A security orchestration and automated response processing method and system

Abstract

This invention provides a security orchestration and automated response processing method and system. The method includes: performing data modeling and encapsulation processing on security element data based on various business requirements to obtain a dataset; constructing functional blocks according to different task types based on input task configuration information to obtain multiple functional blocks; performing script orchestration operations on the functional blocks and dataset based on various business requirements to obtain scripts, and saving the scripts to generate corresponding script definition files; based on the network security event to be processed, calling the corresponding target script definition file from the script definition file, and executing the target script definition file to achieve automated response processing for network security events. The method provided by this invention can automate the execution of routine and repetitive tasks by flexibly orchestrating response scripts, shortening the response time of network security events and improving the standardization and efficiency of the security orchestration and automated response processing process.

Description

Technical Field

[0001] This invention relates to the field of security incident management technology, specifically to a security orchestration and automated response processing method and system. Additionally, it relates to an electronic device and a processor-readable storage medium. Background Technology

[0002] In today's increasingly severe and complex cybersecurity landscape, organizations face greater challenges in their security operations. When cybersecurity incidents occur frequently, the timeliness and effectiveness of emergency response are crucial to minimizing losses. However, in reality, the product capabilities of different security vendors often fail to collaborate effectively, and there is a shortage of security analysis and operations personnel with varying skill levels. This results in inadequate, untimely, and non-standardized responses to cybersecurity incidents, leading to poor processing efficiency. Therefore, designing a more effective security orchestration and automated response method to improve the efficiency and standardization of security orchestration and automated response processing has become an urgent problem to be solved. Summary of the Invention

[0003] To address this, the present invention provides a secure orchestration and automated response processing method and system, which solves the problem that existing secure orchestration and automated response processing schemes have high limitations, resulting in poor efficiency and standardization in secure orchestration and automated response processing.

[0004] In a first aspect, the present invention provides a security orchestration and automated response processing method, comprising: acquiring security element data corresponding to various attributes; performing data modeling and encapsulation processing on the security element data based on various business requirements to obtain a corresponding dataset; the dataset includes various data packets and labels for classifying and marking the data packets;

[0005] Based on the input task configuration information, functional blocks are constructed according to different task types to obtain multiple functional blocks corresponding to different task types, so as to realize the representation of automated response capabilities for network security incidents;

[0006] Based on various business requirements, the script arrangement operation of the functional blocks and the dataset is performed to obtain the corresponding scripts, and the scripts are saved to generate the corresponding script definition files; wherein, the script is a business processing flow representation that includes a start node, an end node, and at least one of the functional blocks;

[0007] Based on the cybersecurity incident to be processed, the corresponding target script definition file is called from the script definition file and executed to achieve automated response processing for the cybersecurity incident.

[0008] Furthermore, the process of performing data modeling and encapsulation on the security element data based on various business requirements to obtain the corresponding dataset specifically includes:

[0009] Use a data picker to pick data from various data sources and package it into an initial dataset;

[0010] The data mapping module is used to map the dispersed and heterogeneous security element data in the initial dataset to different business requirement types that the data analysis module focuses on.

[0011] The data analysis module is used to model various security element data according to different business needs, resulting in the corresponding datasets; the business needs include alarm handling, asset management, vulnerability inspection, intelligence analysis, risk handling, and threat handling.

[0012] Specifically, the step of using a data picker to pick data from various data sources and encapsulate it into an initial dataset includes:

[0013] The access data metadata definition module is used to describe the structure of the data from the data sources that need to be accessed based on the metadata definition mechanism. Then, a data filter running on the metadata definition mechanism is used to filter the data from various data sources according to various attributes to pick the target data and obtain the initial dataset. The attributes include event type, alarm level and asset attributes.

[0014] Furthermore, the input task configuration information is used to construct functional blocks according to different task types, resulting in multiple functional blocks corresponding to different task types, specifically including:

[0015] Retrieve task configuration information input by the user for different task types;

[0016] Based on the task configuration information, response actions corresponding to different task types and used to implement different business logics are determined, as well as task plugins that accept instructions and provide specific services or link security devices; the function blocks are obtained based on the response actions and the task plugins; the function blocks are the basic components constituting the script.

[0017] The task configuration information includes the task name, task description, task type, input parameters, and output parameters corresponding to different task types; the task types include coordinated handling tasks, approval tasks, message notification tasks, work order tasks, context enrichment tasks, log retrieval tasks, intelligence query tasks, handling tasks, logic parsing tasks, and process tasks.

[0018] Furthermore, the script arrangement operation performed on the functional blocks and the dataset based on various business requirements to obtain the corresponding scripts specifically includes:

[0019] The functional blocks and data packets are pre-configured based on various business requirements to obtain a pre-configured general script;

[0020] The general scripts include proactive scripts for adapting to proactive daily inspections and / or passive incident response scripts for handling cybersecurity attack tasks.

[0021] Furthermore, the script arrangement operation performed on the functional blocks and the dataset based on various business requirements to obtain the corresponding script also includes:

[0022] Based on the editing operations in the preset canvas, the starting node, the ending node, and at least one functional block are referenced; the starting node, the ending node, the at least one functional block, and their corresponding data packets are arranged according to various business requirements to obtain the corresponding user-configured script.

[0023] The user-configured scripts include proactive scripts for adapting to proactive daily inspections and / or passive incident response scripts for handling cybersecurity attack tasks.

[0024] Furthermore, saving the script to generate the corresponding script definition file specifically includes: after saving the script, defining the automated response process of the script based on the functional blocks corresponding to various business requirements. The automated response process includes a set of business processing nodes and edges, a dataset defining each business processing node in the automated response process, and basic parameter information defining the script, thereby generating the corresponding script definition file.

[0025] Furthermore, after referencing the start node, end node, and at least one function block based on the editing operation in the preset canvas, it also includes:

[0026] Based on the editing operations in the preset canvas, the preset sub-scripts are referenced. The starting node, the ending node, the at least one functional block and its corresponding data packet, and the sub-scripts are arranged according to various business requirements to obtain the corresponding scripts, so as to realize the nested use of sub-scripts.

[0027] Secondly, the present invention also provides a secure orchestration and automated response processing system, comprising:

[0028] The data modeling and encapsulation unit is used to acquire security element data corresponding to various attributes, and to perform data modeling and encapsulation processing on the security element data based on various business requirements to obtain a corresponding dataset; the dataset contains various data packets and labels for classifying and marking the data packets;

[0029] The function block construction unit is used to construct function blocks according to different task types based on the input task configuration information, so as to obtain multiple function blocks corresponding to different task types, in order to realize the representation of automated response capabilities for network security incidents;

[0030] The script arrangement unit is used to perform script arrangement operations on the functional blocks and the dataset based on various business requirements, obtain the corresponding scripts, and save the scripts to generate the corresponding script definition files; wherein, the script is a business processing flow representation that includes a start node, an end node, and at least one of the functional blocks;

[0031] The script execution unit is used to call the corresponding target script definition file from the script definition file based on the network security event to be processed, and execute the target script definition file to realize automated response processing for the network security event.

[0032] Furthermore, the data modeling and encapsulation unit is specifically used for:

[0033] Use a data picker to pick data from various data sources and package it into an initial dataset;

[0034] The data mapping module is used to map the dispersed and heterogeneous security element data in the initial dataset to different business requirement types that the data analysis module focuses on.

[0035] The data analysis module is used to model various security element data according to different business needs, resulting in the corresponding datasets; the business needs include alarm handling, asset management, vulnerability inspection, intelligence analysis, risk handling, and threat handling.

[0036] Specifically, the step of using a data picker to pick data from various data sources and encapsulate it into an initial dataset includes:

[0037] The access data metadata definition module is used to describe the structure of the data from the data sources that need to be accessed based on the metadata definition mechanism. Then, a data filter running on the metadata definition mechanism is used to filter the data from various data sources according to various attributes to pick the target data and obtain the initial dataset. The attributes include event type, alarm level and asset attributes.

[0038] Furthermore, the functional block construction unit is specifically used for:

[0039] Retrieve task configuration information input by the user for different task types;

[0040] Based on the task configuration information, response actions corresponding to different task types and used to implement different business logics are determined, as well as task plugins that accept instructions and provide specific services or link security devices; the function blocks are obtained based on the response actions and the task plugins; the function blocks are the basic components constituting the script.

[0041] The task configuration information includes the task name, task description, task type, input parameters, and output parameters corresponding to different task types; the task types include coordinated handling tasks, approval tasks, message notification tasks, work order tasks, context enrichment tasks, log retrieval tasks, intelligence query tasks, handling tasks, logic parsing tasks, and process tasks.

[0042] Furthermore, the script arrangement unit is specifically used for:

[0043] The functional blocks and data packets are pre-configured based on various business requirements to obtain a pre-configured general script;

[0044] The general scripts include proactive scripts for adapting to proactive daily inspections and / or passive incident response scripts for handling cybersecurity attack tasks.

[0045] Furthermore, the script arrangement unit is specifically used for:

[0046] Based on the editing operations in the preset canvas, the starting node, the ending node, and at least one functional block are referenced; the starting node, the ending node, the at least one functional block, and their corresponding data packets are arranged according to various business requirements to obtain the corresponding user-configured script.

[0047] The user-configured scripts include proactive scripts for adapting to proactive daily inspections and / or passive incident response scripts for handling cybersecurity attack tasks.

[0048] Furthermore, the script arrangement unit is specifically used to: after saving the script, define the automated response process of the script based on the functional blocks corresponding to various business requirements. The automated response process includes a set of business processing nodes and edges, a dataset defining each business processing node in the automated response process, and basic parameter information defining the script, and generates a corresponding script definition file.

[0049] Furthermore, after referencing the start node, end node, and at least one functional block based on the editing operations in the preset canvas, it also includes: a sub-script arrangement unit, used for:

[0050] Based on the editing operations in the preset canvas, the preset sub-scripts are referenced. The starting node, the ending node, the at least one functional block and its corresponding data packet, and the sub-scripts are arranged according to various business requirements to obtain the corresponding scripts, so as to realize the nested use of sub-scripts.

[0051] Thirdly, the present invention also provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the security orchestration and automated response processing method as described in any of the preceding claims.

[0052] Fourthly, the present invention also provides a processor-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the security orchestration and automated response processing method as described in any of the preceding claims.

[0053] The security orchestration and automated response processing method provided by this invention acquires security element data corresponding to various attributes, and performs data modeling and encapsulation processing on the security element data based on various business requirements to obtain a dataset; constructs functional blocks according to different task types based on input task configuration information to obtain multiple functional blocks; performs script orchestration operations on the functional blocks and dataset based on various business requirements to obtain scripts, and saves the scripts to generate corresponding script definition files; based on the network security event to be processed, calls the corresponding target script definition file from the script definition file, and executes the target script definition file to achieve automated response processing for network security events. It can automate the execution of routine and repetitive tasks by flexibly orchestrating response scripts, effectively shortening the response time of network security events, reducing the cost of security analysis and security operations, and improving the standardization and efficiency of the security orchestration and automated response processing process. Attached Figure Description

[0054] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0055] Figure 1 This is a flowchart illustrating the secure orchestration and automated response processing method provided in an embodiment of the present invention;

[0056] Figure 2 This is a complete flowchart of the secure orchestration and automated response processing method provided in the embodiments of the present invention;

[0057] Figure 3 This is a schematic diagram illustrating the process of data modeling and encapsulation of security element data provided in an embodiment of the present invention;

[0058] Figure 4 This is a schematic diagram of the SOAR business process interpretation, execution, and job scheduling provided in an embodiment of the present invention.

[0059] Figure 5 This is a schematic diagram of the structure of the secure orchestration and automated response processing system provided in an embodiment of the present invention;

[0060] Figure 6 This is a schematic diagram of the physical structure of the electronic device provided in an embodiment of the present invention. Detailed Implementation

[0061] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0062] The following is a detailed description of embodiments of the secure orchestration and automated response processing method described in this invention. For example... Figure 1 The diagram shown is a flowchart of the secure orchestration and automated response processing method provided in an embodiment of the present invention. The specific process includes the following steps:

[0063] Step 101: Obtain security element data corresponding to various attributes, perform data modeling and encapsulation processing on the security element data based on various business requirements, and obtain the corresponding dataset; the dataset contains various data packets and labels for classifying and marking the data packets.

[0064] In this step, a data picker is used to collect data from various data sources and encapsulate it into an initial dataset. A data mapping module maps the scattered, heterogeneous security element data in the initial dataset to different business requirement types relevant to the data analysis module. The data analysis module (SOAR Analysis Models) then models the various security element data according to different business requirement types to obtain the corresponding dataset (SOARDataset). These business requirement types include alarm handling, asset management, vulnerability inspection, intelligence analysis, risk handling, and threat handling. Specifically, the process of collecting data from various data sources and encapsulating it into an initial dataset involves: using the access data metadata definition module (Meta Data) to provide a structural description of the data from the data sources to be accessed based on a metadata definition mechanism; and using a data filter (DataFilter) running on top of the metadata definition mechanism to filter data from various data sources according to various attributes to collect target data, thus obtaining the initial dataset. These attributes include, but are not limited to, event type, alarm level, and asset attributes. The data sources include, but are not limited to, asset information databases, threat intelligence databases, vulnerability scanning databases, network traffic, and operational logs. SOAR (Security Orchestration, Automation and Response) refers to security orchestration automation and response.

[0065] like Figure 2 As shown, in the process of acquiring, modeling, and encapsulating security element data, the data source first needs to be defined. It can be based on NOAH (internal Noah Big Data Analytics Support Platform) ETL to support both structured and unstructured security element data, and can also extract security element data from third-party SIEM (Security Information and Event Management). It supports data acquisition from the preset Situational Awareness and Security Operations Platform (NGSOC), which includes various types of security element data of interest such as logs / traffic, alarms, assets, vulnerabilities, intelligence, risks, and threats.

[0066] Yes, the SOAR Dataset, as input to playbooks, is obtained by encapsulating security element data according to business requirements. In specific functional implementation, the SOAR Dataset contains a tag and a data packet. The tag is a classification label for the data packet, such as a vulnerability tag and a threat alert tag. Vulnerability tagging packets describe the inherent vulnerabilities of IT assets in the environment; threat alert tagging packets describe threat events and behaviors discovered in the network, such as threat alert packets, whose structure is as follows: {Alert Sequence, Alert Unique Identifier, Alert Name, Alert Type, First Alert Time, Latest Alert Time, Data Source IP, Data Source IP Associated Asset, Source IP, Source IP Geographic Location, Source IP Associated Asset, Source Port, Destination IP, Destination IP Geographic Location, Destination IP Associated Asset, Destination Port, Communication Direction, Attacker IP, Victim IP, Confidence Level, Compromise Status, Attack Chain, Attack Result, Severity Level, IOC, IOC Type, Domain Name, URL, Occurrence Count, Handling Recommendation, Handling Sequence, Handling Status, Handling Time, Associated Ticket, Ticket Status, Threat Type, Associated Vulnerability, Associated Intelligence, Associated Log, Detection Rules}. The SOAR DataSet is a collection of SOAR AnalysisModels, i.e., a collection of security element data. Different Playbooks require different SOAR AnalysisModels to form the SOAR DataSet. The Data Picker can automatically or manually pick up security element data and encapsulate it into a SOAR DataSet. The SOAR Analysis Model models various types of security element data, primarily categorized as: logs / traffic, alarms, assets, vulnerabilities, intelligence, risks, and threats. The Meta Data defines the security element data structure. The Data Filter implements filtering. The Data Mapping maps the data to SOAR Analysis Models. That is, the Data Mapping maps the accessed security element data to the different business requirement types that the SOAR Analysis Model focuses on, mapping scattered, heterogeneous data to the different business requirement types that SOAR focuses on. The security element data structure accessed by the Data Mapping is flexibly defined, and the data structure of the data analysis model is also flexibly defined. As long as the security element types that the data analysis model focuses on can be extracted from the accessed security element data, automatic forensics, investigation, analysis, handling, and response can be achieved. The Data Filter is a data filter whose purpose is to pick up target data, filter data according to various attributes, and control the granularity through filtering conditions, such as: by event classification, alarm level, asset attributes, etc.The Data Filter runs on top of the metadata definition. The filter is referenced by the DataPicker to pick different security element data based on conditions. The Meta Data provides a structural description of the data to be accessed, i.e., metadata, such as: kfk topic, ES index, DB table structure, and the structure of data returned by the interface. Heterogeneous data access is supported through the metadata definition mechanism. Various types of NGSOC data access are pre-configured.

[0067] Step 102: Based on the input task configuration information, construct functional blocks according to different task types to obtain multiple functional blocks corresponding to different task types, so as to realize the representation of automated response capabilities for network security incidents.

[0068] In this step, the task configuration information input by the user for different task types is first obtained. Based on the task configuration information, response actions (i.e., Actions) corresponding to different task types and used to implement different business logics are determined, as well as task plugins (i.e., Apps) that accept instructions and provide specific services or link security devices. Based on the response actions and the task plugins, the function blocks (i.e., Function Blocks) are obtained. The function blocks include two parts: Actions and Apps, which are the basic components of the script. The task configuration information includes, but is not limited to, the task name, task description, task type, input parameters, and output parameters input for different task types. The task types include, but are not limited to, linked handling tasks, approval tasks, message notification tasks, work order tasks, context enrichment tasks, log retrieval tasks, intelligence query tasks, handling tasks, logic parsing tasks, and process tasks.

[0069] Specifically, such as Figure 3 As shown, in the process of abstracting and constructing functional blocks for automated response capabilities in this invention, the Function Blocks are used as the basic components of the Playbook. They are atomic in business logic and consist of two parts: Actions and Apps. Actions are highly abstract instruction sets representing the capabilities of security products. Instructions can be built based on the OpenC2 specification, such as running files in a sandbox, locating IP addresses, blocking URLs on edge devices, and isolating devices on the network via NAC. Apps are used to implement response and handling capabilities and also support integration with third-party security devices and services to extend security response capabilities. Supported calling methods include Python scripts, Java classes, and RESTful APIs. Apps are used to accept instructions and provide specific services or coordinate with security devices, as well as return the execution results of the devices or services.

[0070] It should be noted that the Apps of this invention utilize a plugin mechanism, thereby enabling continuous enhancement of orchestration and automated response capabilities. Each response action in this invention has a specific business meaning and functional characteristics, with varying business logic, input and output parameters, and user interfaces. The plugin framework of the secure orchestration and automated response system provides a runtime engine that dynamically scans and loads security capability plugins, manages plugin registration, maintains plugin lifecycles, and exposes plugin capability calls to form multiple executable tasks within a playbook.

[0071] Taking the application of "Tianqing V10 - Isolate Specific Terminals" in the security orchestration script as an example, this paper further illustrates the abstraction of response capabilities and the construction of functional blocks. (1) Input task configuration information in the task configuration interface. The task configuration information includes task name, task description (e.g., issue terminal IP address, and the terminal security management system issues isolation command to the corresponding terminal, so that the isolated terminal can only access the specific IP address. By isolating the terminal corresponding to the IP from the network, it cannot initiate other network connections except for the Tianqing control center, thus blocking the propagation), task type (e.g., linkage handling), input parameters (e.g., device type, handling command "Isolate Specific Terminal", terminal IP, handling description and linkage device, etc.), output parameters (e.g., parameter name "total", data type "value", description "total number of executed commands"; parameter name "done", data type "value", description "number of executed commands"). In particular, different task types have different business logic and input / output parameters. (2) When different task plugins are registered with the runtime engine, they are declared according to the plugin specification. The orchestration engine processes the input and output parameters of the task according to the plugin declaration and calls the plugin to implement the business logic; the front-end program renders different user interfaces according to the plugin declaration. (3) The same type of task can also be implemented by different devices and handling commands. For example, the linkage handling task involves devices such as Tianqing, Jiaotu, and next-generation firewall. Different device types have different handling commands, and different handling commands have different command parameters.

[0072] In the process of script-based Tianqing blocking of specific terminals, the actual workflow may include: specifying a specific terminal IP address as script input parameters; node T1 approving such sensitive operations; node T2 blocking the terminal IP address based on the approval result; if node T2 successfully blocks the terminal IP address, the script ends; if node T2 fails to block the terminal IP address, node T3 sends an email to notify workers to intervene. Each node corresponds to a functional block, and the task types corresponding to these functional blocks include, but are not limited to, coordinated handling tasks, approval tasks, message notification tasks, work order tasks, context enrichment tasks, log retrieval tasks, intelligence query tasks, logic parsing tasks, and workflow tasks.

[0073] The secure orchestration and automated response processing method described in this invention can implement multiple App plugins, specifically covering more than 50 response actions such as linkage handling, approval tasks, message notifications, work orders, context enrichment, log retrieval, intelligence query, and logic parsing, which constitute the Actions of the secure orchestration system, and will not be described in detail here.

[0074] Step 103: Based on various business requirements, perform script arrangement operations on the functional blocks and the dataset to obtain the corresponding scripts, and save the scripts to generate the corresponding script definition files; wherein, the script is a business processing flow representation that includes a start node, an end node, and at least one of the functional blocks.

[0075] During this step, the functional blocks and data packets need to be pre-configured and scripted based on various business requirements to obtain pre-configured general scripts. These general scripts include proactive scripts for routine inspections and / or passive emergency response scripts for handling cybersecurity attacks. In addition, starting nodes, ending nodes, and at least one functional block can be referenced based on editing operations in a preset canvas. The starting nodes, ending nodes, at least one functional block, and their corresponding data packets are then arranged according to various business requirements to obtain corresponding user-configured scripts. Similarly, these user-configured scripts include proactive scripts for routine inspections and / or passive emergency response scripts for handling cybersecurity attacks.

[0076] Furthermore, embodiments of the present invention can also enable the use of nested scripts to improve arrangement efficiency. Specifically, after referencing the start node, the end node, and at least one functional block based on the editing operation in the preset canvas, the invention further includes: referencing a preset sub-script based on the editing operation in the preset canvas, and arranging the start node, the end node, the at least one functional block and its corresponding data packet, and the sub-script according to various business requirements to obtain corresponding scripts, thereby enabling the nested use of sub-scripts.

[0077] The specific implementation process of saving the script to generate the corresponding script definition file includes: after saving the script, defining the automated response process (i.e., diagram) of the script based on the functional blocks corresponding to various business requirements. The automated response process includes a set of business processing nodes and edges, i.e., a set of nodes and edges, a dataset (i.e., dataset) defining each business processing node in the automated response process, and basic parameter information (i.e. Info) defining the script, and generating the corresponding script definition file.

[0078] Specifically, in the process of representing business processes within security orchestration scenarios and scripts, scripts combine data, technology / tools, and people / teams to form processes and strategies. This ensures the standardization, consistency, and efficiency of security responses, and solidifies security analysis, operational capabilities, and experience. It is a process that is followable, traceable, measurable, and continuously improveable. Tasks are the fundamental components of scripts; they are atomic in terms of business logic and highly cohesive in terms of functional design, serving as basic orchestration units. Tasks provide the ability to respond to security incidents. In addition to their own built-in security capabilities, they can also extend security response capabilities through integration with third-party security devices or services (task plugins).

[0079] When drafting a script, the following are included: script ID; basic name (blocking external IPs and notifying the responsible party), script description (e.g., selecting an alert), and script input parameters (including data packets containing the fields / content required for the corresponding alert; these packets are predefined or pre-configured, for example, different data packets are predefined for "alerts," "vulnerabilities," and "asset associations." An "alert" data packet might contain 50 fields, and a "vulnerability" data packet might contain 100 fields; therefore, they can be further divided into alert data packets, vulnerability data packets, etc.). Passive incident response scripts are used for unexpected passive scenarios, such as various alert handling scripts, vulnerability handling scripts, threat handling scripts, and security incident investigation scripts. Proactive scripts are used for planned proactive scenarios, such as daily vulnerability scanning, configuration and baseline checks, and daily system inspections.

[0080] It should be noted that the script compilation process excludes the script ID; basic name, script input / output parameters, flowchart loop detection, and ensures that each Function Block is applicable to the business context and constitutes a valid Playbook. When a Function Block is selected, the Connector specifies the subsequent Function Blocks and their types.

[0081] Furthermore, the script is saved and a corresponding script definition file is generated to facilitate automated response when cybersecurity incidents are detected. The script definition file consists of three parts: diagram, dataset, and info. The diagram contains sets of nodes and edges, corresponding to the definitions of nodes and edges in the script flow, respectively. It is a directed acyclic business process graph, technically a symbolic representation of the automated threat event response process, and business-wise, a definition of the orchestration logic for various security response capabilities. The dataset is the dataset for each node in the defined script flow, including input / output parameters of business nodes, conditional expressions of gateways, and process context data reference declarations. The info contains basic parameter information such as script input / output parameter definitions, script tags, data packets, and script names.

[0082] In conjunction with the security orchestration scenario business, the above-defined script "Network Protection - Blocking Suspicious IPs" is further explained to illustrate the representation of the script's business process, specifically including: (1) The script has a unique identifier, declared at the beginning node of the script, such as "P000004", which uses a six-digit base-36 encoding, with each digit taking a character from [0-9a-z], and has a capacity of more than 2.17 billion, which has the advantages of being concise, easy to reference in the script context, and having sufficient business capacity; (2) The script is a nestable script, and the nested script is called a sub-script. The sub-script provides process reuse capability and improves orchestration efficiency; (3) The unique identifiers of the script and sub-script are prefixed with P, and the task nodes are prefixed with T. (4) The basic information of the script includes: script ID, script name, script description, application module, data packet, and can add any input parameters; (5) Task nodes (i.e. nodes in the script) can reference the script's data packet, script's input parameters, and the output parameters of direct and indirect predecessor task nodes, for example: ${#P000004.attacker_ip}, which references the attacker's IP in the data packet of script P000004; (6) In addition to the tasks composed of response actions, the nodes in the script also support process gateways. The gateway decides the direction of the process. The gateway declares conditional expressions by referencing context data to realize the decision; (7) The nodes in the script also include three set operations: logical parsing - finding complement, finding intersection, and finding union. No specific limitation is made here; (8) The script includes a unique start and end node.

[0083] Step 104: Based on the network security incident to be processed, call the corresponding target script definition file from the script definition file and execute the target script definition file to realize automated response processing for the network security incident.

[0084] Specifically, the cybersecurity incidents to be processed can refer to various network attacks, vulnerabilities, and other incidents, including proactive security inspections and reactive security incident responses. The orchestration of automated cybersecurity incident responses essentially involves generating a script definition file. This script definition file is an executable code file generated based on the script's flow and is interpreted and executed by the engine. The target script definition file is the executable code file determined from the script definition file for automatically responding to and processing the corresponding cybersecurity incident.

[0085] In one instance, the execution principle of the script "Network Protection - Blocking Suspicious IPs" is as follows: (1) Task node T1 is "Internal and External IP Packet Conversion", which divides the IP list into an internal IP list and an external IP list. The input parameter IP list takes the attacker IP in the script P000004 data packet, and the expression is ${#P000004.attacker_ip}. The output parameters include: "Execution status (status), internal IP list (innerIp), external IP list (outerIp), creation time (createTime), and error message (errorMsg)"; (2) Task node T1 is followed by an exclusive branch gateway, which determines whether T1.outerIp is empty; (3) If T1.outerIp is empty, then T1.outerIp is empty. If not empty, then execute task node T2 to obtain the blacklist of blocked IPs to prevent duplicate blocking. The output parameters are "IP blacklist list (blackIpList), creation time (createTime), and error message (errorMsg)"; (4) Task node T3 logic parsing - finding the intersection. The input parameters are ${#T1.outerIp} and ${#T2.blackIpList}, and the output parameter (output) is the intersection of the set operation to obtain the external attacker IPs that already exist in the black IP list; (5) Task node T4 logic parsing - finding the complement. The input parameters are ${#T1.outerIp} and ${#T3.output}, and the output parameter (output) is the complement of the set operation. (6) After task node T4, connect to an exclusive branch gateway and determine whether the list of external attacker IPs to be blocked ${#T4.output} is empty; (7) If the attacker IP list ${#T4.output} is not empty, then execute task node T5 and sub-script P6 in sequence; (8) Script P6 is a sub-script with the input parameter ${#T4.output}, the list of external attacker IPs to be blocked; (9) Task node T5 sends an email to relevant personnel to pay attention to the information of external attackers; (10) Task node T7 adds the list of external attacker IPs that have been successfully blocked ${#T4.output} to the system black IP list, and the script execution ends.

[0086] like Figure 4 As shown, during the interpretation, execution, and job scheduling of the script's business process, the PSW (Program Status Word) register describes the runtime status of node tasks in the global script's flow and is stored in a Redis cache. RuntimeTask is the physical table for data persistence, periodically writing the runtime data recorded in the PSW register to the Runtime table. This minimizes data loss in the event of power outages or equipment failures. The process task scheduling controller periodically polls the PSW register, allowing tasks in the ready state to enter the job queue. The script's flow has unique Start and End nodes. The Start node (i.e., the initial node) receives and verifies the script's input data and performs other process initialization operations, then dispatches a process start event, causing a change in the PSW, putting its subsequent node tasks in the ready state. The End node (i.e., the termination node) indicates the end of the script's flow tasks. Due to the influence of gateway condition judgments and path decisions in the flow, it cannot be guaranteed that all paths pointing to the End node will be executed. Once all tasks that should be executed in the script's business process are completed, the End node dispatches a process end event. It's important to note that in SOAR, a gateway is a decision point within a play that adjusts the execution path of the flow based on specific conditions and messages. These gateways include: exclusive branch gateways, compatible branch gateways, OR-type aggregation gateways, and AND-type aggregation gateways. The execution of the play's flow is influenced by the condition configuration in the flow gateway node and the play's context data. Ordinary business nodes in the play's flow are executed sequentially.

[0087] It should be noted that prior to this step, the standard instruction set and primitive design process for response capability invocation is also included. To standardize SOAR response capability invocation and better integrate with peripheral devices, this invention designs an operation command suitable for network defense systems or devices. This operation command includes four elements: Operation – what to do; Target – the target object to be operated on; Execution Unit – the command executor; Command Options – affecting the execution method of the command. The following example uses calling an NGFW firewall to block access from a specific target IP and port: The `operation` declaration specifies a contain operation, and also supports generic, investigate, and correct operations; `target` declares the target object to be operated on, supporting precise control of the scope of target filtering, and establishing filters using lvalues, rvalues, and operators to configure conditional expressions; `actuator` declares the executor, using different executors for Python scripts, Java classes, and RESTful APIs; `option` declares the command execution method, including timeout and failure policies.

[0088] To further illustrate SOAR's response capabilities, let's take "calling the NGFW firewall to block access from a specific target IP and port" as an example:

[0089] (1) The script instance executes to the task node of “NGFW firewall blocks access to specific target IP and port”.

[0090] (2) Check the connectivity between the security orchestration and automated response system and the NGFW device, and complete the end-to-end login authentication, which is implemented by the NGFW plugin corresponding to the task node.

[0091] (3) This plugin constructs a command body that works in conjunction with NGFW to block network access from specific IPs and ports.

[0092] (4) In addition to the unique identifier and basic descriptive information, the command body also includes four key elements:

[0093] (a) command-operation: Declares the operation type; in this example, it's a blocking operation. (b) command-actuator: Declares the response capability provided by the soar-disposal-ngfw-app plugin, uniquely identified as 1d694fa6cc3c4d8eb793a927fa75a3c8, to block specific network addresses and ports. It is invoked via JavaClassLoader. (c) command-target: Declares the target object of the command, embedding a filter. The filter contains several expressions, each with an lvalue, rvalue, and operator. In this example, it's declared as dip_v4 = "10.48.105.132" and dport = 8088, indicating that network access to the destination address and port 10.48.105.132:8088 should be blocked. (d) `command-option` declares command execution options such as `timeout` and `strategy`. In this example, `timeout` = 60000ms, `strategy-failure` = "retry", and `strategy-retry-max` = 3, indicating that the command execution timeout is set to 60 seconds, and the command will be retried 3 times if it fails. (e) After the above commands are sent to the NGFW device, the device verifies, parses, and executes them according to the linkage interface specification, and returns the execution result, i.e., the response body. (f) The linkage between the security orchestration and automated response system and the device supports HTTP / HTTPS, SSH, and RPC.

[0094] The security orchestration and automated response processing method described in this invention acquires security element data corresponding to various attributes, and performs data modeling and encapsulation processing on the security element data based on various business requirements to obtain a dataset; constructs functional blocks according to different task types based on input task configuration information to obtain multiple functional blocks; performs script orchestration operations on the functional blocks and dataset based on various business requirements to obtain scripts, and saves the scripts to generate corresponding script definition files; based on the network security event to be processed, calls the corresponding target script definition file from the script definition file, and executes the target script definition file to achieve automated response processing for network security events. It can flexibly orchestrate response scripts to automate routine and repetitive tasks, effectively shortening the response time of network security events, reducing the costs of security analysis and security operations, and improving the standardization and efficiency of the security orchestration and automated response processing process.

[0095] Corresponding to the security orchestration and automated response processing method provided above, this invention also provides a security orchestration and automated response processing system. Since the embodiments of this system are similar to the above method embodiments, the description is relatively simple. For relevant details, please refer to the description in the above method embodiment section. The embodiments of the security orchestration and automated response processing system described below are merely illustrative. Please refer to... Figure 5 As shown, it is a structural schematic diagram of a secure orchestration and automated response processing system provided in an embodiment of the present invention.

[0096] The secure orchestration and automated response processing system of the present invention specifically includes the following parts:

[0097] The data modeling and encapsulation unit 501 is used to acquire security element data corresponding to various attributes, and to perform data modeling and encapsulation processing on the security element data based on various business requirements to obtain a corresponding dataset; the dataset contains various data packets and labels for classifying and marking the data packets;

[0098] The function block construction unit 502 is used to construct function blocks according to different task types based on the input task configuration information, so as to obtain multiple function blocks corresponding to different task types, so as to realize the representation of automated response capabilities for network security incidents;

[0099] The script arrangement unit 503 is used to perform script arrangement operations on the functional blocks and the dataset based on various business requirements, obtain the corresponding scripts, and save the scripts to generate the corresponding script definition files; wherein, the script is a business processing flow representation that includes a start node, an end node, and at least one of the functional blocks;

[0100] The script execution unit 504 is used to call the corresponding target script definition file from the script definition file based on the network security event to be processed, and execute the target script definition file to realize automated response processing for the network security event.

[0101] Furthermore, the data modeling and encapsulation unit is specifically used for:

[0102] Use a data picker to pick data from various data sources and package it into an initial dataset;

[0103] The data mapping module is used to map the dispersed and heterogeneous security element data in the initial dataset to different business requirement types that the data analysis module focuses on.

[0104] The data analysis module is used to model various security element data according to different business needs, resulting in the corresponding datasets; the business needs include alarm handling, asset management, vulnerability inspection, intelligence analysis, risk handling, and threat handling.

[0105] Specifically, the step of using a data picker to pick data from various data sources and encapsulate it into an initial dataset includes:

[0106] The access data metadata definition module is used to describe the structure of the data from the data sources that need to be accessed based on the metadata definition mechanism. Then, a data filter running on the metadata definition mechanism is used to filter the data from various data sources according to various attributes to pick the target data and obtain the initial dataset. The attributes include event type, alarm level and asset attributes.

[0107] Furthermore, the functional block construction unit is specifically used for:

[0108] Retrieve task configuration information input by the user for different task types;

[0109] Based on the task configuration information, response actions corresponding to different task types and used to implement different business logics are determined, as well as task plugins that accept instructions and provide specific services or link security devices; the function blocks are obtained based on the response actions and the task plugins; the function blocks are the basic components constituting the script.

[0110] The task configuration information includes the task name, task description, task type, input parameters, and output parameters corresponding to different task types; the task types include coordinated handling tasks, approval tasks, message notification tasks, work order tasks, context enrichment tasks, log retrieval tasks, intelligence query tasks, handling tasks, logic parsing tasks, and process tasks.

[0111] Furthermore, the script arrangement unit is specifically used for:

[0112] The functional blocks and data packets are pre-configured based on various business requirements to obtain a pre-configured general script;

[0113] The general scripts include proactive scripts for adapting to proactive daily inspections and / or passive incident response scripts for handling cybersecurity attack tasks.

[0114] Furthermore, the script arrangement unit is specifically used for:

[0115] Based on the editing operations in the preset canvas, the starting node, the ending node, and at least one functional block are referenced; the starting node, the ending node, the at least one functional block, and their corresponding data packets are arranged according to various business requirements to obtain the corresponding user-configured script.

[0116] The user-configured scripts include proactive scripts for adapting to proactive daily inspections and / or passive incident response scripts for handling cybersecurity attack tasks.

[0117] Furthermore, the script arrangement unit is specifically used to: after saving the script, define the automated response process of the script based on the functional blocks corresponding to various business requirements. The automated response process includes a set of business processing nodes and edges, a dataset defining each business processing node in the automated response process, and basic parameter information defining the script, and generates a corresponding script definition file.

[0118] Furthermore, after referencing the start node, end node, and at least one functional block based on the editing operations in the preset canvas, it also includes: a sub-script arrangement unit, used for:

[0119] Based on the editing operations in the preset canvas, the preset sub-scripts are referenced. The starting node, the ending node, the at least one functional block and its corresponding data packet, and the sub-scripts are arranged according to various business requirements to obtain the corresponding scripts, so as to realize the nested use of sub-scripts.

[0120] The security orchestration and automated response processing system described in this invention acquires security element data corresponding to various attributes, and performs data modeling and encapsulation processing on the security element data based on various business requirements to obtain a dataset. Based on the input task configuration information, it constructs functional blocks according to different task types to obtain multiple functional blocks. Based on various business requirements, it performs script orchestration operations on the functional blocks and dataset to obtain scripts, and saves the scripts to generate corresponding script definition files. Based on the network security event to be processed, it calls the corresponding target script definition file from the script definition file and executes the target script definition file to achieve automated response processing for network security events. It can flexibly orchestrate response scripts and automate routine and repetitive tasks, effectively shortening the response time for network security events, reducing the costs of security analysis and security operations, and improving the standardization and efficiency of the security orchestration and automated response processing process.

[0121] Corresponding to the security orchestration and automated response processing method provided above, this invention also provides an electronic device. Since the embodiments of this electronic device are similar to the method embodiments described above, the description is relatively simple. For relevant details, please refer to the description in the method embodiment section above. The electronic device described below is merely illustrative. Figure 6 The diagram shown is a schematic representation of the physical structure of an electronic device disclosed in an embodiment of the present invention. The electronic device may include a processor 601, a memory 602, and a communication bus 603. The processor 601 and the memory 602 communicate with each other via the communication bus 603 and communicate with external devices via a communication interface 604. The processor 601 can call logical instructions in the memory 602 to execute a security orchestration and automated response processing method. This method includes: acquiring security element data corresponding to various attributes; performing data modeling and encapsulation processing on the security element data based on various business requirements to obtain a corresponding dataset; the dataset contains various data packets and labels for classifying and marking the data packets; constructing functional blocks according to different task types based on input task configuration information to obtain multiple functional blocks corresponding to different task types, thereby representing the automated response capability for network security incidents; performing script orchestration operations on the functional blocks and the dataset based on various business requirements to obtain corresponding scripts, and saving the scripts to generate corresponding script definition files; wherein, the script is a business processing flow representation containing a start node, an end node, and at least one of the functional blocks; based on the network security incident to be processed, calling the corresponding target script definition file from the script definition file and executing the target script definition file to achieve automated response processing for the network security incident.

[0122] Furthermore, the logical instructions in the aforementioned memory 602 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as memory chips, USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0123] On the other hand, embodiments of the present invention also provide a computer program product, the computer program product including a computer program stored on a processor-readable storage medium, the computer program including program instructions, and when the program instructions are executed by a computer, the computer can execute the security orchestration and automated response processing methods provided in the above-described method embodiments. The method includes: acquiring security element data corresponding to various attributes; performing data modeling and encapsulation processing on the security element data based on various business requirements to obtain a corresponding dataset; the dataset includes various data packets and labels for classifying and marking the data packets; constructing functional blocks according to different task types based on input task configuration information to obtain multiple functional blocks corresponding to different task types, so as to realize the representation of automated response capabilities for network security events; performing script orchestration operations on the functional blocks and the dataset based on various business requirements to obtain corresponding scripts, and saving the scripts to generate corresponding script definition files; wherein, the script is a business processing flow representation including a start node, an end node, and at least one of the functional blocks; based on the network security event to be processed, calling a corresponding target script definition file from the script definition file and executing the target script definition file to realize automated response processing for the network security event.

[0124] In another aspect, embodiments of the present invention also provide a processor-readable storage medium storing a computer program, which, when executed by a processor, implements the security orchestration and automated response processing methods provided in the above embodiments. The method includes: acquiring security element data corresponding to various attributes; performing data modeling and encapsulation processing on the security element data based on various business requirements to obtain a corresponding dataset; the dataset includes various data packets and labels for classifying and marking the data packets; constructing functional blocks according to different task types based on input task configuration information to obtain multiple functional blocks corresponding to different task types, thereby realizing the representation of automated response capabilities for network security events; performing script orchestration operations on the functional blocks and the dataset based on various business requirements to obtain corresponding scripts, and saving the scripts to generate corresponding script definition files; wherein the script is a business processing flow representation including a start node, an end node, and at least one of the functional blocks; based on the network security event to be processed, calling a corresponding target script definition file from the script definition file and executing the target script definition file to realize automated response processing for the network security event.

[0125] The processor-readable storage medium can be any available medium or data storage device that the processor can access, including but not limited to magnetic memory (e.g., floppy disk, hard disk, magnetic tape, magneto-optical disk (MO)), optical memory (e.g., CD, DVD, BD, HVD), and semiconductor memory (e.g., ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid-state drive (SSD)).

[0126] The system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0127] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0128] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for secure orchestration and automated response processing, characterized in that, include: Obtain security element data corresponding to various attributes, and perform data modeling and encapsulation processing on the security element data based on various business requirements to obtain the corresponding dataset; The dataset contains various data packets and labels for classifying and marking the data packets; Based on the input task configuration information, functional blocks are constructed according to different task types to obtain multiple functional blocks corresponding to different task types, so as to realize the representation of automated response capabilities for network security incidents; Based on various business requirements, the script arrangement operation of the functional blocks and the dataset is performed to obtain the corresponding scripts, and the scripts are saved to generate the corresponding script definition files; wherein, the script is a business processing flow representation that includes a start node, an end node, and at least one of the functional blocks; Based on the cybersecurity incident to be processed, the corresponding target script definition file is called from the script definition file and the target script definition file is executed to achieve automated response processing for the cybersecurity incident; The process of modeling and encapsulating the security element data based on various business requirements to obtain a corresponding dataset specifically includes: Use a data picker to pick data from various data sources and package it into an initial dataset; The data mapping module is used to map the dispersed and heterogeneous security element data in the initial dataset to different business requirement types that the data analysis module focuses on. The data analysis module is used to model various security element data according to different business needs, resulting in the corresponding datasets; the business needs include alarm handling, asset management, vulnerability inspection, intelligence analysis, risk handling, and threat handling. Specifically, the step of using a data picker to pick data from various data sources and encapsulate it into an initial dataset includes: The access data metadata definition module is used to describe the structure of the data from the data sources that need to be accessed based on the metadata definition mechanism. Then, a data filter running on the metadata definition mechanism is used to filter the data from various data sources according to various attributes to pick the target data and obtain the initial dataset. The attributes include event type, alarm level and asset attributes.

2. The secure orchestration and automated response handling method of claim 1, wherein, The input task configuration information is used to construct functional blocks according to different task types, resulting in multiple functional blocks corresponding to different task types, specifically including: Retrieve task configuration information input by the user for different task types; Based on the task configuration information, response actions corresponding to different task types and used to implement different business logics are determined, as well as task plugins that accept instructions and provide specific services or link security devices; the function blocks are obtained based on the response actions and the task plugins; the function blocks are the basic components constituting the script. The task configuration information includes the task name, task description, task type, input parameters, and output parameters corresponding to different task types; the task types include coordinated handling tasks, approval tasks, message notification tasks, work order tasks, context enrichment tasks, log retrieval tasks, intelligence query tasks, handling tasks, logic parsing tasks, and process tasks.

3. The method of claim 1, wherein, The script arrangement operation based on various business requirements of the functional blocks and the dataset, to obtain the corresponding script, specifically includes: The functional blocks and data packets are pre-configured based on various business requirements to obtain a pre-configured general script; The general scripts include proactive scripts for adapting to proactive daily inspections and / or passive incident response scripts for handling cybersecurity attack tasks.

4. The method of claim 3, wherein, Based on various business requirements, script arrangement operations are performed on the functional blocks and the dataset to obtain corresponding scripts, which also includes: Based on the editing operations in the preset canvas, the starting node, the ending node, and at least one functional block are referenced; the starting node, the ending node, the at least one functional block, and their corresponding data packets are arranged according to various business requirements to obtain the corresponding user-configured script. The user-configured scripts include proactive scripts for adapting to proactive daily inspections and / or passive incident response scripts for handling cybersecurity attack tasks.

5. The method of claim 1, wherein, Saving the script to generate the corresponding script definition file specifically includes: After saving the script, the automated response process of the script is defined based on the functional blocks corresponding to various business requirements. The automated response process includes a set of business processing nodes and edges, a dataset defining each business processing node in the automated response process, and basic parameter information defining the script, thereby generating the corresponding script definition file.

6. The method of claim 4, wherein, After referencing the start node, end node, and at least one function block based on editing operations in the preset canvas, it also includes: Based on the editing operations in the preset canvas, the preset sub-scripts are referenced. The starting node, the ending node, the at least one functional block and its corresponding data packet, and the sub-scripts are arranged according to various business requirements to obtain the corresponding scripts, so as to realize the nested use of sub-scripts.

7. A secure orchestration and automated response processing system, characterized by, include: The data modeling and encapsulation unit is used to acquire security element data corresponding to various attributes, and to perform data modeling and encapsulation processing on the security element data based on various business requirements to obtain the corresponding dataset. The dataset contains various data packets and labels for classifying and marking the data packets; The function block construction unit is used to construct function blocks according to different task types based on the input task configuration information, so as to obtain multiple function blocks corresponding to different task types, in order to realize the representation of automated response capabilities for network security incidents; The script arrangement unit is used to perform script arrangement operations on the functional blocks and the dataset based on various business requirements, obtain the corresponding scripts, and save the scripts to generate the corresponding script definition files; wherein, the script is a business processing flow representation that includes a start node, an end node, and at least one of the functional blocks; The script execution unit is used to call the corresponding target script definition file from the script definition file based on the network security event to be processed, and execute the target script definition file to realize automated response processing for the network security event; The data modeling and encapsulation unit is specifically used for: Use a data picker to pick data from various data sources and package it into an initial dataset; The data mapping module is used to map the dispersed and heterogeneous security element data in the initial dataset to different business requirement types that the data analysis module focuses on. The data analysis module is used to model various security element data according to different business needs, resulting in the corresponding datasets; the business needs include alarm handling, asset management, vulnerability inspection, intelligence analysis, risk handling, and threat handling. Specifically, the step of using a data picker to pick data from various data sources and encapsulate it into an initial dataset includes: The access data metadata definition module is used to describe the structure of the data from the data sources that need to be accessed based on the metadata definition mechanism. Then, a data filter running on the metadata definition mechanism is used to filter the data from various data sources according to various attributes to pick the target data and obtain the initial dataset. The attributes include event type, alarm level and asset attributes.

8. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the secure orchestration and automated response processing method as described in any one of claims 1 to 6.

9. A processor-readable storage medium having stored thereon a computer program, characterized in that When the computer program is executed by the processor, it implements the steps of the secure orchestration and automated response processing method as described in any one of claims 1 to 6.

Images