Prisma Cloud - Classifier

{
    "id": "RedLock",
    "name": "Prisma Cloud - Classifier",
    "type": "classification",
    "description": "Classifies incoming Prisma Cloud alerts that are created through the 'fetch incidents' command in the Prisma Cloud integration.",
    "defaultIncidentType": "Prisma Cloud",
    "keyTypeMap": {
        "AWS EC2 instance not configured with Instance Metadata Service v2 (IMDSv2)": "Prisma Cloud - VM Alert Prioritization",
        "AWS EC2 instance that is internet reachable with unrestricted access (0.0.0.0/0)": "Prisma Cloud - VM Alert Prioritization",
        "AWS EC2 instance with unrestricted outbound access to internet": "Prisma Cloud - VM Alert Prioritization",
        "Azure VM data disk is encrypted with the default encryption key instead of ADE/CMK": "Prisma Cloud - VM Alert Prioritization",
        "Azure Virtual Machine in running state that is internet reachable with unrestricted access (0.0.0.0/0)": "Prisma Cloud - VM Alert Prioritization",
        "Instance affected by Apache Log4j JDBC Appender remote code execution vulnerability is exposed to network traffic from the internet [CVE-2021-44832]": "Prisma Cloud - VM Alert Prioritization",
        "Instance affected by Apache Log4j Thread Context Map remote code execution vulnerability is exposed to network traffic from the internet [CVE-2021-45046]": "Prisma Cloud - VM Alert Prioritization",
        "Instance affected by Apache Log4j denial of service vulnerability is exposed to network traffic from the internet [CVE-2021-45105]": "Prisma Cloud - VM Alert Prioritization",
        "Instance affected by Apache Log4j vulnerability is exposed to network traffic from the internet [CVE-2021-44228]": "Prisma Cloud - VM Alert Prioritization",
        "Instance affected by Argo CD vulnerability is exposed to network traffic from the internet [CVE-2022-24348]": "Prisma Cloud - VM Alert Prioritization",
        "Instance affected by Dirty Pipe vulnerability is exposed to network traffic from the internet [CVE-2022-0847]": "Prisma Cloud - VM Alert Prioritization",
        "Instance affected by Java Psychic Signatures vulnerability is exposed to network traffic from the internet [CVE-2022-21449]": "Prisma Cloud - VM Alert Prioritization",
        "Instance affected by Linux kernel container escape vulnerability is exposed to network traffic from the internet [CVE-2022-0185]": "Prisma Cloud - VM Alert Prioritization",
        "Instance affected by OMIGOD vulnerability is exposed to network traffic from the internet [CVE-2021-38647]": "Prisma Cloud - VM Alert Prioritization",
        "Instance affected by OpenSSL X.509 email address 4-Byte BOF (Spooky SSL) vulnerability is exposed to network traffic from the internet [CVE-2022-3602]": "Prisma Cloud - VM Alert Prioritization",
        "Instance affected by SMB DCE/RPC remote code execution vulnerability is exposed to network traffic from the internet [CVE-2022-26809]": "Prisma Cloud - VM Alert Prioritization",
        "Instance affected by Samba vfs_fruit module remote code execution vulnerability is exposed to network traffic from the internet [CVE-2021-44142]": "Prisma Cloud - VM Alert Prioritization",
        "Instance affected by Spring Cloud Function SpringShell vulnerability is exposed to network traffic from the internet [CVE-2022-22963]": "Prisma Cloud - VM Alert Prioritization",
        "Instance affected by Spring Framework SpringShell vulnerability is exposed to network traffic from the internet [CVE-2022-22965]": "Prisma Cloud - VM Alert Prioritization",
        "Instance affected by Text4shell RCE vulnerability is exposed to network traffic from the internet [CVE-2022-42889]": "Prisma Cloud - VM Alert Prioritization",
        "Instance is communicating with ports known to mine Bitcoin": "Prisma Cloud - VM Alert Prioritization",
        "Instance is communicating with ports known to mine Ethereum": "Prisma Cloud - VM Alert Prioritization",
        "Instances exposed to network traffic from the internet": "Prisma Cloud - VM Alert Prioritization",
        "Internet connectivity via TCP over insecure port": "Prisma Cloud - VM Alert Prioritization",
        "Prisma Cloud": "Prisma Cloud",
        "RedisWannaMine vulnerable instances with active network traffic": "Prisma Cloud - VM Alert Prioritization",
        "Azure AKS cluster HTTP application routing enabled": "Azure AKS Misconfiguration",
        "Azure Network Security Group allows all traffic on SQL Server (UDP Port 1434)": "Azure Network Misconfiguration",
        "AWS CloudTrail is not enabled on the account": "AWS CloudTrail Misconfiguration",
        "Azure Network Security Group allows all traffic on ICMP (Ping)": "Azure Network Misconfiguration",
        "Azure Network Security Group allows all traffic on NetBIOS DNS (TCP Port 53)": "Azure Network Misconfiguration",
        "AWS CloudTrail trail logs is not integrated with CloudWatch Log": "AWS CloudTrail Misconfiguration",
        "GCP VM Instances without any Custom metadata information": "GCP Compute Engine Misconfiguration",
        "AWS IAM password policy does not have a minimum of 14 characters": "AWS IAM Policy Misconfiguration",
        "Azure Network Security Group allows all traffic on NetBIOS (UDP Port 137)": "Azure Network Misconfiguration",
        "AWS Default Security Group does not restrict all traffic": "AWS EC2 Instance Misconfiguration",
        "AWS IAM password policy does not have an uppercase character": "AWS IAM Policy Misconfiguration",
        "AWS CloudTrail is not enabled with multi trail and not capturing all management events": "AWS CloudTrail Misconfiguration",
        "Azure Network Security Group allows all traffic on NetBIOS (UDP Port 138)": "Azure Network Misconfiguration",
        "AWS CloudTrail log validation is not enabled in all regions": "AWS CloudTrail Misconfiguration",
        "Azure Network Security Group allows all traffic on SQL Server (TCP Port 1433)": "Azure Network Misconfiguration",
        "Azure Network Security Group allows all traffic on SSH port 22": "Azure Network Misconfiguration",
        "Azure Network Security Group allows all traffic on FTP (TCP Port 21)": "Azure Network Misconfiguration",
        "Azure Network Security Group allows all traffic on Windows RPC (TCP Port 135)": "Azure Network Misconfiguration",
        "Azure Network Security Group allows all traffic on Windows SMB (TCP Port 445)": "Azure Network Misconfiguration",
        "GCP Kubernetes Engine Clusters have binary authorization disabled": "GCP Kubernetes Engine Misconfiguration",
        "GCP Kubernetes Engine Clusters have Cloud Logging disabled": "GCP Kubernetes Engine Misconfiguration",
        "Azure Network Security Group having Inbound rule overly permissive to all traffic on TCP protocol": "Azure Network Misconfiguration",
        "Azure Network Security Group allows all traffic on MSQL (TCP Port 4333)": "Azure Network Misconfiguration",
        "Azure Network Security Group allows all traffic on MySQL (TCP Port 3306)": "Azure Network Misconfiguration",
        "GCP Kubernetes Engine Clusters have Network policy disabled": "GCP Kubernetes Engine Misconfiguration",
        "Azure Network Security Group allows all traffic on NetBIOS DNS (UDP Port 53)": "Azure Network Misconfiguration",
        "GCP VM instances have block project-wide SSH keys feature disabled": "GCP Compute Engine Misconfiguration",
        "Azure storage account has a blob container with public access": "Azure Storage Misconfiguration",
        "Azure Network Security Group having Inbound rule overly permissive to all traffic on any protocol": "Azure Network Misconfiguration",
        "Azure SQL databases Defender setting is set to Off": "Azure SQL Misconfiguration",
        "Azure Network Security Group allows all traffic on VNC Listener (TCP Port 5500)": "Azure Network Misconfiguration",
        "Azure Network Security Group allows all traffic on Telnet (TCP Port 23)": "Azure Network Misconfiguration",
        "Azure SQL database auditing is disabled": "Azure SQL Misconfiguration",
        "AWS IAM password policy does not have a number": "AWS IAM Policy Misconfiguration",
        "Azure Network Security Group allows all traffic on PostgreSQL (TCP Port 5432)": "Azure Network Misconfiguration",
        "AWS IAM password policy allows password reuse": "AWS IAM Policy Misconfiguration",
        "GCP Kubernetes Engine Clusters have HTTP load balancing disabled": "GCP Kubernetes Engine Misconfiguration",
        "Azure Network Security Group allows all traffic on RDP Port 3389": "Azure Network Misconfiguration",
        "AWS IAM password policy does not have password expiration period": "AWS IAM Policy Misconfiguration",
        "Azure Network Security Group allows all traffic on SMTP (TCP Port 25)": "Azure Network Misconfiguration",
        "AWS IAM Password policy is unsecure": "AWS IAM Policy Misconfiguration",
        "AWS Security Group allows all traffic on RDP port (3389)": "AWS EC2 Instance Misconfiguration",
        "Azure Storage Account without Secure transfer enabled": "Azure Storage Misconfiguration",
        "Azure Network Security Group allows all traffic on CIFS (UDP Port 445)": "Azure Network Misconfiguration",
        "Azure AKS cluster monitoring not enabled": "Azure AKS Misconfiguration",
        "GCP Kubernetes cluster intra-node visibility disabled": "GCP Kubernetes Engine Misconfiguration",
        "GCP Kubernetes Engine Clusters have Cloud Monitoring disabled": "GCP Kubernetes Engine Misconfiguration",
        "Azure Network Security Group having Inbound rule overly permissive to all traffic on UDP protocol": "Azure Network Misconfiguration",
        "GCP Kubernetes Engine Clusters have Master authorized networks disabled": "GCP Kubernetes Engine Misconfiguration",
        "AWS IAM password policy does not have a lowercase character": "AWS IAM Policy Misconfiguration",
        "Azure Network Security Group allows all traffic on FTP-Data (TCP Port 20)": "Azure Network Misconfiguration",
        "AWS IAM password policy does not expire in 90 days": "AWS IAM Policy Misconfiguration",
        "GCP Kubernetes Engine Clusters have Legacy Authorization enabled": "GCP Kubernetes Engine Misconfiguration",
        "Azure SQL Database with Auditing Retention less than 90 days": "Azure SQL Misconfiguration",
        "AWS IAM password policy does not have a symbol": "AWS IAM Policy Misconfiguration"
    },
    "marketplaces": [
        "xsoar"
    ],
    "transformer": {
        "simple": "policy.name"
    },
    "version": -1,
    "fromVersion": "6.0.0"
}