Cloud Response - Azure

This playbook provides response actions to Azure. The following are available for execution automatically/manually: - Resource remediation - Delete the instance - Power off the instance - Identity remediation: - Disable the user - Delete the user - Block indicators.

Azure Enrichment and Remediation · 28 tasks · 9 inputs · 0 outputs

Inputs

  • resourceRemediationType — Choose the remediation type for the instances created. Poweroff - for shutting down the instances. Delete - for deleting the instances.
  • userRemediationType — Choose the remediation type for the user involved. Disable - for disabling the user. Delete - for deleting the user.
  • autoResourceRemediation — Whether to execute the resource remediation flow automatically.
  • autoUserRemediation — Whether to execute the user remediation flow automatically.
  • autoBlockIndicators — Whether to block the indicators automatically.
  • resourceName — The resource name to take action on.
  • resourceGroup — The resource group.
  • username — The username to take action on.
  • sourceIP — The source IP address of the attacker.

Commands used

azure-vm-delete-instance azure-vm-poweroff-instance msgraph-user-account-disable msgraph-user-delete msgraph-user-session-revoke

Flowchart

yes yes Delete Disable yes yes Delete Power Off yes yes yes yes Start Start Resource Resource Block Indicators Block Indicators Identity Identity Is there a user to remediate? Is there a user to remedi... Should remediate automatically? Should remediate automati... Continue by remediation type Continue by remediation type Disable the user - msgraph-user-account-disable Disable the user msgraph-user-account-disable Delete the user - msgraph-user-delete Delete the user msgraph-user-delete Done Done Is there a resource to remediate? Is there a resource to re... Should remediate automatically? Should remediate automati... Continue by remediation type Continue by remediation type Poweroff the instance - azure-vm-poweroff-instance Poweroff the instance azure-vm-poweroff-instance Delete the instance - azure-vm-delete-instance Delete the instance azure-vm-delete-instance Done Done Block IP - Generic v3 - Block IP - Generic v3 Block IP - Generic v3 Block IP - Generic v3 Done Done Choose user to remediate Choose user to remediate Check user answer Check user answer Should block indicators automatically? Should block indicators a... Choose indicators to block Choose indicators to block Check user answer Check user answer Set selected indicators to remediate - Set Set selected indicators t... Set Check user answer Check user answer Set selected resources to remediate - Set Set selected resources to... Set Choose resources to remediate Choose resources to remed... Revoke user's existing sessions - msgraph-user-session-revoke Revoke user's existing se... msgraph-user-session-revoke