Enabling a Workflow
A workflow determines how a playbook responds to threats when it is triggered. SecMaster provides some preconfigured workflows, such as WAF one-click unblocking, HSS alert synchronization, and alert metric extraction. The initial version (V1) of a workflow is automatically enabled. You can edit existing workflow versions to create custom workflows.
This topic describes how to configure and enable custom workflows. The procedure is as follows:
- Copy a workflow version.
- Edit and submit the workflow version.
- Review the workflow version.
- Enable the workflow.
You can also quickly create a workflow by copying a workflow. The steps are as follows:
- Copy a workflow.
- Edit and submit the workflow version.
- Review the workflow version.
- Enable the workflow.
Prerequisites
The workflow must have an activated version. For details, see Managing Workflow Versions.
Copying a Workflow Version
- Log in to the SecMaster console.
- Click
in the upper left corner of the management console and select a region or project. - In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace. Figure 1 Workspace management page
- In the navigation pane on the left, choose Security Orchestration > Playbooks. On the displayed page, select the Workflows tab. Figure 2 Workflows tab
- In the Operation column of the target workflow, click More and select Version Management. Figure 3 Version management page
- On the Manage Version slide-out panel for the workflow, find the Version Information area, locate the row containing the target workflow version, and click Copy in the Operation column.
- In the displayed dialog box, click OK.
- Then, check the workflow version. If Version is Draft Version and Status is Draft, the version has been copied. Figure 4 Copying a workflow version
Copying a Workflow
- Log in to the SecMaster console.
- Click
in the upper left corner of the management console and select a region or project. - In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace. Figure 5 Workspace management page
- In the navigation pane on the left, choose Security Orchestration > Playbooks. On the displayed page, select the Workflows tab. Figure 6 Workflows tab
- In the Operation column of the target workflow, click Copy Workflow to open the Copy Workflow dialog box.
- In the Copy Workflow dialog box, configure the following parameters.
Table 1 Parameters for copying a workflow Parameter
Description
Source Version
Select the version you want to copy and click OK. A new workflow will be generated.
To copy a workflow, there must be at least one existing workflow version.
You can only select a value from the drop-down list.
Workflow Name
Specify a name for the new workflow.
- The workflow name must be unique.
- The workflow name cannot be empty.
- The workflow name can contain 1 to 64 characters. Only letters, digits, periods (.), hyphens (-), underscores (_), and spaces are allowed.
- Click OK. You can choose , click the Workflows tab, and view the information about the new workflow. Now, you need to submit the workflow version for review before enabling it. For details, see Editing and Submitting a Workflow Version, Reviewing a Workflow Version, and Enabling a Workflow.
Editing and Submitting a Workflow Version
Only To be submitted or Rejected workflow versions can be edited.
- Log in to the SecMaster console.
- Click
in the upper left corner of the management console and select a region or project. - In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace. Figure 7 Workspace management page
- In the navigation pane on the left, choose Security Orchestration > Playbooks. On the displayed page, select the Workflows tab. Figure 8 Workflows tab
- In the Operation column of the target workflow, click More and select Version Management. Figure 9 Version management page
- On the Version Management slide-out panel for the workflow, find the Version Information area, locate the row containing the target workflow version, and click Edit in the Operation column.
- On the workflow canvas, drag basic, workflow, and plug-in nodes from Resource Libraries on the left to the canvas on the right.
Table 2 Resource Libraries parameters Parameter
Description
Basic
Basic Node
StartEvent
The start of the workflow. Each workflow can have only one start node. The entire workflow starts from the start node.
EndEvent
The end of the workflow.
Each workflow can have one or more end nodes.
A workflow must always end with an end node. End nodes cannot appear before other nodes are executed.
UserTask
When the workflow execution reaches this node, the workflow is suspended and a to-do task is generated on the Task Center page.
After processing the to-do task, you can choose to end the workflow or continue to execute subsequent nodes.
Table 3 describes the manual review parameters.
Sub Process
A loop body nested in a workflow. It has the same structure as the workflow and is mainly used to perform loop operations. It is equivalent to the loop body in the workflow.
System Gateway
ExclusiveGateway
- For an exclusive, diverging gateway, the workflow chooses only the path that matches the conditional expression to proceed.
- For an exclusive, converging gateway, the workflow chooses the path that arrives the gateway first to proceed.
ParallelGateway
- For a parallel, diverging gateway, the workflow executes all lines that arrive the gateway.
- During line converging, the subsequent nodes can be executed only when all lines arrive.
- Parallel gateways appear in pairs.
InclusiveGateway
- During line diverging, all lines that match conditional expressions are executed.
- During line converging, the subsequent nodes can be executed only when all executed diverged lines arrive the inclusive gateway.
Workflows
You can select all released workflows in the current workspace as the functional module of a node in the workflow.
Plug-ins
You can select all plug-ins in the current workspace as the functional module of a node in the workflow.
Table 3 UserTask parameters Parameter
Description
Primary key ID
A primary key ID is generated by the system. You can change it if needed.
Name
Name of the manual review node.
Valid Till
Time the manual review node expires.
Workflow Expiration Policy
The way to handle the task when the workflow expires.
- Continue: The subsequent nodes are executed.
- Terminate: The workflow ends.
Description
Description of the manual review node.
View Parameters
Click
. On the Select Context pane displayed, select a parameter. To add a parameter, click Add Parameter.Manual Processing Parameters
Input Parameter Key. To add a parameter, click Add Parameter.
- After the design is complete, click Save and Submit in the upper right corner. In the automatic workflow verification dialog box displayed, click OK.
If the workflow verification fails, check the workflow based on the failure message.
- After the submission, check the version information on the workflow version management page. If the version status changes from Draft to Pending review, the workflow version is submitted successfully.
Reviewing a Workflow Version
- Log in to the SecMaster console.
- Click
in the upper left corner of the management console and select a region or project. - In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace. Figure 10 Workspace management page
- In the navigation pane on the left, choose Security Orchestration > Playbooks. On the displayed page, select the Workflows tab. Figure 11 Workflows tab
- In the Operation column of the target workflow, click More and select Version Management. Figure 12 Version management page
- On the Version Management slide-out panel, click Review in the Operation column of the target workflow.
- Set Comment. Table 4 describes the parameters.
Table 4 Workflow review parameters Parameter
Description
Comment
Select the review conclusion.
- Passed: If the workflow version is approved, the status of the workflow version changes to Activated.
- Reject: If the workflow version is rejected, the status of the workflow version changes to Rejected. You can edit the workflow version and submit it again.
Reason for Rejection
Enter the rejection reason. This parameter is mandatory when Reject is selected for Comment.
- Click OK to complete the workflow version review.
- After the review, check the version information on the workflow version management page.
- If the current workflow has only one workflow version, the status of the approved workflow version is Activated by default.
- If the current workflow has multiple workflow versions, the status of the approved workflow versions is Unactivated by default. Only one version of each workflow can be activated. After a version is activated, the previously activated version will be deactivated.
Enabling a Workflow
- Log in to the SecMaster console.
- Click
in the upper left corner of the management console and select a region or project. - In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace. Figure 13 Workspace management page
- In the navigation pane on the left, choose Security Orchestration > Playbooks. On the displayed page, select the Workflows tab. Figure 14 Workflows tab
- In the row containing the target workflow, click Enable in the Operation column.
- On the slide-out panel displayed, select the workflow version to be enabled and click OK.
- Then, choose , click the Workflows tab, go to the workflow version management page, and check the workflow status. If its status is Enabled, the operation is successful.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot