Security Center:Automated response rules

How it works

The core of the automated response feature is the "match conditions, execute actions" logic. When the system receives a new alert or event, it processes it through the following workflow:

1. Data input: Security Center receives and analyzes security alerts from various cloud products (such as WAF and AEGIS), and aggregates related alerts into security events based on correlation.

2. Rule matching: The response engine matches each enabled rule against the configured Trigger and Filter Condition.

3. Action execution: Once a match is successful, the system executes one or more response actions based on the Order and Silence Rule policy defined in the rule, such as running playbooks and modifying event statuses.

4. Result logging: The execution results of all automated actions are recorded in the Disposal Center for auditing and tracing.

Key concepts

• Entity: The operation object of a response action. It is key information extracted from an alert or event, such as IP addresses, file MD5 hashes, and process names.

• Playbook: A predefined, automated operation workflow. Automated response rules complete complex entity handling operations by running playbooks.

• Automated response rule types:

  • Predefined: The system provides built-in response policies that can be enabled directly. You can view the related configuration on the details page, but cannot edit or delete them.

  • Custom: Response Orchestration provides flexible response rule configuration. You can customize response rules based on your business needs.

Create an automated response rule

After you create an automated response rule, Agentic SOC matches new security events based on the rule policy you configure. After a successful match, Agentic SOC executes the preset rule actions to help you respond to and mitigate security threats more quickly.

1. Access the Security Center console - Agentic SOC - Management - Response Rules. In the upper-left corner of the page, select the region of your assets: Chinese Mainland or Outside Chinese Mainland.

2. On the Automated Rules tab, click Create Rule.

   Note

   You can also select an existing predefined or custom rule and click Actions > Copy to quickly create a rule.

3. Configure Basic Information

   • Rule Name: Set a clear and easy-to-understand name for the rule. We recommend the format Scenario_Object_Action, for example, MiningProgram_Process_AutoTerminate.

   • Trigger: Select an appropriate method based on the trigger condition.

     Trigger method	When it fires	Action restrictions
     Alert Occurrence	Fires immediately when a single alert is generated.	Only Run Playbook and Add Alert to Whitelist are supported.
     Event Occurrence	Fires for the first time when multiple alerts are aggregated into a security event.	All event-level actions and playbook runs are supported.
     Event Update	Fires when a new alert is associated with an existing event (the occurrence time is updated).	All event-level actions and playbook runs are supported.

4. Configure trigger and execution rules

   Filter Condition

   Set the specific field values for the trigger rule. Different execution methods require different feature fields. In the configuration area, click Add Condition or Add Group to add multiple conditions and condition groups.

   • Condition logic:

     • Within a group: Multiple conditions can be configured in a single condition group, with the relationship set to AND or OR.

     • Between groups: Multiple condition groups can be configured, with the relationship between groups also set to AND or OR.

     • Example:

       • Assume there are 3 groups with the relationship "group1 AND group2 OR group3".

       • group1 uses AND logic internally, group2 uses OR logic internally, and group3 uses AND logic internally.

   • Parameters:

     • Feature fields: The available feature fields vary depending on the Trigger. Subject to the console.

     • Condition fields: The supported conditions are described in the following table.

       Condition	Description
       =	Equals.
       <>	Does not equal.
       contains	String contains.
       not contains	String does not contain.
       in	Is in the condition values. Separate multiple values with commas, such as condi1,condi2.
       not in	Is not in the condition values. Separate multiple values with commas, such as condi1,condi2.
       is null	Is an empty string. "", null, and NULL are all treated as empty strings.
       is not null	Is not an empty string.
       regexp	Matches a regular expression.
       not regexp	Does not match a regular expression.
       not in ip dataset	Is not in the IP dataset. Note The dataset can be selected only after it is configured in Agentic SOC > Agentic SOC > Integration Settings > Observation List.
       in ip dataset	Is in the IP dataset.
       not in dataset	Is not in the dataset.
       in dataset	Is in the dataset.

   Rule Action

   When a security alert or event matches an automated response rule, the system executes all configured rule actions in sequence for the specified entity. In the Rule Action area, click Add to add multiple rule actions.

   Important

   If you add multiple rule actions, Agentic SOC executes all rule actions in sequence when the rule policy is matched.

   • Action restrictions

     • When the execution method is Alert Occurrence, only Run Playbook and Add Alert to Whitelist are supported.

     • When the execution method is Incident Occurrence/Incident Update, the following actions are supported: Run Playbook, Change Incident Status, Change Risk Level, Use Recommend Playbook, Modify Owner, Add incident tag, and Delete incident tag.

   • Action details

     • Run Playbook: When the rule policy is matched, the selected playbook is automatically executed.

       • Playbook compatibility:

         • Predefined Playbook and published Custom Playbook are supported.

         • Only when the Start node of a playbook is configured with specific output parameter types can the playbook be associated with an automated response rule. Supported entity types include: IP entity, file entity, process entity, container entity, domain name entity, host entity, and security alert.

       • Playbook Parameters:

         Parameter	Description
         Entity (such as malicious IP or malicious process)	Defaults to Automatically Obtain and cannot be modified. Agentic SOC automatically retrieves the entity information to be processed based on the log information of the incoming alert or event.
         Destination Account	The Alibaba Cloud account that executes the playbook. Two account types are supported: System automatic acquisition: Automatically populated based on the entity object information. The entity object contains attribute descriptions for the Alibaba Cloud account connected to the current Agentic SOC. Custom: The current Alibaba Cloud UID (root account) or a member account managed by multi-account security management.
         Action validity period	The validity period for IP playbook actions. If the playbook blocks an IP address and the validity period is set to 7 days, the IP address is blocked for 7 days and automatically unblocked upon expiration. If the playbook adds an IP address to a whitelist and the validity period is set to 7 days, the IP address is whitelisted for 7 days and automatically released upon expiration. If the playbook monitors an IP address in observation mode and the validity period is set to 7 days, the IP address is monitored with alerts for 7 days and monitoring is removed upon expiration.

     • Add Alert to Whitelist:

       • For a CWPP alert, the alert status is automatically updated to Automatically Add to Whitelist. For an Agentic SOC alert, the Add to Whitelist field is updated to Yes, and alert notifications are no longer sent.

       • Alerts that match this whitelist rule are no longer associated with events.

     • Use Recommend Playbook: The system recommends a corresponding predefined playbook based on the alert and entity information.

       Note

       You can view all built-in playbooks on the Predefined Playbook tab. For example, for an IP entity extracted from a WAF alert, the system recommends the WAF IP blocking playbook.

     • Change Incident Status: When the rule policy is matched, the event status is automatically adjusted.

     • Change Risk Level: When the rule policy is matched, the threat level of the event is automatically adjusted.

     • Modify Owner: Automatically assigns an owner to the generated event to ensure timely response to security events.

       Note

       You can find the automatic owner assignment record under the Activity Log on the Response Activity tab of the event details page.

     • Add incident tag/Delete incident tag: Automatically adds or removes specified tags for events for easier categorization, filtering, and management.

   Rule execution frequency and order

   • Silence Rule: For the same entity running the same playbook, a maximum of one execution is allowed within a 1-minute window.

   • Order: When multiple rule policies are matched, the system executes all rule actions in sequence based on the specified Order.

5. A rule is in the disabled state after creation. On the rule list page, click the icon in the Enabling Status column to enable the automated response rule.

View processing records

After an automated response rule is enabled, the system automatically executes rule actions when an event or alert matches the rule policy. You can view processing records through the following methods.

• Incident Response: Go to Agentic SOC > Incident Response to view processing details.

• Playbook details: If a playbook is run for processing, an execution record is generated. You can view historical execution records on the playbook details page.

• Playbook Execution Records: Go to Agentic SOC > Response Rules and click the Playbook Execution Records tab to view all playbook executions.

Apply in production

• Test and verify: To avoid misoperations, before using high-risk actions (such as blocking IP addresses or deleting files) in the production environment, verify the trigger logic of the rules.

• Avoid rule conflicts: Plan the execution order of rules to avoid conflicting operations on the same event by multiple rules. For example, one rule escalates an event to High while another de-escalates it to Low. The system executes actions sequentially, and the last action overwrites the result of the previous one.

• Performance considerations: In Filter Condition, use complex regular expressions (regexp) with caution. Inefficient expressions may affect rule matching performance.

FAQ

• Why was the rule I created not triggered?

  Troubleshoot the issue by performing the following steps:

  1. Rule status: Check whether the rule is enabled on the rule list page.

  2. Filter conditions: Check whether the filter conditions are too restrictive. Try relaxing the conditions or using a harmless action (such as adding tags) for testing.

  3. Field matching: Confirm that the actual field values in the alert or event exactly match the values set in the filter conditions. Pay attention to spaces, case sensitivity, and other details.

  4. Silence Rule: Check whether the Silence Rule mechanism is suppressing repeated actions within a short period.

• How do I troubleshoot a failed playbook execution?

  1. View execution records: Go to the Disposal Center or the Historical Execution Records page of the playbook to view the detailed logs and error information of the failed task.

  2. Check account permissions: Check whether the Destination Account (or its RAM role) specified in the playbook has sufficient permissions to perform the related operations, such as creating VPC security group rules or isolating files.

  3. Check parameter configuration: Confirm whether the entity information of the triggering rule is complete and can be passed as valid parameters to the playbook.