Operation Object Management Overview

Updated on 2025-01-20 GMT+08:00

View PDF

Data class: A data class is required for a playbook and workflow running for security orchestration and response. The playbook is triggered by data objects. A data object is the specific instance of a data class. Common data classes include alerts, incidents, indicators, and vulnerabilities. You can view data classes by referring to Viewing Data Classes.
Alert: An alert is a notification of abnormal signals in O&M. It is usually automatically generated by a monitoring system or security device when detecting an exception in the system or networks. For example, when the CPU usage of a server exceeds 90%, the system may generate an alert. These exceptions may include system faults, security threats, or performance bottlenecks. Generally, an alert can clearly indicate the location, type, and impact of an exception. In addition, alerts can be classified by severity, such as critical, major, and minor, so that O&M personnel can determine which alerts need to be handled first based on their severity. The purpose of an alert is to notify related personnel in a timely manner so that they can make a quick response and take measures to fix the problem. Common alert types include web tamper protection, abnormal process behavior, and abnormal network connections. For more details, see Managing Alert Types.
Incident: An incident is a broad concept. It can include but is not limited to alerts. It can be a part of normal system operations, exceptions, or errors. In the O&M and security fields, an incident usually refers to a problem or fault that has occurred and needs to be focused on, investigated, and handled. An incident may be triggered by one or more alerts or other factors, such as user operations and system logs. An incident is usually used to record and report historical activities in a system for analysis and audits. For more details, see Managing Incident Types.
Indicator: For details, see Viewing Threat Intelligence Types.
Vulnerability: Common vulnerability types include Linux software vulnerabilities, Windows OS vulnerabilities, Web-CMS vulnerabilities, and application vulnerabilities. For more details, see Managing Vulnerability Types.
Custom type: You can add custom data classes. For details, see Viewing Custom Types.
Classification & mapping: A categorical mapping indicates the relationship of data sources and data objects (the specific instance of data classes). For details, see Managing Categorical Mappings.