Functions

Security Overview

• Security Score: A security score shows the overall health status of your workloads on the cloud so you can quickly learn of unhandled risks and their threats to your assets.

  The lower the security score, the greater the overall asset security risk.

• Security Monitoring: You can view how many threats, vulnerabilities, and compliance violations that are not handled and view their details.
• Security Scores over the Time: You can view the trend of the asset health scores for the last seven days.

Workspaces

• Workspace management:

  Workspaces are top-level workbenches in SecMaster. A single workspace can be bound to projects and regions to support workspace operational modes in different scenarios.

Security Governance

• Compliance packs

  SecMaster provides security governance templates, including detailed terms, scan policies, compliance evaluation items, and improvement suggestions from experts. These templates covers PCI DSS, ISO 27701, ISO 27001, privacy protection, and other standards. You can subscribe to and unsubscribe from compliance packs and view results.

• Policy-based checks

  SecMaster periodically checks the compliance status of cloud assets through policy-as-code-based scanning. You can view compliance risks on the dashboard, and obtain corresponding improvement suggestions from our experts.

• Self-assessment check items

  SecMaster integrates regulatory clauses and standard requirements into compliance pack check items. You complete evaluation of your services using the compliance pack, and view evaluation results. You can also view historical results, upload and download evidence, and take actions based on suggestions from our experts.

• Visible compliance results

  SecMaster displays the evaluation results and compliance status on the dashboard, including the compliance rates of the compliance packs you subscribed to, and the compliance rate of each term the regulations and standards, each security, as well as the policy check results.

Purchased Resources

You can view resources purchased by the current account on the Purchased Resources page and manage them centrally.

Situation Overview

• Security Score: A security score shows the overall health status of your workloads on the cloud so you can quickly learn of unhandled risks and their threats to your assets.

  The lower the security score, the greater the overall asset security risk.

• Security Monitoring: You can view how many threats, vulnerabilities, and compliance violations that are not handled and view their details.
• Security Scores over the Time: You can view the trend of the asset health scores for the last seven days.

Large Screen

SecMaster leverages AI to analyze and classify massive cloud security data and then displays real-time results on a large screen. In a simple, intuitive, and efficient way, you will learn of what risks your cloud environment are facing and how secure your cloud environment is.

NOTE:

The large screen function needs to be applied for separately.

Security Reports

You can generate analysis reports and periodically send them to specified recipients by email. In this way, all recipients can learn about the security status of your assets in a timely manner.

Task Center

All tasks that need to be processed are displayed centrally.

Resource Manager

SecMaster can synchronize the security statistics of all resources. So that you can check the name, service, and security status of a resource to quickly locate security risks.

Baseline Inspection

SecMaster can scan cloud baseline configurations to find out unsafe settings, report alerts for incidents, and offer hardening suggestions to you.

Vulnerabilities

SecMaster automatically synchronizes vulnerability scan result from Host Security Service (HSS), displays vulnerability scan details by category, and provides vulnerability fixing suggestions.

Security Policies

SecMaster supports centralized management of defense and emergency policies.

Incidents

SecMaster centrally displays incident details and allows you to manually or automatically convert alerts into incidents.

Alerts

This module provides unified data class (security operations objects) management and built-in alert reporting standards. Alerts of other cloud services such as HSS, WAF, and DDoS Mitigation are integrated and centrally displayed.

Indicators

This module provides unified data class (security operation objects) management and built-in threat intelligence indicator library. Security indicators from other cloud services can be accessed, and custom rules for extracting indicators are supported.

Intelligent Modeling

Models are supported to scan log data in pipelines. If SecMaster detects data that hits the trigger in a model, SecMaster generates an alert.

Security Analysis

• Query and analysis
  • Search and analysis: Supports quick data search and analysis, quick filtering of security data for security survey, and quick locating of key data.
  • Statistics filtering: SecMaster supports quick analysis and statistics of data fields and quick data filtering based on the analysis result. Time series data supports statistics collection by default time partition, allowing data volume trend to be quickly spotted. SecMaster supports analysis, statistics, and sorting functions, and supports quick building of security analysis models.
  • Visualization: Data analysis is visualized to intuitively reflect service structure and trend, so that you can create custom analysis reports and analysis indicators easily.
• Data delivery: SecMaster can deliver data to other pipelines or other cloud products in real time so that you can store data or consume data with other systems.
• Data monitoring: SecMaster supports end-to-end data traffic monitoring and management.
• Data consumption: SecMaster provides streaming communication interfaces for data consumption and production and data pipelines that are integrated in SDKs. You can use SDKs to integrate data across systems and customize data consumers and producers. SecMaster provides open-source log collection plug-in Logstash. You can enable custom data consumers and producers.

NOTE:

You need to apply for the security analysis function separately.

Objects

This module helps centrally manage operation objects such as data classes, data class types, and categorical mappings.

Playbooks

This module supports full lifecycle management of playbooks, workflows, asset connections, and instances.

Layouts

This module provides a visualized low-code development platform. In this module, you can create custom layout of pages for security analysis reports, alert management, incident management, vulnerability management, baseline management, and threat indicator library management.

NOTE:

You need to separately apply for the security orchestration function in the value-added package.

Plugins

Plug-ins used in the security orchestration process can be managed centrally.

Data Collection

(Collections and Components)

Logstash is used to collect varied log data in multiple modes. After data is collected, historical data analysis and comparison, data association analysis, and unknown threat discovery can be quickly implemented.

Data Integration

SecMaster provides a preset log collection system. You can enable access to logs of other cloud services in just a few clicks. You can search and analyze all collected logs in SecMaster.

Directory Customization

You can view in-use directories and change their layouts.