This script retrieves additional original alert information from the context.

Display the Cloud indicators found in a dynamic-section

This script will extract indicators from a given AWS CloudTrail or GCP Logging event.

This script returns an HTML result of the cloud providers in the incident. The result will be displayed in the following font colors: AWS - red, GCP - green, Azure - blue.

Data Exfiltration Response

The Data Exfiltration Response playbook is designed to address data exfiltration activity alerts in the cloud environment. This playbook is intended for handling "An identity performed a suspicious download of multiple cloud storage object" alert.
The playbook supports AWS, GCP, and Azure and executes the following:

• Enrichment involved assets.
• Determines the appropriate verdict based on the data collected from the enrichment phase.
• Cloud Persistence Threat Hunting:
  • Conducts threat hunting activities to identify any cloud persistence techniques
• Verdict Handling:
  • Handles false positives identified during the investigation
  • Handles true positives by initiating appropriate response actions

This playbook is responsible for collecting data from Cortex XDR detector and enriching data for further usage and building the layout.

The playbook collects or enriches the following data:

• Resource enrichment
  • Previous activity seen in the specified region or project
• Account enrichment
• Network enrichment
  • Attacker IP
  • Geolocation
  • ASN

Cloud Token Theft - Set Verdict Playbook

The playbook is built from a decision tree whose ultimate goal is to decide whether the observed activity is malicious.

Event Search

The playbook searches for events based on the attacker's IP address within the last two hours.

Tests Performed

The following tests are performed on the observed activity:

1. Malicious IP Check: Determines if the IP address is malicious.
2. CSP ASN Check: Checks if the activity was performed from an Autonomous System Number (ASN) belonging to one of the Cloud Service Providers (CSPs).
3. IP and ASN History Check: Verifies if the IP address and ASN have been previously observed.
4. Region Check: Determines if the API call was made from outside the recognized region.
5. Anomalous State Check: Checks if the API call was made from an anomalous state.
6. Alert Check: Looks for any related alerts around the event, including:
   • Possible cloud instance metadata service (IMDS) abuse.
   • Impossible Traveler by cloud identity.

This playbook sets the alert's verdict as malicious if one of the following conditions is true:

1. If the source IP address is malicious
2. If the incident includes both "Unusual allocation of multiple cloud compute resources" AND "Cloud identity reached a throttling API rate" (medium/high severity)
3. If the incident includes both "Unusual allocation of multiple cloud compute resources" AND "Suspicious heavy allocation of compute resources - possible mining activity"
4. If the incident includes "Unusual allocation of multiple cloud compute resources" with medium/high severity, the source ASN isn't known, and the source IP isn't known as well.
5. If the incident includes both "Unusual allocation of multiple cloud compute resources" AND "A cloud compute instance was created in a dormant region"

If none of the conditions is true, the playbook will wait for an analyst's decision.

This playbook ensures a swift and effective response to malicious activities within Kubernetes environments, leveraging cloud-native tools to maintain cluster security and integrity.

The playbook is designed to handle agent-generated alerts due to malicious activities within Kubernetes (K8S) pods, such as mining activities, which require immediate action. The playbook also addresses scenarios where the malicious pod is killed, but the malicious K8S workload repeatedly creates new pods.

Key Features:

AWS Function Integration: This utilizes an AWS Lambda function that can manage resources and facilitate rapid response actions within an Amazon EKS cluster without the need for third-party tools such as Kubectl.

The Lambda function can initiate the following response actions:

- Pod Termination: The playbook includes steps to safely terminate the affected pod within the K8S environment.
- Workload Suspension: If necessary, the playbook can be escalated to suspend the entire workload associated with the mining activity.

Once the Lambda function execution is completed, the playbook deletes all of the created objects to ensure undesirable usage.

Workflow:

1. Alert Detection: The playbook begins with the monitoring agent detecting a mining alert within a Kubernetes pod.
2. Alert Validation: Validates the alert to ensure it is not a false positive.
3. Response Decision:
   • Pod Termination: If the mining activity is isolated to a single pod, the AWS Lambda function is invoked to terminate the affected pod within the K8S environment.
   • Workload Suspension: If the mining activity is widespread or poses a significant threat, the AWS Lambda function suspends the entire workload within the K8S environment.
4. Cleanup: This action initiates the complete removal of all objects created for the Lambda execution for security and hardening purposes.

Required Integration

AWS IAM (Identity and Access Management)

• AWS IAM API Documentation
• Cortex XSOAR AWS IAM Integration

AWS EC2 (Elastic Compute Cloud)

• AWS EC2 API Documentation
• Cortex XSOAR AWS EC2 Integration

AWS EKS (Elastic Kubernetes Service)

• AWS EKS API Documentation
• Cortex XSOAR AWS EKS Integration

AWS Lambda

• AWS Lambda API Documentation
• Cortex XSOAR AWS Lambda Integration.

Cloud Token Theft Response Playbook

The Cloud Token Theft Response Playbook provides a structured and comprehensive flow to effectively respond to and mitigate alerts involving the theft of cloud tokens. The playbook supports AWS, GCP, and Azure and executes the following:

Cloud Enrichment:

• Enriches the involved resources.
• Enriches the involved identities.
• Enriches the involved IPs.

Verdict Decision Tree:

• Determines the appropriate verdict based on the investigation findings.

Early Containment using the Cloud Response - Generic Playbook:

• Implements early containment measures to prevent further impact.

Cloud Persistence Threat Hunting:

• Conducts threat hunting activities to identify any cloud persistence techniques.

Enriching and Responding to Hunting Findings:

• Performs additional enrichment and responds to the findings from threat hunting.

Verdict Handling:

• Handles false positives identified during the investigation.
• Handles true positives by initiating appropriate response actions.

Investigates a Cortex XDR incident containing a Cloud Cryptojacking related alert.
The playbook supports AWS, Azure, and GCP and executes the following:

• Cloud enrichment:
  • Collects info about the involved resources
  • Collects info about the involved identities
  • Collects info about the involved IPs
• Verdict decision tree
• Verdict handling:
  • Handle False Positives
  • Handle True Positives
    • Cloud Response - Generic sub-playbook.
• Notifies the SOC if a malicious verdict was found

Cloud Threat Hunting - Persistence Playbook

The playbook is responsible for hunting persistence activity in the cloud. It supports AWS, GCP, and Azure - one at a time.

Hunting Queries

The playbook executes hunting queries for each provider related to each of the following:

1. IAM
2. Compute Resources
3. Compute Functions

Indicator Extraction

If relevant events are found during the search, indicators will be extracted using the ExtractIndicators-CloudLogging script.

Investigate and respond to Cortex XDR Cloud alerts where a Cloud IAM user`s access key is used suspiciously to access the cloud environment.
The following alerts are supported for AWS, Azure, and GCP environments.

• Penetration testing tool attempt
• Penetration testing tool activity
• Suspicious API call from a Tor exit node

Entry widget that returns the resource type involved in the alert.

This script returns an HTML result of the cloud providers in the incident. The result will be displayed in the following font colors: AWS - red, GCP - green, Azure - blue.

Display the Cloud indicators found in a dynamic-section

Entry widget that returns the region involved in the alert.

This script will extract indicators from a given AWS CloudTrail or GCP Logging event.

This script retrieves additional original alert information from the context.

This script retrieves the identity fields from the incident context.

This script retrieves additional original alert information from the context.

Default display for Cloud Alerts generated by XDR Analytics.

Investigates a Cortex XDR alert containing Cloud Cryptojacking related alert.
The playbook supports AWS, Azure, and GCP and executes the following:

• Cloud enrichment:

  -Collects info about the involved resources

  -Collects info about the involved identities

  -Collects info about the involved IPs

• Verdict decision tree

• Verdict handling:

  -Handle False Positives

  -Handle True Positives

  -Cloud Response - Generic sub-playbook.

• Notifies the SOC if a malicious verdict was found

Cloud Token Theft Response Playbook

The Cloud Token Theft Response Playbook provides a structured and comprehensive flow to effectively respond to and mitigate alerts involving the theft of cloud tokens. The playbook supports AWS, GCP, and Azure and executes the following:

Cloud Enrichment:

• Enriches the involved resources
• Enriches the involved identities
• Enriches the involved IPs

Verdict Decision Tree:

• Determines the appropriate verdict based on the investigation findings

Early Containment using the Cloud Response - Generic Playbook:

• Implements early containment measures to prevent further impact

Cloud Persistence Threat Hunting:

• Conducts threat hunting activities to identify any cloud persistence techniques

Enriching and Responding to Hunting Findings:

• Performs additional enrichment and responds to the findings from threat hunting

Verdict Handling:

• Handles false positives identified during the investigation
• Handles true positives by initiating appropriate response actions

This playbook sets the alert's verdict as malicious if one of the following conditions is true:

1. If the source IP address is malicious
2. If the alert includes both "Unusual allocation of multiple cloud compute resources" AND "Cloud identity reached a throttling API rate" (medium/high severity)
3. If the alert includes both "Unusual allocation of multiple cloud compute resources" AND "Suspicious heavy allocation of compute resources - possible mining activity"
4. If the alert includes "Unusual allocation of multiple cloud compute resources" with medium/high severity, the source ASN isn't known, and the source IP isn't known as well.
5. If the alert includes both "Unusual allocation of multiple cloud compute resources" AND "A cloud compute instance was created in a dormant region"

If none of the conditions is true, the playbook will wait for an analyst's decision.

This playbook is responsible for data collection and enrichment.

The playbook collects or enriches the following data:

• Account enrichment

• Network enrichment

  -Attacker IP

  -Geolocation

  -ASN

Cloud Token Theft - Set Verdict Playbook

The playbook is built from a decision tree whose ultimate goal is to decide whether the observed activity is malicious.

Event Search

The playbook searches for events based on the attacker's IP address within the last two hours.

Tests Performed

The following tests are performed on the observed activity:

1. Malicious IP Check: Determines if the IP address is malicious.
2. CSP ASN Check: Checks if the activity was performed from an Autonomous System Number (ASN) belonging to one of the Cloud Service Providers (CSPs).
3. IP and ASN History Check: Verifies if the IP address and ASN have been previously observed.
4. Region Check: Determines if the API call was made from outside the recognized region.
5. Anomalous State Check: Checks if the API call was made from an anomalous state.
6. Alert Check: Looks for any related alerts around the event, including:
   • Possible cloud instance metadata service (IMDS) abuse.
   • Impossible Traveler by cloud identity.

Cloud Threat Hunting - Persistence Playbook

The playbook is responsible for hunting persistence activity in the cloud. It supports AWS, GCP, and Azure - one at a time.

Hunting Queries

The playbook executes hunting queries for each provider related to each of the following:

1. IAM
2. Compute Resources
3. Compute Functions

Indicator Extraction

If relevant events are found during the search, indicators will be extracted using the ExtractIndicators-CloudLogging script.

Cloud Data Exfiltration Response

The Cloud Data Exfiltration Response playbook is designed to address data exfiltration activity alerts in the cloud environment. This playbook is intended for handling "An identity performed a suspicious download of multiple cloud storage object" alert.
The playbook supports AWS, GCP, and Azure and executes the following:

• Enrichment involved assets.
• Determines the appropriate verdict based on the data collected from the enrichment.
• Cloud Persistence Threat Hunting:
  • Conducts threat hunting activities to identify any cloud persistence techniques
• Verdict Handling:
  • Handles false positives identified during the investigation
  • Handles true positives by initiating appropriate response actions

Investigate and respond to Cortex XSIAM alerts where a Cloud IAM user access key is used suspiciously to access the cloud environment.
The following alerts are supported for AWS, Azure, and GCP environments.
Penetration testing tool attempt
Penetration testing tool activity
Suspicious API call from a Tor exit node

This trigger is responsible for handling Cloud Token Theft alerts

This trigger is responsible for handling Cloud IAM user access investigation alerts

This trigger is responsible for handling cloud data exfiltration alerts

This trigger is responsible for handling Cryptojacking alerts