Cloud Response - AWS
This playbook provides response actions to AWS. The following are available for execution automatically/manually: - Resource remediation: - Terminate the instance - Stop the instance - Identity remediation: - Delete the user - Revoke the user's credentials - Access key remediation: - Disable the access key - Delete the access key - Block indicators.
AWS Enrichment and Remediation · 36 tasks · 12 inputs · 0 outputs
Inputs
accessKeyRemediationType— Choose the remediation type for the user's access key. Disable - for disabling the user's access key. Delete - for the user's access key deletion.userRemediationType— Choose the remediation type for the user involved. Delete - for the user deletion. Revoke - for revoking the user's credentials.resourceRemediationType— Choose the remediation type for the instances created. Stop - for stopping the instances. Terminate - for terminating the instances.autoResourceRemediation— Whether to execute the resource remediation flow automatically.autoUserRemediation— Whether to execute the user remediation flow automatically.autoAccessKeyRemediation— Whether to execute the access key remediation flow automatically.autoBlockIndicators— Whether to block the indicators automatically.resourceName— The resource name to take action on.region— The resource's region.username— The username to take action on.accessKeyId— The user's access key ID.sourceIP— The source IP address of the attacker.
Commands used
aws-ec2-stop-instances
aws-ec2-terminate-instances
aws-iam-delete-access-key
aws-iam-delete-login-profile
aws-iam-delete-user
aws-iam-update-access-key