On this page

Show all

Help Center/ SecMaster/ User Guide/ Playbook Overview/ Auto Blocking for High-risk Alerts

Auto Blocking for High-risk Alerts

Updated on 2025-01-20 GMT+08:00

View PDF

Playbook Overview

SecMaster provides a playbook for automatic blocking of high-risk alerts. This playbook can automatically scan high-risk alerts for source IP addresses that are identified by ThreatBook as medium and high risk and block them in the services, such as WAF, CFW, and VPC security groups, where the high-risk alerts have been generated.

The Auto Blocking for High-Risk Alerts playbook has matched the Auto Blocking for High-Risk Alerts workflow.

Figure 1 Auto Blocking for High-risk Alerts

Prerequisites

You have enabled access to WAF access logs or WAF attack logs on the Data Integration page under Settings in the current workspace. For details, see Data Integration.
Figure 2 Enabling access to WAF logs
You have available quota for querying indicators in ThreatBook.

Step 1: Configure an Asset Connection

Before using the Auto Blocking for High-Risk Alerts workflow, configure the API key of the ThreatBook plug-in used for the workflow first. You can obtain it in the threatbook authentication token asset connection.

Log in to the management console.
Click in the upper left corner of the page and choose Security & Compliance > SecMaster.
In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
Figure 3 Workspace management page
In the navigation pane on the left, choose Security Orchestration > Playbooks. On the displayed page, click the Asset Connections tab.
Figure 4 Asset Connections tab
On the Asset connection page, locate the row that contains the threatbook authentication token asset connection and click Edit in the Operation column.
On the Edit pane sliding out from the right, configure the token.
- freeApiKey or payApiKey: Set either of them. The value can be obtained after you buy ThreatBook quota.
- redisHost: IP address of your Redis resources. If there are no IP addresses, leave this parameter blank.
- redisPort: Port of your Redis resources. If there are no such ports, leave this parameter blank.
- redisPassword: Passwords of your Redis resources. If there are no such passwords, leave this parameter blank.
Click OK.

Step 2: Configure and Enable the Playbook

In SecMaster, the initial version (V1) of the Auto Blocking for High-Risk Alerts workflow is enabled by default. You do not need to manually enable it. The initial version (V1) of the Auto Blocking for High-Risk Alerts playbook is also activated by default. To use it, you only need to enable it.

On the Playbooks page, locate the row that contains the Auto Blocking for High-Risk Alerts playbook and click Enable in the Operation column.
In the dialog box displayed, select the initial playbook version v1 and click OK.

Implementation Effect

The following uses WAF as an example.

If an IP address is blocked, it will be included in the WAF blacklist. The procedure is as follows:

Log in to the WAF console, go to the Policies page, and click the name of the target protection policy.
On the protection policy details page, click Blacklist and Whitelist in the Protection Details area. You can see that the IP address is listed in an address group in the WAF blacklist.
Figure 5 Blacklist and Whitelist