关键词: 安全编排, 自动化响应, 原子化, 安全设备管理, 安全资产管理, 安全编排自动化与响应

Abstract: The means, scale and frequency of network attacks continue to evolve, and the network threats faced by countries and enterprises are becoming increasingly severe. In this context, SOAR (security orchestration automation and response) technology provided a solution for enterprises to balance “security, cost and efficiency” by solidifying automation scenarios. For the dynamic and agile requirements of security device capability access and call, network asset information entry and association in the SOAR practice, the atomization device and asset management strategy based on the concept of standard security orchestration actions and security attribute asset sets was proposed. Through the atomization and instantiation of device capabilities and asset attributes, as well as the integration of standard security orchestration actions and security attribute asset sets based on the knowledge atlas, the agile integration of security equipment and network asset capabilities, efficient resource allocation, and information associated storage to deal with the dynamic changes of network threats and protection requirements can be implemented. At the same time, several SOAR automation scenarios based on this strategy were studied and discussed.

Key words: security orchestration, automated response, atomization, security device management, security asset management, SOAR