Configuring and Enabling the Playbook

Scenario

This topic walks you through on how to configure the SecMasterBiz node, enable the automatic renaming of alert name workflow, and enable the automatic renaming of alert name playbook.

Step 1: Configure and Enable the Workflow

Accessing the workflow management page

1. Log in to the management console.
2. Click in the upper left corner of the page and choose Security & Compliance > SecMaster.
3. In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
   Figure 1 Workspace management page
   

4. In the left navigation pane, choose Security Orchestration > Playbooks. Click Workflows.
   Figure 2 Workflows tab page
   

Copying a workflow version

5. Locate the row containing the Automatic renaming of alarm names workflow. In the Operation column, click Version Management.
   Figure 3 Version Management page
   

6. On the Version Management page displayed, go to the Version Information area, locate the row where the initial version (v1) is listed, and click Clone in the Operation column.
7. In the displayed dialog box, click OK.

Editing and submitting a workflow version

8. On the Version Management slide-out panel for the Automatic renaming of alarm names workflow, go to the Version Information area, locate the row containing the copied workflow version, and click Edit in the Operation column.
9. On the drawing page, click the SecMasterBiz plug-in and configure it in the Node Parameters pane displayed from the right.

   For details about SecMasterBiz plug-in parameters, see What Is SecMasterBiz.

   Figure 4 SecMasterBiz plug-in
   

10. After the configuration is complete, click Save and Submit in the upper right corner. In the dialog box displayed, click OK.

Reviewing a workflow version

11. On the Workflows page, locate the Automatic renaming of alarm names workflow and click Version Management in the Operation column.
12. On the displayed Version Management page, locate the row that contains the edited workflow version, and click Review in the Operation column.
13. In the displayed dialog box, set Comment to Passed and click OK.

Activating a workflow version

14. On the Version Management page, locate the row that contains the reviewed workflow version and click Activate in the Operation column.
15. In the displayed dialog box, click OK.

    After a workflow version is activated, the workflow is enabled by default.

Step 2: Configure and Enable the Playbook

1. In the left navigation pane, choose Security Orchestration > Playbooks.
   Figure 5 Accessing the Playbooks tab
   

2. On the Playbooks, locate the row that contains the playbook for automatically renaming alert names, and click Enable in the Operation column.
3. In the dialog box displayed, select the initial playbook version v1 and click OK.

What Is SecMasterBiz

SecMasterBiz is a plug-in used in the workflow for automatically renaming alert names. It analyzes and processes web shell alert names. You can combine alert names in the way you want and let the system return the alert names as you configured.

The SecMasterBiz plug-in contains multiple actions. The changeWebshellAlertName action provides several input parameters for you to customize. Each input parameter indicates an analysis dimension.

You can select different dimension parameters as required to combine alert names. If a parameter is not selected, then it will not be returned in alert names by default. If you enter y, this parameter is selected. If you enter n, this parameter is not selected. If you leave this parameter blank, this parameter is not selected.