Help Center/ SecMaster/ Best Practices/ Using SecMaster to Enable Efficient Security Operations/ Step 4: Configure a Custom Security Operations Policy/ Enabling Workflows and Playbooks
Updated on 2026-06-24 GMT+08:00
View PDF
Share

Enabling Workflows and Playbooks

Scenarios

SecMaster provides response playbooks for cloud security incidents. After security data collection, you can use playbooks to implement efficient and automatic response to security incidents.

The workflows built into SecMaster are enabled by default. There is no need to enable it manually. The initial versions of built-in playbooks have been activated by default as well. So you only need to enable the corresponding playbook. You are advised to enable the playbooks in the following table.

Table 1 Playbooks you can enable

Playbook Name

Description

Automatic closing of repeated alerts

This playbook associates the alerts with the same name and closes the duplicated ones generated within the past seven days.

Automatic notification of high-risk alerts

This playbook sends emails or SMS notifications to specified recipients when there are alerts rated as high or fatal.

Enabling a Workflow and Playbook

  1. Log in to the SecMaster console.
  2. Go to the target workspace.
  3. In the left navigation pane, choose Security Orchestration > Playbooks.

    Figure 1 Accessing the Playbooks tab

  4. On the Playbooks tab, filter the Automatic closing of repeated alerts and Automatic notification of high-risk alerts playbooks. If the playbooks are not enabled, click Enable in the Operation column of the row for each playbook.
  5. In the displayed confirmation dialog box, select the latest playbook version and click OK.

    The Automatic notification of high-risk alerts workflow uses Simple Message Notification (SMN) to send notifications. You need to create and subscribe to a topic for receiving notifications. You need to configure recipients for the workflow. For details, see Create and Subscribe to a Topic.