Cortex XDR - AWS IAM user access investigation Deprecated

Deprecated. Use `Cortex XDR - Cloud IAM User Access Investigation` instead. Investigate and respond to Cortex XDR Cloud alerts where an AWS IAM user`s access key is used suspiciously to access the cloud environment. The following alerts are supported for AWS environments. - Penetration testing tool attempt - Penetration testing tool activity - Suspicious API call from a Tor exit node This is a beta playbook, which lets you implement and test pre-release software. At the moment we support AWS but are working towards multi-cloud support. Since the playbook is beta, it might contain bugs. Updates to the playbook during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the content to help us identify issues, fix them, and continually improve.

Cortex XDR by Palo Alto Networks · 35 tasks · 4 inputs · 0 outputs

Inputs

  • IndicatorTag — Tag name for bad reputation IP addresses investigated in the incident. Use it when the EDL service is configured to add indicators to block in PANW PAN-OS. If indicator verdict (Malicious/Bad) is used to add indicators to XSOAR EDL you don't need to use the tag. Indicators will be set as malicious automatically in the incident.
  • DAG — This input determines whether Palo Alto Networks Panorama or Firewall Dynamic Address Groups are used. Specify the Dynamic Address Group tag name for IP handling.
  • AutoBlockIP — True/False to initiate block IP playbook automatically
  • AutoDeleteProfile — True/False to automatically delete the user login profile if it exists.

Commands used

aws-iam-delete-login-profile aws-iam-get-user-login-profile aws-iam-update-access-key ip setIncident setIndicators xdr-get-cloud-original-alerts xdr-get-incident-extra-data xdr-xql-generic-query

Flowchart

yes No Yes yes yes Delete profile Yes yes yes yes Start Start Get incident extra data - xdr-get-incident-extra-data Get incident extra data xdr-get-incident-extra-data Get original cloud alert - xdr-get-cloud-original-alerts Get original cloud alert xdr-get-cloud-original-alerts Collect Additional Data Collect Additional Data XQL Query - Last 100 API calls made with the access key - xdr-xql-generic-query XQL Query - Last 100 API ... xdr-xql-generic-query Remediation Remediation Set compromised IAM access key as inactive - aws-iam-update-access-key Set compromised IAM acces... aws-iam-update-access-key Delete user login profile to AWS console - aws-iam-delete-login-profile Delete user login profile... aws-iam-delete-login-profile AWS IAM - User enrichment - AWS IAM - User enrichment AWS IAM - User enrichment AWS IAM - User enrichment Investigate collected data Investigate collected data XQL Query - Actions performed by the user in the last 7 days - xdr-xql-generic-query XQL Query - Actions perfo... xdr-xql-generic-query Is it a Tor IP? Is it a Tor IP? Done Done Block IP - Generic v2 - Block IP - Generic v2 Block IP - Generic v2 Block IP - Generic v2 Decision making - true/false-positive alert Decision making - true/fa... False Positive - Done False Positive - Done Validate access key type is AKIA Validate access key type ... Investigation Investigation Check for AWS user login profile Check for AWS user login ... Enrich Source IP addresses - ip Enrich Source IP addresses ip New IP addresses were found in the XQL query results? New IP addresses were fou... Enrich new IP addresses - ip Enrich new IP addresses ip Check for supported xcloud alerts Check for supported xclou... Done - No supported alerts Done - No supported alerts Done - No supported alerts Done - No supported alerts Tag indicators for EDL - setIndicators Tag indicators for EDL setIndicators Automated block IP playbook? Automated block IP playbook? Block IP - Manual Block IP - Manual Set Remediation Action - Set Set Remediation Action Set Set Remediation Action - Set Set Remediation Action Set Set Remediation Action - Set Set Remediation Action Set Set incident type to XCLOUD - setIncident Set incident type to XCLOUD setIncident AWS IAM - Get user profile - aws-iam-get-user-login-profile AWS IAM - Get user profile aws-iam-get-user-login-profile Automatically delete user login profile? Automatically delete user... Delete user login profile - Manual Delete user login profile...