Preconfigured Playbooks

In security orchestration module, SecMaster provides preconfigured playbooks. You can use them without extra settings.

Preconfigured Playbooks

**Table 1** Preconfigured playbooks
Security Layer	Playbook Name	Description	Enabled by Default
Server security	HSS alert synchronization	Automatically synchronizes HSS alerts generated for servers.	Yes
	Auto High-Risk Vulnerability Notification	Sends emails or SMS notifications to specified recipients when vulnerabilities rated as high severity are discovered.	No
	Attack Link Analysis Alert Notification	Analyzes attack links. If HSS generates an alert for a server, the system checks the website running on the server. If the website information and alert exist, the system sends an alert notification.	No
	Server vulnerability notification	Checks servers with EIPs bound on the resource manager page and notifies of discovered vulnerabilities.	No
	HSS Isolation and Killing of Malware	Automatically isolates and kills malware.	No
	Mining host isolation	Isolates the server for which an alert of mining program or software was generated. The playbook also adds the server into a security group that allows no inbound or outbound traffic.	No
	Ransomware host isolation	Isolates the server for which an alert of ransomware was generated. The playbook also adds the server into a security group that allows no inbound or outbound traffic.	No
	Host Defense Alarms Are Associated With Historical Handling Information	Associates new HSS alerts with HSS alerts handled earlier and adds historical handling details to the comment area for the corresponding HSS alerts.	Yes
	Add host asset protection status notification	Checks new servers and notifies you of servers unprotected by HSS.	No
	HSS High-Risk Alarm Interception Notification	Checks HSS high-risk alarms and generates to-do task notifications for source IP addresses that are not blocked by security groups. The to-do tasks will be reviewed manually. Once confirmed, the source IP addresses will be added to VPC block policy in SecMaster.	No
	Automated handling of host Rootkit event attacks	If a Rootkit alert is generated, this playbook automatically isolates the affected host by adding it to a security group that blocks all inbound and outbound traffic, and closes the alert.	No
	Automated handling of host rebound Shell attacks	If a reverse shell alert is generated, this playbook automatically isolates the affected host by adding it to a security group that blocks all inbound and outbound traffic, and closes the alert.	No
Application security	SecMaster WAF Address Group Association Policy	Associates SecMaster and WAF blacklist address groups for all enterprise projects.	Yes
	WAF clear Non-domain Policy	Checks WAF protection policies at 09:00 every Monday and deletes policies with no rules included.	No
	Application Defense Alarms Are Associated With Historical Handling Information	Associates new WAF alerts with WAF alerts handled earlier and adds historical handling details to the comment area for the new alerts.	Yes
	Web login burst interception	Checks IP addresses that establish brute-force login connections. If the IP addresses are not whitelisted, the workflow generates a to-do task. The to-do task will be reviewed manually. Once it is confirmed that the IP addresses should be blocked, the IP addresses will be added to a WAF block policy in SecMaster.	No
O&M security	Real-time Notification of Critical Organization and Management Operations	Sends real-time notifications for O&M alerts generated by models. Currently, SMN notifications can be sent for three key O&M operations: attaching NICs, creating VPC peering connections, and binding EIPs to resources.	No
Identity security	Identity Defense Alarms Are Associated With Historical Handling Information	Associates new IAM alerts with IAM alerts handled earlier and adds historical handling details to the comment area for the new alerts.	No
Network security	Network Defense Alarms Are Associated With Historical Handling Information	Associates new CFW alerts with CFW alerts handled earlier and adds historical handling details to the comment area for new alerts.	Yes
Others/General	Automatic Notification of High-Risk Alerts	Sends emails or SMS notifications when there are alerts rated as High or Fatal.	No
	Alert metric extraction	Extracts IP addresses from alerts, checks the IP addresses against the intelligence system, sets the alert indicators for confirmed malicious IP addresses, and associates the indicators with the source alerts.	No
	Automatic Disabling of Repeated Alerts	Associates the alerts with the same names and closes the duplicated ones generated within the past seven days.	Yes
	Automatic renaming of alert names	Generates custom alert names by combining specified key fields.	No
	Alert IP metric labeling	Adds attack source IP address and attacked IP address labels for alerts.	No
	IP intelligence association	Associates alerts with SecMaster intelligence (preferred) and ThreatBook intelligence.	No
	Asset Protection Status Statistics Notification	Collects statistics on asset protection status every week and sends notifications to customers by email or SMS.	No
	Alert statistics Notify	At 19:00 every day, collects statistics on alerts that are not cleared and sends notifications to customers by email or SMS.	No
	Auto Blocking for High-risk Alerts	If a source IP address launched more than three attacks, triggered high-risk or critical alerts, and hit the malicious label in ThreatBook, this playbook triggers the corresponding security policies in WAF, VPC, CFW, or IAM to block the IP address.	No
	Automatic clearing of low-risk alerts	This playbook automatically clears low-risk and informative alerts.	No
	CFW Synchronizes Black IP Addresses to Intelligence	This playbook synchronizes the IP address blacklist configured in CFW to the Indicators page in SecMaster.	No
	WAF Synchronizes Black IP Addresses to Intelligence	This playbook synchronizes the IP address blacklist configured in WAF to the Indicators page in SecMaster.	No
Others/General	Credential Leak Response	This playbook automatically identifies leaked AKs and SKs for accounts, IAM users, and agencies, then disables compromised IAM users and changes the delegated account of an agency to the current account.	No
Others/General	Automatic Handling of High-Risk WAF Alerts (Automatic handling of high-risk WAF Alert)	The Automatic handling of high-risk WAF Alert playbook has been associated with the Automatic handling of high-risk WAF Alert workflow. This playbook automatically checks WAF-related IP indicators from CloudTIC (intelligence center on the Huawei Cloud platform), blocks risky IP addresses, and adds corresponding IP indicators. The IP addresses whose severity is Black and confidence is greater than 70 are classified as risky. This playbook automatically disables alerts triggered by low-risk IP indicators and adds these indicators to SecMaster. The IP addresses whose severity is White or confidence is less than 30 are classified as low-risk.	No
Others/General	Abnormal AccessKey leakage risk scanning	The Abnormal AccessKey leakage risk scanning playbook has been associated with the Abnormal AccessKey leakage risk scanning workflow. This playbook scans GitHub for leaked AK/SK pairs at 00:00 every day. If any leaked AK/SK pairs are found, SecMaster automatically adds an attack alert of the AKSK Leakage type.	No

Parent topic: Experience Packages

Previous topic: Built-in Check Items

Next topic: Built-in Types

Feedback

Was this page helpful?

Helpful Not helpful

Provide feedback

Thank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.

The system is busy. Please try again later.

For any further questions, feel free to contact us through the chatbot.

Chatbot