Cloud IAM User Access Investigation

id: Cloud IAM User Access Investigation
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Cloud IAM User Access Investigation
description: |-
  Investigate and respond to Cortex XSIAM alerts where a Cloud IAM user access key is used suspiciously to access the cloud environment.
  The following alerts are supported for AWS, Azure, and GCP environments.
  Penetration testing tool attempt
  Penetration testing tool activity
  Suspicious API call from a Tor exit node
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 40b4c735-392d-4c86-8ab3-6d49441a813d
    type: start
    task:
      id: 40b4c735-392d-4c86-8ab3-6d49441a813d
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "61"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 550,
          "y": -190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: c48a2862-f3e1-4dd3-89b7-8590f645298b
    type: title
    task:
      id: c48a2862-f3e1-4dd3-89b7-8590f645298b
      version: -1
      name: 'Remediation '
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "81"
      - "87"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 550,
          "y": 1790
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: 1e498a1e-df55-4805-8fa9-973ba6554ac1
    type: title
    task:
      id: 1e498a1e-df55-4805-8fa9-973ba6554ac1
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1220,
          "y": 2620
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: 08cf3974-ddc8-4694-8a1a-e737b3e69973
    type: condition
    task:
      id: 08cf3974-ddc8-4694-8a1a-e737b3e69973
      version: -1
      name: Manual verdict decision
      description: Based on the collected data investigation, select the verdict of the alert.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      False Positive:
      - "64"
      True positive:
      - "83"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 880,
          "y": 1080
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: 043b96c8-7870-4754-823d-3a0658690cf2
    type: title
    task:
      id: 043b96c8-7870-4754-823d-3a0658690cf2
      version: -1
      name: False Positive
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "19"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1220,
          "y": 1770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "50":
    id: "50"
    taskid: cee3b559-fdae-4404-863c-39f9dd375566
    type: title
    task:
      id: cee3b559-fdae-4404-863c-39f9dd375566
      version: -1
      name: Verdict
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "66"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 550,
          "y": 600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "57":
    id: "57"
    taskid: 9bc32470-1e47-447a-8a0b-f41a4049394c
    type: condition
    task:
      id: 9bc32470-1e47-447a-8a0b-f41a4049394c
      version: -1
      name: Close the alert and finish the investigation?
      description: Close the alert and finish the investigation?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "65"
      "yes":
      - "58"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.ShouldCloseAutomatically
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 550,
          "y": 2280
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "58":
    id: "58"
    taskid: 2c77b9cd-84ff-48cc-86cd-a3cb3f439314
    type: regular
    task:
      id: 2c77b9cd-84ff-48cc-86cd-a3cb3f439314
      version: -1
      name: Close alert after remediation
      description: commands.local.cmd.close.inv
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      closeReason:
        simple: Resolved - True positive
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 770,
          "y": 2450
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "61":
    id: "61"
    taskid: 8634ca8c-2535-4d70-857f-d5e77b87b09e
    type: regular
    task:
      id: 8634ca8c-2535-4d70-857f-d5e77b87b09e
      version: -1
      name: Fetch alert extra data
      description: Returns information about each alert ID.
      script: '|||core-get-cloud-original-alerts'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "67"
    scriptarguments:
      alert_ids:
        complex:
          root: alert
          accessor: id
      extend-context:
        simple: alertData=
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 550,
          "y": -50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "64":
    id: "64"
    taskid: 8eded0e7-c70b-40a6-8515-6a3215682533
    type: playbook
    task:
      id: 8eded0e7-c70b-40a6-8515-6a3215682533
      version: -1
      name: Handle False Positive Alerts
      description: |
        This playbook handles false positive alerts.
      playbookName: Handle False Positive Alerts
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "22"
    scriptarguments:
      ShouldCloseAutomatically:
        complex:
          root: inputs.ShouldCloseAutomatically
      alertName:
        complex:
          root: alert
          accessor: name
      sourceIP:
        complex:
          root: alert
          accessor: hostip
      username:
        complex:
          root: alert
          accessor: username
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1220,
          "y": 1250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "65":
    id: "65"
    taskid: 62cfaa81-81fb-4166-8f73-e3e903c5e3c5
    type: regular
    task:
      id: 62cfaa81-81fb-4166-8f73-e3e903c5e3c5
      version: -1
      name: Continue the investigation
      description: Continue the investigation.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 320,
          "y": 2450
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "66":
    id: "66"
    taskid: cfb35229-4702-4fa4-8b8b-f9d86778c329
    type: condition
    task:
      id: cfb35229-4702-4fa4-8b8b-f9d86778c329
      version: -1
      name: Is activity malicious?
      description: Checks whether the alert is malicious based on either one of the following:<br>- Source IP address with a malicious DBot score.<br>- A Tor IP address.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "73"
      "yes":
      - "83"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: containsGeneral
          left:
            value:
              simple: alert.name
            iscontext: true
          right:
            value:
              simple: Suspicious API call from a Tor exit node
        - operator: isEqualNumber
          left:
            value:
              complex:
                root: DBotScore
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: DBotScore.Indicator
                      iscontext: true
                    right:
                      value:
                        simple: alert.hostip
                      iscontext: true
                    ignorecase: true
                accessor: Score
            iscontext: true
          right:
            value:
              simple: "3"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 550,
          "y": 750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "67":
    id: "67"
    taskid: 4f102212-5337-40d7-8477-f983500618fe
    type: regular
    task:
      id: 4f102212-5337-40d7-8477-f983500618fe
      version: -1
      name: Load alert JSON
      description: Loads a JSON from a string input, and returns a JSON object.
      scriptName: LoadJSON
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "68"
    scriptarguments:
      extend-context:
        simple: alertJson=
      ignore-outputs:
        simple: "true"
      input:
        complex:
          root: alertData.alerts
          accessor: original_alert_json
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 550,
          "y": 120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "68":
    id: "68"
    taskid: 3d769696-08fc-4298-880f-a47793a9a3f2
    type: title
    task:
      id: 3d769696-08fc-4298-880f-a47793a9a3f2
      version: -1
      name: Analysis
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "80"
      - "82"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 550,
          "y": 280
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "73":
    id: "73"
    taskid: 6e5634a7-7393-4cfa-8bb4-b2beca7a782e
    type: regular
    task:
      id: 6e5634a7-7393-4cfa-8bb4-b2beca7a782e
      version: -1
      name: Investigate collected data
      description: 'To determine if this is a true positive event, review the operations performed by the access key and the user in the recent time frame.<br>Search for the following items:<br>-Investigate the operation performed by the access key and examine the executed operations, by who it was executed, on which resource, and the operation status.<br>-Investigate operations performed by the user and examine the executed operations, by who it was executed, on which resource, and the operation status.<br>-Look at any persistence, for example - a new user creation or key, etc.<br>-Look at any lateral movement operations. For example, an operation can be = AsumeRole.<br>As an extra validation step, it is recommended to query the user and/or the user’s manager regarding the investigated suspicious activity.'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "21"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 880,
          "y": 920
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "80":
    id: "80"
    taskid: 3e6e0a3b-c353-46a8-895c-e46d5fcb4efe
    type: playbook
    task:
      id: 3e6e0a3b-c353-46a8-895c-e46d5fcb4efe
      version: -1
      name: Enrichment for Verdict
      description: This playbook checks prior alert closing reasons and performs enrichment and prevalence checks on different IOC types. It then returns the information needed to establish the alert's verdict.
      playbookName: Enrichment for Verdict
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "50"
    scriptarguments:
      CloseReason:
        simple: Resolved - False Positive,Resolved - Duplicate Incident,Resolved - Known Issue
      Domain:
        complex:
          root: alert
          accessor: domainname
      FileSHA256:
        complex:
          root: alert
          accessor: initiatorsha256
      IP:
        complex:
          root: alert
          accessor: hostip
      URL:
        complex:
          root: alert
          accessor: url
      User:
        complex:
          root: alert
          accessor: username
      query:
        simple: sourceBrand:"${alert.sourceBrand}" and name:"${alert.name}" and username:"${alert.username}" and hostip:"${alert.hostip}"
      threshold:
        simple: "2"
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 760,
          "y": 430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "81":
    id: "81"
    taskid: c74e0107-fdaa-4a6a-8d3b-f4ab5f4ddeff
    type: playbook
    task:
      id: c74e0107-fdaa-4a6a-8d3b-f4ab5f4ddeff
      version: -1
      name: Cloud Response - Generic
      description: |-
        This playbook provides response playbooks for:
        - AWS
        - Azure
        - GCP

        The response actions available are:
        - Terminate/Shut down/Power off an instance
        - Delete/Disable a user
        - Delete/Revoke/Disable credentials
        - Block indicators
      playbookName: Cloud Response - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "57"
    scriptarguments:
      AWS-accessKeyRemediationType:
        complex:
          root: inputs.AWS-accessKeyRemediationType
      AWS-resourceRemediationType:
        simple: Stop
      AWS-userRemediationType:
        complex:
          root: inputs.AWS-userRemediationType
      Azure-resourceRemediationType:
        simple: Poweroff
      Azure-userRemediationType:
        complex:
          root: inputs.Azure-userRemediationType
      GCP-accessKeyRemediationType:
        complex:
          root: inputs.GCP-accessKeyRemediationType
      GCP-resourceRemediationType:
        simple: Stop
      GCP-userRemediationType:
        complex:
          root: inputs.GCP-userRemediationType
      accessKeyId:
        complex:
          root: alertJson.raw_abioc.event._aws_specific_fields
          accessor: access_key_id
      autoAccessKeyRemediation:
        complex:
          root: inputs.autoAccessKeyRemediation
      autoBlockIndicators:
        complex:
          root: inputs.autoBlockIndicators
      autoResourceRemediation:
        simple: "False"
      autoUserRemediation:
        complex:
          root: inputs.autoUserRemediation
      cloudProvider:
        complex:
          root: alert
          accessor: cloudprovider
      region:
        complex:
          root: alertJson.raw_abioc.event
          accessor: region
      resourceGroup:
        complex:
          root: alertJson.raw_abioc.event
          accessor: referenced_resource
          transformers:
          - operator: Cut
            args:
              delimiter:
                value:
                  simple: /
              fields:
                value:
                  simple: "5"
      resourceName:
        complex:
          root: alertJson.raw_abioc.event
          accessor: referenced_resource_name
      resourceZone:
        complex:
          root: alertJson.raw_abioc.event
          accessor: zone
      username:
        complex:
          root: alertJson.raw_abioc.event
          accessor: identity_name
    separatecontext: false
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 550,
          "y": 1930
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "82":
    id: "82"
    taskid: 47581c50-b254-476b-8458-b375454cd095
    type: playbook
    task:
      id: 47581c50-b254-476b-8458-b375454cd095
      version: -1
      name: Cloud IAM Enrichment - Generic
      description: This playbook is responsible for collecting and enriching data on Identity Access Management (IAM) in cloud environments (AWS, Azure, and GCP).
      playbookName: Cloud IAM Enrichment - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "50"
    scriptarguments:
      GCPProjectName:
        complex:
          root: alert
          accessor: cloudproject
      cloudIdentityType:
        complex:
          root: alert
          accessor: cloudidentitytype
      cloudProvider:
        complex:
          root: alert
          accessor: cloudprovider
      username:
        complex:
          root: alert
          accessor: username
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 340,
          "y": 430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "83":
    id: "83"
    taskid: 03fb2c84-97c4-4a5e-86d9-14eaffeb57bb
    type: regular
    task:
      id: 03fb2c84-97c4-4a5e-86d9-14eaffeb57bb
      version: -1
      name: Set Alert Severity to High
      description: commands.local.cmd.set.parent.alert.field
      script: Builtin|||setParentIncidentFields
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "84"
    scriptarguments:
      manual_severity:
        simple: high
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 550,
          "y": 1250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "84":
    id: "84"
    taskid: 9741fe58-9cdb-4b1d-81c4-da1c0eed30d3
    type: condition
    task:
      id: 9741fe58-9cdb-4b1d-81c4-da1c0eed30d3
      version: -1
      name: Should open a ticket automatically in a ticketing system?
      description: Checks whether to open a ticket automatically in a ticketing system.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "8"
      "yes":
      - "85"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.ShouldOpenTicket
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 550,
          "y": 1410
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "85":
    id: "85"
    taskid: a374d6fc-7d50-4b69-81d1-d26498ece1e3
    type: playbook
    task:
      id: a374d6fc-7d50-4b69-81d1-d26498ece1e3
      version: -1
      name: Ticket Management - Generic
      description: "`Ticket Management - Generic` allows you to open new tickets or
        update comments to the existing ticket in the following ticketing systems:\n-ServiceNow
        \n-Zendesk \nusing the following sub-playbooks:\n-`ServiceNow - Ticket Management`\n-`Zendesk
        - Ticket Management`\n"
      playbookName: Ticket Management - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      CommentToAdd:
        complex:
          root: inputs.CommentToAdd
      ZendeskAssigne:
        complex:
          root: inputs.ZendeskAssigne
      ZendeskCollaborators:
        complex:
          root: inputs.ZendeskCollaborators
      ZendeskPriority:
        complex:
          root: inputs.ZendeskPriority
      ZendeskRequester:
        complex:
          root: inputs.ZendeskRequester
      ZendeskStatus:
        complex:
          root: inputs.ZendeskStatus
      ZendeskSubject:
        complex:
          root: inputs.ZendeskSubject
      ZendeskTags:
        complex:
          root: inputs.ZendeskTags
      ZendeskType:
        complex:
          root: inputs.ZendeskType
      addCommentPerEndpoint:
        complex:
          root: inputs.addCommentPerEndpoint
      description:
        complex:
          root: inputs.description
      serviceNowAssignmentGroup:
        complex:
          root: inputs.serviceNowAssignmentGroup
      serviceNowCategory:
        complex:
          root: inputs.serviceNowCategory
      serviceNowImpact:
        complex:
          root: inputs.serviceNowImpact
      serviceNowSeverity:
        complex:
          root: inputs.serviceNowSeverity
      serviceNowShortDescription:
        complex:
          root: inputs.serviceNowShortDescription
      serviceNowTicketType:
        complex:
          root: inputs.serviceNowTicketType
      serviceNowUrgency:
        complex:
          root: inputs.serviceNowUrgency
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 290,
          "y": 1610
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "86":
    id: "86"
    taskid: 0126e6bb-4904-4b01-859b-1e238fbbc0f4
    type: playbook
    task:
      id: 0126e6bb-4904-4b01-859b-1e238fbbc0f4
      version: -1
      name: Cloud Credentials Rotation - Generic
      description: |-
        ## **Cloud Credentials Rotation - Generic**

        This comprehensive playbook combines the remediation steps from AWS, Azure, and GCP sub-playbooks into a single, cohesive guide. Regardless of which Cloud Service Provider (CSP) you're working with, this playbook will direct you to the relevant steps, ensuring swift and effective response.

        The primary objective is to offer an efficient way to address compromised credentials across different cloud platforms. By consolidating the key steps from AWS, Azure, and GCP, it minimizes the time spent searching for platform-specific procedures and accelerates the remediation process, ensuring the highest level of security for your cloud environments.

        ## **Integrations for Each Sub-Playbook**

        In order to seamlessly execute the actions mentioned in each sub-playbook, specific integrations are essential. These integrations facilitate the automated tasks and processes that the playbook carries out. Here are the required integrations for each sub-playbook:

        ### **AWS Sub-Playbook:**
        1. [**AWS - IAM**](https://xsoar.pan.dev/docs/reference/integrations/aws---iam): Used to manage AWS Identity and Access Management.
        2. [**AWS - EC2**](https://xsoar.pan.dev/docs/reference/integrations/aws---ec2): Essential for managing Amazon Elastic Compute Cloud (EC2) instances.

        ### **GCP Sub-Playbook:**
        1. [**Google Workspace Admin**](https://xsoar.pan.dev/docs/reference/integrations/g-suite-admin): Manages users, groups, and other entities within Google Workspace.
        2. [**GCP-IAM**](https://xsoar.pan.dev/docs/reference/integrations/gcp-iam): Ensures management and control of GCP's Identity and Access Management.

        ### **Azure Sub-Playbook:**
        1. [**Microsoft Graph Users**](https://xsoar.pan.dev/docs/reference/integrations/microsoft-graph-user): Manages users and related entities in Microsoft Graph.
        2. [**Microsoft Graph Applications**](https://xsoar.pan.dev/docs/reference/integrations/microsoft-graph-applications): Manages applications within Microsoft Graph.
      playbookName: Cloud Credentials Rotation - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "57"
    scriptarguments:
      AWS-accessKeyID:
        simple: ${Core.OriginalAlert.event.identity_orig.accessKeyId}
      AWS-instanceID:
        complex:
          root: alert.username
          filters:
          - - operator: containsGeneral
              left:
                value:
                  simple: alert.username
                iscontext: true
              right:
                value:
                  simple: i-
          transformers:
          - operator: Cut
            args:
              delimiter:
                value:
                  simple: /
              fields:
                value:
                  simple: "2"
      AWS-newInstanceProfileName:
        simple: ${inputs.AWS-newInstanceProfileName}
      AWS-newRoleName:
        simple: ${inputs.AWS-newRoleName}
      AWS-roleNameToRestrict:
        simple: ${inputs.AWS-roleNameToRestrict}
      AWS-userID:
        simple: ${alert.username}
      Azure-AppID:
        simple: ${Core.OriginalAlert.event.identity_orig.claims.appid}
      Azure-ObjectID:
        complex:
          root: Core.OriginalAlert.event.identity_orig
          accessor: claims
          transformers:
          - operator: Stringify
          - operator: RegexExtractAll
            args:
              error_if_no_match: {}
              ignore_case: {}
              multi_line: {}
              period_matches_newline: {}
              regex:
                value:
                  simple: http://schemas.microsoft.com/identity/claims/objectidentifier":"\w{8}\-\w{4}\-\w{4}\-\w{4}\-\w{12}
              unpack_matches: {}
          - operator: ExtractInbetween
            args:
              from:
                value:
                  simple: http://schemas.microsoft.com/identity/claims/objectidentifier":"
              to:
                value:
                  simple: '"'
      Azure-userID:
        simple: ${alert.username}
      GCP-SAEmail:
        simple: ${Core.OriginalAlert.event.identity_orig.principalEmail}
      GCP-cloudProject:
        simple: ${alert.cloudproject}
      GCP-userID:
        simple: ${alert.username}
      GCP-zone:
        simple: ${Core.OriginalAlert.event.zone}
      RemediationType:
        simple: ${inputs.credentialsRemediationType}
      cloudProvider:
        simple: ${alert.cloudprovider}
      identityType:
        simple: ${alert.cloudidentitytype}
      shouldCloneSA:
        simple: ${inputs.shouldCloneSA}
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 110,
          "y": 2110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "87":
    id: "87"
    taskid: 06456a85-ca31-4637-844b-2fd3dfce9a41
    type: condition
    task:
      id: 06456a85-ca31-4637-844b-2fd3dfce9a41
      version: -1
      name: Should rotate the credentials automatically?
      description: Whether to rotate the credentials automatically.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "yes":
      - "86"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.autoAccessKeyRemediation
            iscontext: true
          right:
            value:
              simple: "true"
          ignorecase: true
        - operator: isEqualString
          left:
            value:
              simple: inputs.autoUserRemediation
            iscontext: true
          right:
            value:
              simple: "true"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 110,
          "y": 1930
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "21_64_False Positive": 0.54
    },
    "paper": {
      "dimensions": {
        "height": 2875,
        "width": 1490,
        "x": 110,
        "y": -190
      }
    }
  }
inputs:
- key: ShouldCloseAutomatically
  value:
    simple: "False"
  required: false
  description: Whether to close alerts automatically as a false positive. (True/False).
  playbookInputQuery:
- key: autoAccessKeyRemediation
  value:
    simple: "False"
  required: false
  description: Whether to execute the user remediation flow automatically.
  playbookInputQuery:
- key: autoBlockIndicators
  value:
    simple: "True"
  required: false
  description: Whether to block the indicators automatically.
  playbookInputQuery:
- key: autoUserRemediation
  value:
    simple: "False"
  required: false
  description: Whether to execute the user remediation flow automatically.
  playbookInputQuery:
- key: credentialsRemediationType
  value:
    simple: "Reset"
  required: false
  description: |-
    The response playbook provides the following remediation actions using AWS, MSGraph Users, GCP and GSuite Admin:

    Reset: By entering "Reset" in the input, the playbook will execute password reset.
    Supports: AWS, MSGraph Users, GCP and GSuite Admin.

    Revoke: By entering "Revoke" in the input, the GCP will revoke the access key, GSuite Admin will revoke the access token and the MSGraph Users will revoke the session.
    Supports: GCP, GSuite Admin and MSGraph Users.

    Deactivate - By entering "Deactivate" in the input, the playbook will execute access key deactivation.
    Supports: AWS.

    ALL: By entering "ALL" in the input, the playbook will execute the all remediation actions provided for each CSP.
  playbookInputQuery:
- key: AWS-accessKeyRemediationType
  value:
    simple: Disable
  required: false
  description: |-
    Choose the remediation type for the user's access key.

    AWS available types:
    Disable - for disabling the user's access key.
    Delete - for deleting the user's access key.
  playbookInputQuery:
- key: AWS-userRemediationType
  value:
    simple: Revoke
  required: false
  description: |-
    Choose the remediation type for the user involved.

    AWS available types:
    Delete - for deleting the user.
    Revoke - for revoking the user's credentials.
  playbookInputQuery:
- key: shouldCloneSA
  value: {}
  required: false
  description: |-
    Whether to clone the compromised SA before putting a deny policy to it.
    True/False
  playbookInputQuery:
- key: AWS-newRoleName
  value: {}
  required: false
  description: The name of the new role to create if the analyst decides to clone the service account.
  playbookInputQuery:
- key: AWS-newInstanceProfileName
  value: {}
  required: false
  description: The name of the new instance profile to create if the analyst decides to clone the service account.
  playbookInputQuery:
- key: AWS-roleNameToRestrict
  value: {}
  required: false
  description: If provided, the role will be attached with a deny policy without the compute instance analysis flow.
  playbookInputQuery:
- key: Azure-userRemediationType
  value:
    simple: Disable
  required: false
  description: |-
    Choose the remediation type for the user involved.

    Azure available types:
    Disable - for disabling the user.
    Delete - for deleting the user.
  playbookInputQuery:
- key: GCP-accessKeyRemediationType
  value:
    simple: Disable
  required: false
  description: |-
    Choose the remediation type for the user's access key.

    GCP available types:
    Disable - For disabling the user's access key.
    Delete - For deleting the user's access key.
  playbookInputQuery:
- key: GCP-userRemediationType
  value:
    simple: Disable
  required: false
  description: |-
    Choose the remediation type for the user involved.

    GCP available types:
    Delete - For deleting the user.
    Disable - For disabling the user.
  playbookInputQuery:
- key: ShouldOpenTicket
  value:
    simple: "False"
  required: false
  description: Whether to open a ticket automatically in a ticketing system. (True/False).
  playbookInputQuery:
- key: description
  value:
    simple: ${parentIncidentFields.description}. ${parentIncidentFields.xdr_url}
  required: false
  description: The ticket description.
  playbookInputQuery:
- key: CommentToAdd
  value:
    simple: '${alert.name}. Alert ID: ${alert.id}'
  required: false
  description: Comment for the ticket.
  playbookInputQuery:
- key: addCommentPerEndpoint
  value:
    simple: "True"
  required: false
  description: 'Whether to append a new comment to the ticket for each endpoint in the incident. Possible values: True/False.'
  playbookInputQuery:
- key: serviceNowShortDescription
  value:
    simple: XSIAM Incident ID - ${parentIncidentFields.incident_id}
  required: false
  description: A short description of the ticket.
  playbookInputQuery:
- key: serviceNowImpact
  value: {}
  required: false
  description: The impact for the new ticket. Leave empty for ServiceNow default impact.
  playbookInputQuery:
- key: serviceNowUrgency
  value: {}
  required: false
  description: The urgency of the new ticket. Leave empty for ServiceNow default urgency.
  playbookInputQuery:
- key: serviceNowSeverity
  value: {}
  required: false
  description: The severity of the new ticket. Leave empty for ServiceNow default severity.
  playbookInputQuery:
- key: serviceNowTicketType
  value: {}
  required: false
  description: The ServiceNow ticket type. Options are "incident", "problem", "change_request", "sc_request", "sc_task", or "sc_req_item". Default is "incident".
  playbookInputQuery:
- key: serviceNowCategory
  value: {}
  required: false
  description: The category of the ServiceNow ticket.
  playbookInputQuery:
- key: serviceNowAssignmentGroup
  value: {}
  required: false
  description: The group to which to assign the new ticket.
  playbookInputQuery:
- key: ZendeskPriority
  value: {}
  required: false
  description: The urgency with which the ticket should be addressed. Allowed values are "urgent", "high", "normal", or "low".
  playbookInputQuery:
- key: ZendeskRequester
  value: {}
  required: false
  description: The user who requested this ticket.
  playbookInputQuery:
- key: ZendeskStatus
  value: {}
  required: false
  description: The state of the ticket. Allowed values are "new", "open", "pending", "hold", "solved", or "closed".
  playbookInputQuery:
- key: ZendeskSubject
  value:
    simple: XSIAM Incident ID - ${parentIncidentFields.incident_id}
  required: false
  description: The value of the subject field for this ticket.
  playbookInputQuery:
- key: ZendeskTags
  value: {}
  required: false
  description: The array of tags applied to this ticket.
  playbookInputQuery:
- key: ZendeskType
  value: {}
  required: false
  description: The type of this ticket. Allowed values are "problem", "incident", "question", or "task".
  playbookInputQuery:
- key: ZendeskAssigne
  value: {}
  required: false
  description: The agent currently assigned to the ticket.
  playbookInputQuery:
- key: ZendeskCollaborators
  value: {}
  required: false
  description: The users currently CC'ed on the ticket.
  playbookInputQuery:
inputSections:
- inputs:
  - ShouldCloseAutomatically
  name: Alert Management
  description: Alert management settings and data, including escalation processes, user engagements, and ticketing methods
- inputs:
  - autoAccessKeyRemediation
  - autoBlockIndicators
  - autoUserRemediation
  - credentialsRemediationType
  name: Remediation
  description: Remediation settings and data, including containment, eradication, and recovery.
- inputs:
  - AWS-accessKeyRemediationType
  - AWS-userRemediationType
  - shouldCloneSA
  - AWS-newRoleName
  - AWS-newInstanceProfileName
  - AWS-roleNameToRestrict
  name: AWS Remediation
  description: AWS Remediation settings and data, including containment, eradication, and recovery.
- inputs:
  - Azure-userRemediationType
  name: Azure Remediation
  description: Azure Remediation settings and data, including containment, eradication, and recovery.
- inputs:
  - GCP-accessKeyRemediationType
  - GCP-userRemediationType
  name: GCP Remediation
  description: GCP Remediation settings and data, including containment, eradication, and recovery.
- inputs:
  - ShouldOpenTicket
  - description
  - CommentToAdd
  - addCommentPerEndpoint
  - serviceNowShortDescription
  - serviceNowImpact
  - serviceNowUrgency
  - serviceNowSeverity
  - serviceNowTicketType
  - serviceNowCategory
  - serviceNowAssignmentGroup
  - ZendeskPriority
  - ZendeskRequester
  - ZendeskStatus
  - ZendeskSubject
  - ZendeskTags
  - ZendeskType
  - ZendeskAssigne
  - ZendeskCollaborators
  name: Ticket Management
  description: Ticket management settings and data.
outputSections:
- outputs: []
  name: General (Outputs group)
  description: Generic group for outputs
outputs: []
tests:
- No tests (auto formatted)
marketplaces: 
- marketplacev2
- platform
fromversion: 6.6.0
supportedModules:
- xsiam