This topic describes the limits of Security Center.
Limits on threat detection
Security Center sends alerts in real time when risks are detected. You can manage security alerts, scan for and fix vulnerabilities, analyze attacks, and perform configuration assessment in the Security Center console. Security Center can analyze alerts and trace attacks. This reinforces the security of your assets. To protect your assets against attacks, we recommend that you regularly install the latest security patches on your server, and use other security services together with Security Center, such as Cloud Firewall and Web Application Firewall (WAF).
After you install the Security Center agent on a server, the defense process of Security Center requires a specific period of time to take effect on the server. During this period of time, Security Center cannot block threats such as ransomware and DDoS trojans.
Attacks and viruses are always changing, and actual workloads run in different environments. Therefore, Security Center cannot ensure that all unknown threats are detected in real time. We recommend that you use Security Center features such as alerting, vulnerability detection, baseline check, and configuration assessment to enhance security and prevent intrusions, data thefts, and data damage.
Logstore limits
All logs of Security Center are stored in a dedicated Logstore.
You cannot use Log Service API or SDK to import data to the dedicated Logstore or modify the attributes of the Logstore, such as the retention period.
The Logstore has no limits on queries, statistics, alerts, or streaming consumption.
The Logstore does not incur charges if Log Service does not have overdue payments.
The default reports may be updated in later versions.