Alert IP Metric Labeling (Add the IP indicator tag to the alert)

Playbook Overview

When a new alert added to SecMaster met the following conditions, the Add the IP indicator tag to the alert playbook synchronizes the label in the IP indicator to the label of the new alert.

• Condition 1: There are attack source IP addresses or target IP addresses in new alerts.
• Condition 2: The attack source IP address or destination IP address in new alerts is the same as the IP address in an existing IP indicator.

This playbook is applied to alerts only. Attacks cannot trigger it. For details about the differences between alerts and attacks, see Overview.

This playbook is enabled by default. There is no need to manually configure or enable it.

Prerequisites

Your SecMaster professional edition is available.

Implementation Effect

If the attack source IP address or destination IP address in a new alert is the same as the IP address in an existing IP indicator, the Add the IP indicator tag to the alert playbook synchronizes the label in the IP indicator to the label in the new alert.

1. View the label of the IP indicator.
   1. For details about how to view indicators, see Viewing Indicators. In the navigation pane on the left in a specific workspace, choose Threats > Indicators to go to the indicator management page.
   2. On the Indicators page, click in the upper right corner of the indicator list, select Labels to view the labels of an indicator in the indicator list.
2. View the label of the new alert.
   1. For details about how to view alerts, see Viewing Alert Details. In the navigation pane on the left in a specific workspace, choose Threats > Alerts to go to the Alerts page.
   2. On the Alerts page, click in the upper right corner of the alert list to customize the list items. Select Labels to view the label information of the alert in the list.