Delay task processing method and device in security orchestration playbooks

Abstract

The application provides a safe delay task processing method and device in a script. It relates to the technical field of computers. It comprises: creating a transition task corresponding to a delay task in advance; determining a first safe script corresponding to a target event to be processed, the first safe script comprising a target delay task; when the target delay task in the first safe script is executed, a target transition task corresponding to the target delay task is executed to generate a second safe script based on the target delay task; and when the countdown ends, the second safe script is executed. The delay script of the wrapped delay task created at runtime is scheduled based on time, which ingeniously supports the delay task and does not constrain the user from arranging the specific content of the delay task, because the background regards the delay task as a script embedded in the script, thereby creating an asynchronous task execution effect for the user and making up for the objective shortcomings of the prior art.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method and apparatus for handling delayed tasks in secure script arrangement. Background Technology

[0002] In recent years, the country has attached great importance to cybersecurity, and security vendors have become increasingly sophisticated in their enterprise security construction, especially in terms of threat detection capabilities. For these reasons, more and more enterprises are deploying Security Information and Event Management Systems (SIEM), Situational Awareness Platforms, and Security Operations Centers (SOC). These software systems can detect security threats in a timely manner and generate security events or trigger alarms to notify staff.

[0003] Security operations are inherently unpredictable. If, upon receiving a security incident, staff still handle it manually—for example, in the case of a simple cyberattack: logging into the system, querying threat intelligence, determining the maliciousness of the IP address, sending messages, initiating approvals, and blocking the IP address—this traditional approach to emergency response, due to its inherent uncertainty and excessive human involvement, will lead to low efficiency. For larger incidents, it may even result in significant delays, preventing timely damage mitigation. A successful incident response requires at least stable and rapid execution of contingency plans, minimizing losses, and avoiding catastrophic events.

[0004] To improve the efficiency and success rate of security incident handling, enterprise customers increasingly need automated security incident response solutions. As early as 2015, Gartner proposed "Security Orchestration, Automation, and Response" (SOAR), and since then, leading manufacturers both domestically and internationally have been developing SOAR products. SOAR constructs incident handling processes by orchestrating specific tasks, distilling the experience of security experts into scripts, and handling security incidents in an automated manner—that is, executing the scripts—thereby enhancing an enterprise's threat response capabilities.

[0005] Some SOAR products on the market mainly solve the "no-code" problems such as visual task orchestration (aesthetically pleasing flowcharts and draggable tasks) and secure communication during event reception (security war room). However, due to the characteristics of their orchestration, they cannot execute delayed tasks or will encounter anomalies when encountering delayed tasks. Summary of the Invention

[0006] The purpose of this invention is to provide a method and apparatus for handling delayed tasks in a secure script arrangement, so as to alleviate the technical problems of unreasonable arrangement in the prior art.

[0007] In a first aspect, the present invention provides a method for handling delayed tasks in a secure script arrangement, comprising:

[0008] Pre-create transition tasks corresponding to delayed tasks;

[0009] Determine the first security orchestration script corresponding to the target pending event, the first security orchestration script including the target delayed task;

[0010] When the target delay task in the first security orchestration script is executed, the target transition task corresponding to the target delay task is executed so as to generate a second security orchestration script based on the target delay task. The second security orchestration script has a countdown time.

[0011] When the countdown ends, the second safety orchestration script is executed.

[0012] In an optional implementation, the pre-creation of a transition task corresponding to the delayed task includes:

[0013] Receive a secure orchestration script creation request sent by the browser, the secure orchestration script creation request being used to request the creation of a first secure orchestration script;

[0014] Create a target transition task corresponding to the target delay task in the first security orchestration script.

[0015] In an optional implementation, the method is applied to a server, the server including a web service, a database, and an orchestration engine, the web service being used to interact with a browser and execute tasks in a secure orchestration playbook, the database being used to record playbooks to be executed and events to be processed, and the orchestration engine being used to control the web service's execution of tasks based on the playbook.

[0016] In an optional implementation, the step of determining the first security orchestration script corresponding to the target event to be processed, the first security orchestration script including the target delayed task, includes:

[0017] The web service determines the target event to be processed and the first security orchestration script corresponding to the target event to be processed from the database.

[0018] The web service sends the first secure orchestration script to the orchestration engine and requests execution of the first secure orchestration script;

[0019] The orchestration engine determines the tasks to be executed based on the first secure orchestration script, and determines the execution order of the tasks to be executed based on the first secure orchestration script. Based on the execution order, the web service is controlled to execute the tasks to be executed sequentially. The tasks to be executed include target delay tasks.

[0020] In an optional implementation, when the target delay task in the first security orchestration script is executed, the target transition task corresponding to the target delay task is executed to generate a second security orchestration script based on the target delay task, including:

[0021] When the orchestration engine is ready to control the web service to execute the target delayed task, it controls the web service to execute the target transition task corresponding to the target delayed task;

[0022] The web service executes the target transition task: generates a second secure orchestration script based on the target delayed task; sends the second secure orchestration script to the server; and sends an indication to the orchestration engine that the target transition task has been completed, so that other tasks in the pending tasks can continue to be executed based on the execution order.

[0023] In an optional implementation, executing the second safety orchestration script when the countdown ends includes:

[0024] The orchestration engine periodically queries the data to determine the second safe orchestration script when the countdown ends;

[0025] The orchestration engine controls the web service to execute the second security orchestration script when the countdown ends;

[0026] When the second security orchestration script finishes execution after the countdown ends, the web service deletes the completed second security orchestration script from the database.

[0027] In an optional implementation, the server is a secure orchestration and automation, and response SOAR platform.

[0028] Secondly, the present invention provides a device for handling delayed tasks in a secure script arrangement, comprising:

[0029] A module for creating transition tasks that correspond to delayed tasks;

[0030] The determination module is used to determine the first security orchestration script corresponding to the target event to be processed, wherein the first security orchestration script includes the target delayed task;

[0031] The execution module is used to execute a target transition task corresponding to the target delay task when the target delay task in the first security orchestration script is executed, so as to generate a second security orchestration script based on the target delay task. The second security orchestration script has a countdown time.

[0032] The execution module is also configured to execute the second security orchestration script when the countdown ends.

[0033] In an optional implementation, the creation module is specifically used for:

[0034] Receive a secure orchestration script creation request sent by the browser, the secure orchestration script creation request being used to request the creation of a first secure orchestration script;

[0035] Create a target transition task corresponding to the target delay task in the first security orchestration script.

[0036] In an optional implementation, the method is applied to a server, the server including a web service, a database, and an orchestration engine, the web service being used to interact with a browser and execute tasks in a secure orchestration playbook, the database being used to record playbooks to be executed and events to be processed, and the orchestration engine being used to control the web service's execution of tasks based on the playbook.

[0037] In an optional implementation, the determining module is specifically used for:

[0038] The web service determines the target event to be processed and the first security orchestration script corresponding to the target event to be processed from the database.

[0039] The web service sends the first secure orchestration script to the orchestration engine and requests execution of the first secure orchestration script;

[0040] The orchestration engine determines the tasks to be executed based on the first secure orchestration script, and determines the execution order of the tasks to be executed based on the first secure orchestration script. Based on the execution order, the web service is controlled to execute the tasks to be executed sequentially. The tasks to be executed include target delay tasks.

[0041] In an optional implementation, the execution module is specifically used for:

[0042] When the orchestration engine is ready to control the web service to execute the target delayed task, it controls the web service to execute the target transition task corresponding to the target delayed task;

[0043] The web service executes the target transition task: generates a second secure orchestration script based on the target delayed task; sends the second secure orchestration script to the server; and sends an indication to the orchestration engine that the target transition task has been completed, so that other tasks in the pending tasks can continue to be executed based on the execution order.

[0044] In an optional implementation, the execution module is specifically used for:

[0045] The orchestration engine periodically queries the data to determine the second safe orchestration script when the countdown ends;

[0046] The orchestration engine controls the web service to execute the second security orchestration script when the countdown ends;

[0047] When the second security orchestration script finishes execution after the countdown ends, the web service deletes the completed second security orchestration script from the database.

[0048] In an optional implementation, the server is a secure orchestration and automation, and response SOAR platform.

[0049] Thirdly, the present invention provides an electronic device, the electronic device including a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus;

[0050] Memory, used to store computer programs;

[0051] When a processor executes a program stored in memory, it implements the steps of the method described in any of the foregoing embodiments.

[0052] Fourthly, the present invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of any of the methods described in the foregoing embodiments.

[0053] This invention provides a method and apparatus for handling delayed tasks in a secure orchestration script. It involves pre-creating transition tasks corresponding to delayed tasks; determining a first secure orchestration script corresponding to a target pending event, the first secure orchestration script including the target delayed task; when the target delayed task in the first secure orchestration script is executed, the target transition task corresponding to the target delayed task is executed, so as to generate a second secure orchestration script based on the target delayed task, the second secure orchestration script having a countdown timer; when the countdown ends, the second secure orchestration script is executed. The delayed script, which wraps the delayed task and is created at runtime, is time-scheduled, cleverly supporting delayed tasks without restricting the user's arrangement of the specific content of the delayed task. Because the background treats the delayed task as a script embedded in the script, it creates an effect of asynchronous task execution for the user, overcoming the objective shortcomings of existing technologies. Attached Figure Description

[0054] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0055] Figure 1 An example of a secure script arrangement provided in this application embodiment;

[0056] Figure 2 A flowchart illustrating a method for handling delayed tasks in a secure script arrangement, as provided in this application embodiment;

[0057] Figure 3 A schematic diagram of a SOAR structure provided in an embodiment of this application;

[0058] Figure 4 A schematic flowchart illustrating another method for handling delayed tasks in a secure orchestration script, provided as an embodiment of this application;

[0059] Figure 5 A schematic flowchart illustrating another method for handling delayed tasks in a secure orchestration script, provided as an embodiment of this application;

[0060] Figure 6 A schematic flowchart illustrating another method for handling delayed tasks in a secure orchestration script, provided as an embodiment of this application;

[0061] Figure 7 A schematic diagram of a delayed task processing device in a secure script arrangement provided in this application embodiment;

[0062] Figure 8 This is a schematic diagram of an electronic device structure provided in an embodiment of this application. Detailed Implementation

[0063] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0064] Therefore, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.

[0065] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0066] The following detailed description of some embodiments of the present invention is provided in conjunction with the accompanying drawings. Unless otherwise specified, the following embodiments and features can be combined with each other.

[0067] See Figure 1 As shown, the underlying data structure of a script is a directed acyclic graph (DAG), which can also be simply referred to as a flowchart. A flowchart consists of one or more linked nodes, where each node carries a task. Executing a script means starting from the first node and running the tasks on the linked nodes in the direction of the links until all tasks on all nodes have been executed.

[0068] like Figure 1 As shown, there are two node task execution flows: a->b->d and a->c->d. Assuming a and d are both empty tasks, b is a non-delayed task, and c is a delayed task, the orchestration engine should consider whether executing task b and executing task c is blocking:

[0069] a->b (blocked here until completion)->d;

[0070] a->c (exit immediately without blocking here)->d;

[0071] Asynchronous execution is one of the non-blocking implementation methods. On the surface, although task c exits immediately, the thread executing task c actually creates a delayed task instance c. Since the delayed task instance c will only begin execution in the future, the thread does not need to wait here but continues to execute subsequent tasks.

[0072] Figure 2 This is a flowchart illustrating a method for handling delayed tasks in a secure script arrangement, as provided in an embodiment of this application. Figure 2 As shown, the method may include the following steps:

[0073] S210, pre-create a transition task corresponding to the delayed task.

[0074] This delayed task is a task in the script that is not to be executed immediately, meaning it needs to be executed after a certain period of time. This transitional task can be a task that replaces the delayed task.

[0075] S220, determine the first safety orchestration script corresponding to the target pending event, the first safety orchestration script includes the target delayed task.

[0076] The first safety orchestration scenario is the scenario that needs to be executed. The target delay task is the delay task in the first safety orchestration scenario.

[0077] S230, when the target delay task in the first safety orchestration script is executed, the target transition task corresponding to the target delay task is executed so as to generate the second safety orchestration script based on the target delay task. The second safety orchestration script has a countdown time.

[0078] Instead of executing a delayed task, use a transition task to execute immediately, treating the delayed task as another playbook.

[0079] S240, when the countdown ends, execute the second safety orchestration script.

[0080] At this point, execute the delayed task immediately.

[0081] In some embodiments, such as Figure 3 As shown, this method is applied to a server that includes a web service, a database, and an orchestration engine. The web service interacts with the browser and executes tasks in secure orchestration playbooks. The database records playbooks to be executed and events to be processed. The orchestration engine controls the web service's execution of tasks based on the playbooks. This server can be a Secure Orchestration, Automation, and Response (SOAR) platform.

[0082] Among them, the selection not only supports immediate execution of flowcharts, but also an orchestration engine based on time-scheduled flowcharts.

[0083] An immediately run flowchart refers to the interface provided by the orchestration engine to the client, which is a prerequisite for the SOAR platform to execute scripts. If the script to be executed contains a delayed task X, then the delayed task X is not executed immediately, but at a later time. For example, the user can set the delayed task X to be executed a few minutes, hours, or even days after the process reaches the delayed task X.

[0084] Time-based scheduling of flowcharts refers to an orchestration engine's ability to monitor which flowcharts' countdowns have reached zero, and automatically run the flowcharts that have reached zero. For example, if a user sets the estimated start time of flowchart X to T, and the orchestration engine finds that T for flowchart X is less than or equal to the current time, then the orchestration engine will immediately run flowchart X. Orchestration engines that satisfy both of these conditions exist, such as Apache Airflow, Cadence, and Temporal.

[0085] In some embodiments, step S210 may include:

[0086] Receive a secure orchestration play creation request sent by the browser. The secure orchestration play creation request is used to request the creation of the first secure orchestration play.

[0087] Create a target transition task that corresponds to the target delay task in the first safety orchestration script.

[0088] As an example, such as Figure 4 As shown, this occurs when a user using the SOAR platform edits a script on a browser page and then submits it.

[0089] When saving script A (i.e., the first safe orchestration script) containing delayed tasks, create task α (i.e., the target transition task) that requests the creation of delayed tasks. Insert or update the database with the script A information passed from the browser to the server; if script A already exists, update it; otherwise, insert it.

[0090] You can use a relational database that provides an SQL interface, such as PostgreSQL or MySQL; the web service calls the database interface to insert or update script A.

[0091] Task α is actually an HTTP task hidden behind Task A. It initiates a request from the orchestration engine to the web service: "Please create delayed task A." The necessary parameters are the unique identifier of script A and the information of delayed task A. This request occurs when delayed task A is encountered during the execution of script A in the future. Task α should be transparent to the user, because the user is only responsible for what delayed task A will do. Editing delayed task A is exactly the same as editing another script.

[0092] Delayed task A is based on a node, but a node can nest multiple nodes. The nested nodes can form an internal flowchart (script). However, from the perspective of the external script A, delayed task A is one of its node tasks.

[0093] In some embodiments, step S220 may include:

[0094] The web service determines the target event to be processed and the first security orchestration script corresponding to the target event from the database.

[0095] The web service sends the first safe orchestration playbook to the orchestration engine and requests to execute the first safe orchestration playbook;

[0096] The orchestration engine determines the tasks to be executed based on the first secure orchestration script, and determines the execution order of the tasks to be executed based on the first secure orchestration script. Based on the execution order, the web service is controlled to execute the tasks to be executed in sequence. The tasks to be executed include target delayed tasks.

[0097] In some embodiments, step S230 may include:

[0098] When the orchestration engine is ready to control the web service to execute the target delayed task, it controls the web service to execute the target transition task corresponding to the target delayed task.

[0099] The web service executes the target transition task: a second secure orchestration script is generated based on the target delayed task; the second secure orchestration script is sent to the server, and an indication that the target transition task has been completed is sent to the orchestration engine so that other tasks in the pending tasks can continue to be executed according to the execution order.

[0100] As an example, such as Figure 5 As shown, when a delayed task is encountered during the execution of a script that includes a delayed task, a delayed script for the current script execution is created.

[0101] Note the sequence of operations following "send event A and request execution of script A". When a delayed task A is encountered, it is not executed immediately. What is actually executed is task α: producing a script A', which does not wait until timeout. The web service wraps the delayed task A into a time-based script A', which is persisted to the database. Later, when the orchestration engine observes that the expected start time of script A' has arrived, script A' may be executed immediately, possibly after script A has completed execution or during its execution.

[0102] An event refers to a security event stored in the database. Some security events contain a status field indicating "pending". Events can be seen as input for script execution.

[0103] The first execution of script A generates a delayed script A', the second execution of script A generates a delayed script A'", and so on. These delayed scripts will not be executed immediately, but they contain user-defined estimated start times.

[0104] The orchestration engine polls a set of delayed scripts whose estimated start time is less than or equal to the current time, and if any are found, triggers their execution.

[0105] In some embodiments, step S240 may include:

[0106] The orchestration engine periodically queries the data to determine the second safe orchestration script when the countdown ends;

[0107] The orchestration engine controls the second secure orchestration script to execute when the web service execution countdown ends;

[0108] When the countdown ends and the second security orchestration script is completed, the web service deletes the completed second security orchestration script from the database.

[0109] As an example, such as Figure 6 As shown, the orchestration engine is set to query the database for the countdown script at a fixed frequency, for example, every half minute.

[0110] Since each execution of script A produces a script A', the difference between the actual start time and the expected start time increases as the orchestration engine listens for more delayed scripts. One solution is to delete script A', which no longer needs to be rescheduled, once the web service receives a message that script A' has been completed.

[0111] This application's embodiments cleverly utilize existing frameworks to support delayed tasks by using a runtime-created, packaged delayed task script, which is then scheduled by the orchestration engine based on time. Furthermore, it does not restrict the user's arrangement of the specific content of the delayed task, as the background treats the delayed task as a script embedded within the script. This creates an effect of asynchronous task execution for the user, overcoming the objective shortcomings of existing technologies.

[0112] Figure 7 This is a schematic diagram of a delayed task processing device in a secure script arrangement, provided as an embodiment of the present invention. Figure 7 As shown, the device includes:

[0113] Create module 701 to pre-create transition tasks corresponding to delayed tasks;

[0114] The determination module 702 is used to determine the first security orchestration script corresponding to the target event to be processed, and the first security orchestration script includes the target delayed task;

[0115] The execution module 703 is used to execute the target transition task corresponding to the target delay task when the target delay task in the first security orchestration script is executed, so as to generate a second security orchestration script based on the target delay task. The second security orchestration script has a corresponding countdown time.

[0116] The execution module 703 is also used to execute a second safety orchestration script when the countdown ends.

[0117] In some embodiments, creating a module is specifically used for:

[0118] Receive a secure orchestration play creation request sent by the browser. The secure orchestration play creation request is used to request the creation of the first secure orchestration play.

[0119] Create a target transition task that corresponds to the target delay task in the first safety orchestration script.

[0120] In some embodiments, the apparatus is applied to a server, which includes a web service, a database, and an orchestration engine. The web service is used to interact with a browser and execute tasks in a secure orchestration playbook. The database is used to record playbooks to be executed and events to be processed. The orchestration engine is used to control the web service's execution of tasks based on the playbook.

[0121] In some embodiments, the determining module is specifically used for:

[0122] The web service determines the target event to be processed and the first security orchestration script corresponding to the target event from the database.

[0123] The web service sends the first safe orchestration playbook to the orchestration engine and requests to execute the first safe orchestration playbook;

[0124] The orchestration engine determines the tasks to be executed based on the first secure orchestration script, and determines the execution order of the tasks to be executed based on the first secure orchestration script. Based on the execution order, the web service is controlled to execute the tasks to be executed in sequence. The tasks to be executed include target delayed tasks.

[0125] In some embodiments, the execution module is specifically used for:

[0126] When the orchestration engine is ready to control the web service to execute the target delayed task, it controls the web service to execute the target transition task corresponding to the target delayed task.

[0127] The web service executes the target transition task: a second secure orchestration script is generated based on the target delayed task; the second secure orchestration script is sent to the server, and an indication that the target transition task has been completed is sent to the orchestration engine so that other tasks in the pending tasks can continue to be executed according to the execution order.

[0128] In some embodiments, the execution module is specifically used for:

[0129] The orchestration engine periodically queries the data to determine the second safe orchestration script when the countdown ends;

[0130] The orchestration engine controls the second secure orchestration script to execute when the web service execution countdown ends;

[0131] When the countdown ends and the second security orchestration script is completed, the web service deletes the completed second security orchestration script from the database.

[0132] In some embodiments, the server is a secure orchestration and automation, and a response SOAR platform.

[0133] This application also provides an electronic device, such as... Figure 8 As shown, it includes a processor 810, a communication interface 820, a memory 830, and a communication bus 840, wherein the processor 810, the communication interface 820, and the memory 830 communicate with each other through the communication bus 840.

[0134] Memory 830 is used to store computer programs;

[0135] When the processor 810 executes the program stored in the memory 830, it performs the following steps:

[0136] Pre-create transition tasks corresponding to delayed tasks;

[0137] Determine the first safety orchestration script corresponding to the target pending event, the first safety orchestration script includes the target delayed task;

[0138] When the target delay task in the first safety orchestration script is executed, the target transition task corresponding to the target delay task is executed so as to generate the second safety orchestration script based on the target delay task. The second safety orchestration script has a corresponding countdown time.

[0139] When the countdown ends, execute the second safety choreography.

[0140] The communication bus mentioned above can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the diagram, but this does not mean that there is only one bus or one type of bus.

[0141] The communication interface is used for communication between the aforementioned electronic devices and other devices.

[0142] The memory may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0143] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0144] The implementation methods and beneficial effects of the various components of the electronic device in the above embodiments for solving the problem can be found in [reference needed]. Figure 2 The steps in the illustrated embodiments are used to implement the electronic device. Therefore, the specific working process and beneficial effects of the electronic device provided in this application will not be repeated here.

[0145] In another embodiment provided in this application, a computer-readable storage medium is also provided, which stores instructions that, when executed on a computer, cause the computer to perform any of the vehicle diagnostic data communication methods described in the above embodiments.

[0146] In another embodiment provided in this application, a computer program product containing instructions is also provided, which, when run on a computer, causes the computer to execute any of the vehicle diagnostic data communication methods in the above embodiments.

[0147] Those skilled in the art will understand that the embodiments in this application can be provided as methods, systems, or computer program products. Therefore, the embodiments in this application can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, the embodiments in this application can take the form of computer program products implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0148] This application describes embodiments of methods, apparatus (systems), and computer program products according to embodiments of this application with reference to flowchart illustrations and / or block diagrams. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0149] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0150] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0151] Although preferred embodiments have been described in this application, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of this application.

[0152] Obviously, those skilled in the art can make various modifications and variations to the embodiments of this application without departing from the spirit and scope of the embodiments of this application. Therefore, if these modifications and variations to the embodiments of this application fall within the scope of the claims in this application and their equivalents, then this application also intends to include these modifications and variations.

Claims

1. A method for handling delayed tasks in a secure script arrangement, characterized in that, include: Pre-create transition tasks corresponding to delayed tasks; Determine the first security orchestration script corresponding to the target pending event, the first security orchestration script including the target delayed task; When the target delay task in the first security orchestration script is executed, the target transition task corresponding to the target delay task is executed so as to generate a second security orchestration script based on the target delay task. The second security orchestration script has a countdown time. When the countdown ends, the second safety orchestration script will be executed; The method is applied to a server, which includes a web service, a database, and an orchestration engine. The web service is used to interact with a browser and execute tasks in a secure orchestration playbook. The database is used to record playbooks to be executed and events to be processed. The orchestration engine is used to control the web service's execution of tasks based on the playbook. When the target delay task in the first security orchestration script is executed, the target transition task corresponding to the target delay task is executed to generate a second security orchestration script based on the target delay task, including: When the orchestration engine is ready to control the web service to execute the target delayed task, it controls the web service to execute the target transition task corresponding to the target delayed task; The web service executes the target transition task: generates a second secure orchestration script based on the target delayed task; sends the second secure orchestration script to the server; and sends an indication to the orchestration engine that the target transition task has been completed, so that other tasks in the pending tasks can continue to be executed according to the execution order.

2. The method according to claim 1, characterized in that, The pre-created transition tasks corresponding to the delayed tasks include: Receive a secure orchestration script creation request sent by the browser, the secure orchestration script creation request being used to request the creation of a first secure orchestration script; Create a target transition task corresponding to the target delay task in the first security orchestration script.

3. The method according to claim 1, characterized in that, The first security orchestration script corresponding to the target event to be processed is determined, and the first security orchestration script includes a target delayed task, including: The web service determines the target event to be processed and the first security orchestration script corresponding to the target event to be processed from the database. The web service sends the first secure orchestration script to the orchestration engine and requests execution of the first secure orchestration script; The orchestration engine determines the tasks to be executed based on the first secure orchestration script, and determines the execution order of the tasks to be executed based on the first secure orchestration script. Based on the execution order, the web service is controlled to execute the tasks to be executed sequentially. The tasks to be executed include target delay tasks.

4. The method according to claim 1, characterized in that, When the countdown ends, the execution of the second safety orchestration script includes: The orchestration engine periodically queries the data to determine the second safe orchestration script when the countdown ends; The orchestration engine controls the web service to execute the second security orchestration script when the countdown ends; When the second security orchestration script finishes execution after the countdown ends, the web service deletes the completed second security orchestration script from the database.

5. The method according to claim 1, characterized in that, The server is a secure orchestration and automation, and a response SOAR platform.

6. A device for handling delayed tasks in a secure script arrangement, characterized in that, include: A module for creating transition tasks that correspond to delayed tasks; The determination module is used to determine the first security orchestration script corresponding to the target event to be processed, wherein the first security orchestration script includes the target delayed task; The execution module is used to execute a target transition task corresponding to the target delay task when the target delay task in the first security orchestration script is executed, so as to generate a second security orchestration script based on the target delay task. The second security orchestration script has a countdown time. The execution module is further configured to execute the second security orchestration script when the countdown ends; The device is applied to a server, which includes a web service, a database, and an orchestration engine. The web service is used to interact with a browser and execute tasks in a secure orchestration script. The database is used to record scripts to be executed and events to be processed. The orchestration engine is used to control the web service's execution of tasks based on the script. The execution module is specifically used for: When the orchestration engine is ready to control the web service to execute the target delayed task, it controls the web service to execute the target transition task corresponding to the target delayed task; The web service executes the target transition task: generating a second secure orchestration script based on the target delayed task; The second secure orchestration script is sent to the server, and an indication that the target transition task has been completed is sent to the orchestration engine so that other tasks in the pending tasks can continue to be executed based on the execution order.

7. An electronic device, characterized in that, The electronic device includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, when executing a program stored in memory, implements the steps of the method according to any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the method described in any one of claims 1-5.

Images