GCP Enrichment and Remediation

Determine potential offending firewall rules in GCP based on port, protocol and possibly target tags (network tags).

Considerations:

• At this time this automation only find potential offending rules and not necessarily the rule that is matching traffic.

Determine GCP project hierarchy by looking up parent objects until the organization level is reached.

GCP Credentials Rotation Playbook

IAM Remediation

For compromised service accounts:

• Access Key Disabling: Immediately disable the compromised service account access key.

• New Key Generation: After ensuring the old key is disabled, generate a new access key.

GSuite Admin Remediation

Admin accounts are crucial:

• Reset Password: Resets the user password to halt any unauthorized access.

• Revoke Access Token: Revoke any suspicious or unauthorized access tokens.

• Combo Action: Reset the password and revoke access tokens to ensure complete safety.

This playbook performs an investigation on a specific user in GCP environments, using queries and logs from G Suite Auditor, and GCP Logging to locate the following activities performed by the user:

• Failed login attempt
• Suspicious API usage by the user
• Anomalous network traffic by the user
• Unusual and suspicious login attempt
• User's password leaked

Given the IP address this playbook enriches GCP and Firewall information.

This playbook provides response actions to GCP. The following are available for execution automatically/manually:

• Resource remediation:
  • Delete the instance
  • Stop the instance
• Identity remediation:
  • Disable the user
  • Delete the user
• Access key remediation:
  • Disable the access key
  • Delete the access key
• Block indicators.

This playbook adds new firewall rules with access only from private ip address range and blocks traffic that's exposed to public internet. For example, if RDP is exposed to the entire world, this playbook adds new firewall rules that only allows traffic from private ip address and blocks rest of the RDP traffic.

Determine GCP project hierarchy by looking up parent objects until the organization level is reached.

Determine potential offending firewall rules in GCP based on port, protocol and possibly target tags (network tags).

Considerations:

• At this time this automation only find potential offending rules and not necessarily the rule that is matching traffic.

GCP Credentials Rotation Playbook

IAM Remediation

For compromised service accounts:

• Access Key Disabling: Immediately disable the compromised service account access key.

• New Key Generation: After ensuring the old key is disabled, generate a new access key.

GSuite Admin Remediation

Admin accounts are crucial:

• Reset Password: Resets the user password to halt any unauthorized access.

• Revoke Access Token: Revoke any suspicious or unauthorized access tokens.

• Combo Action: Reset the password and revoke access tokens to ensure complete safety.

Given the IP address this playbook enriches GCP and Firewall information.

This playbook adds new firewall rules with access only from private ip address range and blocks traffic that's exposed to public internet. For example, if RDP is exposed to the entire world, this playbook adds new firewall rules that only allows traffic from private ip address and blocks rest of the RDP traffic.

This playbook provides response actions to GCP. The following are available for execution automatically/manually:

• Resource remediation:
  • Delete the instance
  • Stop the instance
• Identity remediation:
  • Disable the user
  • Delete the user
• Access key remediation:
  • Disable the access key
  • Delete the access key
• Block indicators.

This playbook performs an investigation on a specific user in GCP environments, using queries and logs from G Suite Auditor, and GCP Logging to locate the following activities performed by the user:

• Failed login attempt
• Suspicious API usage by the user
• Anomalous network traffic by the user
• Unusual and suspicious login attempt
• User's password leaked