Creating and Editing a Model

Scenario

SecMaster can use models to monitor log data in pipelines. If SecMaster detects the data that hits trigger conditions in a mode, SecMaster generates an alert.

The recommended preconfigured models in the current region can be automatically enabled in the first workspace of each region. For non-first workspaces, you need to enable them manually.

This topic describes how to create and edit an alert model.

• Creating an Alert Model Using a Template
• Creating a Custom Alert Model
• Editing a Model

Limitations and Constraints

• A maximum of 100 alert models can be created in a single workspace under a single account in a single region.
• The running interval of an alert model must be greater than or equal to 5 minutes, and the time range for querying data must be less than or equal to 14 days.

Creating an Alert Model Using a Template

1. Log in to the management console.
2. Click in the upper left corner of the management console and select a region or project.
3. Click in the upper left corner of the page and choose Security & Compliance > SecMaster.
4. In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
   Figure 1 Workspace management page
   

5. In the navigation pane on the left, choose Threat Operations > Intelligent Modeling, and select the Model Templates tab.
   Figure 2 Model Templates tab
   

6. In the model template list, click Details in the Operation column of the target model template. The template details page is displayed on the right.
7. On the model template details page, click Create Model in the lower right corner. The page for creating an alert model is displayed.
8. On the Create Threat Model page, configure basic information about the model by referring to Table 1.

   Table 1 Basic alert model parameters

   Parameter	Description
   Pipeline Name	Select the execution pipeline for the alert model based on the pipeline described in Restrictions area in the Description text box.
   Model Name	Name of the alert model.
   Severity	Severity of the alert model. You can set the severity to Critical, High, Medium Low, or Informative.
   Alarm Type	Alarm type displayed after the alert model is triggered.
   Model Type	The default value is Rule model.
   Description	Description of the alert model
   Status	Indicates whether to enable the alert model. The status set here can be changed after the entire alert model is set successfully.

9. After the setting is complete, click Next in the lower right corner of the page. The page for setting the model logic is displayed.
10. Set the model logic. For details about the parameters, see Table 2.

    Table 2 Configure Model Logic

    Parameter	Description
    Query Rule	Set alert query rules. After the setting is complete, click Run and view the running result. A query analysis statement consists of a query statement and an analysis statement. The format is Query Statement|Analysis Statement. For details about the syntax of query analysis statements, see Query and Analysis Syntax Overview. NOTE: If the reserved field is of the text type, MATCH_QUERY is used for word segmentation queries by default.
    Query Plan	Set an alert query plan. Running query interval: xx minutes/hour/day. If the running query interval is minute, set this parameter to a value ranging from 5 to 59 minutes. If the running query interval is hour, set this parameter to a value ranging from 1 to 23 hours. If the running query interval is day, set this parameter to a value ranging from 1 to 14 days. Time window: xx minutes/hour/day. If the time window is minute, the value ranges from 5 minutes to 59 minutes. If the time window is hour, the value ranges from 1 hour to 23 hours. If the time window is day, the value ranges from 1 day to 14 days. Execution Delay: xx minutes. The value ranges from 0 to 5 minutes.
    Advanced Alarm Settings	Custom Information: Customize extended alert information. Click Add, and set the key and value information. Alarm Details: Enter the alarm name, description, and handling suggestions.
    Trigger Condition	Sets alert triggering conditions. The value can be greater than, equal to, not equal to, or less than xx. If there are multiple trigger conditions, click Add and add them. A maximum of five trigger conditions can be added. If there are multiple trigger conditions, SecMaster scans log data to hit each trigger condition from top to bottom and generates all types of alerts for hit trigger conditions.
    Alarm Trigger	The way to trigger alerts for queried results. The options are as follows: One alert for all query results One alert for each query result
    Debugging	Sets whether to generate debugging alarms.
    Suppression	Specifies whether to stop the query after an alert is generated. If Suppression is enabled, the query stops after an alert is generated. If Suppression is disabled, the query is not stopped after an alert is generated.

11. After the setting is complete, click Next in the lower right corner of the page. The model details preview page is displayed.
12. After confirming that the preview is correct, click OK in the lower right corner of the page.

Creating a Custom Alert Model

1. Log in to the management console.
2. Click in the upper left corner of the management console and select a region or project.
3. Click in the upper left corner of the page and choose Security & Compliance > SecMaster.
4. In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
   Figure 3 Workspace management page
   

5. In the navigation pane on the left, choose Threat Operations > Intelligent Modeling.
   Figure 4 Available Models
   

6. Click Create Model in the upper left corner of the Available Models tab.
7. On the Create Model slide-out panel displayed, configure basic information about the alert model. For details about the parameters, see Table 3.

   Table 3 Basic alert model parameters

   Parameter	Description
   Pipeline Name	Select the execution pipeline of the alert model.
   Model Name	Name of the alert model.
   Severity	Severity of the alert model. You can set the severity to Critical, High Risk, Medium Risk, Low Risk, or Warning.
   Alarm Type	Alarm type displayed after the alert model is triggered.
   Model Type	The default value is Rule model.
   Description	Description of the alert model
   Status	Indicates whether to enable the alert model. The status set here can be changed after the entire alert model is set successfully.

8. After the setting is complete, click Next in the lower right corner of the page. The page for setting the model logic is displayed.
9. Set the model logic. For details about the parameters, see Table 4.

   Table 4 Configure Model Logic

   Parameter	Description
   Query Rule	Set alert query rules. After the setting is complete, click Run and view the running result. For details about the syntax, see Query and Analysis Syntax Overview.
   Query Plan	Set an alert query plan. Running query interval: xx minutes/hour/day. If the running query interval is minute, set this parameter to a value ranging from 5 to 59 minutes. If the running query interval is hour, set this parameter to a value ranging from 1 to 23 hours. If the running query interval is day, set this parameter to a value ranging from 1 to 14 days. Time window: xx minutes/hour/day. If the time window is minute, the value ranges from 5 minutes to 59 minutes. If the time window is hour, the value ranges from 1 hour to 23 hours. If the time window is day, the value ranges from 1 day to 14 days. Execution Delay: xx minutes. The value ranges from 0 to 5 minutes.
   Advanced Alarm Settings	Extended information about a user-defined alert. Click Add, and set the Key and Value information. Alarm Details: Enter the alarm name, description, and handling suggestions.
   Trigger Condition	Setting alert triggering conditions. The value can be greater than, equal to, not equal to, or less than xx. To configure multiple trigger conditions, click Add and add them one by one. A maximum of five trigger conditions can be added. If there are multiple trigger conditions, SecMaster scans log data to hit each trigger condition and generates all types of alerts for hit trigger conditions.
   Alarm Trigger	The way to trigger alerts for queried result. The options are as follows: One alert for all query results One alert for each query result
   Debugging	Sets whether to generate debugging alarms.
   Suppression	Specifies whether to stop the query after an alert is generated. If Suppression is enabled, the query stops after an alert is generated. If Suppression is disabled, the query is not stopped after an alert is generated.

10. After the setting is complete, click Next in the lower right corner of the page. The model details preview page is displayed.
11. After confirming that the preview is correct, click OK in the lower right corner of the page.

Editing a Model

Only custom models can be edited.

1. Log in to the management console.
2. Click in the upper left corner of the management console and select a region or project.
3. Click in the upper left corner of the page and choose Security & Compliance > SecMaster.
4. In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
   Figure 5 Workspace management page
   

5. In the navigation pane on the left, choose Threat Operations > Intelligent Modeling.
   Figure 6 Available Models
   

6. In the available model list, click Edit in the Operation column of the target model.
7. On the Edit Model slide-out panel, configure basic information about the alert model. For details about the parameters, see Table 5.

   Table 5 Basic alert model parameters

   Parameter	Description
   Pipeline Name	Select the execution pipeline of the alert model. Editing the pipeline name is not supported currently.
   Model Name	Name of the alert model.
   Severity	Severity of the alert model. You can set the severity to Critical, High, Medium Low, or Informative.
   Alarm Type	Alarm type displayed after the alert model is triggered.
   Model Type	The default value is Rule model.
   Description	Description of the alert model

8. After the setting is complete, click Next in the lower right corner of the page. The page for setting the model logic is displayed.
9. Set the model logic. For details about the parameters, see Table 6.

   Table 6 Configure Model Logic

   Parameter	Description
   Query Rule	Set alert query rules. After the setting is complete, click Run and view the running result. A query analysis statement consists of a query statement and an analysis statement. The format is Query Statement|Analysis Statement. For details about the syntax of query analysis statements, see Query and Analysis Syntax Overview. NOTE: If the reserved field is of the text type, MATCH_QUERY is used for word segmentation queries by default.
   Query Plan	Set an alert query plan. Running query interval: xx minutes/hour/day. If the running query interval is minute, set this parameter to a value ranging from 5 to 59 minutes. If the running query interval is hour, set this parameter to a value ranging from 1 to 23 hours. If the running query interval is day, set this parameter to a value ranging from 1 to 14 days. Time window: xx minutes/hour/day. If the time window is minute, the value ranges from 5 minutes to 59 minutes. If the time window is hour, the value ranges from 1 hour to 23 hours. If the time window is day, the value ranges from 1 day to 14 days. Execution Delay: xx minutes. The value ranges from 0 to 5 minutes.
   Advanced Alarm Settings	Custom Information: Customize extended alert information. Click Add, and set the key and value information. Alarm Details: Enter the alarm name, description, and handling suggestions.
   Trigger Condition	Sets alert triggering conditions. The value can be greater than, equal to, not equal to, or less than xx. If there are multiple trigger conditions, click Add and add them. A maximum of five trigger conditions can be added. If there are multiple trigger conditions, SecMaster scans log data to hit each trigger condition from top to bottom and generates all types of alerts for hit trigger conditions.
   Alarm Trigger	The way to trigger alerts for queried results. The options are as follows: One alert for all query results One alert for each query result
   Debugging	Sets whether to generate debugging alarms.
   Suppression	Specifies whether to stop the query after an alert is generated. If Suppression is enabled, the query stops after an alert is generated. If Suppression is disabled, the query is not stopped after an alert is generated.

10. After the setting is complete, click Next in the lower right corner of the page. The model details preview page is displayed.
11. After confirming that the preview is correct, click OK in the lower right corner of the page.