SOAR-based task model construction method, electronic device and storage medium

Abstract

The present application provides a method for constructing a task model based on SOAR, an electronic device and a storage medium, wherein the method can construct a data source unit and a data processing unit, and then construct a task model by connecting the data source unit and the data processing unit in series. Among them, the task model is a link composed of a data source unit and a plurality of data processing units in series, the data source unit is located at the first position of the link, and the data source unit can obtain network data from the network data source. Multiple data processing units are respectively used to call the logic processing module to perform logical processing on the network data. By constructing a task model, the method can automatically connect to a third-party data source, and link functional modules such as cases, scripts, controllers, and applications to realize threat event management based on automated orchestration. At the same time, the scripts, controllers, applications, scenarios, security events and other related information related to the task model can be directly transplanted to the new platform system for reuse.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a SOAR-based task model construction method, electronic device, and storage medium. Background Art

[0002] SOAR (Security Orchestration, Automation and Response) stands for security orchestration automation and response, and is considered to be a fusion of three technologies / tools: Security Orchestration and Automation (SOA), Security Incident Response Platform (SIRP) and Threat Intelligence Platform (TIP). Security orchestration refers to the process of combining the security capabilities of different customer systems or different components within a system through programmable interfaces API (Application Programming Interface) and manual detection points according to certain logical relationships to complete a specific security operation. The SOAR platform can flexibly orchestrate existing security capabilities, complete scenario construction by writing playbooks, and achieve automated operations.

[0003] The SOAR platform includes application nodes and virtual nodes corresponding to multiple application apps, and each application app includes a series of actions. The script is composed of a series of actions and virtual nodes, and includes a complete analysis and disposal process for security operations. Through rich product integration capabilities, workflows can be automatically orchestrated, alerts generated by related security products can be summarized, internal or external threat intelligence can be integrated, and rapid investigation, evidence collection and analysis can be performed to achieve real-time and efficient threat event management based on automated orchestration.

[0004] However, most of the current SOAR automated security operations are based on the integration of existing products, which are less portable and flexible. For example, migrating the SOAR automated security operations process from project A to project B requires certain modifications and development, which is difficult. In addition, the technical requirements for operations personnel are high, requiring more professional technical capabilities and business understanding, and relying on the skills of operations personnel, resulting in low overall efficiency in solving problems. Summary of the invention

[0005] The present application provides a task model construction method, electronic device and storage medium based on SOAR to solve the problems of poor portability and flexibility of SOAR automated security operation and maintenance solutions.

[0006] In a first aspect, the present application provides a method for constructing a task model based on SOAR, which is applied to an event management system and includes:

[0007] Constructing a node unit, wherein the node unit includes a data source unit and a data processing unit;

[0008] The data source unit and the data processing unit are connected in series to construct a task model; the task model is a link composed of one data source unit and a plurality of data processing units connected in series;

[0009] Among them, the data source unit is located at the first position of the link; the data source unit is used to obtain network data from the network data source; multiple data processing units are used to call the logic processing module to perform logical processing on the network data; the data processing unit is associated with a logic processing module; the logic processing module includes a data cleaning module, a data merging module, a data conversion module, a data mapping module, a case access module, a script access module, an application access module and a combination of one or more modules in the controller access module.

[0010] Optionally, the method further includes:

[0011] Obtain a forward call chain, where the forward call chain is used to represent the next level node unit corresponding to each node unit;

[0012] Obtain a reverse call chain, where the reverse call chain is used to represent the previous level node unit corresponding to each node unit;

[0013] A data flow medium is constructed according to the forward call chain and the reverse call chain, and the data flow medium is a data cache queue connecting two adjacent node units.

[0014] Optionally, the method further includes:

[0015] Defining the data format transmitted by each node unit in the task model;

[0016] A transmission data mode of two adjacent node units is constructed according to the data format.

[0017] Optionally, the method further includes:

[0018] Acquire an execution queue, where the execution queue is used to represent the running order of the node unit;

[0019] The data source unit and the data processing unit are connected in series according to the execution queue to construct a task model.

[0020] Optionally, the method further includes:

[0021] Acquire trigger configuration information, wherein the trigger configuration information includes a trigger type, and the trigger type includes a time trigger, an event trigger, and a trigger tool trigger;

[0022] A trigger of the task model is constructed according to the trigger configuration information, so as to receive the network data through the trigger and trigger a data processing unit corresponding to the network data to perform logic processing.

[0023] Optionally, the method further includes:

[0024] Traverse the controller address collection;

[0025] Obtaining a controller address corresponding to each of the data processing units;

[0026] Access the controller address corresponding to the data processing unit to call the controller corresponding to the data processing unit.

[0027] In a second aspect, the present application provides a task model based on SOAR, wherein the task model is a link composed of one data source unit and a plurality of data processing units connected in series; wherein:

[0028] The data source unit is located at the first position of the link; the data source unit is used to obtain network data from a network data source;

[0029] The multiple data processing units are respectively used to call the logic processing module to perform logic processing on the network data; the data processing unit is associated with a logic processing module; the logic processing module includes a combination of one or more modules in the group consisting of a data cleaning module, a data merging module, a data conversion module, a data mapping module, a case access module, a script access module, an application access module and a controller access module.

[0030] Optionally, the case access module is configured to call the case corresponding to the logic processing unit;

[0031] The script access module is configured to call and execute the security script corresponding to the logic processing unit;

[0032] The application access module is configured to call the application corresponding to the logic processing unit.

[0033] In a third aspect, the present application provides a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the above-mentioned SOAR-based task model construction method at runtime.

[0034] In a fourth aspect, the present application provides an electronic device comprising a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the above-mentioned SOAR-based task model construction method.

[0035] It can be seen from the above technical solutions that the present application provides a task model construction method, electronic device and storage medium based on SOAR, wherein the method can construct a node unit, wherein the node unit includes a data source unit and a data processing unit, and the task model is constructed by connecting the data source unit and the data processing unit in series. Among them, the task model is a link composed of a data source unit and a plurality of data processing units in series, the data source unit is located at the first position of the link, and the data source unit can obtain network data from the network data source. Multiple data processing units are respectively used to call the logic processing module to perform logical processing on the network data, and each data processing unit is associated with a logic processing module. The logic processing module includes a combination of one or more modules in a data cleaning module, a data merging module, a data conversion module, a data mapping module, a case access module, a script access module, an application access module and a controller access module. By constructing a task model, the method can automatically connect to a third-party data source, and link functional modules such as cases, scripts, controllers, and applications to realize threat event management based on automated orchestration. At the same time, the scripts, controllers, applications, scenarios, security events and other related information related to the task model can be directly transplanted to the new platform system for reuse to solve the problem of poor portability and flexibility of the SOAR automated security operation and maintenance solution. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solution of the present application, the drawings required for use in the embodiments are briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0037] Figure 1 A flowchart of a SOAR-based task model construction method provided in an embodiment of the present application;

[0038] Figure 2 A schematic diagram of a SOAR-based task model provided in an embodiment of the present application;

[0039] Figure 3 A schematic diagram of the architecture of a data source unit provided in an embodiment of the present application;

[0040] Figure 4 A schematic diagram of the architecture of a data processing unit provided in an embodiment of the present application;

[0041] Figure 5 A schematic diagram of an interface for arranging and constructing a node unit provided in an embodiment of the present application. DETAILED DESCRIPTION

[0042] The following embodiments are described in detail, and examples thereof are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following embodiments do not represent all implementations consistent with the present application. They are only examples of systems and methods consistent with some aspects of the present application as detailed in the claims.

[0043] The SOAR-based task model construction method provided in this application can be applied to event management systems to monitor data sources. When there is security event information, the case management process will be triggered, and operations will be automatically executed according to the preset bound script. At the same time, the relevant network security devices will be linked according to the processing flow defined in the script, and the alarms generated by the relevant network security devices will be summarized, and internal or external threat intelligence will be integrated to conduct rapid investigation, evidence collection and analysis, so as to realize automated and orchestrated security operation and maintenance management.

[0044] Among them, network security equipment includes firewalls, routers, switches, WAF, IDS (intrusion detection), IPS (intrusion prevention), ACG (online behavior management), situational awareness systems, host security, network gates, bastion hosts, vulnerability scanning equipment, proxies, load balancers, etc. Network security equipment can be used to implement operations such as traffic blocking, web page redirection, host antivirus, host isolation, and forcing illegal users to go offline. Security events are events that attempt to change the security status of information systems, such as changing access control measures, changing security levels, changing user passwords, etc. In other words, a security event is an attack event in the network, such as: Http attacks, brute force cracking, worms, Trojans, SQL injections, XSS attacks, DDOS attacks, and other illegal attack-related operations.

[0045] When solving a security incident or a problem, we usually use various tools or ask for help or permission from other people, such as security service software, data processing software, and evidence collection software. And when these problems occur for the second or multiple times, a fixed solution routine will be formed. Or through induction and summary, a problem solving guide map and related operation manuals will be formed. Then, in actual work, according to the fixed solution routine to solve the problem, a script can be formed. Solve security problems or perform tasks through fixed operation steps. And virtual nodes for manual intervention can be embedded in the script, which can connect links such as personnel collaboration and superior permission. In other words, the script is a way to solve the problem, standardizing and streamlining the process of solving the problem or achieving the goal. So that when the problem is encountered again later, it can be quickly solved automatically. There is no need for repeated and trivial manual processing, saving a lot of manpower and material resources and ensuring processing efficiency and quality.

[0046] In the SOAR system, the script is composed of actions corresponding to multiple applications and virtual node connections, which includes a complete analysis and disposal process for security operations. Applications are software services that support network environments. An application represents a software service as a whole, and a software service provides a variety of functions. The name corresponding to the application is action, which is an execution operation with a granularity of a single interface level with direct results or a function that can solve a problem or has direct results. The SOAR system also includes controllers, which are built-in functional items and logic control units of the SOAR platform. It includes but is not limited to conditional judgment, manual review, data cleaning, manual nodes, work order centers, case management, etc.

[0047] Based on the above SOAR system, automated and semi-automated security operation and maintenance can be achieved. However, most of the solutions for building automated and semi-automated security operation and maintenance are integrated solutions based on their own original products, with poor portability and flexibility. For example, migrating the SOAR automated security operation and maintenance process from project A to project B requires certain modifications and research and development, which is difficult. In addition, it relies too much on the technical capabilities and business understanding of the operation and maintenance personnel, resulting in a long overall process for solving the problem, complex structure, cumbersome configuration, and the verification process also requires a certain amount of manpower and material resources, resulting in low overall efficiency.

[0048] Therefore, the present application provides a task model construction method based on SOAR, which is applied to event management systems, such as Figure 1 As shown, it is a flowchart of a method for building a task model based on SOAR in this application, which specifically includes the following steps:

[0049] S100, construct node unit.

[0050] Wherein, the node unit includes a data source unit and a data processing unit. The data source unit (water pump) and the data processing unit (Logical unit) are processing units in the task model. The data source unit is a data input source link, which can obtain network data from the network data source, pre-process the network data, and pass the network data in a fixed format to the data processing unit connected to the data source unit in the order of the link. Wherein, the network data source is a security device, such as security situation awareness (SSA), security operation center (SOC), security information and event management system, threat intelligence, alarm log, WAF, syslog, etc. The network data is obtained from the network data source in real time through the data source unit, and the network data is passed to the data processing unit.

[0051] S200, connecting the data source unit and the data processing unit in series to construct a task model.

[0052] The task model includes a data source unit and multiple data processing units. The user can compile and construct multiple node units by inputting the selection operation of multiple identifiers in the user interface of the event management system. Among them, the multiple identifiers are visual identifiers corresponding to the data cleaning module, data merging module, data conversion module, data mapping module, case access module, script access module, application access module and controller access module.

[0053] After arranging and constructing multiple node units, the multiple node units are connected in series to construct a task model. The task model is a directed acyclic graph model based on a streaming data processing (DAG) structure, that is, in the task model, the data flow is directional, but cannot form a ring. Therefore, an execution queue can be obtained, and the execution queue is used to characterize the running order of the node unit. The data source unit and the data processing unit are connected in series according to the execution queue to construct a task model. Specifically, the node unit is activated according to the execution queue, which is used for sequential instantiation and operation of the node unit, and then multiple node units can be connected in series. When the task model is running, the data source unit and the data processing unit are called in sequence, so that the node unit is executed asynchronously in a single thread.

[0054] like Figure 2 As shown, it is a schematic diagram of the task model provided in the embodiment of the present application. The task model is a link composed of one data source unit and multiple data processing units connected in series. The data source unit is located at the first position of the link, and the data source unit is connected in series with multiple data processing units.

[0055] The data source unit is used to obtain network data from a network data source. The multiple data processing units are respectively used to call a logic processing module to perform logic processing on the network data; the data processing unit is associated with a logic processing module; the logic processing module includes a combination of one or more modules in a data cleaning module, a data merging module, a data conversion module, a data mapping module, a case access module, a script access module, an application access module, and a controller access module.

[0056] In some embodiments, the case corresponding to the logic processing unit can be called through the case access module. The corresponding case can be called through the case management of the SOAR platform. The handling of network security issues starts with the case and ends with the case. Case management can provide functions such as new cases, active card handling, war room collaboration, calling execution scripts and applications, and case closing. In addition, case management can record and store all operation processing processes and changes in the overall case processing process with the timeline as the dimension, thereby realizing visual management of full file storage and instant review and backtracking.

[0057] In some embodiments, the security script corresponding to the logic processing unit can be called and executed through the script access module. By accessing the script arrangement capability of the SOAR platform, the arranged security script can be called and executed, and the pre-selected arranged script can also be triggered according to the trigger mode.

[0058] In some embodiments, the application corresponding to the logic processing unit can be called and executed through the application access module. By accessing the application center module of the SOAR platform, the application execution capability provided by the application center can be called to call and execute various business systems, software products, application services, security tools, network equipment and other security capabilities.

[0059] In some embodiments, the controller corresponding to the logic processing unit can be called through the controller access module. The controller can be a built-in function item and logic control unit of the SOAR platform. The controller is configured to perform condition judgment, information review, data cleaning, manual node, work order center, case management, etc. Among them, manual approval means the operation of manual judgment and annotation. For example, when performing a certain operation, the superior service authorization is required. This is when the information review node comes into play. The superior service approval authorization is performed before execution. If authorized, it will continue, otherwise it will terminate.

[0060] In some embodiments, when calling a controller, the controller address set can be traversed to obtain the controller address corresponding to each of the data processing units. The controller address set is a set containing multiple controller IDs. The controller address corresponding to the data processing unit is accessed, that is, the controller ID is accessed to call the controller corresponding to the data processing unit.

[0061] In some embodiments, when the data source unit obtains network data from a network data source, it can receive data from different message queues, for example, Kafka, RocketMQ, RabbitMQ, ActiveMq, Http call and other message queues.

[0062] The data processing unit is a data logic processing link, which can perform logic processing on the received network data, including: data cleaning, data merging, data conversion, data mapping, case access, script access, application access, controller access, etc. Each data processing unit performs a logic processing operation, that is, the data processing unit is associated with a logic processing module.

[0063] For example, the task model may include a data source unit and two data processing units, and the two data processing units are used to perform data cleaning and data merging on network data respectively. For another example, data cleaning includes steps such as concatenating multiple strings, concatenating multiple strings by symbols, summing multiple values, subtracting multiple values, multiplying multiple values, dividing two values, and dividing two values. The task model may include a data source unit and two data processing units, and the two data processing units are used to perform data cleaning on network data, one data processing unit performs the summing of multiple values, and the other data processing unit performs the multiplication of multiple values.

[0064] In some embodiments, in order to ensure the efficiency and accuracy of data transmission between node units and avoid data loss. Figure 2 As shown, a data flow medium can be constructed between two adjacent node units. Specifically, a forward call chain is obtained, and the forward call chain is used to characterize the next-level node unit corresponding to each node unit, that is, the node unit connected sequentially from the beginning to the end of the link. A reverse call chain is obtained, and the reverse call chain is used to characterize the previous-level node unit corresponding to each node unit, that is, the node unit connected sequentially from the end to the beginning of the link. A data flow medium is constructed based on the forward call chain and the reverse call chain, and the data flow medium is a data cache queue connecting two adjacent node units. The cache queue can store tuple data entering and exiting the queue, and pass the tuple flow to the next node unit according to the first-in-first-out principle.

[0065] In some embodiments, there may be data connection problems during the arrangement and execution of multiple node units. In order to improve the efficiency and quality of data transmission between node units, the data format transmitted by each node unit in the task model can be defined; the transmission data mode of two adjacent node units is constructed according to the data format, and the transmission data mode can connect the data of the upper and lower node units. Specifically, a Totems-EL expression can be constructed to define the data format.

[0066] For example, the task model includes four node units, namely node unit A, node unit B, node unit C and node unit D. Among them, the execution input parameter of node unit B requires a certain field data of the response after node A completes execution. The execution of node unit C requires a certain field data of the response after node unit B completes execution. Node unit D requires a certain field data of the response after node unit C completes execution. The data format of the node unit can be defined to connect the data of the upper and lower node units. For example, the response data of node unit A can be {data: "name": "Zhang San", "sex": "Male"}}; the response data of node unit B can be {data: {"city": "Guangzhou"}}. Therefore, in the input parameter input box of node unit B, you can select the Totems-EL expression to define the data format, for example, {{node A.data.nmae}}. In the input parameter input box of node unit C, you can select the Totems-EL expression to define the data format, for example, {{node B.data.city}}. The expression options can be automatically generated according to the input and output content or sample data of the node unit, or they can be entered manually.

[0067] In some embodiments, a trigger is a prerequisite for the operation of a task model. It needs to be executed in a specific data scenario. Among them, the task model includes multiple trigger types. Therefore, the trigger configuration information can be obtained, and the trigger configuration information includes a trigger type, and the trigger type includes a time trigger, an event trigger, and a trigger tool trigger. The trigger of the task model is constructed according to the trigger configuration information to receive the network data through the trigger, and trigger the data processing unit corresponding to the network data to perform logical processing.

[0068] Among them, time triggering can include multiple triggering modes, the triggering mode can be a specified time trigger, that is, specify a fixed time, for example, a certain hour, minute, and second every day, and when the fixed time point is reached, it will trigger the execution; the triggering mode can be a fixed speed trigger, that is, specify an interval time, and the execution will be triggered cyclically at the interval time; the triggering mode can be a string trigger, that is, a string with time meaning can be set, and the execution will be triggered according to the string, for example, a time string with hour, minute, second, day, month, week, and year is defined through a Cron expression, and the expression is parsed by the time scheduling manager, and the execution is triggered according to the expression. For example, "01510?6L 2002-2006" can mean that the task will be executed at 10:15 am on the last Friday of each month from 2002 to 2006.

[0069] Event triggering is triggered by security events or scripts. It can be triggered by any security event or script, or by a specified security event or script. The trigger tool is triggered by a trigger. It can be triggered by a message queue, and the execution is triggered when data in a specific format is transmitted from the monitoring message queue, such as Kafka, ActiveMQ, RabbitMQ, RocketMQ and other message queues; it can be triggered passively by Http, and triggered by http or https requests; it can be triggered by file changes, and monitor file changes, and trigger when the folder changes; it can be triggered by emails, and monitor email subjects or senders, and trigger when a qualified email subject is received or an email sent by a preset sender is received; it can be triggered by database tables, and trigger when new data is added to the table that meets the monitoring conditions, such as Mysql, Oracle, SqlServer and other databases.

[0070] In some embodiments, Figure 3As shown in the figure, the architecture of the data source unit includes multiple structural modules, which can implement different functions by calling different characters. For example, open() can be called in the initialization of the data source unit to provide an execution environment for the data source unit; declareOutputFields() can declare the output fields, that is, the field names sent to the next level node unit. cleanup() can clean up cached data and release resources; nextTuple() can be non-blocking and call Collector() in a tight loop in a single thread; Collector() can send data to the data flow medium (TotemsQueue); Collector() can also send data to the next node unit; ack() marks tuples that have been completely processed to prevent replay and replay consumption; fail() marks tuples that have not been completely processed, and will put the tuples back into the queue and retry later; close() can be called when closing to release resources. activate() can be called when the deactivation mode is activated, and activation continues to execute; deactivate() can be called when deactivating to suspend the execution process.

[0071] In some embodiments, Figure 4 As shown in the figure, the architecture of the data processing unit includes multiple structural modules, which can implement different functions by calling different characters. For example, prepare() can be called during initialization to provide an execution environment for the data processing unit (Logical unit); execute() can process a single input tuple and process the specific logic; declareOutputFields() can declare the output fields, that is, the field names sent to the next level node unit. Collector() can send data to the data flow medium (TotemsQueue); Collector() can also send data to the next node unit; getComponentType() can define the type of the current node unit; cleanup() can clean up cached data and release resources; ack() marks tuples that have been completely processed to prevent replay and replay consumption; fail() marks tuples that have not been completely processed, and will put the tuple back into the queue and try again later; close() can be called when closing to release resources.

[0072] In some embodiments, the architecture of the data flow medium includes but is not limited to: id represents a unique chain ID; sourceId represents the ID of the previous level node unit; destinationId represents the ID of the next level node unit; label represents a label; JCQueue represents a tuple data queue.

[0073] For example, Figure 5As shown in the figure, it is the user interface of the orchestration node unit. Users can set the Kafka listening trigger trigger to obtain data from the Kafka message queue component in real time. Users can select the trigger type as trigger trigger, select the Kafka message queue as the trigger, and fill in the consumption topic. The trigger trigger can also configure the Kafka server IP and port. In order to enable the subsequent executor to process the received data, the data sample can also be configured in the trigger, which is convenient for the subsequent executor to configure data processing for the log sample. When the data is obtained from the Kafka message queue component, it is automatically passed to the subsequent node unit for processing. For example, the subsequent node unit includes the node unit corresponding to the data clearing, the node unit corresponding to the condition judgment, and the node unit corresponding to the case access.

[0074] Specifically, call open() to initialize and build the Kafka data consumption factory (kafkaConsumerFactory), configure the service address, port, group, topic, offset, data buffer size, etc.; call declareOutputFields() to define the field name sent to the next node unit, for example, UUID, SOURCE_LOG; call cleanup() to clean up cached data and release resources when pausing or closing a task; call nextTuple() to obtain subscribed Topic data through the consumer provided by kafkaConsumerFactory; call Collector(), Data can be sent to the data flow medium TotemsQueue and passed to the next node unit; calling ack() can mark the Topic subscription data that has been received and successfully sent to the next link; calling fail() can mark the Topic subscription data that has been received but failed to send to the next link and try again later; calling close() when closing to release resources; calling activate() can reactivate the Kafka data consumption factory (kafkaConsumerFactory), connect to the Kafka service, and continue execution; calling deactivate() can commit the offset of the last consumed data and suspend the consumption of Topic data logic.

[0075] In some embodiments, the task model structure system includes but is not limited to basic information, organizational description information, environmental basic information, trigger information, controller information, media objects, etc.

[0076] In some embodiments, the structure of the task model includes but is not limited to: jobUuid represents the unique identifier of the task model, which is composed of a 32-bit UUID; taskName represents the name of the task model; taskType represents the type of the task model; taskStage represents the task stage of the task model; and also includes other basic information, such as description, label, detailed classification, external mounting, etc.; retryCount represents the number of retries; retryIntervals represents the retry interval time, which can be in seconds; errorNoticeSwitch represents the abnormal alarm switch; workStatus represents the working status, for example, 0 represents disabled, 1 represents enabled, 2 represents expired; workStatusDesc indicates the description of the work status; runStatus indicates the running status, for example, 0 indicates idle, 1 indicates running, and 2 indicates running failure; runStatusDesc indicates the running status description; startDateStr indicates the start of the validity period; endDateStr indicates the end of the validity period; nextRunTimeStr indicates the next run time; lastRunTimeStr indicates the last run time; triggerConfig indicates the trigger configuration information; triggerUuid indicates the identifier of the trigger; triggerType indicates the trigger type, for example, 0 indicates time trigger, 1 indicates event trigger 1 indicates the trigger type selected when the time is triggered, and 2 indicates the trigger tool trigger; timeType indicates the time type selected when the time is triggered, for example, 0 indicates the specified time, 1 indicates the fixed speed, 2 indicates the Cron expression, and 3 indicates manual execution; specifyTime indicates the corresponding specified time when the time is triggered, for example, 09:12:21; intervals indicates the corresponding fixed speed when the time is triggered, for example, 5; cron indicates the corresponding Cron expression when the time is triggered; incidentType indicates the trigger type selected when the event is triggered, for example, 0 indicates any, 1 indicates specific; specifyIncident indicates the specific event when the event is triggered; incidentWei ghts indicates the weight when the event is triggered; externalType indicates the type selected when the trigger tool is triggered, for example, 0 indicates Kafka, 1 indicates Http, 2 indicates File, 3 indicates Email, etc.; parameters indicates the parameter set after the trigger is selected; incidentContentExample indicates the data content sample; controlUnitList indicates the controller ID set; nextTasks indicates the call chain, which is a data structure used to connect node units in series; TotemsQueue indicates the media object; branches indicates the forward call chain; contraryToBranche indicates the reverse call chain.

[0077] In some embodiments, the steps of starting the task model include: initializing the object space, generating an identifier of the task model, i.e., a 32-bit UUID; looping the nextTasks collection, from the beginning to the end, to construct a forward call chain; looping the nextTasks collection, from the end to the beginning, to construct a reverse call chain; based on the forward call chain, the reverse call chain constructs a data flow medium TotemsQueue for connecting node units and node units; constructing a node output mode in the task model, i.e., a data transmission mode between node units and node units; looping to construct the execution object of the controller through the controller ID set controlUnitList; serializing and constructing an execution queue LinkedList for sequential instantiation and operation of node units; executing the call to the data source unit (water pump) and the data processing unit (Logical unit) in the order of the execution queue to realize single-threaded asynchronous execution of the node unit; setting the running status of the task model, and reporting an error when a closed loop occurs.

[0078] Based on the above-mentioned task model construction method, the present application also provides a task model based on SOAR, wherein the task model is a link composed of one data source unit and multiple data processing units connected in series; wherein:

[0079] The data source unit is located at the first position of the link; the data source unit is used to obtain network data from a network data source.

[0080] The multiple data processing units are respectively used to call the logic processing module to perform logic processing on the network data; the data processing unit is associated with a logic processing module; the logic processing module includes a combination of one or more modules in the group consisting of a data cleaning module, a data merging module, a data conversion module, a data mapping module, a case access module, a script access module, an application access module and a controller access module.

[0081] In some embodiments, the case access module is configured to call the case corresponding to the logical processing unit.

[0082] The script access module is configured to call and execute the security script corresponding to the logic processing unit.

[0083] The application access module is configured to call the application corresponding to the logic processing unit.

[0084] Based on the above-mentioned task model construction method, the present application also provides a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the above-mentioned SOAR-based task model construction method at runtime.

[0085] Based on the above-mentioned task model construction method, the present application also provides an electronic device, including a memory and a processor, characterized in that a computer program is stored in the memory, and the processor is configured to run the computer program to execute the above-mentioned SOAR-based task model construction method.

[0086] It can be seen from the above technical solutions that the present application provides a task model construction method, electronic device and storage medium based on SOAR, wherein the method can construct a data source unit and a data processing unit, and then construct a task model by connecting the data source unit and the data processing unit in series. Among them, the task model is a link composed of a data source unit and a plurality of data processing units in series, the data source unit is located at the first position of the link, and the data source unit can obtain network data from the network data source. Multiple data processing units are respectively used to call the logic processing module to perform logical processing on the network data. By constructing a task model, the method can automatically connect to a third-party data source, and link functional modules such as cases, scripts, controllers, and applications to realize threat event management based on automated orchestration. At the same time, the scripts, controllers, applications, scenarios, security events and other related information related to the task model can be directly transplanted to the new platform system for reuse.

[0087] Similar parts between the embodiments provided in this application can be referenced to each other. The specific implementation methods provided above are only a few examples under the general concept of this application and do not constitute a limitation on the protection scope of this application. For those skilled in the art, any other implementation methods expanded based on the scheme of this application without creative work belong to the protection scope of this application.

Claims

1. A method for constructing a task model based on SOAR, characterized in that: The method is applied to an event management system, comprising: Constructing a node unit, wherein the node unit includes a data source unit and a data processing unit; The data source unit and the data processing unit are connected in series to construct a task model; the task model is a link composed of one data source unit and a plurality of data processing units connected in series; The data source unit is located at the first position of the link; the data source unit is used to obtain network data from a network data source, pre-process the network data, and transmit the network data in a fixed format to a data processing unit connected to the data source unit in a link sequence, and the network data source is a security device; a plurality of data processing units are respectively used to call a logic processing module to perform logic processing on the network data; the data processing unit is associated with a logic processing module; the logic processing module includes a combination of one or more modules of a data cleaning module, a data merging module, a data conversion module, a data mapping module, a case access module, a script access module, an application access module, and a controller access module; A data flow medium is constructed between two adjacent node units.

2. The method for constructing a task model based on SOAR according to claim 1, further comprising: Obtain a forward call chain, where the forward call chain is used to represent the next level node unit corresponding to each node unit; Obtain a reverse call chain, where the reverse call chain is used to represent the previous level node unit corresponding to each node unit; A data flow medium is constructed according to the forward call chain and the reverse call chain, and the data flow medium is a data cache queue connecting two adjacent node units.

3. The method for constructing a task model based on SOAR according to claim 1, characterized in that: The method further comprises: Defining the data format transmitted by each node unit in the task model; A transmission data mode of two adjacent node units is constructed according to the data format.

4. The method for constructing a task model based on SOAR according to claim 1, characterized in that: The method further comprises: Acquire an execution queue, where the execution queue is used to represent the running order of the node unit; The data source unit and the data processing unit are connected in series according to the execution queue to construct a task model.

5. The method for constructing a task model based on SOAR according to claim 1, characterized in that: The method further comprises: Acquire trigger configuration information, wherein the trigger configuration information includes a trigger type, and the trigger type includes a time trigger, an event trigger, and a trigger tool trigger; A trigger of the task model is constructed according to the trigger configuration information, so as to receive the network data through the trigger and trigger a data processing unit corresponding to the network data to perform logic processing.

6. The method for constructing a task model based on SOAR according to claim 1, characterized in that: The method further comprises: Traverse the controller address collection; Obtaining a controller address corresponding to each of the data processing units; Access the controller address corresponding to the data processing unit to call the controller corresponding to the data processing unit.

7. A task model based on SOAR, characterized in that: The task model is a link consisting of a data source unit and multiple data processing units in series; wherein, The data source unit is located at the first position of the link; the data source unit is used to obtain network data from a network data source, pre-process the network data, and transmit the network data in a fixed format to a data processing unit connected to the data source unit in a link sequence, and the network data source is a security device; The plurality of data processing units are respectively used to call a logic processing module to perform logic processing on the network data; the data processing unit is associated with a logic processing module; the logic processing module includes a combination of one or more modules of a data cleaning module, a data merging module, a data conversion module, a data mapping module, a case access module, a script access module, an application access module and a controller access module; A data flow medium is constructed between the data source unit and the connected data processing unit, and a data flow medium is constructed between two adjacent data processing units.

8. The SOAR-based task model according to claim 7, characterized in that: The case access module is configured to call the case corresponding to the logic processing module; The script access module is configured to call and execute the security script corresponding to the logic processing module; The application access module is configured to call the application corresponding to the logic processing module.

9. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, wherein the computer program is configured to execute the method according to any one of claims 1 to 6 when executed.

10. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to run the computer program to perform the method according to any one of claims 1 to 6.

Images