DDoS protection. Exposed asset security Website availability monitoring, exposed IP and port monitoring. event handling Quarterly emergency response services (on demand). External security monitoring Emergency vulnerability notification, AK leak monitoring, sensitive data leak monitoring, content risk monitoring, and source code leak monitoring. MDR Enterprise Edition It is suitable for scenarios with high security protection requirements and builds a comprehensive security operation system. Covers the capabilities of MDR Advanced Edition and supports the following capabilities: Vulnerability classification and hierarchical management Vulnerability grading scheme based on vulnerability scanning, cloud security center, and Alibaba Cloud best practices. Threat analysis Honeypot intelligence analysis, cloud platform intelligence analysis, external monitoring analysis. Security hardening Patch repairs, configuration repairs, cloud security product upgrades or upgrade recommendations. Safety training empowerment Large safety screen, daily consultation, safety training. MDR Ultimate Edition It is suitable for the staged escort scenarios of key businesses during major events, such as: Large-scale offensive and defensive drills organized by regulatory agencies, industry leaders, etc. Security activities for major national and government events or conferences. Company anniversary celebrations, new product launches, major promotions, IPO and other business security guarantees, etc. Covers the capabilities of MDR Advanced Edition and supports the following capabilities: Security plan design Tailor-made security protection plans based on the security objectives of the security protection objects. Assessment and reinforcement guidance Conduct comprehensive safety inspections on key systems and guide customers to perform safety optimization. 7*24 hours security guard During the escort period, 7*24-hour security experts will be provided online on demand to provide timely response to security incidents and provide daily escort safety daily reports. security emergency response Coordinate the Alibaba Cloud security expert team to quickly respond to security incidents once they occur and reduce the impact of security incidents.

One-click hosting, full-stack operation

Big data blessing

Advantages of scale

Minute-level emergency response

Service classification Service Content Delivery content details Deliver output SLA Security consulting Provide consulting services related to security products such as basic security product (Advanced Defense, WAF, Cloud Wall, Cloud Security Center, etc.) configuration issues, policy anomaly analysis, abnormal event handling and other consulting services. Troubleshooting cloud security product anomalies Ding group and housekeeper console notification information push. Summarize and reflect in relevant daily reports. 5*8 working days, providing on-demand consultation response within 30 minutes and completing a closed loop of consultation work orders within 72 hours. Cloud product strategy tuning guidance Consulting on cloud security product issues Security risk assessment Assess the overall security of the cloud and help users discover cloud security risks by analyzing several major risks and exposures on the cloud. Security Operations Capability Assessment Evaluate security maturity through interviews, surveys, etc., and provide security construction suggestions. Provide a "Safety Assessment Report". Once every quarter Network Architecture Risk Assessment Check the rationality of network control access policies and provide policy optimization suggestions for unreasonable policies. Provide a "Safety Assessment Report". Provide "Vulnerability Scanning Report". Continuously provide users with security risk monitoring and repair and reinforcement suggestions, and assist users in repair risk assessment and reinforcement content. During the service period, assessments will be completed monthly. Cloud product security assessment The cloud host performs baseline inspections and risk management, and outputs repair suggestions and risk management best practices, including system vulnerability inspections. Exposure surface/attack surface risk assessment Systematically provides periodic asset exposure, vulnerability detection and management services for cloud hosts and cloud businesses, manually analyzes report content, and outputs repair guidance and risk management best practices, including: public network exposure risks, high-risk port scanning, and Web vulnerabilities scanning. Account security risk assessment Detection and assessment of risks related to AK leakage. Application system security risk assessment Cloud security product configuration risk assessment Security Monitoring Monitor and analyze alarm events, launch alarms in the form of pin groups, manage alarms in the form of work orders, and help users filter out false alarms, false alarms and other issues. Analyze and judge alarms, and provide security opinions based on current business. Monitor the security status of cloud security products. Includes web application firewall, DDoS protection, cloud security center, and cloud firewall. Asset security status monitoring for multi-cloud and IDC access. Provide "Security Monitoring Service Report". Ding group and housekeeper console notification information push. 5*8 working days: 30 minutes to respond to alarms, complete alarm closed-loop processing on the same day, and inspect the cloud security center, cloud firewall, and DDoS every 15 minutes. Security hardening Based on the actual alarm situation and relevant industry standards, we assist users in quickly implementing security reinforcement after a security incident occurs. Security product configuration service: Helps users access security products and configure policies. The output is incorporated into the "Security Assessment Report", "Risk Tracking Form" and "Security Vulnerability Hardening List". have Emergency Response After a security incident occurs, we provide containment, eradication, and recovery methods, as well as prevention and security suggestions to help find the source of the attack and the cause of the intrusion. Security incident emergency response. After the emergency response is completed, an "Emergency Response Report" will be provided. Trigger conditions include the following two types of scenarios: Users proactively request emergency response support. Security experts discovered anomalies and initiated emergency response. Yes (provided by users with orders more than three months old). 5*8 working days: respond proactively to identify risks within 30 minutes, respond passively 24/7, provide improvement suggestions within 2 hours, and complete report output within 72 hours. Vulnerability Notice It provides 0day vulnerability impact detection based on vulnerability detection rules, and provides impact analysis based on the current host's network status, host status, etc. Latest vulnerability intelligence monitoring, analysis and early warning: When new high-risk vulnerability events affecting user assets are detected on the Internet, early warnings and repair plans will be analyzed and issued to remind users to repair them. DingTalk group and housekeeper console notification information push. Provide "Emergency Vulnerability Inspection Notice". Continue daily. Monitoring vulnerability reports are delivered from time to time. Product training Provide cloud security product capabilities, best practices and other related training. The following services are provided on demand: Cloud security products use best practices once Remote training time 30 minutes Provide "training materials". have Visual Portal Provide visualization, management, monitoring, and collaborative security butler service platform. none Security Manager Console have Summary and Report Provide cloud security situation reports in various formats such as monthly, quarterly, and semi-annual summaries, optimize product rules, and communicate at monthly, quarterly, and semi-annual meetings based on the current situation. none Provide the following work summary and content report: "Safety Service Daily" "Security Service Weekly" "Safety Service Monthly Report" "Security Service Quarterly Report" "Security Service Annual Report" Corresponding reports are provided on a regular basis.

Service classification Service Content Delivery content details Deliver output Alibaba Cloud’s new SOW and SLA Security consulting Provide consulting services related to security products such as basic security product (Advanced Defense, WAF, Cloud Wall, Cloud Security Center, etc.) configuration issues, policy anomaly analysis, abnormal event handling and other consulting services. Troubleshooting cloud security product anomalies DingTalk group and housekeeper console notification information push. Summarize and reflect in relevant daily reports. have 5*8 working days, providing on-demand consultation response within 30 minutes and completing a closed loop of consultation work orders within 72 hours. Cloud product strategy tuning guidance Consulting on cloud security product issues Security Monitoring Monitor and analyze alarm events, launch alarms in the form of pin groups, manage alarms in the form of work orders, and help users filter out false alarms, false alarms and other issues. Analyze and judge alarms, and provide security opinions based on current business. Monitor the security status of cloud security products. Includes web application firewall, DDoS protection, cloud security center, and cloud firewall. Asset security status monitoring for multi-cloud and IDC access. Provide "Security Monitoring Service Report". Ding group and housekeeper console notification information push. 5*8 working days: 30 minutes to respond to alarms, complete alarm closed-loop processing on the same day, and inspect the cloud security center, cloud firewall, and DDoS every 15 minutes. Vulnerability Notice It provides 0day vulnerability impact detection based on vulnerability detection rules, and provides impact analysis based on the current host network status, host status, etc. Latest vulnerability intelligence monitoring, analysis and early warning: When new high-risk vulnerability events affecting user assets are detected on the Internet, analysis will be carried out and early warnings and repair plans will be issued to remind users to repair them. DingTalk group and housekeeper console notification information push. Provide "Emergency Vulnerability Inspection Notice". Continue daily Irregular delivery Summary and Report Provide cloud security situation reports in various formats such as monthly, quarterly, and semi-annual summaries, optimize product rules, and communicate at monthly, quarterly, and semi-annual meetings based on the current situation. none Provide the following work summary and content report: "Security Service Biweekly Report" "Safety Service Monthly Report" "Security Service Annual Report" Corresponding reports are provided on a regular basis.