Cortex XDR - AWS IAM user access investigation
Deprecated. Use `Cortex XDR - Cloud IAM User Access Investigation` instead. Investigate and respond to Cortex XDR Cloud alerts where an AWS IAM user`s access key is used suspiciously to access the cloud environment. The following alerts are supported for AWS environments. - Penetration testing tool attempt - Penetration testing tool activity - Suspicious API call from a Tor exit node This is a beta playbook, which lets you implement and test pre-release software. At the moment we support AWS but are working towards multi-cloud support. Since the playbook is beta, it might contain bugs. Updates to the playbook during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the content to help us identify issues, fix them, and continually improve.
- Pack
- CortexXDR
- Tasks
- 35
Inputs
- IndicatorTag — Tag name for bad reputation IP addresses investigated in the incident. Use it when the EDL service is configured to add indicators to block in PANW PAN-OS. If indicator verdict (Malicious/Bad) is used to add indicators to XSOAR EDL you don't need to use the tag. Indicators will be set as malicious automatically in the incident.
- DAG — This input determines whether Palo Alto Networks Panorama or Firewall Dynamic Address Groups are used. Specify the Dynamic Address Group tag name for IP handling.
- AutoBlockIP — True/False to initiate block IP playbook automatically
- AutoDeleteProfile — True/False to automatically delete the user login profile if it exists.
Commands used
- aws-iam-delete-login-profile
- aws-iam-get-user-login-profile
- aws-iam-update-access-key
- ip
- setIncident
- setIndicators
- xdr-get-cloud-original-alerts
- xdr-get-incident-extra-data
- xdr-xql-generic-query