Cloud Response - AWS

This playbook provides response actions to AWS. The following are available for execution automatically/manually: - Resource remediation: - Terminate the instance - Stop the instance - Identity remediation: - Delete the user - Revoke the user's credentials - Access key remediation: - Disable the access key - Delete the access key - Block indicators.

Pack

AWS-Enrichment-Remediation

Tasks

36

Inputs

• accessKeyRemediationType — Choose the remediation type for the user's access key. Disable - for disabling the user's access key. Delete - for the user's access key deletion.
• userRemediationType — Choose the remediation type for the user involved. Delete - for the user deletion. Revoke - for revoking the user's credentials.
• resourceRemediationType — Choose the remediation type for the instances created. Stop - for stopping the instances. Terminate - for terminating the instances.
• autoResourceRemediation — Whether to execute the resource remediation flow automatically.
• autoUserRemediation — Whether to execute the user remediation flow automatically.
• autoAccessKeyRemediation — Whether to execute the access key remediation flow automatically.
• autoBlockIndicators — Whether to block the indicators automatically.
• resourceName — The resource name to take action on.
• region — The resource's region.
• username — The username to take action on.
• accessKeyId — The user's access key ID.
• sourceIP — The source IP address of the attacker.

Commands used

• aws-ec2-stop-instances
• aws-ec2-terminate-instances
• aws-iam-delete-access-key
• aws-iam-delete-login-profile
• aws-iam-delete-user
• aws-iam-update-access-key