Security Center:Standardized rules and datasets

Prerequisites

You have purchased and activated Agentic SOC. For specific operations, see Purchase and activate Agentic SOC.

Create custom standardized rules

1. Log on to the Security Center console. In the upper-left corner of the console, select the region where your assets to be protected are located: China or Outside China.

2. In the navigation pane on the left, choose Agentic SOC > Integration Center. On the Standardized Rule tab, click Create Custom Rule in the upper-left corner.

3. You can refer to the following information to complete the basic configuration.

   Parameter	Description
   Rule Name	User-defined
   Service Provider	Predefined vendors: Alibaba Cloud, Fortinet, Chaitin Tech, Microsoft, Sangfor, Tencent Cloud, Huawei Cloud, Hillstone Networks, Knownsec, Microsoft Cloud, and others. User-defined manufacturers: For how to create manufacturers, see Step 1: Add a product.
   Product	Automatically pulls all products under the manufacturer, such as Alibaba Cloud Security Center, Fortinet Firewall, etc. For products supported by Agentic SOC, see Integration Center.
   Standardization Category or Structure	Standardization Classification: Network Log, Host Log, Security Log, Audit Log, Snapshot Log, Logon Log, Other Log. Standardization Structure: A standardization classification contains multiple standardization structures. A standardization structure corresponds to a set of standardized fields and a dataset (StoreView). A dataset can be mapped to multiple standardization structures. Note For how to view the dataset and standardized fields corresponding to the standardization classification/structure, see Dataset description.
   Remarks	You can add feature descriptions to the current standardized rule to facilitate quick search and improve readability.

4. Set SPL syntax and perform log standardization testing.

   1. Select data source: Select the data source that the custom rule needs to analyze.

   2. Fill in SPL syntax.

      You can use predefined rules and existing custom rules as templates. You can view the SPL syntax corresponding to these rules on the details page.

      

      You can also refer to the SPL syntax documentation to write your own custom syntax.

   3. Perform standardization testing.

      Warning

      If the current data source has no data, the SPL syntax will not be able to parse logs and return results, which will prevent you from selecting test data and completing the standardization test.

      Click the button, select a test data, and click Parse and Test.

      

5. After the test is passed, click Complete in the lower-left corner.

Modify standardized rules

1. Log on to the Security Center console. In the upper-left corner of the console, select the region where your assets to be protected are located: China or Outside China.

2. In the navigation pane on the left, choose Agentic SOC > Integration Center.

3. Find the rule you want to modify and click the Edit button in the Actions column.

4. Modify the relevant content on the edit page. The configuration items that can be modified are as follows:

   • Basic settings: rule name, remarks.

   • SPL syntax: After modifying the SPL syntax, you still need to perform log standardization testing. For specific operations, see Set SPL syntax and perform log standardization testing.

Delete standardized rules

1. Log on to the Security Center console. In the upper-left corner of the console, select the region where your assets to be protected are located: China or Outside China.

2. In the navigation pane on the left, choose Agentic SOC > Integration Center.

3. Find the rule you want to delete and click the Delete button in the Actions column.

Description of the relationship between standardized rules and datasets

Standardized rules need to configure Standardization Category or Structure. Each standardization classification contains multiple standardization structures, and each structure corresponds to a storage dataset (StoreView) and a set of standardized fields. A dataset (StoreView) is also mapped to multiple standardization structures. The relationship can be referred to in the following figure:

Impact on product integration

During product integration, Agentic SOC parses product logs according to SPL syntax based on the data standard fields in the dataset, then matches threat detection rules, and finally identifies security risks. In addition, datasets will have the following configuration restrictions on access policies:

If a dataset (StoreView) has already been bound to 5 access policies in scan query mode, the standardization method for new policies can only be "Real-time Consumption" and does not support "Scan Query". For an explanation of standardization methods, see Product logs.

View datasets

Common datasets are as follows:

If you want to view more dataset information, you can refer to the following steps.

1. Log on to the Security Center console. In the upper-left corner of the console, select the region where your assets to be protected are located: China or Outside China.

2. In the navigation pane on the left, choose Agentic SOC > Integration Center. On the Standardized Rule tab, click View Standard Fields in the upper-left corner.

   

3. In the standardized field list, the Log Activity Category list items on the left are the standardization classifications supported by Agentic SOC, and the list root nodes are the standardization structures. On the right, you can view the Dataset (StoreView) name and the list of standardized fields.