Task processing method and device, computer device, and storage medium

Abstract

The application discloses a task processing method and device, computer equipment and a storage medium. The method comprises the following steps: in response to a template configuration operation, a target notification template is configured, wherein the notification template comprises a notification mode, notification content and a notification scene of a playbook execution result in a security orchestration and automation system (SOAR); in response to a playbook configuration operation, a notification account and the target notification template are associated with a target playbook; during running of the target playbook, based on an execution result of a task of the target playbook, the target notification template associated with the target playbook and the notification account, notification information corresponding to the execution result is sent to a client corresponding to the notification account. By associating the custom configured target notification template with the target playbook, the execution result of the task meeting the notification scene is notified in the preset notification mode and notification content, so that the notification is more in line with the actual needs of the user.

Description

Technical Field

[0001] This application relates to the field of information security technology, and more specifically, to a task processing method, apparatus, computer equipment, and storage medium. Background Technology

[0002] Security orchestration and automation systems can process security incidents in an orderly manner based on pre-programmed security incident response flows, or scripts, when specific security tasks or events are triggered. After a task in the security incident response flow is completed (e.g., a successful IP blocking), the system adds a notification task to send a notification so that users are promptly informed of the incident's progress. However, this approach suffers from limited notification methods and fixed content, leading to overly complex script execution flows. Summary of the Invention

[0003] In view of the above problems, this application proposes a task processing method, apparatus, computer device, and storage medium to realize user-defined notifications of the execution results of script tasks.

[0004] In a first aspect, embodiments of this application provide a task processing method, the method comprising: in response to a template configuration operation, configuring a target notification template, the notification template including a notification method, notification content, and notification scenario for script execution results in a Security Orchestration and Automation (SOAR) system; in response to a script configuration operation, associating a notification account and the target notification template with a target script; and during the execution of the target script, sending notification information corresponding to the execution result to a client corresponding to the notification account based on the execution result of the task in the target script, the target notification template associated with the target script, and the notification account.

[0005] Secondly, embodiments of this application provide a task processing apparatus, comprising: a template configuration module, a script association module, and a notification sending module. The template configuration module, in response to a template configuration operation, configures a target notification template, which includes a notification method, content, and scenario for the execution results of a script in the Secure Orchestration and Automation System (SOAR). The script association module, in response to a script configuration operation, associates a notification account and the target notification template with a target script. The notification sending module, during the execution of the target script, sends notification information corresponding to the execution result to the client corresponding to the notification account, based on the execution result of the task in the target script, the target notification template associated with the target script, and the notification account.

[0006] Thirdly, embodiments of this application provide a computer device, including: one or more processors; a memory; and one or more application programs, wherein the one or more application programs are stored in the memory and configured to be executed by the one or more processors, and the one or more application programs are configured to perform the task processing method provided in the first aspect above.

[0007] Fourthly, embodiments of this application provide a computer-readable storage medium storing program code, which can be invoked by a processor to execute the task processing method provided in the first aspect above.

[0008] The solution provided in this application configures a target notification template in response to a template configuration operation. This template includes the notification method, content, and scenario for the execution results of a script in the Security Orchestration and Automation (SOAR) system. In response to a script configuration operation, a notification account and the target notification template are associated with a target script. During the execution of the target script, based on the execution results of the tasks in the target script, the target notification template associated with the target script, and the notification account, notification information corresponding to the execution results is sent to the client corresponding to the notification account. By associating a custom-configured target notification template with the target script, the execution results of tasks matching the notification scenario are notified using a preset notification method and content, making the notifications more aligned with actual user needs. Attached Figure Description

[0009] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0010] Figure 1 This illustrates the typical task flow of a computer device when running a virus scan script.

[0011] Figure 2 A flowchart illustrating a task processing method provided in one embodiment of this application is shown.

[0012] Figure 3 A schematic diagram of the template configuration interface provided in an embodiment of this application is shown.

[0013] Figure 4 A schematic diagram of the script configuration interface provided in an embodiment of this application is shown.

[0014] Figure 5 The task flow for running a virus scanning script in one embodiment of this application is shown.

[0015] Figure 6 A flowchart illustrating a task processing method provided in another embodiment of this application is shown.

[0016] Figure 7 A schematic diagram of the specific process of step S260 in another embodiment of this application is shown.

[0017] Figure 8 A schematic diagram of the specific process of step S261 in another embodiment of this application is shown.

[0018] Figure 9 A schematic diagram comparing a notification template with an actual notification is shown in another embodiment of this application.

[0019] Figure 10 A schematic diagram of the structure of the target script operation is shown in another embodiment of this application.

[0020] Figure 11 A structural block diagram of the task processing apparatus provided in an embodiment of this application is shown.

[0021] Figure 12 A structural block diagram of a computer device provided in an embodiment of this application is shown.

[0022] Figure 13 A structural block diagram of a computer-readable storage medium provided in an embodiment of this application is shown. Detailed Implementation

[0023] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings.

[0024] The inventors have proposed a task processing method, apparatus, computer device, and storage medium as described in the embodiments of this application. By associating a custom-configured target notification template with a target script, the execution results of tasks that conform to the notification scenario are notified in a preset notification method and with preset notification content, making the notifications more in line with the user's actual needs. The specific task processing method will be described in detail in subsequent embodiments.

[0025] The following explains the commonly used terms in the task processing method provided in the embodiments of this application.

[0026] The task processing method provided in this application is applied to a Security Orchestration, Automation and Response (SOAR) system. A SOAR system allows IT and security teams to pre-program response flows after a security incident, executing security operations without human intervention to reduce human error, improve efficiency, and ensure consistent security incident responses. In a SOAR system, the fixed process of system response to a specific event is called a script. This is a task-based graphical workflow where each task performs a specific operation. Security personnel can use the system's automated response flow for a specific event to create a script of fixed security operations. Furthermore, in a SOAR system, the action of notifying relevant parties of event information when a specific security operation or event occurs is called a Service Level Agreement Notification (SLA). The SOAR system can send SLA notifications to designated responsible parties' terminal applications through applications that can communicate between different terminal devices.

[0027] Normally, during script execution, computer devices determine whether to send a notification based on the result of a task. However, if it is determined that a notification needs to be sent, the computer device will add another task to perform the notification sending action. For example... Figure 1 As shown, in the "Issue Virus Scan" script, once the script starts running, the computer device creates a new task to "Send Scan Notification." The script then checks if the scan was successful; if so, it executes the task of isolating the host. Afterward, the computer device adds another task to "Send Notification to Host Administrator," and finally, the script finishes running. It can be seen that the script adds notification tasks multiple times during this process. For some complex scripts, this number increases, leading to excessively large scripts, complex process configurations, and an increased probability of errors. Furthermore, the notifications sent to the user based on the script execution results are all pre-set templates; the user cannot modify the content or expand the notification method, resulting in notifications that fail to meet the user's actual needs.

[0028] The task processing method provided in the embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0029] Please see Figure 2 , Figure 2 This paper illustrates a flowchart of a task processing method provided in one embodiment of this application. The following will focus on... Figure 2The process shown is described in detail, and the task processing method may specifically include the following steps:

[0030] Step S110: In response to the template configuration operation, configure the target notification template.

[0031] In this embodiment, the computer device can configure the notification method, content, and scenario of a target notification template through user-defined template configuration operations. Specifically, the user can restrict the notifications to be sent by the computer in terms of content, method, and scenario through template configuration. The computer device can obtain the corresponding parameters through the user's notification configuration operations, and then configure a target notification template that meets the user's needs. For example, the user can set the notification content, method, and scenario through template configuration. The notification method can include notifications via all communication methods supported by the system, such as SMS, email, WeChat, or DingTalk. The notification scenario can be based on whether the task is successful, failed, or timed out, thus making the notification delivery more aligned with the user's actual needs.

[0032] like Figure 3 As shown, the computer device can also provide a template user interface, allowing users to configure the notification content, notification method, and notification scenario of the target notification template according to their own needs. The interface shown in the figure indicates that the user has set the target notification template to send notifications via email, and to send notifications in the event of task failure or timeout in the target script. The user has also set the content of the notification. The computer device obtains the user's template configuration operations through the template configuration interface, and can determine the notification content, notification method, and notification scenario when sending notifications based on this target notification template.

[0033] In some implementations, users can configure multiple different notification templates at once. The notification content and scenario for each template can be customized by the user, but each template can only correspond to one notification method. It is understood that notification methods can include SMS, email, WeChat, or DingTalk, among others. Each notification method requires different elements when sending a notification. For example, when sending a notification via SMS, the user only needs to pre-configure the content, while when sending a notification via email, the user also needs to configure the subject line, CC recipients, and other elements. In other words, different notification methods require different elements to be configured when configuring a template. Therefore, a user can only configure one notification template per template configuration operation, and one notification template can only correspond to one notification method.

[0034] Step S120: In response to the script configuration operation, associate the notification account and the target notification template with the target script.

[0035] In this embodiment, after configuring the target notification template based on the user's template configuration operation, the computer device also needs to obtain the user's script configuration operation for the target script. That is, the computer device needs to associate the pre-configured target notification template with the target script through the user's script configuration operation, so that notifications can be sent according to the configuration content of the target template during the subsequent execution of the target script. Specifically, as follows... Figure 4 As shown, the computer device can associate a user-defined target notification template with a target script for monitoring user needs through the script configuration interface. In other words, the target script references the target notification template. Subsequently, during the execution of the target script, it can send notifications to the user in the scenario required by the user through a preset notification method. The script configuration interface shown in the figure indicates that the user referenced the "System Vulnerability" notification template in the "Distribute Virus Scan" script, and the computer device will send the notification to the account of the operation and maintenance manager.

[0036] In some implementations, the same notification template can be associated with multiple different scripts. After a computer device configures multiple notification templates through a user's template configuration operation, it can reference the appropriate notification template in each script according to the user's actual needs. Obviously, a notification template corresponds to a fixed notification method, notification content, and a preset fixed notification scenario. However, when facing the same notification scenario, the same script can reference multiple different notification templates to send different notification content to different users in different notification methods.

[0037] Step S130: During the execution of the target script, based on the execution result of the task of the target script, the target notification template associated with the target script, and the notification account, send the notification information corresponding to the execution result to the client corresponding to the notification account.

[0038] In this embodiment, to ensure that the content, method, and scenario of notifications sent to the user during the script's execution meet the user's actual needs, the computer device can configure a target notification template that meets the user's actual needs through the above steps and associate the target script with the target notification template. Based on this, the computer device can send notifications that meet the user's actual needs to a pre-determined notification account during the execution of the target script, based on the execution result of the target script's tasks and the notification scenario, method, and content corresponding to the target notification template. Thus, all notifications sent to the user during the script's execution meet the user's actual needs. For example, if the user needs to receive a notification when the script's task execution fails, the user can configure a target notification template through the above steps. The notification scenario of this target notification template is task execution failure. The user can also set the notification method and content of the target notification template based on their needs. After associating the target notification template with the target script, the user can receive the pre-set notification content through the preset notification method when the target script's task execution fails during the script's execution. When a computer device sends a notification, it sends the notification content to a notification account associated with the target script. If a user wants to receive the notification content in a timely manner, they can install the corresponding application software on their terminal device and log in to the notification account to receive and view the running status of the target script.

[0039] In some implementations, the execution result of a task in the target script can be the overall execution result of the target script or the execution result of a specific task within the target script. Furthermore, the execution result of a task can include various outcomes such as task failure, task success, and task timeout. The user's notification configuration operation, specifically configuring the notification scenario, determines which of the above-mentioned outcomes the task execution result will trigger a notification during the target script's execution.

[0040] Understandable, such as Figure 5 As shown, based on the distribution of virus scanning scripts, if the task processing method provided in this application embodiment is used, the computer device will only perform the task of judging whether the scan is successful and isolating the host when the scan is successful during the script execution process. As for the tasks of sending scan notifications and sending notifications to the host manager, the computer device will have other processes execute them through the notification configuration template, which will not increase the script arrangement. Moreover, the notification configuration template can make the notifications sent to the user more in line with the user's actual needs.

[0041] The task processing method provided in this application, in response to a template configuration operation, configures a target notification template, which includes the notification method, content, and scenario for the execution results of a script in a Security Orchestration and Automation (SOAR) system. In response to a script configuration operation, it associates a notification account and the target notification template with a target script. During the execution of the target script, based on the execution results of the tasks in the target script, the target notification template associated with the target script, and the notification account, it sends notification information corresponding to the execution results to the client corresponding to the notification account. By associating a custom-configured target notification template with the target script, the execution results of tasks conforming to the notification scenario are notified using a preset notification method and content, making the notifications more aligned with the user's actual needs.

[0042] Please see Figure 6 , Figure 6 A flowchart illustrating a task processing method provided in another embodiment of this application is shown below. Figure 6 The process shown is described in detail, and the task processing method may specifically include the following steps:

[0043] Step S210: In response to the template configuration operation, configure multiple different notification templates, wherein the target notification template is any one of the multiple notification templates.

[0044] In this embodiment, the computer device can configure multiple different notification templates through user-defined template configuration operations. The notification content, method, and scenario of each template are all user-defined, allowing the computer device to select the appropriate notification template to associate with different scripts. For example, the user can set the notification scenario of the first notification template to "task execution failure" and the notification scenario of the second notification template to "task execution failure and task execution success." Thus, if the user only wants to receive a notification when the target script's task execution fails, but not when the task execution succeeds, the computer device can associate the first notification template with the target script based on the user's needs.

[0045] Step S220: In response to the script configuration operation, determine the selected target script and the entered notification account, and determine the selected target notification template from the plurality of notification templates.

[0046] In this embodiment, after configuring multiple different notification templates through user-performed template configuration operations, the computer device can further obtain the user's script configuration operations to determine the target script for which the user requires the use of the target notification template. This means determining which script, based on which notification template configuration, the user requires to send a notification. Based on the user's script configuration operations, the computer device can select one notification template from the pre-configured multiple notification templates as the target notification template, and select one script from the multiple pre-determined scripts as the target script. This allows for subsequent association of the target script with the target notification template, ensuring that the notifications sent to the user during the execution of the target script better meet the user's actual needs.

[0047] Step S230: Associate the target notification template and notification account with the target script.

[0048] In this embodiment, after determining the target notification template and the target script through the above steps, the computer device can associate the target notification template with the target script. This enables the sending of notifications to the user based on the configuration of the target notification template during the execution of the target script. Specifically, when configuring a script, the user not only needs to associate the target script with the target notification template but also needs to set the recipient for the notifications from the target script. That is, the user also needs to associate the target script with a notification account so that the computer device can determine the recipient of the notification based on the notification account.

[0049] Understandably, to ensure that notifications sent to users during script execution meet their actual needs, the computer device not only needs to be configured with multiple different notification templates based on user requirements, but also needs to associate these notification templates with each script. Thus, during script execution, if a notification about the task's execution result needs to be sent to the user, the computer device can determine the notification content and method based on the notification template associated with the running script. Therefore, the computer device can first configure multiple different notification templates based on template settings, and then associate the configured notification templates with the scripts based on the user's script configuration.

[0050] Specifically, associating a notification account and a target notification template with a target script involves referencing the target notification template in the target script and binding the target notification template to the notification account. The computer device can provide users with an interactive interface for configuring scripts. Users can define the target script, the associated target notification template, and the notification account through this interface. The computer device, through this interface, defines the target script, target notification template, and notification account, thereby enabling the referencing of the target notification template in the target script and associating the notification account with it. This facilitates the subsequent sending of corresponding notifications to the notification account during the execution of the target script.

[0051] Step S240: Update the target notification template to the cache area corresponding to the script engine. The script engine is used to drive the target script to run, and the cache area is used to store all notification templates associated with the target script.

[0052] In this embodiment, a script engine drives the execution of a target script. A cache area corresponding to the script engine stores all notification templates associated with the script it drives. During script execution, if the execution result of a script task matches the notification scenario corresponding to a target notification template in the cache area, it can be determined that the execution result of the script task should be sent to the relevant user's notification account, based on the notification content and method configured for the target notification template. In other words, during script engine-driven script execution, if the execution result of a script task matches the notification scenario corresponding to any notification template in the cache area, the computer device can directly send a corresponding notification to the user based on the notification template matching the script task's execution result. Therefore, once the computer device configures a new notification template based on user operations, or modifies an existing notification template, the computer device should update the new notification template to the cache area corresponding to the script engine after the template configuration is complete, to avoid the content and method of notifications sent to the user during script execution not being updated in a timely manner.

[0053] Step S250: Create a Service Level Agreement (SLA) process for executing the target notification template.

[0054] In this embodiment, after configuring the notification template and script, the computer device can create an SLA process for executing the target notification template. This SLA process can interact with the script engine to obtain the execution results of script tasks within the script engine and send notifications to the notification account based on the notification template corresponding to the script. Specifically, the script engine sends the task execution result to the SLA process when it matches the notification scenario corresponding to the notification template in the cache area. Upon receiving the task execution result from the script engine, the SLA process determines the content and method of sending the notification based on the notification template in its cache area, and then sends the notification to the notification account.

[0055] Step S260: During the execution of the target script, if the execution result of the task in the target script matches any of the notification scenarios corresponding to the target notification template, the SLA process sends a notification corresponding to the execution result to the client corresponding to the notification account based on the target notification template.

[0056] In this embodiment, after configuring the notification template and script through the above steps, the computer device can determine whether a notification should be sent to the user during the execution of the target script via the SLA process, based on the task execution result and the notification scenario corresponding to the target notification template. Specifically, if the task execution result matches any of the notification scenarios corresponding to the target notification template, it is determined that a notification needs to be sent to the user. If a notification needs to be sent, the computer device can determine the content, method, and recipient of the notification based on the target notification template through the SLA process.

[0057] Specifically, such as Figure 7 As shown, the computer device sends a notification corresponding to the execution result to the client corresponding to the notification account based on the target notification template, which may include the following steps:

[0058] Step S261: During the execution of the target script, if the execution result of the task in the target script matches any of the notification scenarios corresponding to the target notification template, the SLA process determines the target notification content based on the target notification template.

[0059] In this embodiment, the SLA process can obtain the task execution result of the target script sent by the script engine if the task execution result of the target script matches any of the notification scenarios corresponding to the target notification template. Then, based on the target notification template associated with the target script, it determines the target notification content to be sent to the notification account. For example, if the notification scenarios corresponding to the target notification template are script execution failure and task execution failure, and a task fails during the execution of the target script, the script engine matches this task failure result with the notification scenario corresponding to the target notification template. If a successful match is found, the script engine sends the task failure execution result to the SLA process. Upon receiving this result, the SLA process can determine the template notification content based on the target notification template corresponding to the target script and the task failure execution result.

[0060] Specifically, such as Figure 8 As shown, determining the target notification content based on the target notification template can be achieved in the following ways:

[0061] Step S2611: During the execution of the target script, if the execution result of the task of the target script matches any of the notification scenarios corresponding to the target notification template, the SLA process obtains the running parameters corresponding to the target script. The running parameters include the name of the target script, the execution link, and the log parameters during the execution of the target script.

[0062] Step S2612: The SLA process determines the target notification content based on the running parameters and the notification content corresponding to the target notification template.

[0063] In this embodiment, the computer device can determine the content of the notification to be sent based on the running parameters of the target script, provided that the task execution result of the script matches any of the notification scenarios corresponding to the target notification template. It is understood that when configuring the target notification template, the user cannot determine which task part of the target script's execution process the notification will be triggered in, nor can they determine the reason for the notification or even the name of the script that triggered it. Therefore, the notification content configured by the user during the notification configuration operation typically does not specify these aspects; that is, it does not explicitly state the script name, the reason for the task failure, or the script's execution link when configuring the notification content. However, to make the user who receives the notification more aware of the script's execution process, the notification content can more clearly inform the recipient of the script's execution result, the reason for the result, and the script's execution link. Therefore, when the task execution result of the target script matches the notification scenario corresponding to the target notification template, the computer device can further determine the specific content of the notification to be sent to the user based on the running parameters of the target script. Clearly, the runtime parameters generated during the execution of the target script can record not only the target script's name and execution link, but also the log data of each task within the target script during execution. The computer device can then determine the reasons for task failures based on this log data. In this case, the notification content determined by the computer device based on the target script's runtime parameters will be more specific and clear than the notification content in the target notification template, making it easier for users to determine the script's running status based on the notification content.

[0064] In some implementations, when a computer device configures a target notification template through a user-defined notification template configuration operation, it can replace the script name, execution result, and reason for execution failure in the notification content with predefined replacement characters. Subsequently, during the execution of the target script, if the target notification template is triggered by the task execution result of the target script, the computer device can replace the replacement characters in the notification content based on the running parameters during the execution of the target script, so that the replaced content conforms to the actual situation of the notification triggering. For example... Figure 9 As shown, the left side of the image contains the notification content determined by the user in the template configuration process. Content related to the script, such as the script name, execution link, and execution result, can be replaced with substitution characters. If the target script needs to send a notification during its execution, the computer device can determine the content corresponding to these substitution characters in the target script through the corresponding running parameters of the target script and replace them. This yields the actual notification content sent on the right side of the image.

[0065] Step S262: The target notification content is sent to the client corresponding to the notification account through the SLA process in the notification method corresponding to the target notification template.

[0066] In this embodiment of the application, after the computer device determines the target notification content through the above steps, it can send the target notification content to the client corresponding to the notification account based on the configuration of the target notification template and the notification method corresponding to the target notification template.

[0067] In some implementations, after the computer device sends the target notification content to the client corresponding to the notification account through the SLA process, it can also store the target notification content, the corresponding notification scenario, and the notification method in a log file to facilitate subsequent review and monitoring of the task execution process of the target script.

[0068] In general, such as Figure 10 As shown, the computer device can configure the corresponding notification template through the notification template configuration operation performed by the user, and update the target notification template to the corresponding cache area of ​​the script engine. During the process of the script engine driving the target script to run, if the execution result of a certain task matches the notification scene corresponding to the target notification template in the cache area, the script engine can send the execution result of the task to the SLA process. The SLA process can send a notification to the notification account based on the target notification template and in a preset notification method.

[0069] The task processing method provided in this application, in response to a template configuration operation, configures multiple different notification templates; in response to a script configuration operation, determines a target script, a notification account, and a target notification template; associates the target notification template and notification account with the target script; updates the target notification template to the corresponding cache area of ​​the script engine; and creates a Service Level Agreement (SLA) process for executing the target notification template. During the execution of the target script, if the execution result of the task in the target script matches any of the notification scenarios corresponding to the target notification template, the SLA process sends a notification corresponding to the execution result to the client corresponding to the notification account based on the target notification template. The SLA process separates the notification sending task from the script execution task, avoiding excessive notification sending from affecting the efficiency of script execution. Furthermore, through user-defined target notification templates, the content and method of notifications sent to the notification account during the execution of the target script better meet the user's needs.

[0070] Please see Figure 11This document illustrates a structural block diagram of a task processing device 200 provided in an embodiment of this application. The task processing device 200 includes a template configuration module 210, a script association module 220, and a notification sending module 230. The template configuration module 210 configures a target notification template in response to a template configuration operation. The notification template includes the notification method, content, and scenario for the execution results of a script in the Secure Orchestration and Automation System (SOAR). The script association module 220 associates a notification account and a target notification template with a target script in response to a script configuration operation. The notification sending module 230, during the execution of the target script, sends notification information corresponding to the execution results to the client corresponding to the notification account based on the execution results of the tasks in the target script, the target notification template associated with the target script, and the notification account.

[0071] As one possible implementation, the notification sending module 230 includes a process creation unit and a notification sending unit. The process creation unit is used to create a Service Level Agreement (SLA) process for executing the target notification template. The notification sending unit is used to send a notification corresponding to the execution result to the client corresponding to the notification account based on the target notification template, when the execution result of the task in the target script matches any of the notification scenarios corresponding to the target notification template during the execution of the target script.

[0072] As one possible implementation, the notification sending unit includes a content determination component and a notification sending component. The content determination component is used to determine the target notification content based on the target notification template during the execution of the target script, in the case where the execution result of the task in the target script matches any of the notification scenarios corresponding to the target notification template through the SLA process. The notification sending component is used to send the target notification content to the notification account in the notification method corresponding to the target notification template through the SLA process.

[0073] As one possible implementation, the content determination component is also used to obtain the running parameters of the target script during the execution of the target script by means of the SLA process if the execution result of the task of the target script matches any of the notification scenarios corresponding to the target notification template. The running parameters include the name of the target script, the execution link, and the log parameters during the execution of the target script. Based on the running parameters and the notification content corresponding to the target notification template, the SLA process determines the target notification content.

[0074] In one possible implementation, the template configuration module 210 is also used to configure multiple different notification templates in response to the template configuration operation, wherein the target notification template is any one of the multiple notification templates; the script association module 220 includes a script selection unit and a template association unit, wherein the script selection unit is used to determine the selected target script and the input notification account in response to the script configuration operation, and to determine the selected target notification template from the multiple notification templates; the template association unit is used to associate the target notification template and the notification account with the target script.

[0075] As one possible implementation, the template association unit is also used to reference the target notification template in the target script and bind the target notification template to the notification account.

[0076] As one possible implementation, the task processing device 200 also includes a template caching unit for updating the target notification template to the cache area corresponding to the script engine. The script engine is used to drive the target script to run, and the cache area is used to store all notification templates associated with the target script.

[0077] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the above-described device and module can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0078] In the several embodiments provided in this application, the coupling between modules can be electrical, mechanical, or other forms of coupling.

[0079] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0080] In summary, the solution provided in this application configures a target notification template in response to a template configuration operation. This notification template includes the notification method, content, and scenario for the execution results of a script in the Security Orchestration and Automation (SOAR) system. In response to a script configuration operation, it associates a notification account and the target notification template with a target script. During the execution of the target script, based on the execution results of the tasks in the target script, the target notification template associated with the target script, and the notification account, it sends notification information corresponding to the execution results to the client corresponding to the notification account. By associating a custom-configured target notification template with the target script, the execution results of tasks matching the notification scenario are notified using a preset notification method and content, making the notifications more aligned with the user's actual needs.

[0081] Please refer to Figure 12 This diagram illustrates a structural block diagram of a computer device 300 provided in an embodiment of this application. The computer device 300 can be a physical server, a cloud server, or the like. The computer device 300 in this application may include one or more of the following components: a processor 310, a memory 320, and one or more application programs. The one or more application programs may be stored in the memory 320 and configured to be executed by one or more processors 310. The one or more programs are configured to perform the methods described in the foregoing method embodiments.

[0082] Processor 310 may include one or more processing cores. Processor 310 connects to various parts of the computer device using various interfaces and lines, and performs various functions and processes data by running or executing instructions, programs, code sets, or instruction sets stored in memory 320, and by calling data stored in memory 320. Optionally, processor 310 may be implemented using at least one hardware form of Digital Signal Processing (DSP), Field-Programmable Gate Array (FPGA), or Programmable Logic Array (PLA). Processor 310 may integrate one or a combination of several of the following: Central Processing Unit (CPU), Graphics Processing Unit (GPU), and modem. The CPU primarily handles the operating system, user interface, and applications; the GPU is responsible for rendering and drawing the displayed content; and the modem handles wireless communication. It is understood that the modem may also not be integrated into processor 310 and may be implemented separately using a communication chip.

[0083] The memory 320 may include random access memory (RAM) or read-only memory (ROM). The memory 320 can be used to store instructions, programs, code, code sets, or instruction sets. The memory 320 may include a program storage area and a data storage area. The program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as touch functionality, sound playback functionality, image playback functionality, etc.), and instructions for implementing the various method embodiments described below. The data storage area may also store data created during the use of the computer device (such as phonebook data, audio and video data, chat log data, etc.).

[0084] Please refer to Figure 13This diagram illustrates a structural block diagram of a computer-readable storage medium provided in an embodiment of this application. The computer-readable medium 800 stores program code that can be called by a processor to execute the methods described in the above method embodiments.

[0085] The computer-readable storage medium 800 may be an electronic memory such as flash memory, EEPROM (Electrically Erasable Programmable Read-Only Memory), EPROM, hard disk, or ROM. Optionally, the computer-readable storage medium 800 includes a non-transitory computer-readable storage medium. The computer-readable storage medium 800 has storage space for program code 810 that performs any of the method steps described above. This program code can be read from or written to one or more computer program products. The program code 810 may be compressed, for example, in a suitable form.

[0086] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A task processing method, characterized in that, The method includes: In response to the template configuration operation, a target notification template is configured. The notification template includes the notification method, notification content, and notification scenario for the script execution results in the Security Orchestration and Automation System (SOAR). The template configuration operation is used to restrict the notification to be sent in terms of notification content, notification method, and notification scenario in order to configure a target notification template that meets the user's own needs. In response to the script configuration operation, the notification account and the target notification template are associated with the target script; During the execution of the target script, based on the execution result of the task in the target script, the target notification template associated with the target script, and the notification account, a notification message corresponding to the execution result and conforming to the user's own needs is sent to the client corresponding to the notification account.

2. The method according to claim 1, characterized in that, During the execution of the target script, based on the execution result of the task in the target script, the target notification template associated with the target script, and the notification account, notification information corresponding to the execution result is sent to the client corresponding to the notification account, including: Create a Service Level Agreement (SLA) process for executing the target notification template; During the execution of the target script, if the execution result of the task in the target script matches any of the notification scenarios corresponding to the target notification template, the SLA process sends a notification corresponding to the execution result to the client corresponding to the notification account based on the target notification template.

3. The method according to claim 2, characterized in that, During the execution of the target script, if the execution result of the task in the target script matches any of the notification scenarios corresponding to the target notification template, the SLA process sends a notification corresponding to the execution result to the client corresponding to the notification account based on the target notification template, including: During the execution of the target script, if the execution result of the task in the target script matches any of the notification scenarios corresponding to the target notification template, the SLA process determines the target notification content based on the target notification template. The target notification content is sent to the client corresponding to the notification account through the SLA process in the notification method corresponding to the target notification template.

4. The method according to claim 3, characterized in that, During the execution of the target script, if the execution result of the task in the target script matches any of the notification scenarios corresponding to the target notification template, the target notification content is determined based on the target notification template, including: During the execution of the target script, if the execution result of the task of the target script matches any of the notification scenarios corresponding to the target notification template, the SLA process obtains the running parameters corresponding to the target script. The running parameters include the name of the target script, the execution link, and the log parameters during the execution of the target script. The SLA process determines the target notification content based on the operating parameters and the notification content corresponding to the target notification template.

5. The method according to claim 1, characterized in that, The step of configuring the target notification template in response to the template configuration operation includes: In response to the template configuration operation, multiple different notification templates are configured, and the target notification template is any one of the multiple notification templates; The response to the script configuration operation, associating the notification account and the target notification template with the target script, includes: In response to the script configuration operation, determine the selected target script and the entered notification account, and determine the selected target notification template from the plurality of notification templates; Associate the target notification template and the notification account with the target script.

6. The method according to claim 5, characterized in that, Associating the target notification template and the notification account with the target script includes: The target notification template is referenced in the target script, and the target notification template is bound to the notification account.

7. The method according to any one of claims 1-6, characterized in that, After associating the notification account and the target notification template with the target script in response to the script configuration operation, the method further includes: The target notification template is updated to the cache area corresponding to the script engine. The script engine is used to drive the target script to run, and the cache area is used to store all notification templates associated with the target script.

8. A task processing device, characterized in that, The device includes: The template configuration module is used to configure a target notification template in response to the template configuration operation. The notification template includes the notification method, notification content and notification scenario of the script execution result in the Security Orchestration and Automation System (SOAR). The template configuration operation is used to restrict the notification to be sent in terms of notification content, notification method and notification scenario in order to configure a target notification template that meets the user's own needs. The script association module is used to associate the notification account and the target notification template with the target script in response to the script configuration operation; The notification sending module is used to send notification information corresponding to the execution result and conforming to the user's own needs to the client corresponding to the notification account during the execution of the target script, based on the execution result of the task of the target script, the target notification template associated with the target script, and the notification account.

9. A computer device, characterized in that, include: One or more processors; Memory; One or more applications, wherein the one or more applications are stored in the memory and configured to be executed by the one or more processors, the one or more applications being configured to perform the method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium contains program code that can be invoked by a processor to execute the method as described in any one of claims 1-7.

Images