A script processing method, apparatus, medium and device based on threat events

Abstract

The present invention relates to a script processing method, device, medium and device based on threat events. According to the scheduling priority of each queue, the threat event correlation script can be obtained from the queue and executed, so that the threat event can be processed according to the scheduling priority corresponding to the threat event, and the threat of the threat event can be relieved. By accurately judging the scheduling priority corresponding to each threat event, the threat event with a higher threat level can be prioritized to avoid causing a large loss of assets. In addition, quantitative analysis and determination based on the threat factors of the threat events to achieve dynamic response can complete timely and effective closed-loop disposal, quickly operate and maintain security events, and improve the SOAR engine's disposal efficiency and response speed.

Description

technical field [0001] The present invention relates to the technical field of network security, and in particular, to a script processing method, apparatus, medium and device based on threat events. Background technique [0002] This section is intended to provide a background or context for the embodiments of the invention that are recited in the claims. The descriptions herein are not admitted to be prior art by inclusion in this section. [0003] Security Orchestration and Automated Response (SOAR) transforms the complex threat event response process and operation and maintenance tasks into a consistent and repeatable threat event processing workflow (i.e. playbook), and executes the threat event correlation playbook through the SOAR engine scheduling to complete the response to the threat event. Closed-loop response to threat events. [0004] The generation and outbreak of threat events are random, and there is the possibility of centralized outbreaks in a short perio...

AI Technical Summary

Problems solved by technology

[0011] Embodiments of the present invention provide a script processing method, device, medium, and equipment based on threat events, which are used to solve the problem that threat events with a high degree of threat cannot be processed in time, which will cause relatively large asset losses

Images