SOAR-job implements automated / semi-automated security handling methods

Abstract

The application relates to the technical field of application program security operation and maintenance. A SOAR-Job realizes an automatic / semi-automatic security disposal method, which comprises the following steps: a trigger mechanism of a security disposal task is established; a security disposal task is triggered to obtain first data, wherein the first data comprises data of the security disposal task; the first data is cleaned to obtain second data, wherein the second data comprises data obtained by filtering the first data based on a preset rule; a script and an application program are acquired, wherein the script represents a process of solving the security disposal task, and the application program is used for executing the script; the second data is imported into the script; the application program executes the script, records a process of processing the script by the application program, and stores the process. The automatic / semi-automatic processing can be realized according to the preset trigger mechanism, and the method has the advantages of low operation threshold and strong portability.

Description

Technical Field

[0001] This application relates to the field of application security operation and maintenance technology, and in particular to SOAR-Job's automated / semi-automated security handling methods. Background Technology

[0002] SOAR (Security Orchestration, Automation, and Response) is a large and complex security operations and protection system composed of multiple components. SOAR refers to the process of combining the security capabilities of different customer systems or different components within a system through programmable interfaces (APIs) and manual inspection points, according to certain logical relationships, to complete a specific security operation. The SOAR platform can flexibly orchestrate existing security capabilities, construct scenarios by writing playbooks, and achieve automated operation.

[0003] The experience of security analysts can be solidified into automated scripts for repeated use, improving the efficiency of security incident handling and lowering the barrier to entry for security analysis. However, the automated script orchestration function provided by security orchestration and automated response systems, like the correlation analysis rules in log analysis systems, still requires manual orchestration. Security incidents are diverse, and various analysis scenarios differ, meaning many scripts still require extensive on-site manual editing. This manual editing not only relies on highly skilled personnel but also carries a high error rate, ultimately resulting in a significant investment of time and effort without achieving the desired results. Furthermore, the edited scripts have poor portability, often only applicable to local scenarios. Porting them to other scenarios requires considerable modification and development work, impacting project delivery efficiency.

[0004] For the reasons mentioned above, there is an urgent need for a SOAR-Job method that lowers the barrier to scriptwriting and is portable, enabling automated / semi-automated safety procedures. Summary of the Invention

[0005] This application provides a method for automating / semi-automating safety handling in SOAR-Job, which solves the problems of high threshold, poor portability, and inability to automate / semi-automate script orchestration in existing SOAR platforms.

[0006] The first aspect of this application provides a method for automating / semi-automating safety procedures in SOAR-Job, including:

[0007] Establish a triggering mechanism for security handling tasks. The triggering mechanism is used to trigger the security handling tasks. The triggering mechanism includes a time-mode triggering mechanism, a message queue mode triggering mechanism, a request mode triggering mechanism, or a passive mode triggering mechanism.

[0008] When the triggering mechanism is met, the security handling task is triggered to obtain first data, wherein the first data represents the data of the security handling task;

[0009] The first data is cleaned to obtain the second data, wherein the second data represents the data obtained by filtering the security handling task data based on preset rules;

[0010] Obtain a script and an application, wherein the script represents a process for resolving a security incident task, and the application is used to execute the script;

[0011] Import the second data into the script;

[0012] The application executes the script, records the process of the application processing the script, and stores the data.

[0013] In one feasible approach, the step of establishing the triggering mechanism for the security handling task includes:

[0014] Establish the trigger time point or trigger period of the time-mode triggering mechanism, and determine the trigger node of the safety handling task based on the trigger time point or trigger period; or

[0015] Establish a trigger message queue for the message queue mode triggering mechanism, and determine the trigger node for the security handling task based on the message order of the trigger message queue; or

[0016] Establish a trigger request protocol for the aforementioned request mode triggering mechanism, and determine the trigger node for the security handling task based on the request access method of the trigger request protocol; or

[0017] Establish the trigger information content of the passive mode triggering mechanism, and determine the trigger node of the safety handling task based on the information changes of the trigger information content.

[0018] In one feasible approach, the step of satisfying the triggering mechanism to trigger the security handling task and obtain the first data includes:

[0019] Establish an interface for the first data;

[0020] The security handling task is triggered, and the first data is transmitted through the interface of the first data.

[0021] In one feasible approach, the step of cleaning the first data to obtain the second data includes:

[0022] Establish cleaning rules for the first data, wherein the cleaning rules include removing duplicate data from the first data and processing invalid and missing data in the first data;

[0023] Based on the cleaning rules, the first data is cleaned to obtain the second data.

[0024] In one possible implementation, the steps of obtaining the script and the application include:

[0025] Establish a script database, wherein the script database includes multiple scripts, and each script corresponds to the security handling task;

[0026] Based on the security handling task, select at least one script from the script database;

[0027] Traverse the script database. If no script corresponds to the security handling task, create a first script, where the first script represents the script corresponding to the security handling task.

[0028] The first script is stored in the script database.

[0029] In one possible implementation, the step of importing the second data into the script includes:

[0030] Set the parameters of the script according to the preset security handling tasks;

[0031] Import the second data into the script after setting the parameters.

[0032] In one possible implementation, the steps of the application executing the script, recording the application's processing of the script, and storing the data include:

[0033] Create a timeline;

[0034] Based on the timeline, the processing of the script is recorded, as well as the operation and changes of the script in the application.

[0035] Store the recorded content in the specified location.

[0036] The second aspect of this application provides an automated / semi-automated safety handling system for SOAR-Job implementation, applied to the aforementioned automated / semi-automated safety handling method for SOAR-Job implementation. The system includes:

[0037] A setup unit is used to establish a triggering mechanism for a security handling task. The triggering mechanism is used to trigger the security handling task. The triggering mechanism includes a time-mode triggering mechanism, a message queue mode triggering mechanism, a request mode triggering mechanism, or a passive mode triggering mechanism.

[0038] A triggering unit is configured to trigger the security handling task and obtain first data when the triggering mechanism is satisfied, wherein the first data includes data of the security handling task;

[0039] A cleaning unit is used to clean the first data to obtain second data, wherein the second data includes data obtained by filtering the first data based on preset rules;

[0040] An acquisition unit is used to acquire a script and the application, wherein the script represents a process for resolving a security handling task, and the application is used to execute the script;

[0041] An import unit is used to import the second data into the script;

[0042] An execution unit is used for the application to execute the script, record the process of the application processing the script, and store the data.

[0043] A third aspect of this application provides an electronic device, comprising:

[0044] processor;

[0045] Memory used to store the processor's executable instructions;

[0046] The processor is configured to read the executable instructions from the memory and execute the instructions to implement the aforementioned SOAR-Job automated / semi-automated safety handling method.

[0047] A fourth aspect of this application provides a computer-readable storage medium having computer program instructions stored thereon, which, when executed by a processor, implement the steps of the aforementioned SOAR-Job automated / semi-automated safety handling method.

[0048] Beneficial effects:

[0049] SOAR-Job implements an automated / semi-automated safety handling method. It obtains the trigger mechanism that initiates the safety handling task, cleans the first data in the trigger mechanism to obtain second data, avoiding invalid, missing, or duplicate data. It then obtains the script and the application used for safety handling, sends the cleaned second data to the script, and executes the second data within the application, recording the process of the application handling the script. This method can achieve automated / semi-automated processing based on a pre-set trigger mechanism, reducing manual workload and offering advantages such as lower operational barriers and high portability. Attached Figure Description

[0050] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0051] Figure 1 Flowchart for implementing automated / semi-automated safety procedures for SOAR-Job;

[0052] Figure 2 A diagram illustrating the triggering time points for implementing automated / semi-automated safety procedures for SOAR-Job;

[0053] Figure 3 A schematic diagram illustrating the triggering cycle for implementing automated / semi-automated safety procedures for SOAR-Job;

[0054] Figure 4 A schematic diagram of the CRON expression for implementing automated / semi-automated safety procedures for SOAR-Job;

[0055] Figure 5 A diagram illustrating a Kafka message queue used to implement automated / semi-automated safety handling methods for SOAR-Job;

[0056] Figure 6 A flowchart illustrating the triggered mechanism for implementing automated / semi-automated safety procedures for SOAR-Job.

[0057] Figure 7 Cleaning data flow diagram for implementing automated / semi-automated safety handling methods for SOAR-Job;

[0058] Figure 8 A flowchart for selecting a script in SOAR to implement automated / semi-automated safety procedures for SOAR-Job;

[0059] Figure 9 A flowchart for script integration to implement automated / semi-automated safety handling methods for SOAR-Job;

[0060] Figure 10 A diagram illustrating the addition of a first scenario for implementing automated / semi-automated safety procedures in SOAR-Job;

[0061] Figure 11 A flowchart for the second data import script for implementing automated / semi-automated safety procedures in SOAR-Job;

[0062] Figure 12 A schematic diagram of IP hierarchical blocking for automated / semi-automated safety handling methods in SOAR-Job;

[0063] Figure 13 A diagram illustrating application access for implementing automated / semi-automated safety procedures in SOAR-Job;

[0064] Figure 14 A flowchart illustrating the process of documenting automated / semi-automated safety procedures for SOAR-Job;

[0065] Figure 15 A diagram illustrating the triggering mechanism for establishing a Kafka message queue to implement automated / semi-automated safety handling methods for SOAR-Job;

[0066] Figure 16 A diagram illustrating the use of JSON data cleaning to automate / semi-automate safety procedures for SOAR-Job.

[0067] Figure 17 Two diagrams illustrating the use of JSON data cleaning to implement automated / semi-automated safety handling methods for SOAR-Job;

[0068] Figure 18 A diagram illustrating the ruleName data in Kafka that triggers the decision-making process for automated / semi-automated safety handling methods in SOAR-Job;

[0069] Figure 19 A schematic diagram of script node unit access for implementing automated / semi-automated safety handling methods for SOAR-Job. Detailed Implementation

[0070] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0071] To facilitate understanding of the technical solution of this application, some concepts involved in this application will be explained first below.

[0072] A Job is a function that primarily involves accessing third-party data, processing it according to pre-defined logic, and calling data from the script.

[0073] DAG, or Directed Acycling Graph, is a directed graph without any loops (cycles). It is mainly used to study project process issues, time schedule issues, etc.

[0074] A Cron expression, or scheduled task, refers to a task that executes pre-planned work at a predetermined time. In Linux systems, this is accomplished using a cron server. The cron server can execute specific tasks according to the time specified in the configuration file. A Cron expression consists of seven parts, from left to right: seconds, minutes, hours, day, month, week, and year, separated by spaces.

[0075] A message queue is a "first-in, first-out" (FIFO) data structure. It's typically used to solve problems related to application decoupling, asynchronous messaging, and traffic shaping, achieving high performance, high availability, scalability, and eventual consistency architectures.

[0076] Kafka is a high-throughput distributed publish-subscribe messaging system that builds reliable pipelines for transmitting real-time data between systems or applications, provides message queuing functionality, and enables the construction of real-time streaming data processing programs to transform or process data streams, providing data processing capabilities.

[0077] ActiveMQ is an open-source message bus from Apache that supports JMS 1.1 and J2EE 1.4 specifications through its JMSProvider implementation.

[0078] RabbitMQ is an open-source (MPL) message queuing service software system. It is an open-source implementation of the Advanced Message Queuing Protocol (AMQP) provided by LShift and written in Erlang, which is known for its high performance, robustness, and scalability.

[0079] RocketMQ is a pure Java, distributed, queue-based open-source message middleware that supports transactional messages, sequential messages, batch messages, timed messages, and message backtracking.

[0080] JSON data, or JavaScript Object Notation (JSON), refers to a lightweight form of data.

[0081] A script is a fixed solution to a problem, or a way of thinking to solve a security incident. Each script can solve at least one security incident and belongs to the process-oriented operation management and maintenance actions.

[0082] An action is a predefined method for handling a specific event, such as sending a notification or executing a script.

[0083] App is an abbreviation for Application. In the SOAR system, an application refers to:

[0084] 1. Customized integration support for software services within the customer's on-site network environment. For example, a customer may have an OA system that requires login or clicking menu links for each operation. Integration support means that the customer does not need to directly operate this service software; they can directly use its functions within the SOAR system.

[0085] 2. Supports basic software service capabilities provided by mainstream domestic and international security products, IT products, and services. This includes commercially available software services and open-source software.

[0086] YAML is a relatively user-friendly data serialization language that can be used with most current programming languages.

[0087] A security incident refers to any event that attempts to change the security status of an information system (such as changing access control measures, security levels, or user passwords). Simply put, it's an attack event on a network, encompassing all actions related to a hacker's unauthorized intrusion into the network.

[0088] TotemsEL expressions are a data format that is easy to understand and write, used to connect contextual data and reference data between nodes in a Job task. It enables efficient and high-quality data services between Job task node elements.

[0089] A job chain refers to a job consisting of a "data source unit" and one or more "logical processing units". There can only be one "data source unit" (water pump), and it must be the first unit in the chain. The number of subsequent "logical processing units" can be one or more, depending on business requirements. A complete job chain includes one "data source unit" and one "logical processing unit". Data flow has a sequential order, which is the order of the units in the job chain.

[0090] In related incidents, when a problem is discovered or a task is assigned by a superior, certain methods are typically used to resolve the issue or execute the task. For example, blocking a suspicious IP address. Before blocking the IP, it's first checked if the IP exists in the blacklist. If the IP isn't in the blacklist, a second check is performed: is it an IP from an unknown source? If not, has the IP appeared in threat intelligence? Further checks are conducted on the threat intelligence information. If the information is normal, analysis is needed to determine the IP's approximate source, the server it's destined for, and the port it's requesting. The final conclusion is whether it's a false alarm or a problematic IP that needs blocking. A final decision is made on whether to issue a blocking command, and whether to issue the command manually by logging into the firewall or using other software tools. The above describes a series of methods for blocking suspicious IP addresses.

[0091] Therefore, it's clear that resolving a security incident or problem inevitably involves utilizing various tools (such as security service software, data processing software, and evidence collection software) or requesting assistance or permission from others. Furthermore, when these problems recur, a fixed solution pattern emerges. This pattern can be summarized into problem-solving guides and related operation manuals. In practice, when a pattern for solving problems is established, a script can be created. Fixed operational steps are used to resolve security issues or execute tasks. Furthermore, the script can embed virtual nodes requiring human intervention, and seamlessly connect elements requiring personnel collaboration and superior approval.

[0092] A script is essentially a standardized and streamlined approach to problem-solving or goal achievement, presenting existing methods and processes for quick and automated solutions when similar problems arise again. This eliminates repetitive and tedious manual processes, saving significant human and material resources while ensuring efficiency and quality.

[0093] In the SOAR framework, a script consists of three main models: multiple application actions (tools, software, specific capabilities, etc.), multiple virtual nodes (manual approval, conditional judgment, timers, etc.), and multiple connection directions (logical relationships). These are superimposed with other related basic business data.

[0094] Building SOAR scripts in related technologies typically requires specialized technical skills and business acumen, resulting in a high barrier to entry for technical personnel. Secondly, completed SOAR scripts have poor portability; migration, such as from project A to project B, necessitates modifications, increasing development time and workload. Thirdly, due to the increased development time and workload, coupled with a shortage of technical personnel, a certain rate of operational errors is highly likely during the process. Furthermore, SOAR is a large and complex security operations and protection system composed of multiple components, each with a different structure. Building a SOAR system requires considering not only the triggering mechanisms of third-party data sources but also how this third-party data is applied to the script to enable execution within the application. Finally, SOAR security operations often involve lengthy security maintenance processes, requiring significant time for manual intervention.

[0095] This application discloses a method for implementing automated / semi-automated safety procedures in SOAR-Job, which involves creating Job tasks and performing automated / semi-automated safety procedures on them.

[0096] Create a Job task. The Job task is a node unit for orchestration. By connecting the tasks, a DAG structure task model is constructed. In other words, a directed acyclic graph model is constructed through page input.

[0097] In the Job task, each node unit can be edited, and each node unit acts as a task processing unit to process the task.

[0098] Specifically, the nodes in a Job task can sequentially include triggering mechanisms, data cleaning, script integration, and application integration. By designing each node, the Job task can be constructed. When migrating a Job task from project A to project B, it can be easily exported from project A and ported directly to project B for direct use.

[0099] It's important to note that when a Job is exported from Project A, all nodes within the Job are exported. This includes all information related to the script, controller, application, scene, and security events. When ported to Project B, only minor modifications to the script, controller, application, scene, and security events are needed. The workflow is also implemented through a step-by-step process on the page. For example, after setting the trigger mechanism on the page, the next step leads to data cleaning settings, then the next step leads to script integration, and so on. Once all the next steps are completed and saved, the Job's security processing can be performed automatically or semi-automatically.

[0100] like Figure 1 As shown, further, this application provides a method for automating / semi-automating safety procedures in SOAR-Job, including:

[0101] S100: Establish a triggering mechanism for safety response tasks.

[0102] The triggering mechanism is used to initiate security response tasks.

[0103] Specifically, the security handling task application needs a data source for the security handling task. For example, the data source is a third-party data source, which is used as the test data for the security handling task.

[0104] It should be noted that the triggering mechanism is the first node unit in the Job task. A mechanism to trigger the safety handling task is established in the first node unit; when the mechanism is triggered, the safety handling task can be executed. This can be understood as the triggering mechanism serving as the triggering condition for the safety handling task; when the condition is met, the safety handling task is triggered.

[0105] It should also be noted that the triggering mechanism can include time-based triggering, message queue triggering, request-based triggering, or passive triggering.

[0106] like Figures 2 to 4 As shown, the time-mode triggering mechanism includes establishing the triggering time point or triggering cycle of the time-mode triggering mechanism, and determining the triggering node of the safety handling task based on the triggering time point or triggering cycle.

[0107] Figure 2 In this context, the trigger time point refers to the specific time at which the security response task will be executed. This can be understood as specifying the exact time of the trigger, i.e., the hour, minute, and second of each day. For example, setting the trigger time point to 12:00 means that the security response task will be triggered at 12:00 every day. Figure 3In this context, the trigger cycle refers to triggering safety response tasks at fixed intervals. For example, a trigger cycle of 1 hour means that a safety response task is triggered once every 1 hour. Furthermore, Figure 4 In addition, trigger nodes can be set using CRON expressions. By filling in a CRON expression, the time scheduler will parse the expression and then trigger execution according to it. Cron offers more flexibility than specifying the trigger time and period, allowing you to specify the hour, minute, second, day, month, week, and year. This triggering method is suitable for most use cases.

[0108] like Figure 5 As shown, the message queue mode triggering mechanism includes establishing a trigger message queue and determining the trigger node for the safety handling task based on the message order of the trigger message queue. Message queues can be established using Kafka, ActiveMQ, RabbitMQ, or RocketMQ, and the safety handling task is triggered based on the established queue order. For example, using Kafka as the trigger for the message queue mode triggering mechanism, the following steps are taken to establish the triggering mechanism: First, configure the Kafka server address and port. Then, fill in the consumption topic. To enable subsequent node units to process the received data, data samples can also be configured in the trigger, facilitating subsequent executors (node ​​units) to configure data processing based on the log samples. When data is consumed from Kafka, it will be automatically passed to subsequent node units for processing.

[0109] The request pattern triggering mechanism includes establishing a triggering request protocol and determining the triggering node for the security handling task based on the request access method of the triggering request protocol. For example, the triggering request protocol is either the HTTP protocol or the HTTPS protocol, where the HTTP protocol triggers the security handling task via HTTP, and the HTTPS protocol triggers the security handling task via HTTPS.

[0110] The passive mode triggering mechanism includes establishing the trigger information content and determining the trigger node for the security response task based on changes in the trigger information content. The passive mode triggering mechanism triggers the security response task through monitoring.

[0111] The passive mode triggering mechanism can include file change triggering, email triggering, or database table triggering.

[0112] File change triggers can include FTP monitoring of file changes or FTP monitoring of folder changes.

[0113] FTP file change monitoring: Configure FTP service address, user, password, and file path. Trigger a security action task when a file changes.

[0114] FTP folder change monitoring: Configure FTP service address, user, password, and file path. Trigger a security action task when the folder changes.

[0115] Email triggers can include listening to the email subject or listening to the sender.

[0116] Monitor email subjects: Configure the mail server address, user, password, and other relevant settings. Trigger a security action when a matching email subject is received.

[0117] Monitor senders: Configure the mail server address, user, password, and other related settings. Trigger a security action when an email is received from a preset sender.

[0118] Database table triggers can include MySQL, Oracle, or SQL Server.

[0119] MySQL: Configures the MySQL database connection address, user, password, database name, table name, etc., and triggers a security handling task when new data is added to a table that meets the listening conditions.

[0120] Oracle: Configures the connection address, user, password, database name, table name, etc. for the Oracle database. When new data is added to a table that meets the listening conditions, a security handling task is triggered.

[0121] SQL Server: Configures the SQL Server database connection address, user, password, database name, table name, etc., and triggers a security handling task when new data is added to a table that meets the listening conditions.

[0122] In this embodiment, a triggering mechanism is used to trigger a security handling task so that subsequent node units can process the data in the security handling task.

[0123] S200: When the triggering mechanism is met, a safety handling task is triggered to obtain the first data.

[0124] The first data includes data on safety response tasks.

[0125] like Figure 6 As shown, specifically, when the triggering mechanism is triggered, the third-party data source can generate the first data for subsequent node unit processing. This includes steps S201 and S202.

[0126] S201: Establish the interface for the first data.

[0127] The interface for the first data is the interface for transmitting third-party data to the first node unit, and the transmission of third-party data is realized through this interface.

[0128] S202: Trigger a safety handling task and transmit the first data through the interface of the first data.

[0129] For example, when the time node set by the time mode triggering mechanism arrives, the triggering mechanism is satisfied, the security handling task response triggering mechanism is activated, and third-party data is transmitted through the interface of the first data, forming the first data that is used.

[0130] S300: Clean the first data to obtain the second data.

[0131] The second data includes data obtained by filtering the first data based on preset rules.

[0132] like Figure 7 As shown, specifically, the data constituting the first data security processing task may contain some "dirty" data during use, which needs to be removed to ensure the orderly progress of security processing. The cleaning steps include S301 and S302.

[0133] S301: Establish the cleaning rules for the first data.

[0134] The cleaning rules remove "dirty" data, which includes duplicate data in the first set of data, as well as invalid and missing data.

[0135] Specifically, establishing data cleaning rules for the first set of data will be the second node unit of the Job task. The data cleaning rules are set on the page of this second node unit. These rules re-examine and validate the first set of data to remove duplicate information, correct errors, and ensure data consistency. In other words, they filter out data that does not meet the requirements.

[0136] It should be noted that the data cleaning in the cleaning rules includes text data cleaning, JSON data cleaning, and conditional judgment.

[0137] Text data cleaning can include one or more of the following methods: concatenating multiple strings, concatenating multiple strings by symbols, summing multiple values, subtracting multiple values, multiplying multiple values, dividing two values, dividing two values ​​and taking the remainder, extracting strings by start and end indices, replacing a value in a string, replacing the first occurrence of a value in a string, determining if a string contains a certain string, splitting a string into an array based on a delimiter, extracting the maximum value in an array, extracting the minimum value in an array, summing all values ​​in an array, averaging all values ​​in an array, sorting all values ​​in an array, removing duplicate values ​​from an array, and converting strings into JSON objects.

[0138] JSON data cleaning can include one or more of the following methods: converting JSON into new JSON based on a custom template, stacking JSON or JSONArray into a single JSONArray, merging JSON or JSONArray into a single JSON or JSONArray, comparing JSON key values, setting JSON values ​​based on key and value, deleting nodes based on JSON key values, converting JSON into a string based on a delimiter, filtering JSON arrays, retrieving values ​​from JSON based on keys, and retrieving values ​​from JSON based on keys and removing duplicates.

[0139] Conditional statements can include one or more of the following: equals, does_not_equal, greater than, less than, starts with, ends with, contains, contains any, matches_regex, and not contains.

[0140] In addition, text data cleaning, JSON data cleaning, and conditional judgment can be combined to achieve the purpose of cleaning the first data.

[0141] S302: Based on the cleaning rules, the first data is cleaned to obtain the second data.

[0142] The cleaning rules can be understood as filters. By filtering out data in the first set of data that does not conform to the rules, the second set of data is obtained. This second set of data, which conforms to the cleaning rules, is then used for operations on subsequent node units.

[0143] In this embodiment, a second node unit for the Job task is established, and the first data is cleaned by the second node unit to obtain data that is suitable for use by subsequent node units, thus avoiding the inability to perform safe processing due to "dirty" data.

[0144] S400: Get the script, and the application.

[0145] The script represents the process for resolving security incidents, and the application is used to execute the script.

[0146] like Figure 8As shown, specifically, in the Job task, script selection is used as the third node unit, application selection as the fourth node unit, and a script is selected from SOAR. This script can be a pre-arranged script. When the trigger mechanism is triggered, the second data import script is executed. Selecting a script in SOAR includes steps S401 to S404.

[0147] S401: Establish a script database.

[0148] The script database contains multiple scripts, each with a corresponding security response task.

[0149] Specifically, based on previously reported security incidents or issues, fixed solutions are compiled into scripts. These scripts are then stored in a database, forming a script database. When the same security incident or issue occurs, a script in the script database can be directly invoked and executed to resolve the corresponding security incident or issue.

[0150] For example, a script can consist of multiple application actions and virtual nodes. Scripts can be written using Yaml.

[0151] S402: Select at least one script from the script database based on the security response task.

[0152] like Figure 9 As shown, at least one script corresponding to the security handling task is selected based on the security handling task. The selection of the script can also take the application as a reference. It should be noted that the script used for the same security event or problem may be different in mobile application App or computer program. Therefore, the application should also be referred when selecting the security handling task.

[0153] S403: Traverse the script database. If no script corresponds to the safety response task, create the first script.

[0154] The first scenario refers to the scenario corresponding to the safety response mission.

[0155] Specifically, when a security incident or issue is not recorded in the script database, a first script is created. The process of creating the first script can be added in a subpage within the third node unit page of the Job task.

[0156] S404: Store the first script in the script database.

[0157] like Figure 10As shown, after adding a subpage, the first script is saved, a new case is generated, and the generated case is used for security incident maintenance and handling. Simultaneously, the script database is updated, and the first script is saved in the script database, enabling incremental iteration of the script database to enrich the scripts in the database.

[0158] S500: Import the second data into the script.

[0159] like Figure 11 As shown, the second data import script includes steps S501 and S502.

[0160] S501: Set the parameters of the script according to the preset safety handling task.

[0161] Among them, parameters, also known as input parameters, can be set as needed based on the security handling task and the script called by the application. Input parameters need to be filled in the corresponding parameters or TotemsEl expressions in the third node unit page of the Job task, such as the format "${{application node name.data.parameter}}", which can be automatically obtained from the context of the node unit and the response data of the preceding node unit. Business logic judgments are then performed. For example, Figure 12 In this context, src_ip and event_level are the input parameters for the script "IP hierarchical blocking".

[0162] The `TotemsEl` expression enables rapid flow and seamless processing of contextual data during execution. For example, data seamlessness is a common problem in existing SOAR systems. Consider a `JobTest` with four nodes: A, B, C, and D. Node B requires a specific field from the response of node A. Node C requires a specific field from the response of node B. Node D requires data from the response of node C. This scenario is very common and prevalent.

[0163] To resolve data concatenation issues, Totems-El expressions are used. For example:

[0164] Node A's response data is {data: {"name":"Zhang San", "sex":"Male"}}

[0165] Node B's response data is {data: {"city":"Guangzhou"}}

[0166] In the input parameter input box of node B, you can select the Totems-El expression {{nodeA.data.nmae}} to perform value concatenation. In the input parameter input box of node C, you can select the Totems-El expression {{nodeB.data.ctty}} to perform value concatenation, and so on for other nodes. The expression options can be automatically generated based on the input and output content of the node elements or sample data, or you can manually enter them if you are familiar with data structures.

[0167] S502: Import the second data into the script after setting the parameters.

[0168] The second data is sequentially imported into the script after setting the parameters, so that the script can be executed. The execution order of the second data import can be based on time or on the content of the data; this application does not limit the order of import.

[0169] S600: The application executes the script, records the process of the application handling the script, and stores it.

[0170] like Figure 13 As shown, the application can include mobile applications (APPs) or computer applications. All applications can be centrally stored to form an application center. When an application is used, the corresponding application can be invoked from the application center. Through the application center, various business systems, software products, application services, security tools, and network devices can be flexibly invoked and executed.

[0171] The application executes the prepared script, records the process of the application processing the script, and stores the processing results for easy review later.

[0172] like Figure 14 As shown, specifically, the recording process includes steps S601 to S603.

[0173] S601: Create a timeline.

[0174] S602: Based on the timeline, it records the script processing process, as well as the operation process and changes of the script in the application.

[0175] Specifically, all operation processes and changes are recorded and stored along a timeline. All processes and changes are archived, facilitating review and backtracking, and also serving as data to enrich SOAR content.

[0176] S603: Store the recorded content in the specified location.

[0177] The recorded content is stored in a designated database, and this application does not limit the location where the recorded content is stored.

[0178] In summary, for example, four node units are established for the Job task. Each node unit has a corresponding page for editing. These four node units form the Job chain. In the Job chain, the data source undergoes security processing through the data source unit and the logic processing unit. Once the configuration of each node unit in the Job task is complete, the security processing task can be automatically triggered according to the triggering mechanism, without manual intervention, thus achieving automated security processing. This has the following advantages:

[0179] 1. The creation and editing of Job tasks has a low barrier to entry. You only need to understand the business and know what you need to do. Then, you can quickly develop new Job tasks by following the order of the node units.

[0180] 2. Jobs are highly portable, allowing for easy export and direct use in other projects. This is because the export includes not only the Job itself but also related scripts, controllers, applications, scenarios, security event information, and more. When reusing the Job in a new platform system, only necessary modifications are required for adaptation and deployment.

[0181] 3. Simple operation: The operation process mainly involves configuring and saving step by step. Application actions execute stably, and job orchestration is stable with a low error rate.

[0182] 4. Job orchestration is convenient and streamlined. Users can manually orchestrate and modify existing jobs or develop new ones, quickly resolving requirements or problems. This significantly improves the process from problem identification to response and resolution, increasing work efficiency and productivity.

[0183] The following is combined with Figures 15 to 19 The following is an exemplary description of the specific configuration method for the SOAR-Job automated / semi-automated safety handling method provided in the embodiments of this application:

[0184] When users create a Job on the SOAR platform, they can do so in the following ways.

[0185] like Figure 15As shown, first, the triggering mechanism node unit is configured. Enter the triggering mechanism page, where triggers are configured. Trigger types include trigger-based, time-based, and event-based. Specifically, trigger-based triggering indicates a mechanism that uses triggers to initiate security handling tasks. Time-based triggering indicates a mechanism that uses time to initiate security handling tasks. Event-based triggering indicates a mechanism that uses security events or scripts to initiate tasks. When the user selects trigger-based triggering, the trigger includes Kafka, indicating that triggering is performed using the Kafka message queue. Further, the Kafka Topic is configured as alarmEvent-topic, the service IP is 192.168.215.165, and the port is 9092, with a data sample provided for user reference. After the user completes the configuration, clicking "OK" on the triggering mechanism page will proceed to the next step, the data cleaning node unit.

[0186] like Figure 16 and Figure 17 As shown, next, enter the data cleaning node unit. On the data cleaning page, configure the controllers, which include two types: text data cleaning and JSON data cleaning controllers. When the user selects the JSON data cleaning controller, select the corresponding action "Get value from JSON by key" below the controller. This will retrieve the data with the key name "actionEvent" from the data obtained from the Kafka node unit in the previous node unit. Then, click "OK" on the data cleaning page.

[0187] like Figure 18 As shown, next, by judging the trigger, if the data ruleName in Kafka is equal to "convergence alarm", the data continues to flow to the next node unit; otherwise, the data is lost and not processed.

[0188] like Figure 19As shown, next, enter the script node settings page of the script node unit, name the Job task "Internet Scan Attack," set the case type to "Website Scan," set the case level to "Medium," and select "Threat Handling, Alarm Analysis, and Investigation and Evidence Collection" for the case tags. Describe the case as "The purpose of scanning is to use various tools to find vulnerabilities in the IP addresses or address ranges of the target host. Internet scan attacks automatically generate cases for threat handling upon discovering targets." Next, select the script in the script database and bind the script "Local Area Network Scan Attack." Select "Update Existing Case" as the case access method. "Update Existing Case" indicates that the case already exists, and the data generated by this action updates the original case data, mapping the data previously generated by the node unit to the case update data form. Select "Internet Scan" for the case form, and automatically call the "Internet Scan" script to handle this security incident.

[0189] Finally, the user clicks "OK" on the script node settings page to complete the creation of the Job task. When the trigger mechanism is met, the Job task will be executed automatically.

[0190] Corresponding to the aforementioned embodiments of the SOAR-Job automated / semi-automated safety handling method, this application also provides embodiments of a SOAR-Job automated / semi-automated safety handling system. The system includes:

[0191] Establishment unit, used to establish the triggering mechanism for security handling tasks. The triggering mechanism is used to trigger security handling tasks. The triggering mechanism includes time-mode triggering mechanism, message queue mode triggering mechanism, request mode triggering mechanism or passive mode triggering mechanism.

[0192] The triggering unit is used to trigger a safety handling task when the triggering mechanism is met, and obtain first data, wherein the first data includes data of the safety handling task;

[0193] A cleaning unit is used to clean the first data to obtain the second data, wherein the second data includes data obtained by filtering the first data based on preset rules;

[0194] The acquisition unit is used to acquire a script and an application, wherein the script represents the process of resolving a security disposal task, and the application is used to execute the script;

[0195] The import unit is used to import the second data into the script;

[0196] The execution unit is used by the application to execute the script, record the application's process of processing the script, and store it.

[0197] This application also provides an electronic device, including:

[0198] processor;

[0199] Memory used to store processor-executable instructions;

[0200] The processor is used to read executable instructions from memory and execute the instructions to implement the aforementioned SOAR-Job automated / semi-automated safety handling method.

[0201] Finally, this application provides a computer-readable storage medium storing computer program instructions that, when executed by a processor, implement the steps of the aforementioned SOAR-Job automated / semi-automated safety handling method.

[0202] The above embodiments merely illustrate specific implementations of the present invention, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these all fall within the protection scope of the present invention.

Claims

1. A method for SOAR-Job implementation of automated / semi-automated security handling, characterized in that, include: Establish a triggering mechanism for security handling tasks. The triggering mechanism is used to trigger the security handling tasks. The triggering mechanism includes a time-mode triggering mechanism, a message queue mode triggering mechanism, a request mode triggering mechanism, or a passive mode triggering mechanism. When any of the aforementioned triggering mechanisms is met, the security handling task is triggered to obtain first data, wherein the first data includes the data of the security handling task; The first data is cleaned to obtain the second data, wherein the second data includes data obtained by filtering the first data based on preset rules; Obtain a script and an application, wherein the script represents a process for resolving a security incident task, and the application is used to execute the script; Import the second data into the script; The application executes the script, records the process of the application processing the script, and stores the data. The steps of obtaining the script and the application include: Establish a script database, wherein the script database includes multiple scripts, and each script corresponds to the security handling task; Based on the security handling task, at least one script from the script database is selected; Traverse the script database. If no script corresponds to the security handling task, create a first script, where the first script represents the script corresponding to the security handling task. The first script is stored in the script database.

2. The SOAR-Job implementation automated / semi-automated security handling method of claim 1, wherein, The steps for establishing the triggering mechanism for security handling tasks include: Establish the trigger time point or trigger period of the time-mode triggering mechanism, and determine the trigger node of the safety handling task based on the trigger time point or trigger period; or Establish a trigger message queue for the message queue mode triggering mechanism, and determine the trigger node for the security handling task based on the message order of the trigger message queue; or Establish a trigger request protocol for the aforementioned request mode triggering mechanism, and determine the trigger node for the security handling task based on the request access method of the trigger request protocol; or Establish the trigger information content of the passive mode triggering mechanism, and determine the trigger node of the safety handling task based on the information changes of the trigger information content.

3. The SOAR-Job implementation automated / semi-automated security handling method of claim 2, wherein, The step of triggering the security handling task and obtaining the first data when the triggering mechanism is met includes: Establish an interface for the first data; The security handling task is triggered, and the first data is transmitted through the interface of the first data.

4. The SOAR-Job implementation automated / semi-automated security handling method of claim 1, wherein, The step of cleaning the first data to obtain the second data includes: Establish cleaning rules for the first data, wherein the cleaning rules include removing duplicate data from the first data and processing invalid and missing data in the first data; Based on the cleaning rules, the first data is cleaned to obtain the second data.

5. The SOAR-Job implementation automated / semi-automated security handling method of claim 4, wherein, The step of importing the second data into the script includes: Set the parameters of the script according to the preset security handling tasks; Import the second data into the script after setting the parameters.

6. The SOAR-Job implementation automated / semi-automated security handling method of claim 1, wherein, The steps of the application executing the script, recording the application's processing of the script, and storing the data include: Create a timeline; Based on the time sequence of the timeline, the processing of the script, as well as the operation process and changes of the script in the application, are recorded; Store the recorded content in the specified location.

7. A SOAR-Job implementation automated / semi-automated security handling system, characterized by, The SOAR-Job automated / semi-automated safety handling method applied to any one of claims 1-6, the system comprising: A setup unit is used to establish a triggering mechanism for a security handling task. The triggering mechanism is used to trigger the security handling task. The triggering mechanism includes a time-mode triggering mechanism, a message queue mode triggering mechanism, a request mode triggering mechanism, or a passive mode triggering mechanism. A triggering unit is used to trigger the security handling task when the triggering mechanism is satisfied, and obtain first data, wherein the first data includes the data of the security handling task; A cleaning unit is used to clean the first data to obtain second data, wherein the second data includes data obtained by filtering the first data based on preset rules; An acquisition unit is used to acquire a script and the application, wherein the script represents a process for resolving a security handling task, and the application is used to execute the script; An import unit is used to import the second data into the script; An execution unit is used for the application to execute the script, record the process of the application processing the script, and store the data. The acquisition unit is further configured to: Establish a script database, wherein the script database includes multiple scripts, and each script corresponds to the security handling task; Based on the security handling task, at least one script from the script database is selected; Traverse the script database. If no script corresponds to the security handling task, create a first script, where the first script represents the script corresponding to the security handling task. The first script is stored in the script database.

8. An electronic device, comprising: include: processor; Memory used to store the processor's executable instructions; The processor is configured to read the executable instructions from the memory and execute the instructions to implement the SOAR-Job automated / semi-automated safety handling method as described in any one of claims 1-6.

9. A computer-readable storage medium having stored thereon computer program instructions, wherein, When the program instructions are executed by the processor, they implement the steps of the SOAR-Job automated / semi-automated safety handling method according to any one of claims 1-6.

Images