Cloud-IDS v1.0.2

Google Cloud IDS, a next-generation advanced intrusion detection service that provides threat detection for intrusions, malware, spyware and command-and-control attacks.

Author:
Cortex XSOAR
Support:
community
URL:
https://www.paloaltonetworks.com/cortex
agentixxsiam
Data Enrichment & Threat Intelligence

Incident types (1)

README

CloudIDS

Google Cloud IDS is a next-generation advanced intrusion detection service that provides threat detection for intrusions, malware, spyware, and command-and-control attacks.

What does this pack do?

Playbook

  • Cloud_IDS-IP_Blacklist-GCP_Firewall_Extract: Gets the attacker’s IP address from Cloud IDS through Google Pub/Sub.
    Cloud_IDS-IP_Blacklist-GCP_Firewall_Append will update the ip list so GCP automatically blocks the IP address.

Flow Chart of Playbook