Cloud Response - GCP

Inputs

• accessKeyRemediationType — Choose the remediation type for the user's access key. Disable - For disabling the user's access key. Delete - For deleting user's access key.
• userRemediationType — Choose the remediation type for the user involved. Delete - For deleting the user. Disable - For disabling the user.
• resourceRemediationType — Choose the remediation type for the instances created. Stop - For stopping the instances. Delete - For deleting the instances.
• autoResourceRemediation — Whether to execute the resource remediation flow automatically.
• autoUserRemediation — Whether to execute the user remediation flow automatically.
• autoAccessKeyRemediation — Whether to execute the access key remediation flow automatically.
• autoBlockIndicators — Whether to block the indicators automatically.
• resourceName — The resource name to take action on.
• resourceZone — The resource's zone.
• username — The username to take action on.
• accessKeyName — The access key name in the following format: projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}
• sourceIP — The source IP address of the attacker.
• GCPprojectID — The GCP Project ID. Will be used for handling service account
• accountType — Determine the account type you are dealing with: "user" / "service_account". Default: "user"

Commands used