Cloud Response - AWS

This playbook provides response actions to AWS. The following are available for execution automatically/manually: - Resource remediation: - Terminate the instance - Stop the instance - Identity remediation: - Delete the user - Revoke the user's credentials - Access key remediation: - Disable the access key - Delete the access key - Block indicators.

AWS Enrichment and Remediation · 36 tasks · 12 inputs · 0 outputs

Inputs

  • accessKeyRemediationType — Choose the remediation type for the user's access key. Disable - for disabling the user's access key. Delete - for the user's access key deletion.
  • userRemediationType — Choose the remediation type for the user involved. Delete - for the user deletion. Revoke - for revoking the user's credentials.
  • resourceRemediationType — Choose the remediation type for the instances created. Stop - for stopping the instances. Terminate - for terminating the instances.
  • autoResourceRemediation — Whether to execute the resource remediation flow automatically.
  • autoUserRemediation — Whether to execute the user remediation flow automatically.
  • autoAccessKeyRemediation — Whether to execute the access key remediation flow automatically.
  • autoBlockIndicators — Whether to block the indicators automatically.
  • resourceName — The resource name to take action on.
  • region — The resource's region.
  • username — The username to take action on.
  • accessKeyId — The user's access key ID.
  • sourceIP — The source IP address of the attacker.

Commands used

aws-ec2-stop-instances aws-ec2-terminate-instances aws-iam-delete-access-key aws-iam-delete-login-profile aws-iam-delete-user aws-iam-update-access-key

Flowchart

yes yes Delete Revoke yes yes Stop Terminate yes yes Delete Disable yes yes yes yes yes Start Start Resource Resource Block Indicators Block Indicators Identity Identity Is there a user to remediate? Is there a user to remedi... Should remediate automatically? Should remediate automati... Continue by remediation type Continue by remediation type Delete the user - aws-iam-delete-user Delete the user aws-iam-delete-user Revoke user credentials - aws-iam-delete-login-profile Revoke user credentials aws-iam-delete-login-profile Done Done Is there a resource to remediate? Is there a resource to re... Should remediate automatically? Should remediate automati... Continue by remediation type Continue by remediation type Terminate the instance - aws-ec2-terminate-instances Terminate the instance aws-ec2-terminate-instances Stop the instance - aws-ec2-stop-instances Stop the instance aws-ec2-stop-instances Done Done Privileges Privileges Is there an access key to remediate? Is there an access key to... Should remediate automatically? Should remediate automati... Disable the access key - aws-iam-update-access-key Disable the access key aws-iam-update-access-key Continue by remediation type Continue by remediation type Delete the access key - aws-iam-delete-access-key Delete the access key aws-iam-delete-access-key Done Done Choose a user for access key remediation Choose a user for access ... Check user answer Check user answer Choose resources to remediate Choose resources to remed... Check user answer Check user answer Set selected resources to remediate - Set Set selected resources to... Set Choose user to remediate Choose user to remediate Check user answer Check user answer Block IP - Generic v3 - Block IP - Generic v3 Block IP - Generic v3 Block IP - Generic v3 Done Done Should block indicators automatically? Should block indicators a... Choose indicators to block Choose indicators to block Check user answer Check user answer Set selected indicators to remediate - Set Set selected indicators t... Set