Cloud Credentials Rotation - Azure

## **Azure Credentials Rotation Playbook** ### **IAM Remediation** Protect your identity and access management: - **Reset Password**: Resets the user password to halt any unauthorized access. - **Revoke Session**: Terminates current active sessions to ensure the malicious actor is locked out. - **Combo Action**: Resets the password and terminates all active sessions. ### **Service Principal Remediation** Guard your applications: - **Password Regeneration**: Generate a new password for the service principal, making sure the old one becomes obsolete.

Pack

Azure-Enrichment-Remediation

Tasks

14

Inputs

• IAMRemediationType — The response playbook provides the following remediation actions using MSGraph Users: Reset: By entering "Reset" in the input, the playbook will execute password reset. Revoke: By entering "Revoke" in the input, the playbook will revoke the user's session. ALL: By entering "ALL" in the input, the playbook will execute the reset password and revoke session tasks.
• appID — This is the unique application (client) ID of the application.
• objectID — This is the unique ID of the service principal object associated with the application.
• userID — The user ID or user principal name.
• identityType — The type of identity involved. Usually mapped to incident field named 'cloudidentitytype'. e.g. IAM,APPLICATION

Outputs

• MSGraphUser — The Microsoft Graph Users information.
• MSGraphApplication — The Microsoft Graph Application information.

Commands used

• msgraph-apps-service-principal-get
• msgraph-apps-service-principal-lock-configuration
• msgraph-apps-service-principal-password-add
• msgraph-apps-service-principal-unlock-configuration
• msgraph-user-session-revoke
• msgraph-user-update