Updated on 2023-12-22 GMT+08:00

Creating/Editing a Model

Scenario

SecMaster can use models to monitor log data in pipelines. If the data is not within the model scope, an alert is generated.

This topic describes how to create and edit an alert model.

Limitations and Constraints

  • A maximum of 100 alert models can be created in a single workspace under a single account in a single region.
  • The running interval of an alert model must be greater than or equal to 5 minutes, and the time range for querying data must be less than or equal to 14 days.

Creating an Alarm Model Using an Existing Template

  1. Log in to the management console.
  2. Click in the upper left corner of the page and choose Security & Compliance > SecMaster.
  3. In the navigation pane, choose Workspaces > Management. In the workspace list, click the name of the target workspace.

    Figure 1 Workspace management page

  4. In the navigation tree on the left, choose Threat Operations > Intelligent Modeling. On the Intelligent Modeling page that is displayed, click the Model Templates tab. The Model Template page is displayed.

    Figure 2 Model Templates tab page

  5. In the model template list, click Details in the Operation column of the target model template. The template details page is displayed on the right.

    Figure 3 Model Template Details

  6. On the model template details page, click Create Model in the lower right corner. The page for creating an alert model is displayed.
  7. On the Add Alarm Model page, configure basic information about the alert model. For details about the parameters, see Table 1.

    Figure 4 Perform basic configurations
    Table 1 Basic alert model parameters

    Parameter

    Description

    Pipeline Name

    Select the execution pipeline of the alert model.

    Model Name

    Name of the alert model.

    Severity

    Severity of the alert model. You can set the severity to Critical, High, Medium Low, or Informative.

    Alarm Type

    Alarm type displayed after the alert model is triggered.

    Model Type

    The default value is Rule model.

    Description

    Description of the alert model

    Status

    Indicates whether to enable the alert model.

    • : indicates that the model is enabled. This is the default status.
    • : indicates that the model is disabled.

    The status set here can be changed after the entire alert model is set successfully.

  8. After the setting is complete, click Next in the lower right corner of the page. The page for setting the model logic is displayed.
  9. Set the model logic. For details about the parameters, see Table 2.

    Figure 5 Configure Model Logic
    Table 2 Configure Model Logic

    Parameter

    Description

    Query Rule

    Set alert query rules. After the setting is complete, click Run and view the running result.

    Query Plan

    Set an alert query plan.

    • Running query interval: xx minutes/hour/day.

      If the running query interval is minute, set this parameter to a value ranging from 5 to 59 minutes. If the running query interval is hour, set this parameter to a value ranging from 1 to 23 hours. If the running query interval is day, set this parameter to a value ranging from 1 to 14 days.

    • Time window: xx minutes/hour/day.

      If the time window is minute, the value ranges from 5 minutes to 59 minutes. If the time window is hour, the value ranges from 1 hour to 23 hours. If the time window is day, the value ranges from 1 day to 14 days.

    • Execution Delay: xx minutes. The value ranges from 0 to 5 minutes.

    Advanced Alarm Settings

    • Custom Information: Customize extended alert information.

      Click Add, and set the key and value information.

    • Alarm Details: Enter the alarm name, description, and handling suggestions.

    Trigger Condition

    Sets alert triggering conditions. The value can be greater than, equal to, not equal to, or less than xx.

    If there are multiple triggers, click Add.

    Alarm Trigger

    The way to trigger alerts for queried results. The options are as follows:

    • One alert for all query results
    • One alert for each query result

    Debugging

    Sets whether to generate debugging alarms.

    Suppression

    Specifies whether to stop the query after an alert is generated.

    • : indicates that the query stops after an alert is generated.
    • : indicates that the query is not stopped after an alert is generated.

  10. After the setting is complete, click Next in the lower right corner of the page. The model details preview page is displayed.
  11. After confirming that the preview is correct, click OK in the lower right corner of the page.

Creating a Custom Alert Model

  1. Log in to the management console.
  2. Click in the upper left corner of the page and choose Security & Compliance > SecMaster.
  3. In the navigation pane, choose Workspaces > Management. In the workspace list, click the name of the target workspace.

    Figure 6 Workspace management page

  4. In the navigation pane on the left, choose Threat Operations > Intelligent Modeling.

    Figure 7 Available Models

  5. Click Create Model in the upper left corner of the Available Models tab.
  6. On the Create Model slide-out panel displayed, configure basic information about the alert model. For details about the parameters, see Table 3.

    Figure 8 Basic configuration
    Table 3 Basic alert model parameters

    Parameter

    Description

    Pipeline Name

    Select the execution pipeline of the alert model.

    Model Name

    Name of the alert model.

    Severity

    Severity of the alert model. You can set the severity to Critical, High Risk, Medium Risk, Low Risk, or Warning.

    Alarm Type

    Alarm type displayed after the alert model is triggered.

    Model Type

    The default value is Rule model.

    Description

    Description of the alert model

    Status

    Indicates whether to enable the alert model.

    • : indicates that the model is enabled. This is the default status.
    • : indicates that the model is disabled.

    The status set here can be changed after the entire alert model is set successfully.

  7. After the setting is complete, click Next in the lower right corner of the page. The page for setting the model logic is displayed.
  8. Set the model logic. For details about the parameters, see Table 4.

    Figure 9 Configure Model Logic
    Table 4 Configure Model Logic

    Parameter

    Description

    Query Rule

    Set alert query rules. After the setting is complete, click Run and view the running result.

    For details about the syntax, see SQL Syntax.

    Query Plan

    Set an alert query plan.

    • Running query interval: xx minutes/hour/day.

      If the running query interval is minute, set this parameter to a value ranging from 5 to 59 minutes. If the running query interval is hour, set this parameter to a value ranging from 1 to 23 hours. If the running query interval is day, set this parameter to a value ranging from 1 to 14 days.

    • Time window: xx minutes/hour/day.

      If the time window is minute, the value ranges from 5 minutes to 59 minutes. If the time window is hour, the value ranges from 1 hour to 23 hours. If the time window is day, the value ranges from 1 day to 14 days.

    • Execution Delay: xx minutes. The value ranges from 0 to 5 minutes.

    Advanced Alarm Settings

    • Extended information about a user-defined alert.

      Click Add, and set the Key and Value information.

    • Alarm Details: Enter the alarm name, description, and handling suggestions.

    Trigger Condition

    Setting alert triggering conditions. The value can be greater than, equal to, not equal to, or less than xx.

    Alarm Trigger

    The way to trigger alerts for queried result. The options are as follows:

    • One alert for all query results
    • One alert for each query result

    Debugging

    Sets whether to generate debugging alarms.

    Suppression

    Specifies whether to stop the query after an alert is generated.

    • : indicates that the query stops after an alert is generated.
    • : indicates that the query is not stopped after an alert is generated.

  9. After the setting is complete, click Next in the lower right corner of the page. The model details preview page is displayed.
  10. After confirming that the preview is correct, click OK in the lower right corner of the page.

Editing a Model

Only custom models can be edited.

  1. Log in to the management console.
  2. Click in the upper left corner of the page and choose Security & Compliance > SecMaster.
  3. In the navigation pane, choose Workspaces > Management. In the workspace list, click the name of the target workspace.

    Figure 10 Workspace management page

  4. In the navigation pane on the left, choose Threat Operations > Intelligent Modeling.

    Figure 11 Available Models

  5. In the available model list, click Edit in the Operation column of the target model.
  6. On the Edit Model slide-out panel, configure basic information about the alert model. For details about the parameters, see Table 5.

    Figure 12 Basic Settings
    Table 5 Basic alert model parameters

    Parameter

    Description

    Pipeline Name

    Select the execution pipeline of the alert model. Editing the pipeline name is not supported currently.

    Model Name

    Name of the alert model.

    Severity

    Severity of the alert model. You can set the severity to Critical, High, Medium Low, or Informative.

    Alarm Type

    Alarm type displayed after the alert model is triggered.

    Model Type

    The default value is Rule model.

    Description

    Description of the alert model

  7. After the setting is complete, click Next in the lower right corner of the page. The page for setting the model logic is displayed.
  8. Set the model logic. For details about the parameters, see Table 6.

    Figure 13 Configure Model Logic
    Table 6 Configure Model Logic

    Parameter

    Description

    Query Rule

    Set alert query rules. After the setting is complete, click Run and view the running result.

    Query Plan

    Set an alert query plan.

    • Running query interval: xx minutes/hour/day.

      If the running query interval is minute, set this parameter to a value ranging from 5 to 59 minutes. If the running query interval is hour, set this parameter to a value ranging from 1 to 23 hours. If the running query interval is day, set this parameter to a value ranging from 1 to 14 days.

    • Time window: xx minutes/hour/day.

      If the time window is minute, the value ranges from 5 minutes to 59 minutes. If the time window is hour, the value ranges from 1 hour to 23 hours. If the time window is day, the value ranges from 1 day to 14 days.

    • Execution Delay: xx minutes. The value ranges from 0 to 5 minutes.

    Advanced Alarm Settings

    • Custom Information: Customize extended alert information.

      Click Add, and set the key and value information.

    • Alarm Details: Enter the alarm name, description, and handling suggestions.

    Trigger Condition

    Sets alert triggering conditions. The value can be greater than, equal to, not equal to, or less than xx.

    If there are multiple triggers, click Add.

    Alarm Trigger

    The way to trigger alerts for queried results. The options are as follows:

    • One alert for all query results
    • One alert for each query result

    Debugging

    Sets whether to generate debugging alarms.

    Suppression

    Specifies whether to stop the query after an alert is generated.

    • : indicates that the query stops after an alert is generated.
    • : indicates that the query is not stopped after an alert is generated.

  9. After the setting is complete, click Next in the lower right corner of the page. The model details preview page is displayed.
  10. After confirming that the preview is correct, click OK in the lower right corner of the page.