Event processing method and apparatus, computer device, and storage medium

Abstract

The application discloses an event processing method and device, computer equipment and a storage medium. The method comprises receiving an event execution instruction of a to-be-executed event, the to-be-executed event corresponding to a first event handling script, the first event handling script comprising first execution environment description information; detecting the first execution environment description information according to a preset detection algorithm to obtain a detection result; in the case that the detection result indicates that the first execution environment description information comprises abnormal information, acquiring a second event handling script from a preset event handling script library according to the first event handling script and the abnormal information; and executing a preset task corresponding to the second event handling script to obtain an execution result. In this way, the running condition of the current execution environment can be perceived, and when the current execution environment changes, the event handling script corresponding to the to-be-executed event is re-determined without human intervention, the event processing efficiency is improved, and the SOAR system is more feasible and efficient.

Description

Technical Field

[0001] This application belongs to the field of computer technology, and specifically relates to an event processing method, apparatus, computer equipment, and storage medium. Background Technology

[0002] With the rapid development of technology, Security Orchestration Automation and Response (SOAR) technology has become a focus of attention in the field of cybersecurity. SOAR systems can flexibly orchestrate existing security capabilities, complete scenario construction through playbook writing, and achieve automated event handling.

[0003] In related technologies, the event handling method based on SOAR systems usually triggers the execution of the corresponding script based on the content of the event to complete the event handling. However, the content of the script (i.e. the rules, executable actions, and processes it contains) is often relatively fixed. If the execution environment corresponding to the script changes, it is necessary to manually rearrange the script to be executed or select a matching script. Thus, manual intervention is increased during the event handling process, affecting the efficiency of event handling. Summary of the Invention

[0004] This application provides an event processing method, apparatus, device, and storage medium, which can solve the problem of low event processing efficiency caused by manual intervention in the event processing process in the prior art.

[0005] In a first aspect, embodiments of this application provide an event handling method, which may include:

[0006] Receive the event execution instruction for the event to be executed. The event to be executed corresponds to the first event handling script. The first event handling script includes the first execution environment description information for executing the first event handling script.

[0007] The first execution environment description information is detected according to a preset detection algorithm to obtain the detection result;

[0008] If the detection result indicates that the first execution environment description information includes abnormal information, the second event handling script is obtained from the preset event handling script library based on the first event handling script and the abnormal information. The abnormal information is the information of the object that cannot currently execute the first event handling script.

[0009] Execute the preset task corresponding to the second event handling script to obtain the execution result of the event execution instruction.

[0010] Secondly, embodiments of this application provide an event processing apparatus, which may include:

[0011] The receiving module is used to receive the event execution instruction of the event to be executed. The event to be executed corresponds to the first event handling script. The first event handling script includes the first execution environment description information for executing the first event handling script.

[0012] The detection module is used to detect the description information of the first execution environment according to a preset detection algorithm and obtain the detection result;

[0013] The acquisition module is used to acquire a second event handling script from a preset event handling script library based on the first event handling script and the exception information, when the detection result indicates that the first execution environment description information includes exception information. The exception information is information about the object that cannot currently execute the first event handling script.

[0014] The execution module is used to execute the preset tasks corresponding to the second event handling script and obtain the execution results of the event execution instructions.

[0015] Thirdly, embodiments of this application provide a computing device, which includes: a processor and a memory storing computer program instructions;

[0016] When the processor executes computer program instructions, it implements the event handling methods as shown in the first aspect.

[0017] Fourthly, embodiments of this application provide a computer storage medium storing computer program instructions, which, when executed by a processor, implement the event handling method as described in the first aspect.

[0018] Fifthly, embodiments of this application provide a chip, which includes a processor and a communication interface. The communication interface and the processor are coupled, and the processor is used to run programs or instructions to implement the event handling method as shown in the first aspect.

[0019] In a sixth aspect, embodiments of this application provide a computer program product stored in a storage medium, which is executed by at least one processor to implement the event handling method as described in the first aspect.

[0020] The event processing method, apparatus, device, and storage medium of this application embodiment receive an event execution instruction for an event to be executed. The event to be executed corresponds to a first event handling script, which includes a first execution environment description information for executing the first event handling script. Next, the first execution environment description information is detected according to a preset detection algorithm to obtain a detection result. Furthermore, if the detection result indicates that the first execution environment description information includes abnormal information, a second event handling script is obtained from a preset event handling script library based on the first event handling script and the abnormal information. The abnormal information is information about objects that cannot currently execute the first event handling script. Then, a preset task corresponding to the second event handling script is executed to obtain the execution result of the event execution instruction. Thus, the event processing method provided by this application embodiment can sense the current execution environment, such as the operating status of the device executing the event handling script and the interface corresponding to the device. When the current execution environment changes, the event handling script corresponding to the event to be executed is re-determined without manual intervention, reducing the need for manual adjustments to the event handling script after changes in the current execution environment, improving event processing efficiency, and making the SOAR system more feasible and efficient. Attached Figure Description

[0021] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 A flowchart illustrating an event handling method provided in an embodiment of this application;

[0023] Figure 2 This is a schematic diagram of an event processing architecture provided in an embodiment of this application;

[0024] Figure 3 A flowchart illustrating an event handling method provided in an embodiment of this application;

[0025] Figure 4 This is a flowchart illustrating an event handling method for extracting exception information, provided in an embodiment of this application.

[0026] Figure 5 This is a schematic diagram of the structure of an event processing device provided in one embodiment of this application;

[0027] Figure 6 This is a schematic diagram of the structure of a computer device provided in one embodiment of this application. Detailed Implementation

[0028] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples.

[0029] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes the element.

[0030] In recent years, SOAR technology has become popular in the field of cybersecurity, and more and more platforms are deploying SOAR systems. By automating the invocation of security capabilities through SOAR systems, the problem of excessive reliance on manual processes in security incident analysis, assessment, and handling can be addressed. A security resource pool can be a collection of physical or virtual security functional components. These components can include security devices or systems such as firewalls, next-generation firewalls, and World Wide Web (Web) application firewalls. These components can include network traffic-based defense capabilities, as well as application-based and even user-based multi-dimensional defense / detection capabilities.

[0031] As the deployment and implementation of security resource pools increase and platform security protection systems expand, the types of devices within these pools are also growing. Furthermore, the widespread adoption of elastic and variable infrastructures such as public clouds, private clouds, and hybrid clouds across various platforms creates a dynamic environment where security resource pools can adapt to changing application scenarios. Therefore, in this context, SOAR systems need to proactively detect the composition and structure of security resource pools—that is, to anticipate the availability and changes of specific security capabilities within the pool—and adapt to these changes.

[0032] Especially in scenarios where SOAR scripts are used to automate the handling of a certain type of security incident, if the composition of the security resource pool changes—for example, a security capability is replaced by a new one—although the current components of the security resource pool still possess the ability to handle that type of security incident, the SOAR script may not be able to adapt to this change, leading to script execution failure. For example, as... Figure 1 As shown, the event handling process based on the existing SOAR system is usually to obtain the event, obtain the corresponding preset handling script based on the event content, and trigger the execution of the preset handling script. The arrangement of the preset handling script (i.e., the rules, executable actions, and processes it contains) is often relatively fixed. Whenever the security resource pool changes, its preset handling script cannot be executed successfully. In this case, it is necessary to manually rearrange the preset handling script to be executed or select a matching preset handling script. This undoubtedly increases the workload of manual labor, which is inconsistent with SOAR's original design intention of reducing excessive reliance on manual labor. At the same time, it will also affect the efficiency of event handling.

[0033] Based on this, in order to solve the above problems, this application provides an event processing architecture 10, which may include a SOAR system 20, as described below. Figure 2 The event processing architecture provided in the embodiments of this application will be described in detail.

[0034] like Figure 2 As shown, the SOAR system 20 may include an event handling module 201, a preset event handling script library 202, a script adaptation module 203, and a script execution module 204. The SOAR system 20 will be further described below.

[0035] The event processing module 201 is used to receive event execution instructions sent from external devices of the SOAR system 20, and parse the events to be executed in the event execution instructions to obtain event parsing results. In another example, the event processing module 201 can also be used to extract necessary parameters such as event type and processing target from the event execution instructions for processing the events to be executed. The event type can be used to obtain the event handling script corresponding to the event to be executed, such as a first event handling script and a second event handling script; the processing target can be the target result that the user wants to achieve for the event to be executed, carried in the event execution instructions.

[0036] A preset event handling script library 202 is used to store event handling scripts corresponding to each of multiple event types. An event handling script may include at least one of the following: basic script information such as script name, execution environment description information (such as applicable scenarios, applicable event types, and parameters required for execution), and whether it is a default script. Specifically, the execution environment description information may include: network address information of each of the multiple devices executing the event handling script (e.g., network address information of the device where each security capability is located), interface information corresponding to each device (e.g., authentication information such as username, password, token, etc., interaction protocols such as Secure Shell (SSH), Hyper Text Transfer Protocol (HTTP), WEBSOCKET, etc.), and working status information of the interfaces corresponding to the interface information (e.g., description information of multiple security capabilities). Here, in this embodiment, a security capability can be a single function possessed by multiple devices, interfaces, or systems executing the event handling script.

[0037] It should be noted that the event handling script in this application embodiment corresponds to a SOAR script in the SOAR system, which is the storage format of the orchestration results in the SOAR. The event handling script can be composed of three basic models: multiple application (App) actions (tools, software, specific capabilities, etc.), multiple virtual nodes (manual approval, condition judgment, timers, etc.), and multiple connection directions (logical sequential relationships), superimposed with other related basic business data.

[0038] The script adaptation module 203 is used to interact with the execution environment of the event handling script via the network, detect the execution environment, and obtain a description of the current execution environment status; it can also read the event handling script corresponding to each event type from the preset event handling script library 202. Specifically, it can request the preset event handling script library 202 to read the event handling script corresponding to the event type based on the event type of the event to be executed extracted from the event parsing results by the event handling module 201, and then feed the read event handling script back to the event handling module 201.

[0039] The script execution module 204 is used to parse the event handling script provided by the script adaptation module 203; execute the preset tasks arranged corresponding to the second event handling script, and obtain the execution results of the event execution instructions. Arrangement can refer to connecting and integrating different security tools and systems to simplify the process. Further, the script execution module 204 can specifically be used to send the parameters required for execution to the execution environment via the network during execution, and to receive the execution results from the execution environment.

[0040] Therefore, this application provides an event handling method based on SOAR that adapts to variable execution environments. It receives an event execution instruction for an event to be executed, the event corresponding to a first event handling script. The first event handling script includes a description of a first execution environment for executing the first event handling script. Next, the first execution environment description information is detected according to a preset detection algorithm to obtain a detection result. Furthermore, if the detection result indicates that the first execution environment description information includes abnormal information, a second event handling script is retrieved from a preset event handling script library based on the first event handling script and the abnormal information. The abnormal information is information about objects that cannot currently execute the first event handling script. Then, a preset task corresponding to the second event handling script is executed to obtain the execution result of the event execution instruction. Thus, the event handling method provided by this application can sense the current execution environment, such as the operating status of the device executing the event handling script and the interface corresponding to the device. When the current execution environment changes, it can re-determine the event handling script corresponding to the event to be executed without manual intervention, reducing the need for manual adjustments to the event handling script after changes in the current execution environment, improving event handling efficiency, and making the SOAR system more feasible and efficient.

[0041] Based on the above event processing architecture, embodiments of this application provide an event processing method, apparatus, device, and storage medium. The following will be described in conjunction with the appendix... Figures 3 to 6 This application describes in detail the event processing methods, apparatus, devices, and storage media of the embodiments thereof. It should be noted that these embodiments are not intended to limit the scope of this application.

[0042] The following is combined with Figure 3 The event handling method provided in the embodiments of this application will be described in detail.

[0043] Figure 3 This is a flowchart of an event handling method provided in an embodiment of this application.

[0044] like Figure 3 As shown, this event handling method can be applied to, for example... Figure 5 The event handling apparatus shown may specifically include the following steps:

[0045] Step 310: Receive the event execution instruction for the event to be executed. The event to be executed corresponds to a first event handling script, which includes a first execution environment description information for executing the first event handling script. Step 320: Detect the first execution environment description information according to a preset detection algorithm to obtain a detection result. Step 330: If the detection result indicates that the first execution environment description information includes abnormal information, obtain a second event handling script from a preset event handling script library based on the first event handling script and the abnormal information. The abnormal information is information about an object that cannot currently execute the first event handling script. Step 340: Execute the preset task corresponding to the second event handling script to obtain the execution result of the event execution instruction.

[0046] This allows the system to perceive the current execution environment, such as the devices executing event handling scripts and the corresponding interfaces. When the current execution environment changes, the system can re-determine the event handling scripts corresponding to the events to be executed without human intervention. This reduces the need for manual adjustments to event handling scripts after changes in the current execution environment, improves event processing efficiency, and makes the SOAR system more feasible and efficient.

[0047] The above steps are explained in detail below:

[0048] First, in one or more possible embodiments, the event execution instruction includes an event type. Based on this, after step 310, the event handling method may further include:

[0049] Step 3501: Using a preset event parsing algorithm, parse the event to be executed in the event execution instruction to obtain the event parsing result;

[0050] Step 3502: Extract the event type of the event to be executed from the event parsing results;

[0051] Step 3503: Based on the association information between the preset event type and the preset event handling script, obtain the first event handling script corresponding to the event type from the preset event handling script library.

[0052] For example, the "event type" of the event to be executed is extracted from the event parsing results. Based on the "event type", the first event handling script with the same "event type" is found from the "preset event handling script library". Here, the first event handling script can be considered as the default script corresponding to the event to be processed.

[0053] In addition, in the embodiments of this application, each "event type" generally corresponds to a default script, but there will be special cases. If each "event type" corresponds to multiple default scripts, the selection can be made by the user or based on the preset priority of each default script among the multiple default scripts.

[0054] Based on this, taking the user selection scenario as an example, step 3503 mentioned above may specifically include:

[0055] Step 35031: If N event handling scripts corresponding to the event type are obtained from the preset event handling script library, a prompt message is displayed. The prompt message is used to prompt the user to select an event handling script corresponding to the event execution instruction from the N event handling scripts, where N is a positive integer greater than 1.

[0056] Step 35032: Upon receiving the first input for N event handling scripts, determine the event handling script corresponding to the first input as the first event handling script.

[0057] Next, the first execution environment description information involved in step 320 includes the network address information of each of the multiple devices executing the first event handling script, the interface information corresponding to each device, and the working status information of the interface corresponding to the interface information. The preset detection algorithm includes a preset network diagnostic tool algorithm, a preset interface connection test algorithm, and a preset interface application test algorithm; the detection results include a first detection result, a second detection result, and a third detection result.

[0058] Based on this, in one or more possible embodiments, step 320 may specifically include:

[0059] According to the preset network diagnostic tool algorithm, the device corresponding to the network address information is detected, and the first detection result is obtained as to whether the device can currently execute the first event handling script.

[0060] According to the preset interface connection test algorithm, the interface corresponding to the interface information is detected, and a second detection result is obtained as to whether the interface corresponding to the interface information can be connected at present.

[0061] In addition, according to the preset interface application test algorithm, the third detection result of whether the interface corresponding to the interface information can currently execute the first event handling script is detected.

[0062] For example, such as Figure 4 As shown, in step 401, according to the preset network diagnostic tool algorithm, such as the ping tool algorithm, the device corresponding to the network address information is detected to obtain the first detection result;

[0063] Step 402: Determine whether the first detection result is a result indicating that the device is currently capable of executing the first event handling script;

[0064] Step 4021: If the first detection result is not the result that the device can currently execute the first event handling script, then the information that the device cannot currently execute the first event handling script is determined as abnormal information, and the abnormal information is extracted, which is abnormal information 1.

[0065] Step 4022: If the first detection result is that the device can currently execute the first event handling script, then according to the preset interface connection test algorithm, the interface corresponding to the interface information is detected to obtain the second detection result;

[0066] Step 403: Determine whether the second detection result is that the interface corresponding to the interface information cannot be connected at present;

[0067] Step 4031: If the second detection result is that the interface corresponding to the interface information cannot be connected at present, then the interface information of the first target interface that cannot be connected at present is determined as abnormal information, and its abnormal information is extracted, which is abnormal information 2.

[0068] Step 4032: If the second detection result is not the result that the interface corresponding to the interface information cannot be connected, then the interface corresponding to the interface information is detected according to the preset interface application test algorithm to obtain the third detection result;

[0069] Step 404: Determine whether the third detection result is the result that the interface corresponding to the interface information can currently execute the first event handling script;

[0070] Step 4041: If the third detection result is not the result of the interface corresponding to the interface information being able to execute the first event handling script, then the result information of the second target interface that cannot execute the first event handling script is determined as abnormal information, and its abnormal information is extracted, which is abnormal information 3.

[0071] Step 4042: If the third detection result is that the interface corresponding to the interface information can currently execute the first event handling script, then it is determined that the detection result indicates that the first execution environment description information does not include abnormal information, so as to execute the preset task corresponding to the first event handling script and obtain the execution result of the event execution instruction.

[0072] Thus, the execution environment can be perceived in the above manner. This perception is achieved by checking the validity of the "execution environment description information" within the first event handling script. If all checks pass, a "no change in execution environment" message is returned to the subsequent process. That is, after step 320, if the detection result indicates that the first execution environment description information does not include any abnormal information, the event handling method executes the first event handling script to obtain the execution result of the event execution instruction. Otherwise, step 330 is executed to process abnormal information 1 to 3 accordingly.

[0073] Furthermore, the objects involved in step 330 include at least one of the following: device, interface, code resources; the abnormal information includes at least one of the following: information in the first detection result that the device cannot currently execute the first event handling script, information in the second detection result that the interface corresponding to the interface information cannot currently be connected, and information in the third detection result that the interface corresponding to the interface information cannot currently execute the first event handling script.

[0074] Based on this, in one or more possible embodiments, step 330 may specifically include:

[0075] Step 3301: Remove the exception information from the first execution environment description information to obtain the second execution environment description information;

[0076] Step 3303: Based on the second execution environment description information, determine whether an event handling script corresponding to the second execution environment description information is obtained from the preset event handling script library;

[0077] Step 3303: If it is determined that an event handling script corresponding to the second execution environment description information is obtained from the preset event handling script library, the event handling script corresponding to the second execution environment description information is determined as the second event handling script.

[0078] The event types in the second event handling scenario are the same as those in the first event handling scenario.

[0079] For example, firstly, the "first execution environment description information" is extracted from the "default script"; from the "first execution environment description information" of the "default script", items such as... Figure 4 The system retrieves "Abnormal Information 1", "Abnormal Information 2", and "Abnormal Information 3" to obtain new "Second Execution Environment Description Information". Next, it compares this "Second Execution Environment Description Information" with the execution environment description information of each event handling script in the preset event handling script library. If a matching execution environment description information is found, the event handling script corresponding to this matching script in the preset event handling script library is determined as the second event handling script.

[0080] Conversely, in step 3304, if it is determined that no event handling script corresponding to the second execution environment description information is obtained from the preset event handling script library, the first backup information corresponding to the exception information is obtained from the preset backup information library according to the association information between the preset exception information and the preset backup information. The first backup information corresponds to the exception information and is information about an object that can execute the first event handling script.

[0081] Step 3305: Replace the exception information in the first execution environment description information with the first backup information to obtain the third execution environment description information;

[0082] Step 3306: Based on the third execution environment description information, obtain the event handling script corresponding to the third execution environment description information from the preset event handling script library;

[0083] Step 3307: The event handling script corresponding to the third execution environment description information is determined as the second event handling script.

[0084] For example, in step 1, obtain as follows Figure 4 The abnormal information in the first execution environment description information includes abnormal information 1, abnormal information 2, and abnormal information 3. Step 2 is to determine whether the current abnormal information is abnormal information 1. Step 3 is to obtain the first backup information 1 corresponding to abnormal information 1 and replace the abnormal information 1 in the first execution environment description information with the first backup information 1. For example, if abnormal information 1 is that the device cannot currently execute the first event handling script, then the first backup information 1 is the information of the device with the same function as the device in abnormal information 1 and which can currently execute the first event handling script. Thus, steps 2 and 3 are repeated for abnormal information 2 and abnormal information 3 to ensure that at least one of all abnormal information 1, abnormal information 2, and abnormal information 3 is replaced to obtain the third execution environment description information. For example, in step 2, determine whether the current abnormal information is abnormal information 2; in step 3, if the current abnormal information is determined to be abnormal information 2, obtain the first backup information 2 corresponding to abnormal information 2, and replace the abnormal information 2 in the first execution environment description information with the first backup information 2. Based on this, replace the abnormal information 1 in the first execution environment description information with the first backup information 1, and replace the abnormal information 2 in the first execution environment description information with the first backup information 2. Then, the third execution environment description information 2 can be obtained; in step 4, based on the third execution environment description information, obtain the event handling script corresponding to the third execution environment description information from the preset event handling script library; in step 5, determine the event handling script corresponding to the third execution environment description information as the second event handling script.

[0085] In another or more possible embodiments, if the detection result indicates that the first execution environment description information includes abnormal information, the replacement can be performed directly without performing a removal process. Based on this, step 330 may specifically include:

[0086] Based on the association information between the preset abnormal information and the preset backup information, the second backup information corresponding to the abnormal information is obtained from the preset backup information database. The second backup information corresponds to the abnormal information and is information about the object that can execute the first event handling script.

[0087] Replace the exception information in the first execution environment description information with the second backup information to obtain the fourth execution environment description information;

[0088] Based on the fourth execution environment description information, retrieve the event handling script corresponding to the fourth execution environment description information from the preset event handling script library;

[0089] The event handling script corresponding to the fourth execution environment description information is identified as the second event handling script.

[0090] Therefore, in this embodiment, when receiving an event execution instruction for an event to be executed, where the event to be executed corresponds to a first event handling script, and the first event handling script includes a first execution environment description information for executing the first event handling script, the first execution environment description information is detected according to a preset detection algorithm to obtain a detection result. Then, if the detection result indicates that the first execution environment description information includes abnormal information, a second event handling script is obtained from a preset event handling script library based on the first event handling script and the abnormal information. The abnormal information is information about objects that cannot currently execute the first event handling script. Then, a preset task corresponding to the second event handling script is executed to obtain the execution result of the event execution instruction. Thus, the event processing method provided in this embodiment can sense the current execution environment, such as the operating status of the device executing the event handling script and the interface corresponding to the device, and re-determine the event handling script corresponding to the event to be executed when the current execution environment changes. This eliminates the need for manual intervention, reduces the need for manual adjustments to the event handling script after changes in the current execution environment, improves event processing efficiency, and makes the SOAR system more feasible and efficient.

[0091] Based on the same inventive concept, this application also provides an event processing device. (Specifically combined with...) Figure 5 Please provide a detailed explanation.

[0092] Figure 5 This is a schematic diagram of the structure of an event processing device provided in one embodiment of this application.

[0093] In some embodiments of this application, Figure 5 The event handling device shown can be set up as follows: Figure 6 The computer equipment shown.

[0094] like Figure 5 As shown, the event handling device 50 may specifically include:

[0095] The receiving module 501 is used to receive the event execution instruction of the event to be executed, the event to be executed corresponds to the first event handling script, and the first event handling script includes the first execution environment description information for executing the first event handling script;

[0096] The detection module 502 is used to detect the description information of the first execution environment according to a preset detection algorithm and obtain the detection result;

[0097] The acquisition module 503 is used to acquire a second event handling script from a preset event handling script library based on the first event handling script and the exception information when the detection result indicates that the first execution environment description information includes exception information. The exception information is information about the object that cannot currently execute the first event handling script.

[0098] The execution module 504 is used to execute the preset task corresponding to the second event handling script and obtain the execution result of the event execution instruction.

[0099] In this embodiment, the current execution environment, such as the device executing the event handling script and the operation of the interface corresponding to the device, can be sensed. When the current execution environment changes, the event handling script corresponding to the event to be executed can be re-determined without human intervention. This reduces the need for manual adjustment of the event handling script after changes in the current execution environment, improves event processing efficiency, and makes the SOAR system more feasible and efficient.

[0100] The event handling device 50 in the embodiments of this application will be described in detail below.

[0101] In one or more optional embodiments, the event execution instruction includes an event type. Based on this, the event processing device 50 in the embodiments of this application may further include a parsing module and an extraction module; wherein, the parsing module is used to parse the event to be executed in the event execution instruction through a preset event parsing algorithm to obtain the event parsing result;

[0102] The extraction module is used to extract the event type of the event to be executed from the event parsing results;

[0103] The acquisition module 503 is also used to acquire the first event handling script corresponding to the event type from the preset event handling script library based on the association information between the preset event type and the preset event handling script.

[0104] In another or more alternative embodiments, the event processing device 50 in this application embodiment may further include a display module and a first determination module; wherein,

[0105] The display module is used to display a prompt message when N event handling scripts corresponding to the event type are obtained from the preset event handling script library. The prompt message is used to prompt the user to select an event handling script that corresponds to the event execution instruction from the N event handling scripts, where N is a positive integer greater than 1.

[0106] The first determining module is used to determine the event handling script corresponding to the first input as the first event handling script when receiving the first input of N event handling scripts.

[0107] In another or more alternative embodiments, the first execution environment description information includes network address information of each of the plurality of devices executing the first event handling script, interface information corresponding to each device, and working status information of the interface corresponding to the interface information.

[0108] In another or more alternative embodiments, the detection module 502 may be specifically used to, in the case that the preset detection algorithm includes a preset network diagnostic tool algorithm, a preset interface connection test algorithm and a preset interface application test algorithm; and the detection result includes a first detection result, a second detection result and a third detection result, detect the device corresponding to the network address information according to the preset network diagnostic tool algorithm, and obtain a first detection result as to whether the device can currently execute the first event handling script;

[0109] According to the preset interface connection test algorithm, the interface corresponding to the interface information is detected, and a second detection result is obtained as to whether the interface corresponding to the interface information can be connected at present.

[0110] In addition, according to the preset interface application test algorithm, the third detection result of whether the interface corresponding to the interface information can currently execute the first event handling script is detected.

[0111] In another or more alternative embodiments, the event handling device 50 in this application embodiment may further include a removal module and a second determination module; wherein,

[0112] The removal module is used to remove the exception information from the first execution environment description information to obtain the second execution environment description information when the object includes at least one of the following: device, interface, code resource; and the exception information includes at least one of the following: information in the first detection result that the device cannot currently execute the first event handling script, information in the second detection result that the interface corresponding to the interface information cannot currently be connected, and information in the third detection result that the interface corresponding to the interface information cannot currently execute the first event handling script.

[0113] The second determining module is used to determine, based on the second execution environment description information, whether an event handling script corresponding to the second execution environment description information is obtained from the preset event handling script library;

[0114] The second determining module is further configured to, when it is determined that an event handling script corresponding to the second execution environment description information is obtained from the preset event handling script library, determine the event handling script corresponding to the second execution environment description information as the second event handling script;

[0115] The event types in the second event handling scenario are the same as those in the first event handling scenario.

[0116] In another or more alternative embodiments, the event processing device 50 in this application embodiment may further include a first replacement module and a third determination module; wherein,

[0117] The acquisition module 503 can also be used to, when it is determined that no event handling script corresponding to the second execution environment description information is obtained from the preset event handling script library, obtain the first backup information corresponding to the exception information from the preset backup information library according to the association information between the preset exception information and the preset backup information. The first backup information corresponds to the exception information and is information about an object that can execute the first event handling script.

[0118] The first replacement module is used to replace the exception information in the first execution environment description information with the first backup information to obtain the third execution environment description information.

[0119] The acquisition module 503 can also be used to acquire, based on the third execution environment description information, an event handling script corresponding to the third execution environment description information from a preset event handling script library;

[0120] The third determination module is used to determine the event handling script corresponding to the third execution environment description information as the second event handling script.

[0121] In another or more alternative embodiments, the event processing device 50 in this application embodiment may further include a second replacement module and a fourth determination module; wherein,

[0122] The acquisition module 503 is further configured to acquire second backup information corresponding to the abnormal information from the preset backup information database based on the association information between the preset abnormal information and the preset backup information. The second backup information corresponds to the abnormal information and is information about an object that can execute the first event handling script.

[0123] The second replacement module is used to replace the exception information in the first execution environment description information with the second backup information to obtain the fourth execution environment description information.

[0124] The acquisition module 503 is also used to acquire, based on the fourth execution environment description information, an event handling script corresponding to the fourth execution environment description information from a preset event handling script library;

[0125] The fourth determination module is used to determine the event handling script corresponding to the fourth execution environment description information as the second event handling script.

[0126] Based on the same inventive concept, this application also provides a computer device. (Specifically combined with...) Figure 6 Please provide a detailed explanation.

[0127] Figure 6 This is a schematic diagram of the structure of a computer device provided in one embodiment of this application.

[0128] like Figure 6 As shown, the computer device may include at least one of the following as described in the embodiments of this application: an electronic device, a server. The computer device may include a processor 601 and a memory 602 storing computer program instructions.

[0129] Specifically, the processor 601 may include a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0130] Memory 602 may include a large-capacity memory for data or instructions. For example, and not limitingly, memory 602 may include a hard disk drive (HDD), a floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or a Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 602 may include removable or non-removable (or fixed) media. Where appropriate, memory 602 may be internal or external to the integrated gateway disaster recovery device. In a particular embodiment, memory 602 is non-volatile solid-state memory. In a particular embodiment, memory 602 includes solid-state storage (ROM). Where appropriate, the ROM may be a mask-programmed ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), an electrically rewritable ROM (EAROM), or flash memory, or a combination of two or more of these.

[0131] The processor 601 implements any of the event handling methods described in the above embodiments by reading and executing computer program instructions stored in the memory 602.

[0132] In one example, the event handling device may further include a communication interface 603 and a bus 610. Wherein, as Figure 6As shown, the processor 601, memory 602, and communication interface 603 are connected through bus 610 and complete communication with each other.

[0133] The communication interface 603 is mainly used to realize communication between various modules, devices, units and / or equipment in the embodiments of this application.

[0134] Bus 610 includes hardware, software, or both, that couples components of a flow control device together. For example, and not limitingly, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), HyperTransport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Microchannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local (VLB) bus, or other suitable buses, or combinations of two or more of these. Where appropriate, bus 610 may include one or more buses. Although specific buses are described and illustrated in embodiments of this application, any suitable bus or interconnect is contemplated herein.

[0135] The event processing device can execute the event processing method in the embodiments of this application, thereby achieving the combination Figures 1 to 5 The described event handling methods and apparatus.

[0136] Furthermore, in conjunction with the event handling methods in the above embodiments, this application embodiment can provide a computer-readable storage medium for implementation. This computer-readable storage medium stores computer program instructions; when executed by a processor, these computer program instructions implement any of the event handling methods in the above embodiments.

[0137] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0138] The functional blocks shown in the above block diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. Programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0139] It should also be noted that the exemplary embodiments mentioned in this application describe methods or systems based on a series of steps or apparatus. However, this application is not limited to the order of the above steps; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0140] The above are merely specific embodiments of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the protection scope of this application.

Claims

1. An event handling method, characterized in that, include: Receive an event execution instruction for an event to be executed, wherein the event to be executed corresponds to a first event handling script, the first event handling script includes first execution environment description information for executing the first event handling script, the first execution environment description information includes network address information of each of the multiple devices executing the first event handling script, interface information corresponding to each device, and working status information of the interface corresponding to the interface information; According to the preset network diagnostic tool algorithm, the device corresponding to the network address information is detected, and a first detection result is obtained as to whether the device can currently execute the first event handling script. According to the preset interface connection test algorithm, the interface corresponding to the interface information is detected, and a second detection result is obtained as to whether the interface corresponding to the interface information can be connected at present. According to the preset interface application testing algorithm, the third detection result is used to detect whether the interface corresponding to the interface information can currently execute the first event handling script. If the detection result indicates that the first execution environment description information includes abnormal information, a second event handling script is obtained from a preset event handling script library based on the first event handling script and the abnormal information. The abnormal information is information about objects that cannot currently execute the first event handling script. Execute the preset task corresponding to the second event handling script to obtain the execution result of the event execution instruction.

2. The method according to claim 1, characterized in that, The event execution instruction includes the event type; After receiving the event execution instruction for the event to be executed, the method further includes: The event to be executed in the event execution instruction is parsed using a preset event parsing algorithm to obtain the event parsing result; Extract the event type of the event to be executed from the event parsing results; Based on the association information between the preset event type and the preset event handling script, the first event handling script corresponding to the event type is obtained from the preset event handling script library.

3. The method according to claim 2, characterized in that, The step of obtaining the first event handling script corresponding to the event type from the preset event handling script library includes: If N event handling scripts corresponding to the event type are obtained from the preset event handling script library, a prompt message is displayed. The prompt message is used to prompt the user to select an event handling script that corresponds to the event execution instruction from the N event handling scripts, where N is a positive integer greater than 1. Upon receiving a first input to the N event handling scripts, the event handling script corresponding to the first input is determined as the first event handling script.

4. The method according to claim 1, characterized in that, The object includes at least one of the following: device, interface, code resource; the abnormal information includes at least one of the following: information in the first detection result that the device cannot currently execute the first event handling script, information in the second detection result that the interface corresponding to the interface information cannot currently be connected, and information in the third detection result that the interface corresponding to the interface information cannot currently execute the first event handling script. The step of obtaining a second event handling script from a preset event handling script library based on the first event handling script and the exception information includes: Remove the exception information from the first execution environment description information to obtain the second execution environment description information; Based on the second execution environment description information, determine whether an event handling script corresponding to the second execution environment description information is obtained from the preset event handling script library; If it is determined that an event handling script corresponding to the second execution environment description information is obtained from the preset event handling script library, the event handling script corresponding to the second execution environment description information is determined as the second event handling script; The event type in the second event handling script is the same as the event type in the first event handling script.

5. The method according to claim 4, characterized in that, The method further includes: If it is determined that no event handling script corresponding to the second execution environment description information is obtained from the preset event handling script library, the first backup information corresponding to the abnormal information is obtained from the preset backup information library according to the association information between the preset abnormal information and the preset backup information. The first backup information corresponds to the abnormal information and is information about an object that can execute the first event handling script. The exception information in the first execution environment description information is replaced with the first backup information to obtain the third execution environment description information; Based on the third execution environment description information, obtain the event handling script corresponding to the third execution environment description information from the preset event handling script library; The event handling script corresponding to the third execution environment description information is determined as the second event handling script.

6. The method according to claim 1, characterized in that, The step of obtaining a second event handling script from a preset event handling script library based on the first event handling script and the exception information includes: Based on the association information between preset abnormal information and preset backup information, second backup information corresponding to the abnormal information is obtained from the preset backup information database. The second backup information corresponds to the abnormal information and is information about an object that can execute the first event handling script. The exception information in the first execution environment description information is replaced with the second backup information to obtain the fourth execution environment description information; Based on the fourth execution environment description information, obtain the event handling script corresponding to the fourth execution environment description information from the preset event handling script library; The event handling script corresponding to the fourth execution environment description information is determined as the second event handling script.

7. An event processing device, characterized in that, The device includes: The receiving module is used to receive an event execution instruction for an event to be executed, wherein the event to be executed corresponds to a first event handling script, and the first event handling script includes first execution environment description information for executing the first event handling script. The first execution environment description information includes network address information of each of the multiple devices executing the first event handling script, interface information corresponding to each device, and working status information of the interface corresponding to the interface information. The detection module is used to detect the device corresponding to the network address information according to a preset network diagnostic tool algorithm, and obtain a first detection result of whether the device can currently execute the first event handling script; to detect the interface corresponding to the interface information according to a preset interface connection test algorithm, and obtain a second detection result of whether the interface corresponding to the interface information can currently be connected; and to detect the interface corresponding to the interface information according to a preset interface application test algorithm, and obtain a third detection result of whether the interface can currently execute the first event handling script. The acquisition module is configured to, when the detection result indicates that the first execution environment description information includes abnormal information, acquire a second event handling script from a preset event handling script library based on the first event handling script and the abnormal information, wherein the abnormal information is information about an object that cannot currently execute the first event handling script; The execution module is used to execute a preset task corresponding to the second event handling script and obtain the execution result of the event execution instruction.

8. A computer device, characterized in that, The computer device includes: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, it implements the event handling method as described in any one of claims 1-6.

9. A storage medium, characterized in that, The storage medium stores computer program instructions, which, when executed by a processor, implement the event handling method as described in any one of claims 1-6.

Images