Creating/Editing a Model

Scenario

SecMaster can use models to monitor log data in pipelines. If the data is not within the model scope, an alert is generated.

This topic describes how to create and edit an alert model.

• Creating an Alarm Model Using an Existing Template
• Creating a Custom Alert Model
• Editing a Model

Limitations and Constraints

• A maximum of 100 alert models can be created in a single workspace under a single account in a single region.
• The running interval of an alert model must be greater than or equal to 5 minutes, and the time range for querying data must be less than or equal to 14 days.

Creating an Alarm Model Using an Existing Template

1. Log in to the management console.
2. Click in the upper left corner of the page and choose Security & Compliance > SecMaster.
3. In the navigation pane, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
   Figure 1 Workspace management page
   

4. In the navigation tree on the left, choose Threat Operations > Intelligent Modeling. On the Intelligent Modeling page that is displayed, click the Model Templates tab. The Model Template page is displayed.
   Figure 2 Model Templates tab page
   

5. In the model template list, click Details in the Operation column of the target model template. The template details page is displayed on the right.
   Figure 3 Model Template Details
   

6. On the model template details page, click Create Model in the lower right corner. The page for creating an alert model is displayed.
7. On the Add Alarm Model page, configure basic information about the alert model. For details about the parameters, see Table 1.
   Figure 4 Perform basic configurations
   

   Table 1 Basic alert model parameters

   Parameter	Description
   Pipeline Name	Select the execution pipeline of the alert model.
   Model Name	Name of the alert model.
   Severity	Severity of the alert model. You can set the severity to Critical, High, Medium Low, or Informative.
   Alarm Type	Alarm type displayed after the alert model is triggered.
   Model Type	The default value is Rule model.
   Description	Description of the alert model
   Status	Indicates whether to enable the alert model. : indicates that the model is enabled. This is the default status. : indicates that the model is disabled. The status set here can be changed after the entire alert model is set successfully.

8. After the setting is complete, click Next in the lower right corner of the page. The page for setting the model logic is displayed.
9. Set the model logic. For details about the parameters, see Table 2.
   Figure 5 Configure Model Logic
   

   Table 2 Configure Model Logic

   Parameter	Description
   Query Rule	Set alert query rules. After the setting is complete, click Run and view the running result.
   Query Plan	Set an alert query plan. Running query interval: xx minutes/hour/day. If the running query interval is minute, set this parameter to a value ranging from 5 to 59 minutes. If the running query interval is hour, set this parameter to a value ranging from 1 to 23 hours. If the running query interval is day, set this parameter to a value ranging from 1 to 14 days. Time window: xx minutes/hour/day. If the time window is minute, the value ranges from 5 minutes to 59 minutes. If the time window is hour, the value ranges from 1 hour to 23 hours. If the time window is day, the value ranges from 1 day to 14 days. Execution Delay: xx minutes. The value ranges from 0 to 5 minutes.
   Advanced Alarm Settings	Custom Information: Customize extended alert information. Click Add, and set the key and value information. Alarm Details: Enter the alarm name, description, and handling suggestions.
   Trigger Condition	Sets alert triggering conditions. The value can be greater than, equal to, not equal to, or less than xx. If there are multiple triggers, click Add.
   Alarm Trigger	The way to trigger alerts for queried results. The options are as follows: One alert for all query results One alert for each query result
   Debugging	Sets whether to generate debugging alarms.
   Suppression	Specifies whether to stop the query after an alert is generated. : indicates that the query stops after an alert is generated. : indicates that the query is not stopped after an alert is generated.

10. After the setting is complete, click Next in the lower right corner of the page. The model details preview page is displayed.
11. After confirming that the preview is correct, click OK in the lower right corner of the page.

Creating a Custom Alert Model

1. Log in to the management console.
2. Click in the upper left corner of the page and choose Security & Compliance > SecMaster.
3. In the navigation pane, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
   Figure 6 Workspace management page
   

4. In the navigation pane on the left, choose Threat Operations > Intelligent Modeling.
   Figure 7 Available Models
   

5. Click Create Model in the upper left corner of the Available Models tab.
6. On the Create Model slide-out panel displayed, configure basic information about the alert model. For details about the parameters, see Table 3.
   Figure 8 Basic configuration
   

   Table 3 Basic alert model parameters

   Parameter	Description
   Pipeline Name	Select the execution pipeline of the alert model.
   Model Name	Name of the alert model.
   Severity	Severity of the alert model. You can set the severity to Critical, High Risk, Medium Risk, Low Risk, or Warning.
   Alarm Type	Alarm type displayed after the alert model is triggered.
   Model Type	The default value is Rule model.
   Description	Description of the alert model
   Status	Indicates whether to enable the alert model. : indicates that the model is enabled. This is the default status. : indicates that the model is disabled. The status set here can be changed after the entire alert model is set successfully.

7. After the setting is complete, click Next in the lower right corner of the page. The page for setting the model logic is displayed.
8. Set the model logic. For details about the parameters, see Table 4.
   Figure 9 Configure Model Logic
   

   Table 4 Configure Model Logic

   Parameter	Description
   Query Rule	Set alert query rules. After the setting is complete, click Run and view the running result. For details about the syntax, see SQL Syntax.
   Query Plan	Set an alert query plan. Running query interval: xx minutes/hour/day. If the running query interval is minute, set this parameter to a value ranging from 5 to 59 minutes. If the running query interval is hour, set this parameter to a value ranging from 1 to 23 hours. If the running query interval is day, set this parameter to a value ranging from 1 to 14 days. Time window: xx minutes/hour/day. If the time window is minute, the value ranges from 5 minutes to 59 minutes. If the time window is hour, the value ranges from 1 hour to 23 hours. If the time window is day, the value ranges from 1 day to 14 days. Execution Delay: xx minutes. The value ranges from 0 to 5 minutes.
   Advanced Alarm Settings	Extended information about a user-defined alert. Click Add, and set the Key and Value information. Alarm Details: Enter the alarm name, description, and handling suggestions.
   Trigger Condition	Setting alert triggering conditions. The value can be greater than, equal to, not equal to, or less than xx.
   Alarm Trigger	The way to trigger alerts for queried result. The options are as follows: One alert for all query results One alert for each query result
   Debugging	Sets whether to generate debugging alarms.
   Suppression	Specifies whether to stop the query after an alert is generated. : indicates that the query stops after an alert is generated. : indicates that the query is not stopped after an alert is generated.

9. After the setting is complete, click Next in the lower right corner of the page. The model details preview page is displayed.
10. After confirming that the preview is correct, click OK in the lower right corner of the page.

Editing a Model

Only custom models can be edited.

1. Log in to the management console.
2. Click in the upper left corner of the page and choose Security & Compliance > SecMaster.
3. In the navigation pane, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
   Figure 10 Workspace management page
   

4. In the navigation pane on the left, choose Threat Operations > Intelligent Modeling.
   Figure 11 Available Models
   

5. In the available model list, click Edit in the Operation column of the target model.
6. On the Edit Model slide-out panel, configure basic information about the alert model. For details about the parameters, see Table 5.
   Figure 12 Basic Settings
   

   Table 5 Basic alert model parameters

   Parameter	Description
   Pipeline Name	Select the execution pipeline of the alert model. Editing the pipeline name is not supported currently.
   Model Name	Name of the alert model.
   Severity	Severity of the alert model. You can set the severity to Critical, High, Medium Low, or Informative.
   Alarm Type	Alarm type displayed after the alert model is triggered.
   Model Type	The default value is Rule model.
   Description	Description of the alert model

7. After the setting is complete, click Next in the lower right corner of the page. The page for setting the model logic is displayed.
8. Set the model logic. For details about the parameters, see Table 6.
   Figure 13 Configure Model Logic
   

   Table 6 Configure Model Logic

   Parameter	Description
   Query Rule	Set alert query rules. After the setting is complete, click Run and view the running result.
   Query Plan	Set an alert query plan. Running query interval: xx minutes/hour/day. If the running query interval is minute, set this parameter to a value ranging from 5 to 59 minutes. If the running query interval is hour, set this parameter to a value ranging from 1 to 23 hours. If the running query interval is day, set this parameter to a value ranging from 1 to 14 days. Time window: xx minutes/hour/day. If the time window is minute, the value ranges from 5 minutes to 59 minutes. If the time window is hour, the value ranges from 1 hour to 23 hours. If the time window is day, the value ranges from 1 day to 14 days. Execution Delay: xx minutes. The value ranges from 0 to 5 minutes.
   Advanced Alarm Settings	Custom Information: Customize extended alert information. Click Add, and set the key and value information. Alarm Details: Enter the alarm name, description, and handling suggestions.
   Trigger Condition	Sets alert triggering conditions. The value can be greater than, equal to, not equal to, or less than xx. If there are multiple triggers, click Add.
   Alarm Trigger	The way to trigger alerts for queried results. The options are as follows: One alert for all query results One alert for each query result
   Debugging	Sets whether to generate debugging alarms.
   Suppression	Specifies whether to stop the query after an alert is generated. : indicates that the query stops after an alert is generated. : indicates that the query is not stopped after an alert is generated.

9. After the setting is complete, click Next in the lower right corner of the page. The model details preview page is displayed.
10. After confirming that the preview is correct, click OK in the lower right corner of the page.