HSS Alert Synchronization (Synchronization of HSS alert status)

Playbook Overview

The Synchronization of HSS alert status playbook automatically synchronizes the updated alert status of servers protected by HSS in SecMaster to the HSS service.

This playbook is enabled by default. There is no need to manually configure or enable it.

Prerequisites

• Your SecMaster professional edition is available.
• The HSS security alarm log has been connected to SecMaster, and the Auto Alert Conversion button has been enabled. For details about how to connect logs to SecMaster, see Enabling Log Access.

Trigger Conditions

On the SecMaster Threats > Alerts page, if the Status of the alert whose Data Source is Host Security Service is changed, the playbook is triggered.

Implementation Effect

If the status of the HSS alert on SecMaster is changed, the alert status can be automatically synchronized to the HSS service. Example:

1. The original status of an HSS alarm is To be handled. For details, see Viewing Server Alarms.

2. Handle the HSS alarm on SecMaster. In the navigation pane on the left in your workspace, choose Threats > Alerts. On the Alerts page, handle the HSS alarm. The alarm status changes to Closed.

Figure 2 Handling HSS alarms on SecMaster

3. The Synchronization of HSS alert status playbook is triggered and automatically synchronizes the new alarm status to HSS. For details about how to check the alarm status on HSS, see Viewing Server Alarms.

Figure 3 Automatically synchronizing the alarm status to the HSS side