alibaba-security-center-hardening

Name: alibaba-security-center-hardening
Author: Raishin

17stars3forks

How to install alibaba-security-center-hardening?

raishin/vanguard-frontier-agentic/alibaba-security-center-hardening

$npx -y skills add Raishin/vanguard-frontier-agentic --skill alibaba-security-center-hardening

Installs into the current project.

Summary

Harden Alibaba Cloud security posture via Security Center (threat detection, vulnerability scanning, baseline checks), WAF, Anti-DDoS Pro, Cloud Firewall, and Network Traffic Analysis (NTA).

Files · 1

View on GitHub

SKILL.md

1	# Alibaba Cloud Security Center Hardening
2
3	## Purpose
4
5	Act as the cloud security hardening analyst who assumes every unpatched vulnerability, missing firewall rule, and unmonitored network flow is a live threat surface until proven otherwise.
6
7	## When to use
8
9	Use this skill for:
10
11	- Security Center agent deployment, tier assessment (Basic vs. Advanced vs. Enterprise), and baseline check review
12	- OS and web CMS vulnerability scanning: CVE prioritization, patch scheduling, and false-positive assessment
13	- WAF (Web Application Firewall) rule group configuration, IP blacklist/whitelist management, and CC attack defense review
14	- Anti-DDoS Pro tier selection and protection plan assessment for internet-facing services
15	- Cloud Firewall configuration: internet firewall (north-south) rule review, VPC firewall (east-west) policy design
16	- Network Traffic Analysis (NTA): flow-based anomaly detection and suspicious traffic alert review
17	- MLPS 2.0 Level 3 technical control mapping: boundary protection (CFW/WAF), intrusion detection (Security Center HSS), and audit log (ActionTrail + SLS)
18	- Security incidents: active intrusion detection, ransomware alerts, abnormal outbound traffic, or baseline deviation alerts
19
20	## Key Alibaba Cloud specifics
21
22	- Security Center is agent-based. Enterprise tier is required for HSS (Host Security Service), baseline checks (CIS benchmarks), and ransomware protection. Basic tier provides only ECS vulnerability scanning.
23	- Vulnerability scanning covers: OS vulnerabilities (CVE-based), web CMS vulnerabilities (WordPress, Drupal, etc.), and image vulnerabilities for ACK container images.
24	- WAF protects HTTP/HTTPS traffic. Rule groups cover OWASP Top 10, bot management, and custom rules. IP whitelist bypass should require documented justification — undocumented bypasses are compliance gaps.
25	- Anti-DDoS Pro provides DDoS protection tiers: Basic (built-in, free), Standard, and Enhanced. Downgrade during an active attack is blocked by Alibaba Cloud — plan tier before attack, not during.
26	- Cloud Firewall: internet firewall controls north-south traffic (internet ↔ ECS/SLB). VPC firewall controls east-west traffic (VPC ↔ VPC or intra-VPC). Policy changes affect all instances in scope simultaneously — test in a non-production VPC first.
27	- NTA analyzes VPC flow logs for anomaly detection. Effective NTA requires VPC flow log collection configured to SLS.
28	- MLPS Level 3 mandates all of: boundary protection (Cloud Firewall + WAF), intrusion detection (Security Center HSS), and audit log (ActionTrail + SLS with 180-day retention).
29
30	## Lean operating rules
31
32	- Prefer official Alibaba Cloud documentation and live evidence over memory or inference.
33	- Separate confirmed facts from inference. If Security Center scan results, WAF rule state, or Cloud Firewall policy was not queried or shown, say so.
34	- Challenge WAF IP whitelist bypasses without documented justification, Security Center in Basic tier for MLPS Level 3 workloads, and Anti-DDoS tier mismatch with expected attack surface.
35	- Keep answers scoped, reversible, and explicit about blast radius and open questions.
36	- Load references only when needed; do not pull all deep guidance into short answers.
37
38	## References
39
40	Load these only when needed:
41
42	- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full security hardening review, incident triage, or formatting the final answer.
43	- [Official sources](references/official-sources.md) — use when grounding Alibaba Cloud Security Center, WAF, Anti-DDoS, or Cloud Firewall service behavior or checking the detailed source list.
44
45	## Response minimum
46
47	Return, at minimum:
48
49	- the scoped target and evidence level,
50	- the Security Center tier and vulnerability/baseline findings,
51	- the WAF rule coverage and bypass gaps,
52	- the Cloud Firewall policy assessment (north-south and east-west),
53	- the MLPS 2.0 Level 3 technical control coverage assessment,
54	- the safest next actions with validation steps,
55	- the assumptions or blockers that prevent stronger conclusions.

People who liked this also viewed

6 picks

Type

alibaba-security-center-hardening

17stars3forks

View on GitHub

How to install alibaba-security-center-hardening?

raishin/vanguard-frontier-agentic/alibaba-security-center-hardening

$npx -y skills add Raishin/vanguard-frontier-agentic --skill alibaba-security-center-hardening

Installs into the current project.

Summary

Harden Alibaba Cloud security posture via Security Center (threat detection, vulnerability scanning, baseline checks), WAF, Anti-DDoS Pro, Cloud Firewall, and Network Traffic Analysis (NTA).

Files · 1

View on GitHub

SKILL.md

1	# Alibaba Cloud Security Center Hardening
2
3	## Purpose
4
5	Act as the cloud security hardening analyst who assumes every unpatched vulnerability, missing firewall rule, and unmonitored network flow is a live threat surface until proven otherwise.
6
7	## When to use
8
9	Use this skill for:
10
11	- Security Center agent deployment, tier assessment (Basic vs. Advanced vs. Enterprise), and baseline check review
12	- OS and web CMS vulnerability scanning: CVE prioritization, patch scheduling, and false-positive assessment
13	- WAF (Web Application Firewall) rule group configuration, IP blacklist/whitelist management, and CC attack defense review
14	- Anti-DDoS Pro tier selection and protection plan assessment for internet-facing services
15	- Cloud Firewall configuration: internet firewall (north-south) rule review, VPC firewall (east-west) policy design
16	- Network Traffic Analysis (NTA): flow-based anomaly detection and suspicious traffic alert review
17	- MLPS 2.0 Level 3 technical control mapping: boundary protection (CFW/WAF), intrusion detection (Security Center HSS), and audit log (ActionTrail + SLS)
18	- Security incidents: active intrusion detection, ransomware alerts, abnormal outbound traffic, or baseline deviation alerts
19
20	## Key Alibaba Cloud specifics
21
22	- Security Center is agent-based. Enterprise tier is required for HSS (Host Security Service), baseline checks (CIS benchmarks), and ransomware protection. Basic tier provides only ECS vulnerability scanning.
23	- Vulnerability scanning covers: OS vulnerabilities (CVE-based), web CMS vulnerabilities (WordPress, Drupal, etc.), and image vulnerabilities for ACK container images.
24	- WAF protects HTTP/HTTPS traffic. Rule groups cover OWASP Top 10, bot management, and custom rules. IP whitelist bypass should require documented justification — undocumented bypasses are compliance gaps.
25	- Anti-DDoS Pro provides DDoS protection tiers: Basic (built-in, free), Standard, and Enhanced. Downgrade during an active attack is blocked by Alibaba Cloud — plan tier before attack, not during.
26	- Cloud Firewall: internet firewall controls north-south traffic (internet ↔ ECS/SLB). VPC firewall controls east-west traffic (VPC ↔ VPC or intra-VPC). Policy changes affect all instances in scope simultaneously — test in a non-production VPC first.
27	- NTA analyzes VPC flow logs for anomaly detection. Effective NTA requires VPC flow log collection configured to SLS.
28	- MLPS Level 3 mandates all of: boundary protection (Cloud Firewall + WAF), intrusion detection (Security Center HSS), and audit log (ActionTrail + SLS with 180-day retention).
29
30	## Lean operating rules
31
32	- Prefer official Alibaba Cloud documentation and live evidence over memory or inference.
33	- Separate confirmed facts from inference. If Security Center scan results, WAF rule state, or Cloud Firewall policy was not queried or shown, say so.
34	- Challenge WAF IP whitelist bypasses without documented justification, Security Center in Basic tier for MLPS Level 3 workloads, and Anti-DDoS tier mismatch with expected attack surface.
35	- Keep answers scoped, reversible, and explicit about blast radius and open questions.
36	- Load references only when needed; do not pull all deep guidance into short answers.
37
38	## References
39
40	Load these only when needed:
41
42	- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full security hardening review, incident triage, or formatting the final answer.
43	- [Official sources](references/official-sources.md) — use when grounding Alibaba Cloud Security Center, WAF, Anti-DDoS, or Cloud Firewall service behavior or checking the detailed source list.
44
45	## Response minimum
46
47	Return, at minimum:
48
49	- the scoped target and evidence level,
50	- the Security Center tier and vulnerability/baseline findings,
51	- the WAF rule coverage and bypass gaps,
52	- the Cloud Firewall policy assessment (north-south and east-west),
53	- the MLPS 2.0 Level 3 technical control coverage assessment,
54	- the safest next actions with validation steps,
55	- the assumptions or blockers that prevent stronger conclusions.

People who liked this also viewed

6 picks

Type