Automatic Closing of Low-Risk Alerts (Automatic shutdown of low-risk alarms)

Playbook Overview

The Automatic shutdown of low-risk alarms playbook automatically closes alerts whose Severity is Informational or Low.

This playbook is applied to alerts only. Attacks cannot trigger it. For details about the differences between alerts and attacks, see Overview.

You need to enable this playbook manually.

Prerequisites

Your SecMaster professional edition is available.

Enabling a Playbook

In SecMaster, the initial version (V1) of the Automatic shutdown of low-risk alarms workflow is enabled by default. You do not need to manually enable it. The initial version (V1) of the Automatic shutdown of low-risk alarms playbook is also activated by default. To use it, you only need to enable it.

1. Log in to the SecMaster console.
2. In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
   Figure 1 Workspace management page
   

3. In the navigation pane on the left, choose Security Orchestration > Playbooks.
4. On the Playbooks page, locate the row that contains the Automatic shutdown of low-risk alarms playbook and click Enable in the Operation column.
5. In the dialog box displayed, select the initial playbook version v1 and click OK.

Implementation Effect

On the Alerts page, check the number of automatically handled alerts next to Auto-Closed Alert. If the number is not 0, the Automatic shutdown of low-risk alarms playbook has been triggered and taken effect.

1. For details about how to view alerts, see Viewing Alert Details. In the navigation pane on the left in a specific workspace, choose Threats > Alerts to go to the Alerts page.
2. On the Alerts page, if the number in Auto-Closed Alerts is greater than 0, the Automatic shutdown of low-risk alarms playbook has been triggered and taken effect.