Help Center/ SecMaster/ User Guide/ Security Orchestration/ Workflow Plugins Built in the System/ SecMasterBiz

Updated on 2026-07-01 GMT+08:00

SecMasterBiz

Function Description

This plugin is built into SecMaster and preprocesses alerts and other data.

Each built-in plugin has a corresponding built-in operation connection.

Viewing Details and Operation Connections of the SecMasterBiz Plugin

Log in to the SecMaster console.
Click in the upper left corner of the management console and select a region or project.
In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.

Figure 1 Workspace management page
In the navigation pane on the left, choose Security Orchestration > Plugins.

Figure 2 Plugins page
On the Plugins page, select the SecMasterBiz plugin under the Huawei Cloud catalog. The Details tab is displayed by default. The Details tab displays the login credential information of the operation connection associated with the plugin.
Click the Operation Connections tab for the SecMasterBiz plugin. On the displayed page, you can view information about the operation connections associated with the SecMasterBiz plugin.
For details about how to edit or delete an operation connection, see Editing an Operation Connection and Deleting an Operation Connection. For details about how to add an operation connection for a plugin, see Creating an Operation Connection. A plugin can have multiple operation connections.

Plugin Execution Function modifyStatus

Parameters of the modifyStatus Function: describes the input and output parameters of the function.
Output Example of the modifyStatus Function: provides an example of the function output.

Parameters of the modifyStatus Function

Function: Generates summary for the built-in alert title in SecMaster.

**Table 1** Input parameters of the modifyStatus function
Parameter	Parameter Type	Parameter Description	Mandatory
title	String	Alert title.	Yes
mainTitle	String	Title summary, which can be obtained from Parameters of the processTitle Function.	Yes
eventCount	String	Number of alerts.	Yes

**Table 2** Output parameters of the modifyStatus function
Parameter	Parameter Type	Parameter Description
riskLevel	String	Risk severity level generated based on how many times an alert is repeatedly generated.
riskDesc	String	Risk description generated based on how many times an alert is repeatedly generated.
riskTag	String	Risk label.
riskSubject	string	Alert title with a times label added.
handle_status	string	Recommended status of the alert to be handled.

Output Example of the modifyStatus Function

{
	"riskLevel": "low",
	"riskDesc": "The same alert has been generated twice (more than three times) in the last month. For details about alert backtracking, see the handling comments marked with 0-2 times in the title.",
	"riskTag": "closed",
	"riskSubject": "[2 times] [Host] test",
	"handle_status": "Closed"
}

Plugin Execution Function getDataClassID

Parameters of the getDataClassID Function: describes the input and output parameters of the function.
Output Example of the getDataClassID Function: provides an example of the function output.

Parameters of the getDataClassID Function

Function: Generates the ID of the data class type in the SecMaster workspace.

**Table 3** Input parameters of the getDataClassID function
Parameter	Parameter Type	Parameter Description	Mandatory
projectID	String	Huawei Cloud project ID, which can be viewed on the My Credentials page.	Yes
workspaceID	String	SecMaster workspace ID, which can be viewed on the workspace management page.	Yes
itemID	String	Built-in raw data class IDs: Alert: 369def57-75c3-4cc4-988c-22263ece4b17 Incident: 369def57-75c3-4cc4-988c-22263ece4b18 CommonContext: 369def57-75c3-4cc4-988c-22263ece4b19 Indicator: 369def57-75c3-4cc4-988c-22263ece4b30 Evidence: 369def57-75c3-4cc4-988c-22263ece4b31 Vulnerability: 369def57-75c3-4cc4-988c-22263ece4b32 Resource: 369def57-75c3-4cc4-988c-22263ece4b33 Policy: 369def57-75c3-4cc4-988c-22263ece4b34 PolicyRecord: 369def57-75c3-4cc4-988c-22263ece4b35 Baseline check: 79674a18-3016-4927-9bea-88fd157fb02b	Yes

**Table 4** Output parameters of the getDataClassID function
Parameter	Parameter Type	Parameter Description
dataClassID	string	Target project, target workspace, target data class, and data class ID.

Output Example of the getDataClassID Function

202cb962-ac59-375b-964b-07152d234b70

Plugin Execution Function processTitle

Parameters of the processTitle Function: describes the input and output parameters of the function.
Output Example of the processTitle Function: provides an example of the function output.

Parameters of the processTitle Function

Function: Obtains the alert title summary based on the built-in regular expression.

**Table 5** Input parameters of the processTitle function
Parameter	Parameter Type	Parameter Description	Mandatory
title	String	Alert title.	Yes

**Table 6** Output parameters of the processTitle function
Parameter	Parameter Type	Parameter Description
mainTitle	string	Title summary after regular expression truncation.
allTitle	string	Alert title with special characters escaped.

Output Example of the processTitle Function

mainTitle: Test alert
allTitle: [Host] Test alert

Plugin Execution Function judging

Parameters of the judging Function: describes the input and output parameters of the function.
Output Example of the judging Function: provides an example of the function output.

Parameters of the judging Function

Function: Checks whether the alert title or comment matches the input regular expression.

**Table 7** Input parameters of the judging function
Parameter	Parameter Type	Parameter Description	Mandatory
eventTille	String	Alert title.	No
eventComment	String	Alert comment.	No
susSubjects	Array	List of regular expression for filtering alerts.	No
susComments	Array	List of regular expression for filtering comments.	No

**Table 8** Output parameters of the judging function
Parameter	Parameter Type	Parameter Description
isMatch	bool	true: The alert title or comment matched the regular expression successfully. false: The alert title or comment failed to match the regular expression.

Output Example of the judging Function

{"isMatch":false}

Plugin Execution Function initMessageContent

Parameters of the initMessageContent Function: describes the input and output parameters of the function.
Output Example of the initMessageContent Function: provides an example of the function output.

Parameters of the initMessageContent Function

Function: Initializes the alert notification content based on the input.

**Table 9** Input parameters of the initMessageContent function
Parameter	Parameter Type	Parameter Description	Mandatory
eventTille	String	Alert title.	No
eventComment	String	Alert comment.	No
eventSeverity	String	Alert threat level.	No
judgingResult	Object	The alert title that matches the comment result. It can be obtained through Parameters of the judging Function.	No
eventID	String	Alert ID.	No

**Table 10** Output parameters of the initMessageContent function
Parameter	Parameter Type	Parameter Description
notifiedType	bool	true: Notifications need to be sent. false: Notifications do not need to be sent.
SMSContent	String	Content of the SMS initialization notification.
mailContent	String	Content of the email initialization notification.
sip	String	Attack source IP address matched the regular expression in the title.

Output Example of the initMessageContent Function

{
	"notifiedType": true,
	"SMSContent": "[High-risk vulnerability (ID=11223344)]: test. Please handle it as soon as possible. \\n Matched title: NA \\n Matched comment: NA",
	"mailContent": "xxxx",
	"sip": ""
}

Plugin Execution Function createRMAssetData (Deprecated)

Parameters of the createRMAssetData Function: describes the input and output parameters of the function.
Output Example of the createRMAssetData Function: provides an example of the function output.

Parameters of the createRMAssetData Function

Function: Generates the SecMaster asset format based on the return values of APIs of Huawei Cloud services, such as ECS, VPC, EIP, RDS, and WAF. This function has been deprecated.

**Table 11** Input parameters of the createRMAssetData function
Parameter	Parameter Type	Parameter Description	Mandatory
workspaceData	String	SecMaster workspace ID.	Yes
resourceData	Object	Return value of the cloud service asset API.	Yes
cloudserversData	Object	SecMaster asset format conversion data.	No

**Table 12** Output parameters of the createRMAssetData function
Parameter	Parameter Type	Parameter Description
rmAssetData	Object	Asset data in SecMaster format.

Output Example of the createRMAssetData Function

{
    "is_build_in": true,
    "create_time": "2026-04-07T09:36:20.779Z+0800",
    "sys_key": "CloudServicevpcs936a4cbd-f22a-4dfe-9d7d-f9f973e2bf825de11c5b-3655-4ba1-a80c-937a3b4d190f",
    "region_id": "cn-north-7",
    "import_time": "2026-04-07T09:36:20.285Z+0800",
    "dataclass_id": "63e4e911-2bc2-3a38-bc44-fae3c2fc4c79",
    "type": "vpcs",
    "tags": [],
    "domain_id": "c54198aa774c48eabb0ed1f018f2f2de",
    "workspace_id": "5de11c5b-3655-4ba1-a80c-937a3b4d190f",
    "environment": {
        "domain_id": "c54198aa774c48eabb0ed1f018f2f2de",
        "domain_name": "scc_soc_xxx882",
        "project_id": "8846a9979e464df3817056a9e8f70e53",
        "region_id": "cn-north-7",
        "project_name": "cn-north-7",
        "ep_id": "0",
        "ep_name": "default",
        "vendor_type": "CloudService"
    },
    "protected_status": "CLOSE",
    "update_time": "2026-04-07T09:36:20.779Z+0800",
    "domain_name": "scc_soc_xxx882",
    "is_deleted": false,
    "trigger_flag": true,
    "provider": "vpc",
    "project_id": "8846a9979e464df3817056a9e8f70e53",
    "name": "vpc-2cc2",
    "resource_id": "936a4cbd-f22a-4dfe-9d7d-f9f973e2bf82",
    "region_name": "cn-north-7",
    "id": "CloudServicevpcs936a4cbd-f22a-4dfe-9d7d-f9f973e2bf825de11c5b-3655-4ba1-a80c-937a3b4d190f",
    "properties": {
        "vpc_vpcs": {
            "enterprise_project_id": "0",
            "updated_at": "2025-04-18T07:55:04Z",
            "cloud_resources": [
                {
                    "resource_type": "routetable",
                    "resource_count": 1
                },
                {
                    "resource_type": "virsubnet",
                    "resource_count": 1
                }
            ],
            "project_id": "8846a9979e464df3817056a9e8f70e53",
            "name": "vpc-2cc2",
            "extend_cidrs": [],
            "created_at": "2025-04-18T07:55:04Z",
            "description": "",
            "cidr": "192.168.0.0/16",
            "id": "936a4cbd-f22a-4dfe-9d7d-f9f973e2bf82",
            "status": "ACTIVE",
            "tags": []
        }
    }
}

Plugin Execution Function setCondition

Parameters of the setCondition Function: describes the input and output parameters of the function.
Output Example of the setCondition Function: provides an output example of the function.

Parameters of the setCondition Function

Function: Generates a query condition statement based on the SecMaster data and filter fields.

**Table 13** Input parameters of the setCondition function
Parameter	Parameter Type	Parameter Description	Mandatory
sourcedata	Object	Data in SecMaster format, such as alerts, incidents, assets, and vulnerabilities.	Yes
keys	Array	Character array, which is used to set the fields to be queried. By default, the operator for filter criteria is AND. Example: ["origin_id","!id","?>title","alert_type.id"]: Queries the data with the same value of origin_id, different IDs, the same title, and the same value of alert_type.id.	Yes

**Table 14** Output parameters of the setCondition function
Parameter	Parameter Type	Parameter Description
condition	Object	SecMaster data filtering and query statement.

Output Example of the setCondition Function

{
	"logics": ["id", "and", "title", "and", "alert_type.id", "and", "severity"],
	"conditions": [{
		"data": ["id", "!=", "5770fcf6-885a-xxxx-833e-a1233dcbb9a9"],
		"name": "id"
	}, {
		"data": ["title", "contains", "[Application] there is login burst attack, src_ip:xxxxx"],
		"name": "title"
	}, {
		"data": ["alert_type.id", "=", ""],
		"name": "alert_type.id"
	}, {
		"data": ["severity", "=", "High"],
		"name": "severity"
	}]
}

Plugin Execution Function judgeIp

Parameters of the judgeIp Function: describes the input and output parameters of the function.
Output Example of the judgeIp Function: provides an output example of the function.

Parameters of the judgeIp Function

Function: Checks whether an IP address is an internal IP address.

**Table 15** Input parameters of the judgeIp function
Parameter	Parameter Type	Parameter Description	Mandatory
ip	String	IP address to be checked.	Yes

**Table 16** Output parameters of the judgeIp function
Parameter	Parameter Type	Parameter Description
isMatch	Bool	Result of check whether the IP address is an internal IP address.

Output Example of the judgeIp Function

{"isMatch":false}

Plugin Execution Function splitIpType

Parameters of the splitIpType Function: describes the input and output parameters of the function.
Output Example of the splitIpType Function: provides an output example of the function.

Parameters of the splitIpType Function

Function: Categorizes IP addresses based on the input IP address list.

**Table 17** Input parameters of the splitIpType function
Parameter	Parameter Type	Parameter Description	Mandatory
ip_list	Array	List of IP addresses to be categorized.	Yes

**Table 18** Output parameters of the splitIpType function
Parameter	Parameter Type	Parameter Description
result	Array	IPv4 and IPv6 address lists.

Output Example of the splitIpType Function

[{
	"IPv4": ["8.*.*.8", "9.*.*.9"]
}, {
	"IPv6": []
}]

Plugin Execution Function changeWebshellAlertName

Parameters of the changeWebshellAlertName Function: describes the input and output parameters of the function.
Output Example of the changeWebshellAlertName Function: provides an example of the function output.

Parameters of the changeWebshellAlertName Function

Function: Changes the name of a web shell alert.

**Table 19** Input parameters of the changeWebshellAlertName function
Parameter	Parameter Type	Parameter Description	Mandatory
alertData	Object	List of IP addresses to be categorized.	Yes
severity	String	Severity level. The value can be Tips, Low, Medium, High, or Fatal.	No
createTime	String	Record time.	No
srcIp	String	Attack source IP address.	No
sourceCountryCity	String	Country to which the attack source IP address belongs.	No
destinationIp	String	Destination IP address.	No
destinationCountryCity	String	Country to which the destination IP address belongs.	No

**Table 20** Output parameters of the changeWebshellAlertName function
Parameter	Parameter Type	Parameter Description
title	String	Modified alert name.

Output Example of the changeWebshellAlertName Function

{
  "title": "Hackers launched a cyber-attack on tenant service!"
}

Plugin Execution Function getCredential (Deprecated)

Parameters of the getCredential Function: describes the input and output parameters of the function.
Output Example of the getCredential Function: provides an example of the function output.

Parameters of the getCredential Function

Function: Calls the target API through IAM 5 authentication. This function has been deprecated.

**Table 21** Input parameters of the getCredential function
Parameter	Parameter Type	Parameter Description	Mandatory
key	String	ID of the target API for IAM authentication, which determines the API to be called.	Yes
method	String	Methods of calling APIs: GET POST PUT DELETE	Yes
headers	Object	API request header. Default value: { "Content-type": "application/json;charset=UTF-8" }	Yes
body	Object	Body of the API call.	No
region_id	String	Region where the resource called by the API is located.	Yes
domain_id	String	Account to which the resource called by the API belongs.	Yes
project_id	String	ID of the project to which the resource called by the API belongs.	No
policy_id	String	IAM API policy name.	No
agency_id	String	IAM API agency ID.	No
child_id	String	IAM user ID.	No
agency_name	String	IAM API agency name.	No

**Table 22** Output parameters of the getCredential function
Parameter	Parameter Type	Parameter Description
result	Object	IAM 5 authentication response for the target API.

Output Example of the getCredential Function

{
	"code": 200,
	"body": {
		"page_info": {
			"next_marker": null,
			"current_count": 6
		},
		"accounts": [{
			"urn": "organizations::94aee09081cxxxx00ec50:account:o-eveyxxxxxxt2rtrsic5d66p/0ca3xxxxxxx211884fd97",
			"joined_at": "2025-05-08T02:33:55.582Z",
			"join_method": "created",
			"mobile_phone": null,
			"name": "lixxxx3350_01",
			"description": "",
			"intl_number_prefix": null,
			"id": "0cxxxxxxx7a2211884fd97",
			"email": null,
			"status": "pending_closure"
		}, {
			"urn": "organizations::94aeexxxxxxxx5200ec50:account:o-eveyj9jnbpkiaxxxxxx2rtrsic5d66p/44525d669xxxxx59c028",
			"joined_at": "2025-12-25T14:10:36.337Z",
			"join_method": "invited",
			"mobile_phone": null,
			"name": "scc_sa_lxxxxxx8",
			"description": null,
			"intl_number_prefix": null,
			"id": "44525d66xxxxxxxx95413c659c028",
			"email": null,
			"status": "active"
		}, {
			"urn": "organizations::94aexxxxxx0ec50:account:o-eveyj9jnbpkiaxxxxxxrsic5d66p/52aba5xxxxxxa7e6644e",
			"joined_at": "2026-02-28T03:11:53.727Z",
			"join_method": "invited",
			"mobile_phone": null,
			"name": "scc_cnfw_xxxxxxxx0",
			"description": null,
			"intl_number_prefix": null,
			"id": "52aba5xxxxxxx9d30efa7e6644e",
			"email": null,
			"status": "active"
		}, {
			"urn": "organizations::94aee09xxxxxx25200ec50:account:o-eveyj9xxxxxx4uxt2rtrsic5d66p/94aee09081c6xxxxxx5200ec50",
			"joined_at": "2024-12-13T01:47:58.641Z",
			"join_method": "invited",
			"mobile_phone": null,
			"name": "scc_sa_xxxxxxx8",
			"description": null,
			"intl_number_prefix": null,
			"id": "94aee09081c649xxxxxxxx00ec50",
			"email": null,
			"status": "active"
		}, {
			"urn": "organizations::94axxxxxxx25200ec50:account:o-eveyj9xxxxxxxd66p/bfxxxxxxe3a2208",
			"joined_at": "2025-05-06T11:13:18.549Z",
			"join_method": "created",
			"mobile_phone": null,
			"name": "lixxxxxxx73350",
			"description": "xxxxxx test account",
			"intl_number_prefix": null,
			"id": "bf2fefexxxxxxxa2208",
			"email": null,
			"status": "pending_closure"
		}, {
			"urn": "organizations::94aee09xxxxxxx200ec50:account:o-eveyj9jnbpxxxxxxxtrsic5d66p/c54198xxxxxxx018f2f2de",
			"joined_at": "2025-08-01T07:27:14.306Z",
			"join_method": "invited",
			"mobile_phone": null,
			"name": "scc_soc_xxxxxxxx",
			"description": null,
			"intl_number_prefix": null,
			"id": "c54198aaxxxxxxxxxxe",
			"email": null,
			"status": "active"
		}]
	}
}

Plugin Execution Function getProductId (Deprecated)

Parameters of the getProductId Function: describes the input and output parameters of the function.
Output Example of the getProductId Function: provides an example of the function output.

Parameters of the getProductId Function

Function: Calls the target API to obtain the product ID through IAM 5 authentication. This function has been deprecated.

**Table 23** Input parameters of the getProductId function
Parameter	Parameter Type	Parameter Description	Mandatory
region_id	String	Region where the resource called by the API is located.	Yes

**Table 24** Output parameters of the getProductId function
Parameter	Parameter Type	Parameter Description
result	String	Product ID (product_id) obtained based on the region.

Output Example of the getProductId Function

result: 000000000

Plugin Execution Function obtainToken

Parameters of the obtainToken Function: describes the input and output parameters of the function.
Output Example of the obtainToken Function: provides an example of the function output.

Parameters of the obtainToken Function

Function: Calculates and obtains Huawei Cloud service token.

**Table 25** Input parameters of the obtainToken function
Parameter	Parameter Type	Parameter Description	Mandatory
sk	String	Key for calculating the authentication token.	Yes
user_name	String	Username for obtaining the token.	Yes
user_role	String	Permission level for obtaining the token.	Yes
cookie_login_user	String	Login user ID.	Yes
attribute_groups	String	Attribute group.	Yes
audience	String	The party who gains the authorization. The value is fixed at THIRD.	Yes
subject	String	Authentication method for accessing the service.	Yes
issuer	String	Service name to be accessed.	Yes

**Table 26** Output parameters of the obtainToken function
Parameter	Parameter Type	Parameter Description
result	String	Calculated token on the Huawei Cloud platform.

Output Example of the obtainToken Function

result:eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiAiQ1NQIEp3dCB0b2tlbiIsICJpc3MiOiAiQ1NQIiwgImlhdCI6IDE3NzU2MTcxOTMsICJleHAiOiAxNzc1NjMxNTkzLCAiV******CJ4aF90ZXN0IiwgIlJPTEUiOiAiYWRtaW4ifQ.S******lAV5ubjis5N75Oxsq8MStBgXv0J0******

Parent topic: Workflow Plugins Built in the System

Previous topic: SMN

Next topic: SecMasterUtilities

Feedback

Was this page helpful?

Helpful Not helpful

Provide feedback

Thank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.

The system is busy. Please try again later.

For any further questions, feel free to contact us through the chatbot.

Chatbot