Cloud Response - GCP

This playbook provides response actions to GCP. The following are available for execution automatically/manually: - Resource remediation: - Delete the instance - Stop the instance - Identity remediation: - Disable the user - Delete the user - Access key remediation: - Disable the access key - Delete the access key - Block indicators.

GCP Enrichment and Remediation · 40 tasks · 14 inputs · 0 outputs

Details

IDCloud Response - GCP
From Version6.5.0
Tasks40

README

This playbook provides response actions to GCP. The following are available for execution automatically/manually:

  • Resource remediation:
    • Delete the instance
    • Stop the instance
  • Identity remediation:
    • Disable the user
    • Delete the user
  • Access key remediation:
    • Disable the access key
    • Delete the access key
  • Block indicators

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Block IP - Generic v3

Integrations

This playbook does not use any integrations.

Scripts

  • Set

Commands

  • gcp-iam-service-account-disable
  • gcp-iam-service-account-key-disable
  • gsuite-user-delete
  • gcp-compute-stop-instance
  • gcp-iam-service-account-delete
  • gcp-iam-service-account-key-delete
  • gcp-compute-delete-instance

Playbook Inputs

Name Description Default Value Required
accessKeyRemediationType Choose the remediation type for the user’s access key.
Disable - For disabling the user’s access key.
Delete - For deleting user’s access key.		 Disable Optional
userRemediationType Choose the remediation type for the user involved.
Delete - For deleting the user.
Disable - For disabling the user.		 Disable Optional
resourceRemediationType Choose the remediation type for the instances created.
Stop - For stopping the instances.
Delete - For deleting the instances.		 Stop Optional
autoResourceRemediation Whether to execute the resource remediation flow automatically. False Optional
autoUserRemediation Whether to execute the user remediation flow automatically. False Optional
autoAccessKeyRemediation Whether to execute the access key remediation flow automatically. False Optional
autoBlockIndicators Whether to block the indicators automatically. False Optional
resourceName The resource name to take action on.   Optional
resourceZone The resource’s zone.   Optional
username The username to take action on.   Optional
accessKeyName The access key name in the following format:
projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}		   Optional
sourceIP The source IP address of the attacker.   Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Cloud Response - GCP

Inputs

  • accessKeyRemediationType — Choose the remediation type for the user's access key. Disable - For disabling the user's access key. Delete - For deleting user's access key.
  • userRemediationType — Choose the remediation type for the user involved. Delete - For deleting the user. Disable - For disabling the user.
  • resourceRemediationType — Choose the remediation type for the instances created. Stop - For stopping the instances. Delete - For deleting the instances.
  • autoResourceRemediation — Whether to execute the resource remediation flow automatically.
  • autoUserRemediation — Whether to execute the user remediation flow automatically.
  • autoAccessKeyRemediation — Whether to execute the access key remediation flow automatically.
  • autoBlockIndicators — Whether to block the indicators automatically.
  • resourceName — The resource name to take action on.
  • resourceZone — The resource's zone.
  • username — The username to take action on.
  • accessKeyName — The access key name in the following format: projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}
  • sourceIP — The source IP address of the attacker.
  • GCPprojectID — The GCP Project ID. Will be used for handling service account
  • accountType — Determine the account type you are dealing with: "user" / "service_account". Default: "user"

Commands used

gcp-compute-delete-instance gcp-compute-stop-instance gcp-iam-service-account-delete gcp-iam-service-account-disable gcp-iam-service-account-key-delete gcp-iam-service-account-key-disable gsuite-user-delete

Flowchart

yes yes Delete Disable yes yes Delete Disable User yes yes Delete Stop yes yes yes yes yes yes Start Start Resource Resource Block Indicators Block Indicators Identity Identity Privileges Privileges Is there an access key to remediate? Is there an access key to... Should remediate automatically? Should remediate automati... Disable the access key - gcp-iam-service-account-key-disable Disable the access key gcp-iam-service-account-key-d... Continue by remediation type Continue by remediation type Delete the access key - gcp-iam-service-account-key-delete Delete the access key gcp-iam-service-account-key-d... Done Done Is there a user to remediate? Is there a user to remedi... Should remediate automatically? Should remediate automati... Continue by remediation type Continue by remediation type Delete the user - gcp-iam-service-account-delete Delete the user gcp-iam-service-account-delete Done Done Is there a resource to remediate? Is there a resource to re... Should remediate automatically? Should remediate automati... Continue by remediation type Continue by remediation type Delete the instance - gcp-compute-delete-instance Delete the instance gcp-compute-delete-instance Stop the instance - gcp-compute-stop-instance Stop the instance gcp-compute-stop-instance Done Done Disable the user - gcp-iam-service-account-disable Disable the user gcp-iam-service-account-disable Choose resources to remediate Choose resources to remed... Check user answer Check user answer Set selected resources to remediate - Set Set selected resources to... Set Choose a user to remediate Choose a user to remediate Check user answer Check user answer Choose a user for access key remediation Choose a user for access ... Check user answer Check user answer Block IP - Generic v3 - Block IP - Generic v3 Block IP - Generic v3 Block IP - Generic v3 Done Done Should block indicators automatically? Should block indicators a... Choose indicators to block Choose indicators to block Check user answer Check user answer Set selected indicators to remediate - Set Set selected indicators t... Set Delete regular user - gsuite-user-delete Delete regular user gsuite-user-delete Check if the user is a service account Check if the user is a se... Set regular user pattern - Set Set regular user pattern Set Set service account user pattern - Set Set service account user ... Set

Source

playbook-Cloud_Response_-_GCP.yml
Download History Raw 
id: Cloud Response - GCP
version: -1
name: Cloud Response - GCP
description: |-
  This playbook provides response actions to GCP. The following are available for execution automatically/manually:
  - Resource remediation:
     - Delete the instance
     - Stop the instance
  - Identity remediation:
     - Disable the user
     - Delete the user
  - Access key remediation:
     - Disable the access key
     - Delete the access key
  - Block indicators.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: cf64eba4-df4f-44d1-84c4-65c9ef85b786
    type: start
    task:
      id: cf64eba4-df4f-44d1-84c4-65c9ef85b786
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "7"
      - "9"
      - "1"
      - "4"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 70,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 4e285d3b-924b-48ab-8bb3-b1092e74a8a5
    type: title
    task:
      id: 4e285d3b-924b-48ab-8bb3-b1092e74a8a5
      version: -1
      name: Resource
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "24"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1980,
          "y": 530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: daead8d0-6cad-4acb-811a-c5eeb75fda74
    type: title
    task:
      id: daead8d0-6cad-4acb-811a-c5eeb75fda74
      version: -1
      name: Block Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "43"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1830,
          "y": 530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 3e349c03-2c6a-4283-8a64-50a326832bc6
    type: title
    task:
      id: 3e349c03-2c6a-4283-8a64-50a326832bc6
      version: -1
      name: Identity
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "17"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 640,
          "y": 530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: d0710c00-62c5-4984-83af-85c319fc9699
    type: title
    task:
      id: d0710c00-62c5-4984-83af-85c319fc9699
      version: -1
      name: Privileges
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "10"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -750,
          "y": 530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 35a2a97e-51fc-41a7-88d6-24c7aa59c52c
    type: condition
    task:
      id: 35a2a97e-51fc-41a7-88d6-24c7aa59c52c
      version: -1
      name: Is there an access key to remediate?
      description: Checks if there is an access key available for remediation.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "16"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.accessKeyName
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -750,
          "y": 670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 0102ae72-ebe0-44ac-844f-5844d224320a
    type: condition
    task:
      id: 0102ae72-ebe0-44ac-844f-5844d224320a
      version: -1
      name: Should remediate automatically?
      description: Checks if the user chose automatic remediation.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "39"
      "yes":
      - "13"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.autoAccessKeyRemediation
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -750,
          "y": 860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: df4a0a5a-9ef2-4e1f-88eb-3859bc2f932b
    type: regular
    task:
      id: df4a0a5a-9ef2-4e1f-88eb-3859bc2f932b
      version: -1
      name: Disable the access key
      description: Disables a service account key.
      script: '|||gcp-iam-service-account-key-disable'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      key_name:
        complex:
          root: inputs.accessKeyName
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -750,
          "y": 1660
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 6ea41880-e0bd-4635-8243-a5449efbcff5
    type: condition
    task:
      id: 6ea41880-e0bd-4635-8243-a5449efbcff5
      version: -1
      name: Continue by remediation type
      description: Checks for the user's chosen remediation type.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      Delete:
      - "14"
      Disable:
      - "12"
    separatecontext: false
    conditions:
    - label: Delete
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.accessKeyRemediationType
            iscontext: true
          right:
            value:
              simple: Rotate
          ignorecase: true
    - label: Disable
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.accessKeyRemediationType
            iscontext: true
          right:
            value:
              simple: Disable
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -750,
          "y": 1400
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 6ad0514c-34c6-45d4-888a-6336734940aa
    type: regular
    task:
      id: 6ad0514c-34c6-45d4-888a-6336734940aa
      version: -1
      name: Delete the access key
      description: Deletes a service account key.
      script: '|||gcp-iam-service-account-key-delete'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      key_name:
        complex:
          root: inputs.accessKeyName
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -330,
          "y": 1660
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: 250543fb-7b16-48fb-8de6-0bdd0681c273
    type: title
    task:
      id: 250543fb-7b16-48fb-8de6-0bdd0681c273
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1430,
          "y": 1840
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: ef7d1d56-2219-4e84-8363-9847b74d54df
    type: condition
    task:
      id: ef7d1d56-2219-4e84-8363-9847b74d54df
      version: -1
      name: Is there a user to remediate?
      description: Checks if there is a user available for remediation.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "23"
      "yes":
      - "48"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.username
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 640,
          "y": 670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: 0c7568e0-ca17-44f2-80fc-1944b2f51b40
    type: condition
    task:
      id: 0c7568e0-ca17-44f2-80fc-1944b2f51b40
      version: -1
      name: Should remediate automatically?
      description: Checks if the user chose automatic remediation.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "37"
      "yes":
      - "19"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.autoUserRemediation
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 630,
          "y": 1220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: 2ee9ba9a-9171-4cf5-8ab6-5eeee52bbb45
    type: condition
    task:
      id: 2ee9ba9a-9171-4cf5-8ab6-5eeee52bbb45
      version: -1
      name: Continue by remediation type
      description: Checks for the user's chosen remediation type.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      Delete:
      - "20"
      Disable:
      - "33"
      User:
      - "47"
    separatecontext: false
    conditions:
    - label: User
      condition:
      - - operator: notContainsGeneral
          left:
            value:
              complex:
                root: inputs.username
            iscontext: true
          right:
            value:
              simple: gserviceaccount
          ignorecase: true
    - label: Disable
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.userRemediationType
            iscontext: true
          right:
            value:
              simple: Revoke
          ignorecase: true
    - label: Delete
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.userRemediationType
            iscontext: true
          right:
            value:
              simple: Delete
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 630,
          "y": 1750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "20":
    id: "20"
    taskid: 1bde297b-0d24-4663-8b78-6034dc4c26ea
    type: regular
    task:
      id: 1bde297b-0d24-4663-8b78-6034dc4c26ea
      version: -1
      name: Delete the user
      description: Deletes a service account.
      script: '|||gcp-iam-service-account-delete'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "23"
    scriptarguments:
      service_account_name:
        complex:
          root: Manual user remediation.Answers
          accessor: "0"
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: username
                iscontext: true
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: service_account
                iscontext: true
          - operator: uniq
          - operator: RemoveEmpty
            args:
              empty_values: {}
              remove_keys:
                value:
                  simple: "true"
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 630,
          "y": 1960
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: 710a1688-0775-418f-8cf2-3ff25fce9336
    type: title
    task:
      id: 710a1688-0775-418f-8cf2-3ff25fce9336
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -50,
          "y": 2210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: ac88602d-417d-4649-8f84-64cfc1f0a244
    type: condition
    task:
      id: ac88602d-417d-4649-8f84-64cfc1f0a244
      version: -1
      name: Is there a resource to remediate?
      description: Checks if there is a resource available for remediation.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "30"
      "yes":
      - "25"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.resourceName
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1980,
          "y": 670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: 050459fa-9edc-4342-8f51-ec4b535e1090
    type: condition
    task:
      id: 050459fa-9edc-4342-8f51-ec4b535e1090
      version: -1
      name: Should remediate automatically?
      description: Checks if the user chose automatic remediation.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "34"
      "yes":
      - "26"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.autoResourceRemediation
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1980,
          "y": 860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: dcd2adf0-93e1-4672-8cd6-29469a65105b
    type: condition
    task:
      id: dcd2adf0-93e1-4672-8cd6-29469a65105b
      version: -1
      name: Continue by remediation type
      description: Checks for the user's chosen remediation type.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      Delete:
      - "27"
      Stop:
      - "28"
    separatecontext: false
    conditions:
    - label: Delete
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.resourceRemediationType
            iscontext: true
          right:
            value:
              simple: Terminate
          ignorecase: true
    - label: Stop
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.resourceRemediationType
            iscontext: true
          right:
            value:
              simple: Stop
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1980,
          "y": 1605
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "27":
    id: "27"
    taskid: b7c92358-4c34-42ab-844a-87cc9cbac517
    type: regular
    task:
      id: b7c92358-4c34-42ab-844a-87cc9cbac517
      version: -1
      name: Delete the instance
      description: Deletes the specified instance resource. For more information, see Stopping or Deleting an Instance.
      script: '|||gcp-compute-delete-instance'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "30"
    scriptarguments:
      instance:
        complex:
          root: remediateResourceList
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: inputs.resourceName
                iscontext: true
      zone:
        complex:
          root: inputs.resourceZone
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1730,
          "y": 1800
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "28":
    id: "28"
    taskid: 434c2cb3-871e-4e21-8035-bd26a4287da4
    type: regular
    task:
      id: 434c2cb3-871e-4e21-8035-bd26a4287da4
      version: -1
      name: Stop the instance
      description: Stops a running instance, shutting it down cleanly, and allows you to restart the instance at a later time. Stopped instances do not incur VM usage charges while they are stopped. However, resources that the VM is using, such as persistent disks and static IP addresses, will continue to be charged until they are deleted. For more information, see Stopping an instance.
      script: '|||gcp-compute-stop-instance'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "30"
    scriptarguments:
      instance:
        complex:
          root: remediateResourceList
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: inputs.resourceName
                iscontext: true
      zone:
        complex:
          root: inputs.resourceZone
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2250,
          "y": 1800
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "30":
    id: "30"
    taskid: 4103b833-432f-4188-81e4-624e0ce96ab6
    type: title
    task:
      id: 4103b833-432f-4188-81e4-624e0ce96ab6
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1340,
          "y": 2145
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "33":
    id: "33"
    taskid: 085fbe39-ffbe-4094-8566-f791528d9a3f
    type: regular
    task:
      id: 085fbe39-ffbe-4094-8566-f791528d9a3f
      version: -1
      name: Disable the user
      description: Disables a project service account.
      script: '|||gcp-iam-service-account-disable'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "23"
    scriptarguments:
      service_account_name:
        complex:
          root: Manual user remediation.Answers
          accessor: "0"
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: inputs.username
                iscontext: true
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: service_account
                iscontext: true
          - operator: uniq
          - operator: RemoveEmpty
            args:
              empty_values: {}
              remove_keys:
                value:
                  simple: "true"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1050,
          "y": 1960
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "34":
    id: "34"
    taskid: f6ad987e-75a5-4529-8c7f-08ff8953346c
    type: collection
    task:
      id: f6ad987e-75a5-4529-8c7f-08ff8953346c
      version: -1
      name: Choose resources to remediate
      description: Check whether the values provided in arguments are equal. If either of the arguments are missing, nothing is returned.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "35"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1600,
          "y": 1090
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
        simple: ${incident.assigneduser}
      subject:
        simple: Cloud Response - GCP - Resource Remediation
      body:
        simple: Analyst interaction is needed for the resource remediation.
      methods:
      - email
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Choose resources to remediate
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: inputs.resourceName
            transformers:
            - operator: uniq
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Manual resource remediation
      description: ""
      sender: Your SOC team
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "35":
    id: "35"
    taskid: acc1466a-abd3-474a-877d-cba5d4ce452b
    type: condition
    task:
      id: acc1466a-abd3-474a-877d-cba5d4ce452b
      version: -1
      name: Check user answer
      description: Checks the user's answer.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "30"
      "yes":
      - "36"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: Manual resource remediation.Answers
                accessor: "0"
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1600,
          "y": 1250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "36":
    id: "36"
    taskid: f4cc0f82-e042-4d02-8776-ddc8f91bf93a
    type: regular
    task:
      id: f4cc0f82-e042-4d02-8776-ddc8f91bf93a
      version: -1
      name: Set selected resources to remediate
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "26"
    scriptarguments:
      key:
        simple: remediateResourceList
      value:
        complex:
          root: Manual resource remediation.Answers.0
          filters:
          - - operator: isNotEqualString
              left:
                value:
                  simple: Manual resource remediation.Answers.0
                iscontext: true
              right:
                value:
                  simple: ALL
              ignorecase: true
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: inputs.resourceName
                iscontext: true
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1600,
          "y": 1430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "37":
    id: "37"
    taskid: 52e5c7ce-7d4a-4b74-8761-9c3d05929209
    type: collection
    task:
      id: 52e5c7ce-7d4a-4b74-8761-9c3d05929209
      version: -1
      name: Choose a user to remediate
      description: Check whether the values provided in arguments are equal. If either of the arguments are missing, nothing is returned.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "38"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 180,
          "y": 1400
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
        simple: ${incident.assigneduser}
      subject:
        simple: Cloud Response - GCP - User Remediation
      body:
        simple: Analyst interaction is needed for the user remediation.
      methods:
      - email
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Choose user to remediate
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: username
            transformers:
            - operator: append
              args:
                item:
                  value:
                    simple: service_account
                  iscontext: true
            - operator: uniq
            - operator: RemoveEmpty
              args:
                empty_values: {}
                remove_keys:
                  value:
                    simple: "true"
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Manual user remediation
      description: ""
      sender: Your SOC team
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "38":
    id: "38"
    taskid: c7ec6a0c-fe6b-4a31-8841-142794939002
    type: condition
    task:
      id: c7ec6a0c-fe6b-4a31-8841-142794939002
      version: -1
      name: Check user answer
      description: Checks the user's answer.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "23"
      "yes":
      - "19"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: Manual user remediation.Answers
                accessor: "0"
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 180,
          "y": 1560
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "39":
    id: "39"
    taskid: 44972c36-ce1e-403d-8f23-3654f35aaff7
    type: collection
    task:
      id: 44972c36-ce1e-403d-8f23-3654f35aaff7
      version: -1
      name: Choose a user for access key remediation
      description: Check whether the values provided in arguments are equal. If either of the arguments are missing, nothing is returned.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "40"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1140,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
        simple: ${incident.assigneduser}
      subject:
        simple: Cloud Response - GCP - Access Key Remediation
      body:
        simple: Analyst interaction is needed for the user's access key remediation.
      methods:
      - email
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Choose the user for access key remediation
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: inputs.username
            transformers:
            - operator: uniq
        - simple: None
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Manual access key remediation
      description: ""
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "40":
    id: "40"
    taskid: abea9bd3-ea7d-42a7-8a90-af2faaafd301
    type: condition
    task:
      id: abea9bd3-ea7d-42a7-8a90-af2faaafd301
      version: -1
      name: Check user answer
      description: Checks the user's answer.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "16"
      "yes":
      - "13"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: Manual access key remediation.Answers
                accessor: "0"
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1140,
          "y": 1230
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "41":
    id: "41"
    taskid: 4f647538-9413-4e60-889d-15ccc0bda9d6
    type: playbook
    task:
      id: 4f647538-9413-4e60-889d-15ccc0bda9d6
      version: -1
      name: Block IP - Generic v3
      description: "This playbook blocks malicious IP addresses using all integrations that are enabled. The direction of the traffic that will be blocked is determined by the Cortex XSOAR user (and set by default to outgoing).\nNote the following:\n-  Some of those integrations require specific parameters to run, which are based on the playbook inputs. Also, certain integrations use FW rules or appended network objects.\n- Note that the appended network objects should be specified in blocking rules inside the system later on. \n\n\nSupported integrations for this playbook [Network security products such as FW/WAF/IPs/etc.]: \n\n* Check Point Firewall\n* Palo Alto Networks PAN-OS\n* Zscaler\n* FortiGate\n* Aria Packet Intelligence\n* Cisco Firepower \n* Cisco Secure Cloud Analytics\n* Cisco ASA\n* Akamai WAF\n* F5 SilverLine\n* ThreatX\n* Signal Sciences WAF\n* Sophos Firewall\n\n"
      playbookName: Block IP - Generic v3
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "42"
    scriptarguments:
      AutoCommit:
        simple: "No"
      CustomBlockRule:
        simple: "True"
      IP:
        complex:
          root: blockIndicatorsList
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: inputs.sourceIP
                iscontext: true
          - operator: uniq
      InputEnrichment:
        simple: "False"
      RuleDirection:
        simple: inbound
      RuleName:
        simple: XSOAR - Block IP playbook - ${incident.id}
      UserVerification:
        simple: "False"
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -1830,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "42":
    id: "42"
    taskid: 70e627c4-1366-4679-8ebc-174bf130f7e1
    type: title
    task:
      id: 70e627c4-1366-4679-8ebc-174bf130f7e1
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -2410,
          "y": 1610
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "43":
    id: "43"
    taskid: 34d1f3f4-55cf-43d8-8859-76aa49ee3def
    type: condition
    task:
      id: 34d1f3f4-55cf-43d8-8859-76aa49ee3def
      version: -1
      name: Should block indicators automatically?
      description: Checks whether the user chose automatic remediation.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "44"
      "yes":
      - "41"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.autoBlockIndicators
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1830,
          "y": 670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "44":
    id: "44"
    taskid: 1c979519-3966-4131-8ccb-8fa5a22aee70
    type: collection
    task:
      id: 1c979519-3966-4131-8ccb-8fa5a22aee70
      version: -1
      name: Choose indicators to block
      description: Check whether the values provided in arguments are equal. If either of the arguments are missing, nothing is returned.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "45"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -2110,
          "y": 860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
        simple: ${incident.assigneduser}
      subject:
        simple: Cloud Response - GCP - Block Indicators
      body:
        simple: Analyst interaction is needed for the indicators remediation.
      methods:
      - email
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Choose indicators to block
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: inputs.sourceIP
            transformers:
            - operator: uniq
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Block Indicators
      description: ""
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "45":
    id: "45"
    taskid: 2b930c09-2a7a-473a-8606-b8e2cd2f0618
    type: condition
    task:
      id: 2b930c09-2a7a-473a-8606-b8e2cd2f0618
      version: -1
      name: Check user answer
      description: Checks the user's answer.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "42"
      "yes":
      - "46"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: Block Indicators.Answers
                accessor: "0"
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -2110,
          "y": 1060
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "46":
    id: "46"
    taskid: f4e8b070-914f-47c4-8720-6746d9de54bb
    type: regular
    task:
      id: f4e8b070-914f-47c4-8720-6746d9de54bb
      version: -1
      name: Set selected indicators to remediate
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "41"
    scriptarguments:
      key:
        simple: blockIndicatorsList
      value:
        complex:
          root: Block Indicators.Answers
          accessor: "0"
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -2110,
          "y": 1250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "47":
    id: "47"
    taskid: cae32c6c-c9f5-4392-87ea-4fd3d72f588c
    type: regular
    task:
      id: cae32c6c-c9f5-4392-87ea-4fd3d72f588c
      version: -1
      name: Delete regular user
      description: Deletes a user.
      script: '|||gsuite-user-delete'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "23"
    scriptarguments:
      user_key:
        complex:
          root: Manual user remediation.Answers
          accessor: "0"
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: username
                iscontext: true
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: service_account
                iscontext: true
          - operator: uniq
          - operator: RemoveEmpty
            args:
              empty_values: {}
              remove_keys:
                value:
                  simple: "true"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 210,
          "y": 1960
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "48":
    id: "48"
    taskid: f0d5235c-42a6-494b-84cd-dfd057f01729
    type: condition
    task:
      id: f0d5235c-42a6-494b-84cd-dfd057f01729
      version: -1
      name: Check if the user is a service account
      description: Check if the user is a service account.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "50"
      "yes":
      - "51"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.accountType
            iscontext: true
          right:
            value:
              simple: service_account
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 640,
          "y": 870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "50":
    id: "50"
    taskid: b735ecde-e743-450e-8ffb-edbc3bac25a1
    type: regular
    task:
      id: b735ecde-e743-450e-8ffb-edbc3bac25a1
      version: -1
      name: Set regular user pattern
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      key:
        simple: username
      value:
        complex:
          root: inputs.username
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 430,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "51":
    id: "51"
    taskid: 64c46d68-3417-4cf5-8d7c-a0b7c03ef352
    type: regular
    task:
      id: 64c46d68-3417-4cf5-8d7c-a0b7c03ef352
      version: -1
      name: Set service account user pattern
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      key:
        simple: service_account
      value:
        simple: projects/${inputs.GCPprojectID}/serviceAccount/${inputs.username}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 840,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "10_11_yes": 0.42,
      "10_16_#default#": 0.44,
      "11_13_yes": 0.27,
      "11_39_#default#": 0.57,
      "17_23_#default#": 0.43,
      "18_19_yes": 0.47,
      "18_37_#default#": 0.57,
      "24_25_yes": 0.41,
      "24_30_#default#": 0.37,
      "25_26_yes": 0.41,
      "25_34_#default#": 0.56,
      "26_27_Delete": 0.68,
      "35_30_#default#": 0.32,
      "35_36_yes": 0.51,
      "38_23_#default#": 0.28,
      "40_13_yes": 0.44,
      "40_16_#default#": 0.27
    },
    "paper": {
      "dimensions": {
        "height": 1905,
        "width": 5040,
        "x": -2410,
        "y": 370
      }
    }
  }
inputs:
- key: accessKeyRemediationType
  value:
    simple: Disable
  required: false
  description: |-
    Choose the remediation type for the user's access key.
    Disable - For disabling the user's access key.
    Delete - For deleting user's access key.
  playbookInputQuery:
- key: userRemediationType
  value:
    simple: Disable
  required: false
  description: |-
    Choose the remediation type for the user involved.
    Delete - For deleting the user.
    Disable - For disabling the user.
  playbookInputQuery:
- key: resourceRemediationType
  value:
    simple: Stop
  required: false
  description: |-
    Choose the remediation type for the instances created.
    Stop - For stopping the instances.
    Delete - For deleting the instances.
  playbookInputQuery:
- key: autoResourceRemediation
  value:
    simple: "False"
  required: false
  description: Whether to execute the resource remediation flow automatically.
  playbookInputQuery:
- key: autoUserRemediation
  value:
    simple: "False"
  required: false
  description: Whether to execute the user remediation flow automatically.
  playbookInputQuery:
- key: autoAccessKeyRemediation
  value:
    simple: "False"
  required: false
  description: Whether to execute the access key remediation flow automatically.
  playbookInputQuery:
- key: autoBlockIndicators
  value:
    simple: "False"
  required: false
  description: Whether to block the indicators automatically.
  playbookInputQuery:
- key: resourceName
  value: {}
  required: false
  description: The resource name to take action on.
  playbookInputQuery:
- key: resourceZone
  value: {}
  required: false
  description: The resource's zone.
  playbookInputQuery:
- key: username
  value: {}
  required: false
  description: The username to take action on.
  playbookInputQuery:
- key: accessKeyName
  value: {}
  required: false
  description: |-
    The access key name in the following format:
    projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}
  playbookInputQuery:
- key: sourceIP
  value: {}
  required: false
  description: The source IP address of the attacker.
  playbookInputQuery:
- description: "The GCP Project ID. Will be used for handling service account"
  key: GCPprojectID
  playbookInputQuery:
  required: false
  value: {}
- description: "Determine the account type you are dealing with: \"user\" / \"service_account\". Default: \"user\""
  key: accountType
  playbookInputQuery:
  required: false
  value:
    simple: "user"
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.5.0
contentitemexportablefields:
  contentitemfields: {}
system: true