Cloud Response - GCP
This playbook provides response actions to GCP. The following are available for execution automatically/manually: - Resource remediation: - Delete the instance - Stop the instance - Identity remediation: - Disable the user - Delete the user - Access key remediation: - Disable the access key - Delete the access key - Block indicators.
- Pack
- GCP-Enrichment-Remediation
- Tasks
- 40
Inputs
- accessKeyRemediationType — Choose the remediation type for the user's access key. Disable - For disabling the user's access key. Delete - For deleting user's access key.
- userRemediationType — Choose the remediation type for the user involved. Delete - For deleting the user. Disable - For disabling the user.
- resourceRemediationType — Choose the remediation type for the instances created. Stop - For stopping the instances. Delete - For deleting the instances.
- autoResourceRemediation — Whether to execute the resource remediation flow automatically.
- autoUserRemediation — Whether to execute the user remediation flow automatically.
- autoAccessKeyRemediation — Whether to execute the access key remediation flow automatically.
- autoBlockIndicators — Whether to block the indicators automatically.
- resourceName — The resource name to take action on.
- resourceZone — The resource's zone.
- username — The username to take action on.
- accessKeyName — The access key name in the following format: projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}
- sourceIP — The source IP address of the attacker.
- GCPprojectID — The GCP Project ID. Will be used for handling service account
- accountType — Determine the account type you are dealing with: "user" / "service_account". Default: "user"
Commands used
- gcp-compute-delete-instance
- gcp-compute-stop-instance
- gcp-iam-service-account-delete
- gcp-iam-service-account-disable
- gcp-iam-service-account-key-delete
- gcp-iam-service-account-key-disable
- gsuite-user-delete