Cloud Enrichment - Generic

## Generic Cloud Enrichment Playbook The **Cloud Enrichment - Generic Playbook** is designed to unify all the relevant playbooks concerning the enrichment of information in the cloud. It provides a standardized approach to enriching information in cloud environments. ### Supported Blocks 1. **Cloud IAM Enrichment - Generic** - Enriches information related to Identity and Access Management (IAM) in the cloud. 2. **Cloud Compute Enrichment - Generic** - Enriches information related to cloud compute resources. The playbook supports a single CSP enrichment at a time.

Common Playbooks · 4 tasks · 9 inputs · 22 outputs

Inputs

  • cloudProvider — The cloud provider involved. The supported CSPs are AWS, Azure and GCP.
  • instanceName — The instance name.
  • instanceID — The instance ID.
  • zone — The zone holding the instance.
  • region — The region holding the instance.
  • azureResourceGroup — The instance's resource group.
  • username — The username involved.
  • GCPProjectName — The GCP project name.
  • cloudIdentityType — The type of the GCP identity. Can be either Service Account or a user.

Outputs

  • AWS.EC2.Instances — The instances.
  • AWS.EC2.Instances.NetworkInterfaces — The network interfaces for the instance.
  • GoogleCloudCompute.Instances — The instances.
  • GoogleCloudCompute.Instances.networkInterfaces — An array of network configurations for this instance. These specify how interfaces are configured to interact with other network services, such as connecting to the internet. Multiple interfaces are supported per instance.
  • GoogleCloudCompute.Instances.disks — Array of disks associated with this instance. Persistent disks must be created before you can assign them.
  • GoogleCloudCompute.Instances.metadata — The metadata key/value pairs assigned to this instance. This includes custom metadata and predefined keys.
  • GoogleCloudCompute.Instances.scheduling — Sets the scheduling options for this instance.
  • Azure.Compute — The VMs.
  • AWS.IAM.Users — AWS AM Users include: UserId Arn CreateDate Path PasswordLastUsed
  • AWS.IAM.UserPolicies — AWS IAM - user inline policies.
  • AWS.IAM.AttachedUserPolicies — AWS IAM - User attached policies.
  • AWS.IAM.Users.AccessKeys — AWS IAM Users Access Keys include: AccessKeyId Status CreateDate UserName
  • AWS.IAM.Users.Groups — AWS IAM - User groups.
  • GCPIAM — GCP IAM information.
  • GSuite — GSuite user information.
  • MSGraphUser — MSGraph user information.
  • MSGraphGroups — MSGraph groups information.
  • MSGraphGroup — MSGraph group information.
  • GSuite.PageToken — Token to specify the next page in the list.
  • MSGraph.identityProtection — MSGraph identity protection - risky user history.
  • AWS.IAM.Users.AccessKeys.CreateDate — The date when the access key was created.
  • AWS.IAM.Users.AccessKeys.UserName — The name of the IAM user that the key is associated with.

Flowchart

Start Start Cloud Compute Enrichment - Generic - Cloud Compute Enrichment - Generic Cloud Compute Enrichment ... Cloud Compute Enrichment - Ge... Done Done Cloud IAM Enrichment - Generic - Cloud IAM Enrichment - Generic Cloud IAM Enrichment - Ge... Cloud IAM Enrichment - Generic