AWS IAM User Access Investigation Deprecated

Deprecated. Use `Cloud IAM User Access Investigation` instead. Investigate and respond to Cortex XSIAM alerts where an AWS IAM user`s access key is used suspiciously to access the cloud environment. The following alerts are supported for AWS environments. - Penetration testing tool attempt - Penetration testing tool activity - Suspicious API call from a Tor exit node This is a beta playbook, which lets you implement and test pre-release software. Although AWS is supported, we are working towards multi-cloud support. As the playbook is beta, it might contain bugs. Updates to the playbook during the beta phase might include non-backward compatible features. We encourage feedback on the quality and usability of the content to help us identify and fix issues, so we can continually improve the content.

Core · 15 tasks · 5 inputs · 0 outputs

Details

IDAWS IAM User Access Investigation
From Version6.6.0
Tasks15

README

Deprecated. Use Cloud IAM User Access Investigation instead. Investigate and respond to Cortex XSIAM alerts where an AWS IAM user`s access key is used suspiciously to access the cloud environment.
The following alerts are supported for AWS environments.

  • Penetration testing tool attempt
  • Penetration testing tool activity
  • Suspicious API call from a Tor exit node
    This is a beta playbook, which lets you implement and test pre-release software. Although AWS is supported, we are working towards multi-cloud support. As the playbook is beta, it might contain bugs. Updates to the playbook during the beta phase might include non-backward compatible features. We encourage feedback on the quality and usability of the content to help us identify and fix issues, so we can continually improve the content.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Handle False Positive Alerts
  • Enrichment for Verdict
  • AWS IAM User Access Investigation - Remediation

Integrations

  • CortexCoreIR

Scripts

This playbook does not use any scripts.

Commands

  • closeInvestigation
  • core-get-cloud-original-alerts

Playbook Inputs

Name Description Default Value Required
AutoDeleteProfile Whether to automatically delete the user login profile if it exists (True/False). False Optional
AutoBlockIP Whether to initiate block IP playbook automatically (True/False). False Optional
IndicatorTag The tag name for bad reputation IP addresses investigated in the incident.
Use this when the EDL service is configured to add indicators to block in PANW PAN-OS.
If the indicator verdict (Malicious/Bad) is used to add indicators to Cortex XSIAM EDL you don’t need to use the tag. Indicators are set as malicious, automatically in the incident.		   Optional
DAG This input determines whether Palo Alto Networks Panorama or Firewall Dynamic Address Groups are used.
Specify the Dynamic Address Group tag name for IP handling.		   Optional
ShouldCloseAutomatically Whether to close alerts automatically as a false positive (True/False).   Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

AWS IAM User Access Investigation

Inputs

  • AutoDeleteProfile — Whether to automatically delete the user login profile if it exists (True/False).
  • AutoBlockIP — Whether to initiate block IP playbook automatically (True/False).
  • IndicatorTag — The tag name for bad reputation IP addresses investigated in the incident. Use this when the EDL service is configured to add indicators to block in PANW PAN-OS. If the indicator verdict (Malicious/Bad) is used to add indicators to Cortex XSIAM EDL you don't need to use the tag. Indicators are set as malicious, automatically in the incident.
  • DAG — This input determines whether Palo Alto Networks Panorama or Firewall Dynamic Address Groups are used. Specify the Dynamic Address Group tag name for IP handling.
  • ShouldCloseAutomatically — Whether to close alerts automatically as a false positive (True/False).

Commands used

closeInvestigation core-get-cloud-original-alerts

Flowchart

False Positive True positive yes yes Start Start Remediation Remediation Done Done Manual decision making - true/false-positive alert Manual decision making - ... False Positive - Done False Positive - Done Enrichment Enrichment Verdict Verdict AWS IAM User Access Investigation - Remediation - AWS IAM User Access Investigation - Remediation AWS IAM User Access Inves... AWS IAM User Access Investiga... Close the alert and finish the investigation? Close the alert and finis... Close alert after remediation - closeInvestigation Close alert after remedia... closeInvestigation Enrichment for Verdict - Enrichment for Verdict Enrichment for Verdict Enrichment for Verdict Get cloud original alert - core-get-cloud-original-alerts Get cloud original alert core-get-cloud-original-alerts Handle False Positive Alerts - Handle False Positive Alerts Handle False Positive Alerts Handle False Positive Alerts Continue the investigation Continue the investigation Is it a suspicious or Tor IP? Is it a suspicious or Tor...

Source

playbook-AWS_IAM_User_Access_Investigation.yml playbook-AWS_IAM_User_Access_Investigation_-_Remediation.yml playbook-AWS_IAM_User_Access_Investigation_-_Remediation_README.md
Download History Raw 
Deprecated. Use `Cloud IAM User Access Investigation` instead. Respond to Cortex XDR Cloud alerts where an AWS IAM user`s access key is used suspiciously to access the cloud environment. 
The following alerts are supported for AWS environments.
- Penetration testing tool attempt
- Penetration testing tool activity
- Suspicious API call from a Tor exit node
 This is a beta playbook, which lets you implement and test pre-release software. Although AWS is supported, we are working towards multi-cloud support. As the playbook is beta, it might contain bugs. Updates to the playbook during the beta phase might include non-backward compatible features. We encourage your feedback on the quality and usability of the content to help us identify and fix issues, so we can continually improve the content.


## Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

### Sub-playbooks

* Block Indicators - Generic v2

### Integrations

This playbook does not use any integrations.

### Scripts

This playbook does not use any scripts.

### Commands

* aws-iam-get-user-login-profile
* aws-iam-delete-login-profile
* setIndicators
* aws-iam-update-access-key

## Playbook Inputs

---

| **Name** | **Description** | **Default Value** | **Required** |
| --- | --- | --- | --- |
| userName | The name of the user whose key you want to update. |  | Optional |
| accessKeyId | The access key ID of the secret access key you want to update. |  | Optional |
| AutoDeleteProfile | Whether to automatically delete the user login profile, if it exists \(True/False\). |  | Optional |
| IP | The IP address to block using the playbook. |  | Optional |
| AutoBlockIP | Whether to initiate the block IP playbook automatically \(True/False\). | False | Optional |
| IndicatorTag | The Tag name for bad reputation IP addresses investigated in the incident.<br/>Use it when the EDL service is configured to add indicators to block in PANW PAN-OS.<br/>If indicator verdict \(Malicious/Bad\) is used to add indicators to Cortex XSIAM EDL, you don't need to use the tag. Indicators are set as malicious, automatically in the incident. |  | Optional |
| DAG | Determines whether Palo Alto Networks Panorama or Firewall Dynamic Address Groups are used.<br/>Specify the Dynamic Address Group tag name for IP handling. |  | Optional |

## Playbook Outputs

---
There are no outputs for this playbook.

## Playbook Image

---

![AWS IAM User Access Investigation - Remediation](../doc_files/AWS_IAM_User_Access_Investigation_-_Remediation.png)