Cloud Credentials Rotation - Generic

id: Cloud Credentials Rotation - Generic
version: -1
name: Cloud Credentials Rotation - Generic
description: |-
  ## **Cloud Credentials Rotation - Generic**

  This comprehensive playbook combines the remediation steps from AWS, Azure, and GCP sub-playbooks into a single, cohesive guide. Regardless of which Cloud Service Provider (CSP) you're working with, this playbook will direct you to the relevant steps, ensuring swift and effective response.

  The primary objective is to offer an efficient way to address compromised credentials across different cloud platforms. By consolidating the key steps from AWS, Azure, and GCP, it minimizes the time spent searching for platform-specific procedures and accelerates the remediation process, ensuring the highest level of security for your cloud environments.

  ## **Integrations for Each Sub-Playbook**

  In order to seamlessly execute the actions mentioned in each sub-playbook, specific integrations are essential. These integrations facilitate the automated tasks and processes that the playbook carries out. Here are the required integrations for each sub-playbook:

  ### **AWS Sub-Playbook:**
  1. [**AWS - IAM**](https://xsoar.pan.dev/docs/reference/integrations/aws---iam): Used to manage AWS Identity and Access Management.
  2. [**AWS - EC2**](https://xsoar.pan.dev/docs/reference/integrations/aws---ec2): Essential for managing Amazon Elastic Compute Cloud (EC2) instances.

  ### **GCP Sub-Playbook:**
  1. [**Google Workspace Admin**](https://xsoar.pan.dev/docs/reference/integrations/g-suite-admin): Manages users, groups, and other entities within Google Workspace.
  2. [**GCP-IAM**](https://xsoar.pan.dev/docs/reference/integrations/gcp-iam): Ensures management and control of GCP's Identity and Access Management.

  ### **Azure Sub-Playbook:**
  1. [**Microsoft Graph Users**](https://xsoar.pan.dev/docs/reference/integrations/microsoft-graph-user): Manages users and related entities in Microsoft Graph.
  2. [**Microsoft Graph Applications**](https://xsoar.pan.dev/docs/reference/integrations/microsoft-graph-applications): Manages applications within Microsoft Graph.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: fe9310e5-fcd5-438e-8125-061929cf834b
    type: start
    task:
      id: fe9310e5-fcd5-438e-8125-061929cf834b
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "6"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": -80
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: f0859da7-1e99-495f-848f-ec2168951e90
    type: playbook
    task:
      id: f0859da7-1e99-495f-848f-ec2168951e90
      version: -1
      name: Cloud Credentials Rotation - Azure
      description: |-
        ## **Azure Credentials Rotation Playbook**

        ### **IAM Remediation**
        Protect your identity and access management:
        - **Reset Password**: Resets the user password to halt any unauthorized access.

        - **Revoke Session**: Terminate current active sessions to ensure the malicious actor is locked out.

        - **Combo Action**: Consider both resetting the password and revoking all active sessions.

        ### **Service Principal Remediation**
        Guard your applications:
        - **Password Regeneration**: Generate a new password for the service principal, making sure the old one becomes obsolete.
      playbookName: Cloud Credentials Rotation - Azure
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      IAMRemediationType:
        complex:
          root: inputs.RemediationType
      appID:
        complex:
          root: inputs.Azure-AppID
      identityType:
        complex:
          root: inputs.identityType
      objectID:
        complex:
          root: inputs.Azure-ObjectID
      userID:
        complex:
          root: inputs.Azure-userID
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 450,
          "y": 230
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: a6d7d96a-f69a-4da1-8951-12acde4ffff3
    type: playbook
    task:
      id: a6d7d96a-f69a-4da1-8951-12acde4ffff3
      version: -1
      name: Cloud Credentials Rotation - GCP
      description: |-
        ## **GCP Credentials Rotation Playbook**

        ### **IAM Remediation**
        For compromised service accounts:
        - **Access Key Disabling**: Immediately disable the compromised service account access key.

        - **New Key Generation**: After ensuring the old key is disabled, generate a new access key.

        ### **GSuite Admin Remediation**
        Admin accounts are crucial:
        - **Reset Password**: Resets the user password to halt any unauthorized access.

        - **Revoke Access Token**: Revoke any suspicious or unauthorized access tokens.

        - **Combo Action**: Reset the password and revoke access tokens to ensure complete safety.
      playbookName: Cloud Credentials Rotation - GCP
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      GSuiteRemediationType:
        complex:
          root: inputs.RemediationType
      clientID:
        complex:
          root: inputs.GCP-clientID
      cloudProject:
        complex:
          root: inputs.GCP-cloudProject
      identityType:
        complex:
          root: inputs.identityType
      serviceAccountEmail:
        complex:
          root: inputs.GCP-SAEmail
      userID:
        complex:
          root: inputs.GCP-userID
      zone:
        complex:
          root: inputs.GCP-zone
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 880,
          "y": 230
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 930c92a6-7dd5-4caf-8d8b-780e2fcea4da
    type: title
    task:
      id: 930c92a6-7dd5-4caf-8d8b-780e2fcea4da
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 400
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: eb216a05-3e5b-40a5-82ab-3d7379354afc
    type: playbook
    task:
      id: eb216a05-3e5b-40a5-82ab-3d7379354afc
      version: -1
      name: Cloud Credentials Rotation - AWS
      description: |-
        ## **AWS Credentials Rotation Playbook**

        ### **Identity Remediation**
        Secure compromised accounts by taking swift action:
        - **Reset Password**: Resets the user password to halt any unauthorized access.

        - **Access Key Deactivation**: Deactivate any suspicious or known-compromised access keys.

        - **Combo Action**: In some cases, you may want to reset both the password and deactivate the access key for absolute security.

        ### **Role Remediation**
        If a role is suspected to be compromised:
        - **Deny Policy Implementation**: Attach a deny-all policy to the compromised role, thus preventing it from performing any further actions.

        - **Role Cloning**: Before outright remediation, clone the role. This ensures that you have a backup with the same permissions, making transition smoother.
      playbookName: Cloud Credentials Rotation - AWS
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      IAMRemediationType:
        complex:
          root: inputs.RemediationType
      accessKeyID:
        complex:
          root: inputs.AWS-accessKeyID
      identityType:
        complex:
          root: inputs.identityType
      instanceID:
        complex:
          root: inputs.AWS-instanceID
      newInstanceProfileName:
        complex:
          root: inputs.AWS-newInstanceProfileName
      newRoleName:
        complex:
          root: inputs.AWS-newRoleName
      roleNameToRestrict:
        complex:
          root: inputs.AWS-roleNameToRestrict
      shouldCloneSA:
        complex:
          root: inputs.shouldCloneSA
      username:
        complex:
          root: inputs.AWS-userID
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 20,
          "y": 230
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: b3faa4f1-b25b-4577-867d-efc8f9e5f4f3
    type: condition
    task:
      id: b3faa4f1-b25b-4577-867d-efc8f9e5f4f3
      version: -1
      name: Select cloud provider
      description: Checks the cloud provider.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "4"
      AWS:
      - "5"
      Azure:
      - "1"
      GCP:
      - "3"
    separatecontext: false
    conditions:
    - label: Azure
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.cloudProvider
            iscontext: true
          right:
            value:
              simple: Azure
          ignorecase: true
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: MicrosoftGraphApplications
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
                accessor: brand
            iscontext: true
        - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: MicrosoftGraphUser
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
                accessor: brand
            iscontext: true
    - label: AWS
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.cloudProvider
            iscontext: true
          right:
            value:
              simple: AWS
          ignorecase: true
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: AWS - IAM
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: AWS - EC2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    - label: GCP
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.cloudProvider
            iscontext: true
          right:
            value:
              simple: GCP
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: GCP-IAM
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
        - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: GSuiteAdmin
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "6_1_Azure": 0.48
    },
    "paper": {
      "dimensions": {
        "height": 545,
        "width": 1240,
        "x": 20,
        "y": -80
      }
    }
  }
inputs:
- key: RemediationType
  value: {}
  required: false
  description: |-
    The response playbook provides the following remediation actions using AWS, MSGraph Users, GCP and GSuite Admin:

    Reset: By entering "Reset" in the input, the playbook will execute password reset.
    Supports: AWS, MSGraph Users, GCP and GSuite Admin.

    Revoke: By entering "Revoke" in the input, the GCP will revoke the access key, GSuite Admin will revoke the access token and the MSGraph Users will revoke the session.
    Supports: GCP, GSuite Admin and MSGraph Users.

    Deactivate - By entering "Deactivate" in the input, the playbook will execute access key deactivation.
    Supports: AWS.

    ALL: By entering "ALL" in the input, the playbook will execute the all remediation actions provided for each CSP.
  playbookInputQuery:
- key: shouldCloneSA
  value:
    simple: "True"
  required: false
  description: |-
    Whether to clone the compromised SA before putting a deny policy to it.
    Supports: AWS.
    True/False
  playbookInputQuery:
- key: GCP-userID
  value: {}
  required: false
  description: Identifies the user in the API request. The value can be the user's primary email address, alias email address, or unique user ID.
  playbookInputQuery:
- key: GCP-clientID
  value: {}
  required: false
  description: The client ID.
  playbookInputQuery:
- key: GCP-zone
  value: {}
  required: false
  description: |-
    The name of the zone.
    e.g.
    us-central1-c
    us-central1-b
  playbookInputQuery:
- key: GCP-SAEmail
  value: {}
  required: false
  description: The service account email.
  playbookInputQuery:
- key: Azure-AppID
  value: {}
  required: false
  description: This is the unique application (client) ID of the application.
  playbookInputQuery:
- key: Azure-ObjectID
  value: {}
  required: false
  description: This is the unique ID of the service principal object associated with the application.
  playbookInputQuery:
- key: Azure-userID
  value: {}
  required: false
  description: The user ID or user principal name.
  playbookInputQuery:
- key: AWS-instanceID
  value: {}
  required: false
  description: The instance ID.
  playbookInputQuery:
- key: AWS-userID
  value: {}
  required: false
  description: The user name.
  playbookInputQuery:
- key: AWS-accessKeyID
  value: {}
  required: false
  description: The access key ID.
  playbookInputQuery:
- key: AWS-newRoleName
  value: {}
  required: false
  description: The name of the new role to create if the analyst decides to clone the service account.
  playbookInputQuery:
- key: AWS-newInstanceProfileName
  value: {}
  required: false
  description: The name of the new instance profile to create if the analyst decides to clone the service account.
  playbookInputQuery:
- key: AWS-roleNameToRestrict
  value: {}
  required: false
  description: If provided, the role will be attached with a deny policy without the compute instance analysis flow.
  playbookInputQuery:
- key: cloudProvider
  value: {}
  required: false
  description: |-
    The CSP that triggered the alert. Usually mapped to incident field named 'cloudprovider'.
    e.g.
    AWS, AZURE, GCP
  playbookInputQuery:
- key: identityType
  value: {}
  required: false
  description: |-
    The type of identity involved. Usually mapped to incident field named 'cloudidentitytype'.
    e.g.
    IAM,SERVICE_ACCOUNT,APPLICATION
  playbookInputQuery:
- key: GCP-cloudProject
  value: {}
  required: false
  description: The project that the alert was triggered on.
  playbookInputQuery:
outputs:
- contextPath: MSGraphUser
  description: The Microsoft Graph Users information.
  type: unknown
- contextPath: MSGraphApplication
  description: The Microsoft Graph Application information.
  type: unknown
- contextPath: GoogleCloudCompute.Instances
  description: Google Cloud Compute instance information.
  type: unknown
- contextPath: GCPIAM.ServiceAccountKey
  description: The service account keys.
  type: unknown
- contextPath: GCPIAM.ServiceAccount
  description: The service account information.
  type: unknown
- contextPath: AWS.EC2.Instances
  description: AWS EC2 instance information.
  type: unknown
- contextPath: AWS.IAM.InstanceProfiles
  description: AWS IAM instance profile information.
  type: unknown
- contextPath: AWS.IAM.Roles.AttachedPolicies.Policies
  description: A list of managed policy names.
  type: unknown
- contextPath: AWS.IAM.Roles.RoleName.Policies
  description: A list of policy names.
quiet: true
tests:
- No tests (auto formatted)
fromversion: 6.9.0