Viewing Data Classes

Basic Concepts

• Data class: A data class is required for a playbook and workflow running for security orchestration and response. The playbook is triggered by data objects. A data object is the specific instance of a data class. Common data classes include alerts, incidents, indicators, and vulnerabilities.
• Data object: A data object is the instance of a data class.
• Workflows and data classes: Built-in workflows have been bound to the corresponding data classes. For example, a scheduled workflow has been bound to the common context data class. For a non-scheduled workflow that handles alerts, it has been bound to the alert data class.
• Playbooks and data classes: Built-in playbooks have been bound to data classes. For example, a scheduled playbook has been bound to the common context data class.

Viewing Data Classes

1. Log in to the SecMaster console.
2. Click in the upper left corner of the management console and select a region or project.
3. In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
   Figure 1 Workspace management page
   

4. In the navigation pane on the left, choose Security Orchestration > Objects. On the displayed page, click the Data Classes tab.
   Figure 2 Accessing the Data Classes tab
   

5. In the data class list, view the existing data class information.
   • If there are many data classes displayed, use filters to search for a specific one quickly.
   • In the data class list, you can view the data class name, service code, and whether the data class is a built-in data class.

     Table 1 Data class parameters

     Parameter	Description
     Name	Data class name.
     Business Code	Data class code.
     Built-in	Whether the data class is built in the system.
     Created By	Creator of the data class. system indicates that the data class is built in the system and is created by the system.
     Created	Time when the data class is created.
     Updated	Time when the data class is updated.
     Description	Data class description.
     Operation	Built-in data classes cannot be edited or deleted. Their topologies cannot be viewed.

   • To view details about a data class, click the name of the target data class. The details page of the target data class is displayed on the right.

     On the data class details page, you can view the basic information and fields about the data class.