AWS Enrichment and Remediation

Details
Content
Dependencies
Version History

Playbooks using multiple AWS content packs for enrichment and remediation purposes

What does this pack do?

The pack contains AWS playbooks that conduct enrichment and/or remediation and can use multiple other AWS content packs:

Enrichment: Given an IP address, see if there is an associated EC2 instance and if so pull information on the associated security group. If an SSM agent is installed on the instance, pull information from the SSM agent.
Remediation: Given the information collected from enrichment, replace the security group with a "quarantine" security group until vulnerabilities are resolved.
Unclaimed S3 Bucket Validation: The playbook sends a HTTP get response to the domain and validates the missing bucket information.
Unclaimed S3 Bucket Remediation: The playbook will create the unclaimed S3 bucket.

There are multiple AWS content packs for multiple AWS products (EC2, IAM, Route53, S3, SSM, etc.). The intent was that users can install and use only the packs they need. However, if an AWS playbook uses multiple pack integrations (such as EC2, S3, SSM, and IAM), the integrations can't reside in one of the current packs because they include content from multiple pack integrations. This pack was created as a place to put AWS playbooks that use AWS integrations from multiple packs with a focus on enrichment and remediation.

Playbooks

Users are only able to run the playbook in v6.5.0 or higher as it requires commands to execute the task.
This content pack includes the following playbooks:

AWS - Enrichment
AWS - Security Group Remediation
AWS - Security Group Remediation v2
Cloud Response - AWS
AWS - Unclaimed S3 Bucket Validation
AWS - Unclaimed S3 Bucket Remediation

AWS - Enrichment

AWS - Enrichment playbook reports EC2 information given an IP address of an EC2 instance.

AWS - Enrichment

AWS - Security Group Remediation

AWS - Security Group Remediation playbook replaces current security groups associated to NIC with Remediation security group.

AWS - Security Group Remediation

AWS - Security Group Remediation v2

The AWS - Security Group Remediation v2 playbook more selectively determines which security groups are over-permissive, copies them and removes only the over-permissive portions.

AWS - Security Group Remediation v2

AWS - Unclaimed S3 Bucket Validation

AWS - Unclaimed S3 Bucket Validation playbook validates the unclaimed S3 bucket details.

AWS - Unclaimed S3 Bucket Validation

AWS - Unclaimed S3 Bucket Remediation

AWS - Unclaimed S3 Bucket Remediation playbook creates the unclaimed S3 bucket so other vectors can't claim the bucket.

AWS - Unclaimed S3 Bucket Remediation

Automation Scripts

AWSRecreateSG

Automation to determine which interface on an EC2 instance has an over-permissive security group, determine which security groups have over-permissive rules, and replace them with a copy of the security group that has only the over-permissive portion removed. Over-permissive is defined as sensitive ports (SSH, RDP, etc) being exposed to the internet via IPv4.

AWSRecreateSG

AWSAccountHierarchy

Automation to determine AWS account hierarchy by looking up parent objects until the organization level is reached.

AWSAccountHierarchy

What does this pack do?

The pack contains AWS playbooks that conduct enrichment and/or remediation and can use multiple other AWS content packs:

Enrichment: Given an IP address, see if there is an associated EC2 instance and if so pull information on the associated security group. If an SSM agent is installed on the instance, pull information from the SSM agent.
Remediation: Given the information collected from enrichment, replace the security group with a "quarantine" security group until vulnerabilities are resolved.
Unclaimed S3 Bucket Validation: The playbook sends a HTTP get response to the domain and validates the missing bucket information.
Unclaimed S3 Bucket Remediation: The playbook will create the unclaimed S3 bucket.

Playbooks

Users are only able to run the playbook in v6.5.0 or higher as it requires commands to execute the task.
This content pack includes the following playbooks:

AWS - Enrichment
AWS - Security Group Remediation
AWS - Security Group Remediation v2
Cloud Response - AWS
AWS - Unclaimed S3 Bucket Validation
AWS - Unclaimed S3 Bucket Remediation

AWS - Enrichment

AWS - Enrichment playbook reports EC2 information given an IP address of an EC2 instance.

AWS - Enrichment

AWS - Security Group Remediation

AWS - Security Group Remediation playbook replaces current security groups associated to NIC with Remediation security group.

AWS - Security Group Remediation

AWS - Security Group Remediation v2

The AWS - Security Group Remediation v2 playbook more selectively determines which security groups are over-permissive, copies them and removes only the over-permissive portions.

AWS - Security Group Remediation v2

AWS - Unclaimed S3 Bucket Validation

AWS - Unclaimed S3 Bucket Validation playbook validates the unclaimed S3 bucket details.

AWS - Unclaimed S3 Bucket Validation

AWS - Unclaimed S3 Bucket Remediation

AWS - Unclaimed S3 Bucket Remediation playbook creates the unclaimed S3 bucket so other vectors can't claim the bucket.

AWS - Unclaimed S3 Bucket Remediation

Automation Scripts

AWSRecreateSG

AWSAccountHierarchy

Automation to determine AWS account hierarchy by looking up parent objects until the organization level is reached.

AWSAccountHierarchy

Automations

Name	Description
AWSRecreateSG	Automation to determine which interface on an EC2 instance has an over-permissive security group, determine which security groups have over-permissive rules, and replace them with a copy of the security group that has only the over-permissive portion removed. Over-permissive is defined as sensitive ports (SSH, RDP, etc) being exposed to the internet via IPv4.
AWSAccountHierarchy	Determine AWS account hierarchy by looking up parent objects until the organization level is reached.

Playbooks

Name	Description
AWS - Security Group Remediation	Replace current security groups with limited access security groups.
AWS - Unclaimed S3 Bucket Validation	The playbook sends a HTTP get response to the hostname and validates if there is missing bucket information.
Function Removal - AWS	This playbook automates the removal of an AWS Lambda function and its associated resources used for managing resources within an Amazon EKS cluster. It ensures all related roles, policies, and security configurations are properly detached and deleted. Resource Detachment and Deletion Get the Lambda Role: Retrieve the IAM role associated with the Lambda function. Detach Policy from Lambda Role: Remove the policy attached to the Lambda role. Delete IAM Role: Delete the IAM role that was used for the Lambda function. Delete Lambda Policy: Remove the policy specifically created for the Lambda function. Delete Security Group: Delete the security group that was managing the Lambda function's traffic. Access Entry Check Check if Access Entry was Created: Verify if the access entry for the EKS cluster was created. If YES: Proceed to delete additional resources. If NO: Skip the deletion of additional resources. Additional Resource Deletion Delete Kubernetes Layer: Remove the Kubernetes layer that was used by the Lambda function. Delete Lambda Function: Delete the Lambda function itself, ensuring all related code and configurations are removed. Resolution Final Cleanup: Ensure all specified resources have been deleted successfully. Completion: Confirm that the removal process is complete, providing a clean environment free from the previously deployed Lambda function and its configurations. This playbook provides a comprehensive, automated approach to removing an AWS Lambda function and its related resources, ensuring all configurations and dependencies are properly managed and deleted. Required Integration AWS IAM (Identity and Access Management) AWS IAM API Documentation Cortex XSOAR AWS IAM Integration AWS EC2 (Elastic Compute Cloud) AWS EC2 API Documentation Cortex XSOAR AWS EC2 Integration AWS Lambda AWS Lambda API Documentation Cortex XSOAR AWS Lambda Integration.
AWS - Security Group Remediation v2	This playbook takes in some information about an EC2 instance (ID and public_ip) and with provided port and protocol, determines what security groups on the primary interface of an EC2 instance are over-permissive. It uses an automation to determine what interface on an EC2 instance has an over-permissive security group on, determine which security groups have over-permissive rules and to replace them with a copy of the security group that has only the over-permissive portion removed. Over-permissive is defined as sensitive ports (SSH, RDP, etc) being exposed to the internet via IPv4.
AWS - Enrichment	Given the IP address this playbook enriches EC2 and IAM information.
Cloud Credentials Rotation - AWS	AWS Credentials Rotation Playbook Identity Remediation Secure compromised accounts by taking swift action: Reset Password: Resets the user password to halt any unauthorized access. Access Key Deactivation: Deactivate any suspicious or known-compromised access keys. Combo Action: In some cases, you may want to reset both the password and deactivate the access key for absolute security. Role Remediation If a role is suspected to be compromised: Deny Policy Implementation: Attach a deny-all policy to the compromised role, thus preventing it from performing any further actions. Role Cloning: Before outright remediation, clone the role. This ensures that you have a backup with the same permissions, making transition smoother.
AWS - User Investigation	This playbook performs an investigation on a specific user in AWS environments, using queries and logs from AWS CloudTrail to locate the following activities performed by the user: Failed login attempt Suspicious activities API access denied Administrative user activities Security rules and policies changes Access keys and access token activities Script-based user agent usage User role changes activities MFA device changes activities
Function Deployment - AWS	This playbook automates the deployment of an AWS Lambda function to manage resources within an Amazon EKS cluster. It ensures that all necessary configurations are created, updated, and verified. Setup Describe EKS Cluster: Gather essential details of the EKS cluster. Create IAM Role: Set up a new IAM role for the Lambda function. Create and Attach Policy: Define and attach a policy to the IAM role to grant necessary permissions. Authentication Mode Check Verify Authentication Mode: Ensure the current authentication mode allows API access. If not: Update the cluster authentication mode to permit API access. Access Entry Configuration Create Access Entry: Establish a new access entry in the EKS cluster. Associate Access Policy: Link the access policy with the created access entry. Update Access Entry: Apply the latest configurations to the access entry. VPC and Security Group Setup Describe VPCs: Identify the appropriate VPC for the Lambda function. Create Security Group: Define a security group to manage Lambda function traffic. Set Ingress Rules: Configure ingress rules for the security group. VPC Endpoint Creation Create VPC Endpoint for eks-auth: Establish a VPC endpoint for EKS authentication. Check for Errors: Verify if there are any errors during the creation of the VPC endpoint. If errors: Handle and log them. Verify VPC Endpoint Existence: Ensure the VPC endpoint already exists. If exists: Proceed with the next steps. Lambda Function Deployment Download Kubernetes Library: Fetch the necessary Kubernetes library. Publish AWS Lambda Layer: Publish a new layer version for the AWS Lambda function. Create Lambda Code: Develop the Lambda function code. Zip Lambda Code: Compress the Lambda function code for deployment. Create AWS Lambda Function: Deploy the Lambda function using the zipped code. Resolution Final Verification: Ensure all operations have been successfully completed. Completion: Confirm the deployment process is finished, ensuring robust management of EKS authentication through AWS Lambda. This playbook provides a comprehensive, automated approach to deploying an AWS Lambda function for managing resources within an EKS cluster, efficiently handling all configurations and potential errors. Required Integration AWS IAM (Identity and Access Management) AWS IAM API Documentation Cortex XSOAR AWS IAM Integration AWS EC2 (Elastic Compute Cloud) AWS EC2 API Documentation Cortex XSOAR AWS EC2 Integration AWS EKS (Elastic Kubernetes Service) AWS EKS API Documentation Cortex XSOAR AWS EKS Integration AWS Lambda AWS Lambda API Documentation Cortex XSOAR AWS Lambda Integration.
AWS - Unclaimed S3 Bucket Remediation	The playbook will create the unclaimed S3 bucket.
Cloud Response - AWS	This playbook provides response actions to AWS. The following are available for execution automatically/manually: Resource remediation: Terminate the instance Stop the instance Identity remediation: Delete the user Revoke the user's credentials Access key remediation: Disable the access key Delete the access key Block indicators.

Automations

Name	Description
AWSRecreateSG	Automation to determine which interface on an EC2 instance has an over-permissive security group, determine which security groups have over-permissive rules, and replace them with a copy of the security group that has only the over-permissive portion removed. Over-permissive is defined as sensitive ports (SSH, RDP, etc) being exposed to the internet via IPv4.
AWSAccountHierarchy	Determine AWS account hierarchy by looking up parent objects until the organization level is reached.

Playbooks

Name	Description
AWS - Security Group Remediation v2	This playbook takes in some information about an EC2 instance (ID and public_ip) and with provided port and protocol, determines what security groups on the primary interface of an EC2 instance are over-permissive. It uses an automation to determine what interface on an EC2 instance has an over-permissive security group on, determine which security groups have over-permissive rules and to replace them with a copy of the security group that has only the over-permissive portion removed. Over-permissive is defined as sensitive ports (SSH, RDP, etc) being exposed to the internet via IPv4.
AWS - Enrichment	Given the IP address this playbook enriches EC2 and IAM information.
Function Removal - AWS	This playbook automates the removal of an AWS Lambda function and its associated resources used for managing resources within an Amazon EKS cluster. It ensures all related roles, policies, and security configurations are properly detached and deleted. Resource Detachment and Deletion Get the Lambda Role: Retrieve the IAM role associated with the Lambda function. Detach Policy from Lambda Role: Remove the policy attached to the Lambda role. Delete IAM Role: Delete the IAM role that was used for the Lambda function. Delete Lambda Policy: Remove the policy specifically created for the Lambda function. Delete Security Group: Delete the security group that was managing the Lambda function's traffic. Access Entry Check Check if Access Entry was Created: Verify if the access entry for the EKS cluster was created. If YES: Proceed to delete additional resources. If NO: Skip the deletion of additional resources. Additional Resource Deletion Delete Kubernetes Layer: Remove the Kubernetes layer that was used by the Lambda function. Delete Lambda Function: Delete the Lambda function itself, ensuring all related code and configurations are removed. Resolution Final Cleanup: Ensure all specified resources have been deleted successfully. Completion: Confirm that the removal process is complete, providing a clean environment free from the previously deployed Lambda function and its configurations. This playbook provides a comprehensive, automated approach to removing an AWS Lambda function and its related resources, ensuring all configurations and dependencies are properly managed and deleted. Required Integration AWS IAM (Identity and Access Management) AWS IAM API Documentation Cortex XSIAM AWS IAM Integration AWS EC2 (Elastic Compute Cloud) AWS EC2 API Documentation Cortex XSIAM AWS EC2 Integration AWS Lambda AWS Lambda API Documentation Cortex XSIAM AWS Lambda Integration.
Cloud Credentials Rotation - AWS	AWS Credentials Rotation Playbook Identity Remediation Secure compromised accounts by taking swift action: Reset Password: Resets the user password to halt any unauthorized access. Access Key Deactivation: Deactivate any suspicious or known-compromised access keys. Combo Action: In some cases, you may want to reset both the password and deactivate the access key for absolute security. Role Remediation If a role is suspected to be compromised: Deny Policy Implementation: Attach a deny-all policy to the compromised role, thus preventing it from performing any further actions. Role Cloning: Before outright remediation, clone the role. This ensures that you have a backup with the same permissions, making transition smoother.
Cloud Response - AWS	This playbook provides response actions to AWS. The following are available for execution automatically/manually: Resource remediation: Terminate the instance Stop the instance Identity remediation: Delete the user Revoke the user's credentials Access key remediation: Disable the access key Delete the access key Block indicators.
AWS - Unclaimed S3 Bucket Validation	The playbook sends a HTTP get response to the hostname and validates if there is missing bucket information.
AWS - Security Group Remediation	Replace current security groups with limited access security groups.
AWS - User Investigation	This playbook performs an investigation on a specific user in AWS environments, using queries and logs from AWS CloudTrail to locate the following activities performed by the user: Failed login attempt Suspicious activities API access denied Administrative user activities Security rules and policies changes Access keys and access token activities Script-based user agent usage User role changes activities MFA device changes activities
Function Deployment - AWS	This playbook automates the deployment of an AWS Lambda function to manage resources within an Amazon EKS cluster. It ensures that all necessary configurations are created, updated, and verified. Setup Describe EKS Cluster: Gather essential details of the EKS cluster. Create IAM Role: Set up a new IAM role for the Lambda function. Create and Attach Policy: Define and attach a policy to the IAM role to grant necessary permissions. Authentication Mode Check Verify Authentication Mode: Ensure the current authentication mode allows API access. If not: Update the cluster authentication mode to permit API access. Access Entry Configuration Create Access Entry: Establish a new access entry in the EKS cluster. Associate Access Policy: Link the access policy with the created access entry. Update Access Entry: Apply the latest configurations to the access entry. VPC and Security Group Setup Describe VPCs: Identify the appropriate VPC for the Lambda function. Create Security Group: Define a security group to manage Lambda function traffic. Set Ingress Rules: Configure ingress rules for the security group. VPC Endpoint Creation Create VPC Endpoint for eks-auth: Establish a VPC endpoint for EKS authentication. Check for Errors: Verify if there are any errors during the creation of the VPC endpoint. If errors: Handle and log them. Verify VPC Endpoint Existence: Ensure the VPC endpoint already exists. If exists: Proceed with the next steps. Lambda Function Deployment Download Kubernetes Library: Fetch the necessary Kubernetes library. Publish AWS Lambda Layer: Publish a new layer version for the AWS Lambda function. Create Lambda Code: Develop the Lambda function code. Zip Lambda Code: Compress the Lambda function code for deployment. Create AWS Lambda Function: Deploy the Lambda function using the zipped code. Resolution Final Verification: Ensure all operations have been successfully completed. Completion: Confirm the deployment process is finished, ensuring robust management of EKS authentication through AWS Lambda. This playbook provides a comprehensive, automated approach to deploying an AWS Lambda function for managing resources within an EKS cluster, efficiently handling all configurations and potential errors. Required Integration AWS IAM (Identity and Access Management) AWS IAM API Documentation Cortex XSIAM AWS IAM Integration AWS EC2 (Elastic Compute Cloud) AWS EC2 API Documentation Cortex XSIAM AWS EC2 Integration AWS EKS (Elastic Kubernetes Service) AWS EKS API Documentation Cortex XSIAM AWS EKS Integration AWS Lambda AWS Lambda API Documentation Cortex XSIAM AWS Lambda Integration.
AWS - Unclaimed S3 Bucket Remediation	The playbook will create the unclaimed S3 bucket.

Required Content Packs (10)

Pack Name	Pack By
AWS - EC2	By: Cortex XSOAR
AWS - EKS	By: Cortex XSOAR
AWS - IAM	By: Cortex XSOAR
AWS - Lambda	By: Cortex XSOAR
AWS Organizations	By: Cortex XSOAR
AWS - S3	By: Cortex XSOAR
AWS Systems Manager	By: Cortex XSOAR
Base	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR

Optional Content Packs (2)

Pack Name	Pack By
AWS - CloudTrail	By: Cortex XSOAR
Common Playbooks	By: Cortex XSOAR

All level dependencies (12)

Pack Name	Pack By
Base	By: Cortex XSOAR
AWS Systems Manager	By: Cortex XSOAR
Rasterize	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
AWS - EKS	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR
Cortex REST API	By: Cortex XSOAR
AWS Organizations	By: Cortex XSOAR
AWS - Lambda	By: Cortex XSOAR
AWS - S3	By: Cortex XSOAR
AWS - IAM	By: Cortex XSOAR
AWS - EC2	By: Cortex XSOAR

1.1.20 - 1262174 (August 11, 2024)

Scripts

AWSRecreateSG

Fixed an issue where All UDP and All TCP Security Group rules were being treated as if they were All Traffic rules.

Related pull requests:
- 35793
- 35823

Download

1.1.19 - 1151954 (July 6, 2024)

Playbooks

New: Function Deployment - AWS

New: This playbook automates the deployment of an AWS Lambda function to manage resources within an Amazon EKS cluster. It ensures that all necessary configurations are created, updated, and verified.

New: Function Removal - AWS

New: This playbook automates the removal of an AWS Lambda function and its associated resources used for managing resources within an Amazon EKS cluster. It ensures all related roles, policies, and security configurations are properly detached and deleted.

Related pull requests:
- 35269

Download

1.1.18 - 1136970 (July 1, 2024)

Playbooks

AWS - Enrichment

Updated the playbook to enrich EC2 and IAM information using AWS SSM.

Related pull requests:
- 35108
- 34673

Download

1.1.17 - R1104278 (June 19, 2024)

Playbooks

Cloud Response - AWS

Fixed Data Collection titles.
Fixed tasks that use the alertJson context path.

Related pull requests:
- 33122

Download

1.1.16 - 854016 (February 26, 2024)

Scripts

AWSRecreateSG

Fixed an issue where the script failed with the latest version of the AWS - EC2 integration.

NOTE: The AWS - EC2 integration version must be greater than 1.4.0 for this script to run.

Updated the Docker image to: demisto/python3:3.10.13.87159.

Related pull requests:
- 32962

Download

1.1.15 - 798475 (February 1, 2024)

Playbooks

Cloud Credentials Rotation - AWS

Fixes a bug in the playbook flow where a wrong field was used for the identity type selection
Removes an unused playbook input from a conditional task

Related pull requests:
- 32000

Download

1.1.14 - 757686 (January 11, 2024)

Playbooks

AWS - Enrichment

Updated the playbook to include the new AWSAccountHierarchy script for pulling AWS Hierarchy information, note that this script is only available from Xsoar version >= 6.10.0.

Scripts

AWSRecreateSG

Updated the script to fix an issue with security group rule case.
Updated the Docker image to: demisto/python3:3.10.13.84405.

New: AWSAccountHierarchy

Added the AWSAccountHierarchy script to determine AWS account hierarchy by looking up parent objects until the organization level is reached.

Related pull requests:
- 32123
- 31951

Download

1.1.12 - 753737 (January 10, 2024)

Playbooks

AWS - Enrichment

Added the AWSAssumeRoleName input to specify the role to assume for organization level user accounts.
Added support for searching for the EC2 instance public IP in an organization scope using the following commands:
- aws-ec2-describe-ipam-resource-discoveries
- aws-ec2-get-ipam-discovered-public-addresses

Related pull requests:
- 31958
- 31849

Download

1.1.11 - 746830 (January 7, 2024)

Scripts

AWSRecreateSG

Improved implementation to be backwards compatible with the AWS - EC2 changes.

Related pull requests:
- 31993

Download

1.1.10 - 728763 (December 31, 2023)

Playbooks

Cloud Response - AWS

Changed the To values in the data collection tasks to incident.assigneduser.

Related pull requests:
- 31679

Download

1.1.9 - 7132024 (December 11, 2023)

Scripts

AWSRecreateSG

Updated the script to fix an issue with security group rule case and added a change flag.
Updated the Docker image to: demisto/python3:3.10.13.83255.

Related pull requests:
- 31401
- 31237

Download

1.1.8 - 6955725 (November 21, 2023)

Playbooks

AWS - User Investigation

Updated the outputs description.

Related pull requests:
- 30965

Download

1.1.7 - 6758807 (October 31, 2023)

Playbooks

AWS - Security Group Remediation v2

Updated the playbook to output remediatedFlag and setting remediatedFlag to either true or false.

Scripts

AWSRecreateSG

Updated the script to fix an issue with security group creation case and add an output flag.
Updated the Docker image to: demisto/python3:3.10.13.78960.

Related pull requests:
- 30573
- 30541

Download

1.1.6 - 6641023 (October 18, 2023)

Playbooks

New: Cloud Credentials Rotation - AWS

New: This playbook provides a credentials rotation capabilities both for IAM and roles. (Available from Cortex XSOAR 6.9.0).

Related pull requests:
- 30112

Download

1.1.5 - 6499115 (October 3, 2023)

Playbooks

AWS - Security Group Remediation v2

Updated the playbook to include the Region input in the AWSRecreateSG script.

Scripts

AWSRecreateSG

Added the Region input to specify the region to run AWS commands.
Updated the Docker image to: demisto/python3:3.10.13.75921.

Related pull requests:
- 29840
- 30002

Download

1.1.4 - 6285754 (September 10, 2023)

Playbooks

AWS - Security Group Remediation v2

Added the AWSAssumeArn optional input in case a roleArn needs to be passed in.

Scripts

AWSRecreateSG

Updated the Docker image to: demisto/python3:3.10.13.73190.
Added the assume_role optional input in case a roleArn needs to be passed in.
Updated the script to work even when there are multiple AWS-EC2 integration instances configured.

Related pull requests:
- 29311
- 29577

Download

1.1.3 - 6058978 (August 15, 2023)

Playbooks

New: AWS - User Investigation

New: This playbook performs an investigation on a specific user in AWS environments, using queries and logs from AWS CloudTrail.
(Available from Cortex XSOAR 6.9.0).

Related pull requests:
- 28843

Download

1.1.2 - R5692327 (July 5, 2023)

Playbooks

AWS - Enrichment

Updated the playbook to remove IAM related tasks as the IAM list users is only providing all the users present in account.

Related pull requests:
- 26086
- 26229

Download

1.1.1 - R4970096 (April 4, 2023)

Playbooks

New: AWS - Security Group Remediation v2

Added the AWS - Security Group Remediation v2 playbook to more selectively determine which security groups are over-permissive, copy them and remove only the over-permissive portions.

Scripts

New: AWSRecreateSG

Added the AWSRecreateSG script to determine what interface on an EC2 instance has an over-permissive security group on, determine which security groups have over-permissive rules and to replace them with a copy of the security group that has only the over-permissive portion removed. Over-permissive is defined as sensitive ports (SSH, RDP, etc) being exposed to the internet via IPv4.

Related pull requests:
- 25339
- 25434

Download

1.1.0 - R4718798 (March 1, 2023)

Playbooks

New: AWS - Unclaimed S3 Bucket Remediation

The playbook will create the unclaimed S3 bucket. (Available from Cortex XSOAR 6.5.0).

New: AWS - Unclaimed S3 Bucket Validation

The playbook sends a HTTP get response to the domain and validates the missing bucket information. (Available from Cortex XSOAR 6.5.0).

Related pull requests:
- 23969
- 24414

Download

1.0.2 - 4183367 (December 9, 2022)

Playbooks

Cloud Response - AWS

Fixed the playbook description.

Related pull requests:
- 22859

Download

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Cortex
Created	October 30, 2022
Last Release	August 11, 2024

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise. For more information, see the Marketplace documentation.

AWS Enrichment and Remediation

What does this pack do?

Playbooks

AWS - Enrichment

AWS - Security Group Remediation

AWS - Security Group Remediation v2

AWS - Unclaimed S3 Bucket Validation

AWS - Unclaimed S3 Bucket Remediation

Automation Scripts

AWSRecreateSG

AWSAccountHierarchy

What does this pack do?

Playbooks

AWS - Enrichment

AWS - Security Group Remediation

AWS - Security Group Remediation v2

AWS - Unclaimed S3 Bucket Validation

AWS - Unclaimed S3 Bucket Remediation

Automation Scripts

AWSRecreateSG

AWSAccountHierarchy

Resource Detachment and Deletion

Access Entry Check

Additional Resource Deletion

Resolution

Required Integration

AWS IAM (Identity and Access Management)

AWS EC2 (Elastic Compute Cloud)

AWS Lambda

AWS Credentials Rotation Playbook

Identity Remediation

Role Remediation

Setup

Authentication Mode Check

Access Entry Configuration

VPC and Security Group Setup

VPC Endpoint Creation

Lambda Function Deployment

Resolution

Required Integration

AWS IAM (Identity and Access Management)

AWS EC2 (Elastic Compute Cloud)

AWS EKS (Elastic Kubernetes Service)

AWS Lambda

Resource Detachment and Deletion

Access Entry Check

Additional Resource Deletion

Resolution

Required Integration

AWS IAM (Identity and Access Management)

AWS EC2 (Elastic Compute Cloud)

AWS Lambda

AWS Credentials Rotation Playbook

Identity Remediation

Role Remediation

Setup

Authentication Mode Check

Access Entry Configuration

VPC and Security Group Setup

VPC Endpoint Creation

Lambda Function Deployment

Resolution

Required Integration

AWS IAM (Identity and Access Management)

AWS EC2 (Elastic Compute Cloud)

AWS EKS (Elastic Kubernetes Service)

AWS Lambda

Scripts

AWSRecreateSG

Playbooks

New: Function Deployment - AWS

New: Function Removal - AWS

Playbooks

AWS - Enrichment

Playbooks

Cloud Response - AWS

Scripts

AWSRecreateSG

Playbooks

Cloud Credentials Rotation - AWS