Cloud Enrichment - Generic

## Generic Cloud Enrichment Playbook The **Cloud Enrichment - Generic Playbook** is designed to unify all the relevant playbooks concerning the enrichment of information in the cloud. It provides a standardized approach to enriching information in cloud environments. ### Supported Blocks 1. **Cloud IAM Enrichment - Generic** - Enriches information related to Identity and Access Management (IAM) in the cloud. 2. **Cloud Compute Enrichment - Generic** - Enriches information related to cloud compute resources. The playbook supports a single CSP enrichment at a time.

Pack

CommonPlaybooks

Tasks

4

Inputs

• cloudProvider — The cloud provider involved. The supported CSPs are AWS, Azure and GCP.
• instanceName — The instance name.
• instanceID — The instance ID.
• zone — The zone holding the instance.
• region — The region holding the instance.
• azureResourceGroup — The instance's resource group.
• username — The username involved.
• GCPProjectName — The GCP project name.
• cloudIdentityType — The type of the GCP identity. Can be either Service Account or a user.

Outputs

• AWS.EC2.Instances — The instances.
• AWS.EC2.Instances.NetworkInterfaces — The network interfaces for the instance.
• GoogleCloudCompute.Instances — The instances.
• GoogleCloudCompute.Instances.networkInterfaces — An array of network configurations for this instance. These specify how interfaces are configured to interact with other network services, such as connecting to the internet. Multiple interfaces are supported per instance.
• GoogleCloudCompute.Instances.disks — Array of disks associated with this instance. Persistent disks must be created before you can assign them.
• GoogleCloudCompute.Instances.metadata — The metadata key/value pairs assigned to this instance. This includes custom metadata and predefined keys.
• GoogleCloudCompute.Instances.scheduling — Sets the scheduling options for this instance.
• Azure.Compute — The VMs.
• AWS.IAM.Users — AWS AM Users include: UserId Arn CreateDate Path PasswordLastUsed
• AWS.IAM.UserPolicies — AWS IAM - user inline policies.
• AWS.IAM.AttachedUserPolicies — AWS IAM - User attached policies.
• AWS.IAM.Users.AccessKeys — AWS IAM Users Access Keys include: AccessKeyId Status CreateDate UserName
• AWS.IAM.Users.Groups — AWS IAM - User groups.
• GCPIAM — GCP IAM information.
• GSuite — GSuite user information.
• MSGraphUser — MSGraph user information.
• MSGraphGroups — MSGraph groups information.
• MSGraphGroup — MSGraph group information.
• GSuite.PageToken — Token to specify the next page in the list.
• MSGraph.identityProtection — MSGraph identity protection - risky user history.
• AWS.IAM.Users.AccessKeys.CreateDate — The date when the access key was created.
• AWS.IAM.Users.AccessKeys.UserName — The name of the IAM user that the key is associated with.