Cloud Response - AWS

This playbook provides response actions to AWS. The following are available for execution automatically/manually: - Resource remediation: - Terminate the instance - Stop the instance - Identity remediation: - Delete the user - Revoke the user's credentials - Access key remediation: - Disable the access key - Delete the access key - Block indicators.

AWS Enrichment and Remediation · 36 tasks · 12 inputs · 0 outputs

Details

IDCloud Response - AWS
From Version6.5.0
Tasks36

README

This playbook provides response actions to AWS. The following are available for execution automatically/manually:

  • Resource remediation:
    • Terminate the instance
    • Stop the instance
  • Identity remediation:
    • Delete the user
    • Revoke the user’s credentials
  • Access key remediation:
    • Disable the access key
    • Delete the access key
  • Block indicators

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Block IP - Generic v3

Integrations

This playbook does not use any integrations.

Scripts

  • Set

Commands

  • aws-iam-delete-login-profile
  • aws-iam-delete-user
  • aws-iam-update-access-key
  • aws-ec2-stop-instances
  • aws-iam-delete-access-key
  • aws-ec2-terminate-instances

Playbook Inputs

Name Description Default Value Required
accessKeyRemediationType Choose the remediation type for the user’s access key.
Disable - for disabling the user’s access key.
Delete - for the user’s access key deletion.		 Disable Optional
userRemediationType Choose the remediation type for the user involved.
Delete - for the user deletion.
Revoke - for revoking the user’s credentials.		 Revoke Optional
resourceRemediationType Choose the remediation type for the instances created.
Stop - for stopping the instances.
Terminate - for terminating the instances.		 Stop Optional
autoResourceRemediation Whether to execute the resource remediation flow automatically. False Optional
autoUserRemediation Whether to execute the user remediation flow automatically. False Optional
autoAccessKeyRemediation Whether to execute the access key remediation flow automatically. False Optional
autoBlockIndicators Whether to block the indicators automatically. False Optional
resourceName The resource name to take action on.   Optional
region The resource’s region.   Optional
username The username to take action on.   Optional
accessKeyId The user’s access key ID.   Optional
sourceIP The source IP address of the attacker.   Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Cloud Response - AWS

Inputs

  • accessKeyRemediationType — Choose the remediation type for the user's access key. Disable - for disabling the user's access key. Delete - for the user's access key deletion.
  • userRemediationType — Choose the remediation type for the user involved. Delete - for the user deletion. Revoke - for revoking the user's credentials.
  • resourceRemediationType — Choose the remediation type for the instances created. Stop - for stopping the instances. Terminate - for terminating the instances.
  • autoResourceRemediation — Whether to execute the resource remediation flow automatically.
  • autoUserRemediation — Whether to execute the user remediation flow automatically.
  • autoAccessKeyRemediation — Whether to execute the access key remediation flow automatically.
  • autoBlockIndicators — Whether to block the indicators automatically.
  • resourceName — The resource name to take action on.
  • region — The resource's region.
  • username — The username to take action on.
  • accessKeyId — The user's access key ID.
  • sourceIP — The source IP address of the attacker.

Commands used

aws-ec2-stop-instances aws-ec2-terminate-instances aws-iam-delete-access-key aws-iam-delete-login-profile aws-iam-delete-user aws-iam-update-access-key

Flowchart

yes yes Delete Revoke yes yes Stop Terminate yes yes Delete Disable yes yes yes yes yes Start Start Resource Resource Block Indicators Block Indicators Identity Identity Is there a user to remediate? Is there a user to remedi... Should remediate automatically? Should remediate automati... Continue by remediation type Continue by remediation type Delete the user - aws-iam-delete-user Delete the user aws-iam-delete-user Revoke user credentials - aws-iam-delete-login-profile Revoke user credentials aws-iam-delete-login-profile Done Done Is there a resource to remediate? Is there a resource to re... Should remediate automatically? Should remediate automati... Continue by remediation type Continue by remediation type Terminate the instance - aws-ec2-terminate-instances Terminate the instance aws-ec2-terminate-instances Stop the instance - aws-ec2-stop-instances Stop the instance aws-ec2-stop-instances Done Done Privileges Privileges Is there an access key to remediate? Is there an access key to... Should remediate automatically? Should remediate automati... Disable the access key - aws-iam-update-access-key Disable the access key aws-iam-update-access-key Continue by remediation type Continue by remediation type Delete the access key - aws-iam-delete-access-key Delete the access key aws-iam-delete-access-key Done Done Choose a user for access key remediation Choose a user for access ... Check user answer Check user answer Choose resources to remediate Choose resources to remed... Check user answer Check user answer Set selected resources to remediate - Set Set selected resources to... Set Choose user to remediate Choose user to remediate Check user answer Check user answer Block IP - Generic v3 - Block IP - Generic v3 Block IP - Generic v3 Block IP - Generic v3 Done Done Should block indicators automatically? Should block indicators a... Choose indicators to block Choose indicators to block Check user answer Check user answer Set selected indicators to remediate - Set Set selected indicators t... Set

Source

playbook-Cloud_Response_-_AWS.yml
Download History Raw 
id: Cloud Response - AWS
version: -1
name: Cloud Response - AWS
description: |-
  This playbook provides response actions to AWS. The following are available for execution automatically/manually:
   - Resource remediation:
     - Terminate the instance
     - Stop the instance
   - Identity remediation:
     - Delete the user
     - Revoke the user's credentials
  - Access key remediation:
     - Disable the access key
     - Delete the access key
  - Block indicators.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: cf64eba4-df4f-44d1-84c4-65c9ef85b786
    type: start
    task:
      id: cf64eba4-df4f-44d1-84c4-65c9ef85b786
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "7"
      - "1"
      - "4"
      - "35"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 720,
          "y": 390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 4e285d3b-924b-48ab-8bb3-b1092e74a8a5
    type: title
    task:
      id: 4e285d3b-924b-48ab-8bb3-b1092e74a8a5
      version: -1
      name: Resource
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "24"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2120,
          "y": 560
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: daead8d0-6cad-4acb-811a-c5eeb75fda74
    type: title
    task:
      id: daead8d0-6cad-4acb-811a-c5eeb75fda74
      version: -1
      name: Block Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "52"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -2020,
          "y": 570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 3e349c03-2c6a-4283-8a64-50a326832bc6
    type: title
    task:
      id: 3e349c03-2c6a-4283-8a64-50a326832bc6
      version: -1
      name: Identity
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "17"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 720,
          "y": 570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 1cfce3f9-b342-42b2-8b98-7ff57898aeae
    type: condition
    task:
      id: 1cfce3f9-b342-42b2-8b98-7ff57898aeae
      version: -1
      name: Is there a user to remediate?
      description: Checks if there is a user available for remediation.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "23"
      "yes":
      - "18"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.username
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 720,
          "y": 710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: bab366d6-42ab-4202-8212-32c140333cda
    type: condition
    task:
      id: bab366d6-42ab-4202-8212-32c140333cda
      version: -1
      name: Should remediate automatically?
      description: Checks if the user chose automatic remediation.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "48"
      "yes":
      - "19"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.autoUserRemediation
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 720,
          "y": 880
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: 09df0c87-0d3f-44aa-8590-36b83ceca692
    type: condition
    task:
      id: 09df0c87-0d3f-44aa-8590-36b83ceca692
      version: -1
      name: Continue by remediation type
      description: Checks for the user's chosen remediation type.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "23"
      Delete:
      - "20"
      Revoke:
      - "21"
    separatecontext: false
    conditions:
    - label: Delete
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.userRemediationType
            iscontext: true
          right:
            value:
              simple: Delete
          ignorecase: true
    - label: Revoke
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.userRemediationType
            iscontext: true
          right:
            value:
              simple: Revoke
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 720,
          "y": 1560
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "20":
    id: "20"
    taskid: bcb34737-5db4-4545-8808-2a0cb92ce218
    type: regular
    task:
      id: bcb34737-5db4-4545-8808-2a0cb92ce218
      version: -1
      name: Delete the user
      description: Deletes the specified IAM user. The user must not belong to any groups or have any access keys, signing certificates, or attached policies.
      script: '|||aws-iam-delete-user'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "23"
    scriptarguments:
      userName:
        complex:
          root: Manual resource remediation.Answers
          accessor: "0"
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: inputs.username
                iscontext: true
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 720,
          "y": 1750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: 8f08abbe-aa5b-4c80-839a-9ab12a7ef590
    type: regular
    task:
      id: 8f08abbe-aa5b-4c80-839a-9ab12a7ef590
      version: -1
      name: Revoke user credentials
      description: Deletes the password for the specified IAM user, which terminates the user's ability to access AWS services through the AWS Management Console.
      script: '|||aws-iam-delete-login-profile'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "23"
    scriptarguments:
      userName:
        complex:
          root: Manual resource remediation.Answers
          accessor: "0"
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: inputs.username
                iscontext: true
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1140,
          "y": 1750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: 710a1688-0775-418f-8cf2-3ff25fce9336
    type: title
    task:
      id: 710a1688-0775-418f-8cf2-3ff25fce9336
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 80,
          "y": 1920
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: 312cdbd3-aab2-41e2-8a69-341cd3913558
    type: condition
    task:
      id: 312cdbd3-aab2-41e2-8a69-341cd3913558
      version: -1
      name: Is there a resource to remediate?
      description: Checks if there is a resource available for remediation.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "30"
      "yes":
      - "25"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.resourceName
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2120,
          "y": 700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: b27c6a54-04b8-445e-8321-7dee13880686
    type: condition
    task:
      id: b27c6a54-04b8-445e-8321-7dee13880686
      version: -1
      name: Should remediate automatically?
      description: Checks if the user chose automatic remediation.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "45"
      "yes":
      - "26"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.autoResourceRemediation
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2120,
          "y": 870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: c4e8138a-50f0-48a0-8ac0-cd0850a67b71
    type: condition
    task:
      id: c4e8138a-50f0-48a0-8ac0-cd0850a67b71
      version: -1
      name: Continue by remediation type
      description: Checks for the user's chosen remediation type.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "30"
      Stop:
      - "28"
      Terminate:
      - "27"
    separatecontext: false
    conditions:
    - label: Terminate
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.resourceRemediationType
            iscontext: true
          right:
            value:
              simple: Terminate
          ignorecase: true
    - label: Stop
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.resourceRemediationType
            iscontext: true
          right:
            value:
              simple: Stop
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2120,
          "y": 1560
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "27":
    id: "27"
    taskid: c8b84c8e-9761-4faa-8549-5230b0bee94c
    type: regular
    task:
      id: c8b84c8e-9761-4faa-8549-5230b0bee94c
      version: -1
      name: Terminate the instance
      description: Shuts down one or more instances. This operation is idempotent; if you terminate an instance more than once, each call succeeds.
      script: '|||aws-ec2-terminate-instances'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "30"
    scriptarguments:
      instanceIds:
        complex:
          root: remediateResourceList
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: inputs.resourceName
                iscontext: true
      region:
        complex:
          root: inputs.region
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2120,
          "y": 1740
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "28":
    id: "28"
    taskid: aaa32ade-89a0-4bb6-8e31-1bf8b76a3244
    type: regular
    task:
      id: aaa32ade-89a0-4bb6-8e31-1bf8b76a3244
      version: -1
      name: Stop the instance
      description: Stops an Amazon EBS-backed instance.
      script: '|||aws-ec2-stop-instances'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "30"
    scriptarguments:
      instanceIds:
        complex:
          root: remediateResourceList
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: inputs.resourceName
                iscontext: true
      region:
        complex:
          root: inputs.region
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2540,
          "y": 1740
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "30":
    id: "30"
    taskid: 4103b833-432f-4188-81e4-624e0ce96ab6
    type: title
    task:
      id: 4103b833-432f-4188-81e4-624e0ce96ab6
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1490,
          "y": 1910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "35":
    id: "35"
    taskid: 15ee420e-c091-45a1-8976-c55ba3885b17
    type: title
    task:
      id: 15ee420e-c091-45a1-8976-c55ba3885b17
      version: -1
      name: Privileges
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "36"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -790,
          "y": 570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "36":
    id: "36"
    taskid: 543841c1-14ca-425f-84e2-5611a40cf800
    type: condition
    task:
      id: 543841c1-14ca-425f-84e2-5611a40cf800
      version: -1
      name: Is there an access key to remediate?
      description: Checks if there is an access key available for remediation.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "41"
      "yes":
      - "37"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.accessKeyId
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -790,
          "y": 700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "37":
    id: "37"
    taskid: eabd4b85-795a-4fcb-8c8c-8125875c346a
    type: condition
    task:
      id: eabd4b85-795a-4fcb-8c8c-8125875c346a
      version: -1
      name: Should remediate automatically?
      description: Checks if the user chose automatic remediation.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "42"
      "yes":
      - "39"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.autoAccessKeyRemediation
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -790,
          "y": 885
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "38":
    id: "38"
    taskid: 07ee3ac8-53c2-49f2-8fc8-0a1394be0059
    type: regular
    task:
      id: 07ee3ac8-53c2-49f2-8fc8-0a1394be0059
      version: -1
      name: Disable the access key
      description: Changes the status of the specified access key from Active to Inactive, or vice versa. This operation can be used to disable a user's key as part of a key rotation workflow.
      script: '|||aws-iam-update-access-key'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "41"
    scriptarguments:
      accessKeyId:
        complex:
          root: inputs.accessKeyId
      status:
        simple: Inactive
      userName:
        complex:
          root: Manual access key remediation.Answers
          accessor: "0"
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: inputs.username
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -790,
          "y": 1600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "39":
    id: "39"
    taskid: 3524216f-4549-402a-82c5-9d06e60925c4
    type: condition
    task:
      id: 3524216f-4549-402a-82c5-9d06e60925c4
      version: -1
      name: Continue by remediation type
      description: Checks for the user's chosen remediation type.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "41"
      Delete:
      - "40"
      Disable:
      - "38"
    separatecontext: false
    conditions:
    - label: Disable
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.accessKeyRemediationType
            iscontext: true
          right:
            value:
              simple: Disable
          ignorecase: true
    - label: Delete
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.accessKeyRemediationType
            iscontext: true
          right:
            value:
              simple: Rotate
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -790,
          "y": 1390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "40":
    id: "40"
    taskid: ace50672-d4ae-463b-8068-027b07a9f4b9
    type: regular
    task:
      id: ace50672-d4ae-463b-8068-027b07a9f4b9
      version: -1
      name: Delete the access key
      description: Deletes the access key pair associated with the specified IAM user.
      script: '|||aws-iam-delete-access-key'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "41"
    scriptarguments:
      AccessKeyId:
        complex:
          root: inputs.accessKeyId
      userName:
        complex:
          root: Manual access key remediation.Answers
          accessor: "0"
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: inputs.username
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -370,
          "y": 1600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "41":
    id: "41"
    taskid: 78c2d61c-90f3-4a29-8a15-62f7e07afbc3
    type: title
    task:
      id: 78c2d61c-90f3-4a29-8a15-62f7e07afbc3
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1420,
          "y": 1770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "42":
    id: "42"
    taskid: 6ee1b8cf-879c-4592-8e24-cf77e77047cb
    type: collection
    task:
      id: 6ee1b8cf-879c-4592-8e24-cf77e77047cb
      version: -1
      name: Choose a user for access key remediation
      description: Check whether the values provided in arguments are equal. If either of the arguments are missing, nothing is returned.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "43"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1170,
          "y": 1060
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
        simple: ${incident.assigneduser}
      subject:
        simple: Cloud Response - AWS - Credentials Remediation
      body:
        simple: Analyst interaction is needed for the credentials remediation.
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Choose the user for access key remediation
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: inputs.username
            transformers:
            - operator: uniq
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Manual access key remediation
      description: ""
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "43":
    id: "43"
    taskid: 913072c5-9f1a-4572-8cad-fd2024262ffe
    type: condition
    task:
      id: 913072c5-9f1a-4572-8cad-fd2024262ffe
      version: -1
      name: Check user answer
      description: Checks the user's answer.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "41"
      "yes":
      - "39"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: Manual access key remediation.Answers
                accessor: "0"
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1170,
          "y": 1220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "45":
    id: "45"
    taskid: 45617fee-be4e-455e-823b-d808752896f5
    type: collection
    task:
      id: 45617fee-be4e-455e-823b-d808752896f5
      version: -1
      name: Choose resources to remediate
      description: Check whether the values provided in arguments are equal. If either of the arguments are missing, nothing is returned.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "46"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1740,
          "y": 1050
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
        simple: ${incident.assigneduser}
      subject:
        simple: Cloud Response - AWS - Resource Remediation
      body:
        simple: Analyst interaction is needed for the resource remediation.
      methods:
      - email
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Choose resources to remediate
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - simple: ALL
        - complex:
            root: inputs.resourceName
            transformers:
            - operator: uniq
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Manual resource remediation
      description: ""
      sender: Your SOC team
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "46":
    id: "46"
    taskid: 1f73cc8e-b5b5-40cf-8c8d-8963f17c4e5b
    type: condition
    task:
      id: 1f73cc8e-b5b5-40cf-8c8d-8963f17c4e5b
      version: -1
      name: Check user answer
      description: Checks the user's answer.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "30"
      "yes":
      - "47"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: Manual resource remediation.Answers
                accessor: "0"
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1740,
          "y": 1210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "47":
    id: "47"
    taskid: 66f67863-87e4-4f5e-8856-2d6b25a95053
    type: regular
    task:
      id: 66f67863-87e4-4f5e-8856-2d6b25a95053
      version: -1
      name: Set selected resources to remediate
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "26"
    scriptarguments:
      key:
        simple: remediateResourceList
      value:
        complex:
          root: Manual resource remediation.Answers.0
          filters:
          - - operator: isNotEqualString
              left:
                value:
                  simple: Manual resource remediation.Answers.0
                iscontext: true
              right:
                value:
                  simple: ALL
              ignorecase: true
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: inputs.resourceName
                iscontext: true
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1740,
          "y": 1390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "48":
    id: "48"
    taskid: 45209b5d-6952-45fd-8874-0254ec26d039
    type: collection
    task:
      id: 45209b5d-6952-45fd-8874-0254ec26d039
      version: -1
      name: Choose user to remediate
      description: Check whether the values provided in arguments are equal. If either of the arguments are missing, nothing is returned.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "49"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 330,
          "y": 1050
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
        simple: ${incident.assigneduser}
      subject:
        simple: Cloud Response - AWS - User Remediation
      body:
        simple: Analyst interaction is needed for the user remediation.
      methods:
      - email
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Choose user to remediate
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: inputs.username
            transformers:
            - operator: uniq
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Manual user remediation
      description: ""
      sender: Your SOC team
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "49":
    id: "49"
    taskid: f522ce9e-32a4-41b3-8f08-3e461e320b7d
    type: condition
    task:
      id: f522ce9e-32a4-41b3-8f08-3e461e320b7d
      version: -1
      name: Check user answer
      description: Checks the user's answer.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "23"
      "yes":
      - "19"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: Manual user remediation.Answers
                accessor: "0"
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 330,
          "y": 1210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "50":
    id: "50"
    taskid: eeac60d9-2cab-42cb-8a43-f2ee0bee6bbb
    type: playbook
    task:
      id: eeac60d9-2cab-42cb-8a43-f2ee0bee6bbb
      version: -1
      name: Block IP - Generic v3
      description: "This playbook blocks malicious IP addresses using all integrations that are enabled. The direction of the traffic that will be blocked is determined by the Cortex XSOAR user (and set by default to outgoing)\nNote the following:\n- Some of those integrations require specific parameters to run, which are based on the playbook inputs. Also, certain integrations use FW rules or appended network objects.\n- Note that the appended network objects should be specified in blocking rules inside the system later on. \n\n\nSupported integrations for this playbook [Network security products such as FW/WAF/IPs/etc.]: \n\n* Check Point Firewall\n* Palo Alto Networks PAN-OS\n* Zscaler\n* FortiGate\n* Aria Packet Intelligence\n* Cisco Firepower \n* Cisco Secure Cloud Analytics\n* Cisco ASA\n* Akamai WAF\n* F5 SilverLine\n* ThreatX\n* Signal Sciences WAF\n* Sophos Firewall\n\n"
      playbookName: Block IP - Generic v3
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "51"
    scriptarguments:
      AutoCommit:
        simple: "No"
      CustomBlockRule:
        simple: "True"
      IP:
        complex:
          root: blockIndicatorsList
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: inputs.sourceIP
                iscontext: true
          - operator: uniq
      InputEnrichment:
        simple: "False"
      RuleDirection:
        simple: inbound
      RuleName:
        simple: XSOAR - Block IP playbook - ${incident.id}
      UserVerification:
        simple: "False"
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -2020,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "51":
    id: "51"
    taskid: 27f24ac8-e957-471f-880c-a659bc0d94ff
    type: title
    task:
      id: 27f24ac8-e957-471f-880c-a659bc0d94ff
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -2590,
          "y": 1600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "52":
    id: "52"
    taskid: 607a944f-e0c5-44c1-8682-3d8212c85882
    type: condition
    task:
      id: 607a944f-e0c5-44c1-8682-3d8212c85882
      version: -1
      name: Should block indicators automatically?
      description: Checks if the user chose automatic.remediation.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "53"
      "yes":
      - "50"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.autoBlockIndicators
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -2020,
          "y": 700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "53":
    id: "53"
    taskid: ffac410b-ada0-42a8-819b-a017faff78aa
    type: collection
    task:
      id: ffac410b-ada0-42a8-819b-a017faff78aa
      version: -1
      name: Choose indicators to block
      description: Check whether the values provided in arguments are equal. If either of the arguments are missing, nothing is returned.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "54"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -2300,
          "y": 885
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
        simple: ${incident.assigneduser}
      subject:
        simple: Cloud Response - AWS - Block Indicators
      body:
        simple: Analyst interaction is needed for the indicators remediation.
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Choose indicators to block
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: inputs.sourceIP
            transformers:
            - operator: uniq
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Block Indicators
      description: ""
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "54":
    id: "54"
    taskid: f10149ae-cb98-4e78-8a85-c18ef55b99e4
    type: condition
    task:
      id: f10149ae-cb98-4e78-8a85-c18ef55b99e4
      version: -1
      name: Check user answer
      description: Checks the user's answer.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "51"
      "yes":
      - "55"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: Block Indicators.Answers
                accessor: "0"
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -2300,
          "y": 1050
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "55":
    id: "55"
    taskid: b00c02fa-87ff-4541-82aa-8117ebf4a1e0
    type: regular
    task:
      id: b00c02fa-87ff-4541-82aa-8117ebf4a1e0
      version: -1
      name: Set selected indicators to remediate
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "50"
    scriptarguments:
      key:
        simple: blockIndicatorsList
      value:
        complex:
          root: Block Indicators.Answers
          accessor: "0"
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -2300,
          "y": 1240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "17_18_yes": 0.4,
      "17_23_#default#": 0.37,
      "18_19_yes": 0.4,
      "19_23_#default#": 0.77,
      "24_25_yes": 0.37,
      "24_30_#default#": 0.37,
      "25_26_yes": 0.12,
      "25_45_#default#": 0.56,
      "26_27_Terminate": 0.68,
      "26_28_Stop": 0.45,
      "26_30_#default#": 0.77,
      "36_37_yes": 0.52,
      "36_41_#default#": 0.36,
      "39_41_#default#": 0.78,
      "43_39_yes": 0.65,
      "43_41_#default#": 0.3,
      "46_30_#default#": 0.32,
      "49_19_yes": 0.63,
      "49_23_#default#": 0.31,
      "54_51_#default#": 0.57
    },
    "paper": {
      "dimensions": {
        "height": 1595,
        "width": 5510,
        "x": -2590,
        "y": 390
      }
    }
  }
inputs:
- key: accessKeyRemediationType
  value:
    simple: Disable
  required: false
  description: |-
    Choose the remediation type for the user's access key.
    Disable - for disabling the user's access key.
    Delete - for the user's access key deletion.
  playbookInputQuery:
- key: userRemediationType
  value:
    simple: Revoke
  required: false
  description: |-
    Choose the remediation type for the user involved.
    Delete - for the user deletion.
    Revoke - for revoking the user's credentials.
  playbookInputQuery:
- key: resourceRemediationType
  value:
    simple: Stop
  required: false
  description: |-
    Choose the remediation type for the instances created.
    Stop - for stopping the instances.
    Terminate - for terminating the instances.
  playbookInputQuery:
- key: autoResourceRemediation
  value:
    simple: "False"
  required: false
  description: Whether to execute the resource remediation flow automatically.
  playbookInputQuery:
- key: autoUserRemediation
  value:
    simple: "False"
  required: false
  description: Whether to execute the user remediation flow automatically.
  playbookInputQuery:
- key: autoAccessKeyRemediation
  value:
    simple: "False"
  required: false
  description: Whether to execute the access key remediation flow automatically.
  playbookInputQuery:
- key: autoBlockIndicators
  value:
    simple: "False"
  required: false
  description: Whether to block the indicators automatically.
  playbookInputQuery:
- key: resourceName
  value: {}
  required: false
  description: The resource name to take action on.
  playbookInputQuery:
- key: region
  value: {}
  required: false
  description: The resource's region.
  playbookInputQuery:
- key: username
  value: {}
  required: false
  description: The username to take action on.
  playbookInputQuery:
- key: accessKeyId
  value: {}
  required: false
  description: The user's access key ID.
  playbookInputQuery:
- key: sourceIP
  value: {}
  required: false
  description: The source IP address of the attacker.
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.5.0
contentitemexportablefields:
  contentitemfields: {}
system: true