Before You Start

SecMaster (SecMaster) is a next-generation cloud native security operations center Huawei Cloud provides for you. With SecMaster, you can enjoy one-stop cloud security management. You can centrally manage cloud assets, security posture, security information, and incidents, improving security operations efficiency and responding to threats faster.

This topic describes how to quickly use SecMaster for security operations.

Figure 1 Process of using SecMaster

**Table 1** Process description
Step	Description
Step 1: Buy SecMaster	Buy the SecMaster edition, quota, and value-added package based on your service needs.
Step 2: Create a Workspace	You can create different workspaces to group resources by scenarios. This will makes you easier to manage security when you have a large number of resources.
Step 3: Enable Access to Asset and Log Data	You can enable security data access to SecMaster and manage all security data in SecMaster. Subscribe to asset data: Subscribe to all asset data in the current region under the current account for centralized asset management. Enable log access: Logs of other services are aggregated into SecMaster for centralized management and analysis. Aggregation of logs from Huawei Cloud services (Optional) Aggregation of logs from non-Huawei Cloud services
Step 4: Configure and Enable Related Checks	You can enable alert models, activate playbooks, start baseline inspections, and configure security policies. SecMaster will help check all your resources comprehensively. Enable preconfigured models: You can use models to monitor logs. If any content that meets the trigger condition is detected, an alert is generated. Enable playbooks: You can use playbooks to enable automated security incident responses. Perform a baseline check: You can learn the latest baseline configuration status and risky settings. (Optional) Configure defense policies and emergency policies: You can configure defense policies to implement full-process protection and configure emergency policies to control risks.
Step 5: Create a Security Report	You can specify how you would like SecMaster to automatically send security operations reports.
Step 6: Start Security Operations	You can start security operations, such as asset management, threat detection, and alert investigation, based on the integrated data.