Cloud Workload Protection Platform

Cloud Workload Protection Platform
Product Introduction
Product Documentation©2013-2022 Tencent Cloud. All rights reserved.

Page 1 of 24

Cloud Workload Protection Platform

Copyright Notice©2013-2024 Tencent Cloud. All rights reserved.
Copyright in this document is exclusively owned by Tencent Cloud. You must not reproduce, modify, copy or distributein any way, in whole or in part, the contents of this document without Tencent Cloud's the prior written consent.
Trademark Notice

All trademarks associated with Tencent Cloud and its services are owned by Tencent Cloud Computing (Beijing)
Company Limited and its affiliated companies. Trademarks of third parties referred to in this document are owned bytheir respective proprietors.
Service Statement
This document is intended to provide users with general information about Tencent Cloud's products and services
only and does not form part of Tencent Cloud's terms and conditions. Tencent Cloud's products or services are
subject to change. Specific products and services and the standards applicable to them are exclusively provided for in
Tencent Cloud's applicable terms and conditions.

©2013-2022 Tencent Cloud. All rights reserved.

Page 2 of 24

Cloud Workload Protection Platform

Contents
Product Introduction
Overview
Advantages
Basic Concepts
Scenarios
Associated Products
Features in Different Editions©2013-2022 Tencent Cloud. All rights reserved.

Page 3 of 24

Cloud Workload Protection Platform

Product Introduction
Overview：

Last updated 2023-12-26 16:17:43
﻿This document describes the basics of CWPP.

Overview
Cloud Workload Protection Platform (CWPP) leverages the massive amount of threat data accumulated by Tencent
Security and uses machine learning algorithms to provide security services for servers. It can detect and block bruteforce attacks, abnormal logins, Trojan files, high-risk vulnerabilities, and more.

Qualifications
CWPP has obtained a number of international authoritative certifications such as and CSA CSTR (CSA, Cloud Sec
Tech Review).
VB100: Certified 42 times in a row with 100% pass rate
AV-C: 29 A+ ratings, Top Rated product for three consecutive years
Gartner: Listed in the Market Guide for Cloud Workload Protection Platforms
AMTSO: Member of Anti-Malware Testing Standards Organization (AMTSO)
AVAR: Member of Association of Anti-Virus Asia Researchers (AVAR)
EICAR: Member of European Institute for Computer Anti-Virus Research (EICAR)

How it Works
Install the CWPP agent on the server to .
When you start a detection task on the CWPP console, the agent will execute the task and return data. You can checkand process the security events on the CWPP console.

©2013-2022 Tencent Cloud. All rights reserved.

Page 4 of 24

Cloud Workload Protection Platform

Term

Description
A cloud-native security system independently developed by Tencent Cloud,<br> which

CWPP console

provides a one-stop cloud workload protection solution (prevention-defense-detectionresponse).

©2013-2022 Tencent Cloud. All rights reserved.

Page 5 of 24

Cloud Workload Protection Platform

Agent

Official security plugin for CWPP, which can be used for servers running in a hybrid
cloud.<br> It syncs risk information to CWPP in real time and performs detection orprocess tasks issued by the CWPP Console.

Tencent Cloud
servers
Non-Tencent Cloud
servers

CVM, Lighthouse, and ECM.

Third-party servers and IDC servers.
Cloud Workload Protection Platform (CWPP) is a security information processing center
that continuously checks and analyzes the information returned by different servers. It
boasts six core security capabilities to check servers from various dimensions.
1. TAV Engine: Efficiently detects and removes binary Trojan viruses.
2. BinaryAI Engine: The binary search engine built on the deep learning algorithm for

CWPP

efficient detection and removal of malicious samples.
3. Cloud Security Engine: Efficiently detects and removes the popular Trojans and virus
files both at home and aboard based on the deep self-learning algorithm and multiengine cloud virus detection mechanism.
4. Threat Intelligence Engine: Built on a large threat intelligence library that keeps
updated to help identify malicious files, IPs, and domain names.
5. Anti-Attack Engine: Detects cyber attacks in real time, including Webshell detection,
Struts vulnerability exploitation, code repository pulling, code injection attacks, and brute
force cracking. Provides auto defense capabilities.
6. Unusual Behavior Engine: Matches unusual behavior characteristics and detects
multi-behavior threats in real time to facilitate real-time detection and alarm of malicious
intrusion events.

Editions
CWPP is available in Basic, Pro and Ultimate editions. For more information on the features in different editions, see
Features in Different Editions.

How to Use
After registering a Tencent Cloud account, you can configure security protection settings on the CWPP Console. For
more information about console operations, see Operation Guide.

©2013-2022 Tencent Cloud. All rights reserved.

Page 6 of 24

Cloud Workload Protection Platform

Advantages：

Last updated 2023-12-26 16:17:58
﻿This document describes the advantages of CWPP.

Advantages
Tencent Cloud CWPP has the following advantages:
Advantage

Hacking behavior
detection

Trojan file detection

Installation and ops free

Tencent Cloud CWPP
Based on the threat data collected from the entire
Internet, CWPP is able to detect hacker attacks
in real time.

Other host security products
Determination is made basedon the single-server behavior
data with weak detection
ability and slow response.

The CWPP backend is integrated with the new-In the absence of the ability
to detect executable

gen TAV anti-virus engine of Tencent PC
Manager and the Hubble Analysis System tomalicious files, WebShell
detection is only conducted

respond to unknown risks instantly. Its machine

based on regular expressions

learning-based WebShell detection engine caneffectively combat encrypted and disguisedand character logic
matching, which can lead tomalicious scripts.

a lot of false positives andfalse negatives.

The ops information of cloud platform servers can

You need to log in to

be automatically associated, which can be used
after you purchase a CVM, Lighthouse, or ECM

individual servers to manually
install the product, andinstance. Security policies are automatically
updated in the cloud, with no manual

personnel with certain
security knowledge are

maintenance of various security detection scripts

required to configure security

required.

policies.

Security events can be managed in the console inCentralized
managementa centralized manner, eliminating your need tolog in to multiple servers. Centralized

You need to log in to
individual servers to address

management of server assets enables you tosecurity events one by one.

quickly construct a visualized security platform.
Low resource

With self-developed lightweight agents, CWPP

Software clients consume aconsumption

carries out most of its computing and protection

high amount of memory
resources (generally over©2013-2022 Tencent Cloud. All rights reserved.

Page 7 of 24

Cloud Workload Protection Platformworkload in the cloud, ensuring low consumptionof server resources.

100 MB), which may
compromise server
performance during peak
hours.

©2013-2022 Tencent Cloud. All rights reserved.

Page 8 of 24

Cloud Workload Protection Platform

Basic Concepts：

Last updated 2023-12-26 16:18:06
﻿This document describes the basic concepts of CWPP.

Basic Concepts
Common concepts of CWPP are as follows.

Security baseline
A security baseline is a specific set of standards and basic requirements that relevant system and service security
configurations must meet to satisfy security needs. Projects of different configurations and policies, such as accountconfiguration security, password configuration security, authorization configuration, log configuration, and network
configuration, are used to evaluate whether a product has met the security baseline. The evaluation result reflects theserver security to some extent.

Trojan virus
A Trojan virus is a piece of malicious code or a backdoor program hidden in legitimate applications that has thecapability to destroy and delete files, send passwords, record keystrokes, and launch DDoS attacks among others.

WebShell
WebShell is a command execution environment that exists as webpage files such as .asp, .php, .jsp or .cgi files, and isa type of web backdoor. After gaining access to a website, hackers usually mix the backdoor files with the normal
webpage files in the WEB directory of the website server, thus gaining access to the asp or php backdoor with thebrowser, and getting a command execution environment to control the website server.

Vulnerability detection
Host vulnerability detection refers to the method of a CWPP agent to detect vulnerabilities on a server. The
vulnerability detection module runs on the server and can directly verify or collect information to determine whether theserver has vulnerabilities.

System component
In a general sense, a component (or common component) at the server layer refers to a web container or software
program corresponding to a service or application, such as Nginx and WordPress. A system component mainly refers
to non-web system software.

Common component vulnerability©2013-2022 Tencent Cloud. All rights reserved.

Page 9 of 24

Cloud Workload Protection Platform

A common component vulnerability (aka common vulnerability) mainly refers to a vulnerability in a common
component instead of business code, such as SQL injection in WordPress and ShellShock in a component's Bash.

Unauthorized access
Unauthorized access is a type of problems caused by failure to meet the security baseline and mainly refers to thelack of restrictions on the conditions for access to certain services, such as password setting and access source
restriction. In this case, anyone can directly connect to the service and perform operations, resulting in security
problems.

Abnormal login
With RDP and SSH login logs collected from the server, information such as login source IP, login username, login
time, and login location is reported to the cloud for risk assessment, so as to send alarms against illegal logins in realtime.

File isolation
The isolation technology is to isolate and store malicious Trojans and virus files to prevent them from spreading.

©2013-2022 Tencent Cloud. All rights reserved.

Page 10 of 24

Cloud Workload Protection Platform

Scenarios：

Last updated 2023-12-26 16:18:14
﻿This document describes the common use cases of CWPP.

Scenarios
When your server is compromised, you will face the following security risks:Business interruption: Databases and files are tampered with or deleted, resulting in inaccessible services and systemparalysis.
Data theft: Hackers steal your data and sell it publicly, leading to customer privacy leaks, and thus causing customer
churn and damage to your brand image.
File encryption by ransomware: Hackers intrude into your server and implant irreversible ransomware to encrypt yourdata for ransom.
Service instability: Hackers run mining programs and DDoS Trojans on your server to gain financial benefits, which
consumes a large amount of system resources, thus causing the failure of the server to provide services.
CWPP can effectively prevent the above problems and ensure the security of your servers.

©2013-2022 Tencent Cloud. All rights reserved.

Page 11 of 24

Cloud Workload Protection Platform

Associated Products：

Last updated 2023-12-26 16:18:57
﻿This document describes Tencent Cloud products associated with CWPP.

Associated Products
The following Tencent Cloud products are involved while using CWPP:
Tencent Cloud product

CWPP feature
involved

CVM

Description

Lighthouse
ECM

All features

CVM, Lighthouse, and ECM are all computing services
provided by Tencent Cloud and are protected by CWPP.

Cloud Block Storage

Vulnerability fix

The auto fix of vulnerabilities feature of CWPP requires
snapshot backup, which is supported by CBS.

©2013-2022 Tencent Cloud. All rights reserved.

Page 12 of 24

Cloud Workload Protection Platform

Features in Different Editions：

Last updated 2024-05-10 09:41:10
The features of different CWPP editions are listed below.

Category

FeatureDescription

CWPP

CWPP Pro

CWPP Ultimate

Basic
Free of

Monthly
subscription: 12

Monthly
subscription: 27

charge

USD/license/month

USD/license/month

✓

✓

✓

✓

✓

✓

✓

✓

✓

Displays thehealth score,protection
status,Security
Dashboard

Security
Dashboard

pending risks,risk trend,
and new
security
incidents inreal time.

Asset

Displays theManagement

statistics of allservers andasset
fingerprints,
as well as top

Asset
DashboardServer List

5 accounts,
ports,
processes,
softwareapplications,
databases,
Webapplications,
Web services,Web
frameworks,
and Websites.
Displays theinformation of
all servers
connected to©2013-2022 Tencent Cloud. All rights reserved.

Page 13 of 24

Cloud Workload Protection Platform

CWPP,
helping you
get a full
picture of the
security
status of yourassets.
Providesdetailed asset
inventory data
about server
resource
monitoring,accounts,
Asset
Fingerprint

ports, andprocesses×and helps you
quickly✓✓

Supports 10 kinds

Supports 15 kindsof fingerprints

of fingerprints✓
Supports detection(no auto isolation)✓
Supports
detection, and auto

investigate
the risks of
security
events thathaveoccurred.
Intrusion
Detection

Malicious
File Scan

Webshell
detection:
Detects✓
Detects
at most 5

common web
script Trojans
andrisks forfree

isolation

backdoors,
covering
various script
languages
such as ASP,
PHP, JSP,
and Python.
Binary virus
and Trojan
detection:
Detectsbinaryexecutableviruses and©2013-2022 Tencent Cloud. All rights reserved.

Page 14 of 24

Cloud Workload Protection Platform

Trojans suchas DDoS
Trojans,
remotecontrol, andminingsoftware on.exe, .ddl, and.bin files, andsends alarms.
Password
Cracking

Supports realtime
detection,✓
Supports
detection

alarm, andblocking ofbrute force

only (noblocking)✓
Supports detection
and auto blocking✓
Supports detection
and auto blocking

attacks on
SSH and
RDP, andlogin allowlist
configuration.
Supports
user-defined
blocking rules
for brute force
attacks, suchas rules todetect brute
force attacks
5 times within
1 minute andblock theattacks
detected for
15 minutes.
Records
events,including thecracking
status, server,
attacker IP,
attack source,login
username,©2013-2022 Tencent Cloud. All rights reserved.

Page 15 of 24

Cloud Workload Protection Platform

attack time,number of
attackattempts andblocking
status.
Detects logins
in real time,andautomatically
identifies non-

UnusualLogin

allowlist IP
logins andmalicious
logins.
Supports

✓

✓

✓

×

✓

✓

×

✓

✓

allowlist
configurationin terms oflogin source,
source IP,
server, login
username andlogin time.
Detects theserver's

Malicious
Requests

internal orexternal
connection
requests withmalicious
domainnames in realtime, provides
threat source
informationand eventrecords, andsends alarms
automaticallyto users.

Local

Supports real-

Privilegetime alarms©2013-2022 Tencent Cloud. All rights reserved.

Page 16 of 24

Cloud Workload Protection Platform

Escalation

for local
privilege
escalation,
and allowlist
configuration.
Records
events,including theserver name,privilege
escalation
user, privilege
escalation
process,parentprocess,parentprocess user,
discovery
time, file pathand process
tree.
Supports realtime alarms
for reverseshells, andallowlist

ReverseShell

configuration.
Records
events,including theserver name,connection
process,parentprocess,
target server,
target port,

×

✓

✓

×

✓

✓

discovery
time, file path,
process tree
and executioncommands.
High-risk

Records the©2013-2022 Tencent Cloud. All rights reserved.

Page 17 of 24

Cloud Workload Protection Platform

Commands

bash
commandexecuted on
the CVM, andmonitorspotentially
dangerous
operationsaligning withthe audit rules
in real time.
Providesdefault rules
and userdefined rules.
Records
events,including theserver name,matched rule
name, threat
level,
commandcontent, login
user and
operation
time.

Vulnerability
Management

UrgentVulnerability

Detects
recent urgent
vulnerabilities(such as zero-✓
Detects
at most 5

day attacks).
Displaysrisks forfree✓
Supports detection(no fixing)✓
Supports detection
and partial fixing

vulnerability
details,
including thevulnerability
description,
vulnerability
type, threat
level, fix
scheme,reference link,
disclosure©2013-2022 Tencent Cloud. All rights reserved.

Page 18 of 24

Cloud Workload Protection Platform

event, CVE
number,CVSS score,and radar
chart.
Detects gnutls
resource
management
errors andother common
Linuxsoftwarevulnerabilities
and provides
fix schemes.
DisplaysLinuxvulnerability
details,

SoftwareVulnerability

including thevulnerability
description,
vulnerability
type, threat
level, fix
scheme,reference link,
disclosure
event, CVE
number,CVSS score,and radar
chart.

Windows

Detects andSystemVulnerability

provides fix
schemes for
Windows
systemvulnerabilities
by syncing thepatch sourceson Microsoft's
official
website inreal time, to©2013-2022 Tencent Cloud. All rights reserved.

Page 19 of 24

Cloud Workload Protection Platform

prevent
hackers fromattacking or
threatening
your server
through thevulnerabilities.
Displaysvulnerability
details,
including thevulnerability
description,
vulnerability
type, threat
level, fix
scheme,reference link,
disclosure
event, CVE
number,CVSS score,and radar
chart.
Web-CMS
Vulnerability

ChecksphpMyAdmin,
WordPress
and other web
components
for commonWebvulnerabilities
and provides
fix schemes.
Displaysvulnerability
details,
including thevulnerability
description,
vulnerability
type, threat
level, fix
scheme,©2013-2022 Tencent Cloud. All rights reserved.

Page 20 of 24

Cloud Workload Protection Platformreference link,
disclosure
event, CVE
number,CVSS score,and radar
chart.
Providesweak
password
detection forsystemservices, aswell asvulnerability
detection forsystem andapplication
services.

Application
Vulnerability

Displaysvulnerability
details,
including thevulnerability
description,
vulnerability
type, threat
level, fix
scheme,reference link,
disclosure
event, CVE
number,CVSS score,and radar
chart.

Security
Baseline

CIS BaselineStandard

Supports
baseline✓
Detects✓
Supports detection✓
Supports detection

at most 5
risks for(no customization)and customization

Tencent

checksagainst CIS

CloudBaseline

and weakfreeStandard

passwords,
and provides
fix schemes.

©2013-2022 Tencent Cloud. All rights reserved.

Page 21 of 24

Cloud Workload Protection Platform

Weak
Password

Displays
check results,

Baseline

including thecheck server,
check items,baseline passrate, top 5
baselinecheck items
and top 5
server risks,and supports
periodic andquick checks.
You canconfiguremonitoring
rules for core
files and view
and processmonitoring
events. You

AdvancedCore File

DefenseMonitoring

can also
configure theallowlist to

×

×

✓

View thedetails of all

× Valueadded

× Value-added
billing

× Value-added
billing

stored traffic
logs. Log

billingallow
permitted
access tofiles. (Onlyoperatingsystems withLinux kernel
3.10 or abovearesupported.)

Value-Added
Service

Log Analysis

search andquery basedon searchstatementsare©2013-2022 Tencent Cloud. All rights reserved.

Page 22 of 24

Cloud Workload Protection Platform

supported.
Report andstatisticalanalysisservices areprovided.
Supports

Alarm
Notificationalarm
notifications
via SMS andemail, and

✓

✓

✓

✓

✓

✓

✓

✓

✓

lists of alarm
events.
If you havepurchased the
CWPP Pro or
CWPP
Ultimate, you
can bind theSettings

LicenseManagement

server to
upgrade its
protectionlevel on the
LicenseManagement
page. Youcan also
unbind an
upgradedserver.

Performance

Each agent
requires low
resource
usage with
Resource

CPU usage
below 5% andConsumption

memorybelow 30 MB,
which does
not affect thesystemperformance.

©2013-2022 Tencent Cloud. All rights reserved.

Page 23 of 24

Cloud Workload Protection Platform

High Stability

With a high-

✓

✓

✓

✓

✓

✓

reliability andhigh-stability
system, CVM
canimplement
mechanisms
such asdowngrade or
suicide toensure theavailability of
yourbusiness.
Compatible
MultiOperating
System
Supportwith major
operatingsystems suchas Windows,
CentOS,
Debian, andRedHat.

©2013-2022 Tencent Cloud. All rights reserved.

Page 24 of 24