Cloud Response - Azure

This playbook provides response actions to Azure. The following are available for execution automatically/manually: - Resource remediation - Delete the instance - Power off the instance - Identity remediation: - Disable the user - Delete the user - Block indicators.

Pack

Azure-Enrichment-Remediation

Tasks

28

Inputs

• resourceRemediationType — Choose the remediation type for the instances created. Poweroff - for shutting down the instances. Delete - for deleting the instances.
• userRemediationType — Choose the remediation type for the user involved. Disable - for disabling the user. Delete - for deleting the user.
• autoResourceRemediation — Whether to execute the resource remediation flow automatically.
• autoUserRemediation — Whether to execute the user remediation flow automatically.
• autoBlockIndicators — Whether to block the indicators automatically.
• resourceName — The resource name to take action on.
• resourceGroup — The resource group.
• username — The username to take action on.
• sourceIP — The source IP address of the attacker.

Commands used

• azure-vm-delete-instance
• azure-vm-poweroff-instance
• msgraph-user-account-disable
• msgraph-user-delete
• msgraph-user-session-revoke