DSPM Multi-Cloud Risk Remediation

The playbook ensures efficient incident resolution and compliance with security policies by guiding the user through decision points based on incident type, such as empty storage assets or assets open to the world. It concludes by updating the incident status and closing the playbook upon resolution.

DSPM · 38 tasks · 3 inputs · 0 outputs

Inputs

  • defaultSlackUserName — In the event that the risk asset tag is absent, the risk notice will be sent to this Slack user email address.
  • slackMessageLifetime — Lifetime for slack notification (in seconds)
  • rerunTime — Incident re-run time (in hours)

Commands used

addToList closeInvestigation core-api-post createList getList setList

Flowchart

no yes no yes Invalid response Valid response no yes Invalid response Valid response #error# no yes #error# #error# add Start Start Closed current Incident playbook - closeInvestigation Closed current Incident ... closeInvestigation Get DSPM risk details - DSPMExtractRiskDetails Get DSPM risk details DSPMExtractRiskDetails Create a Slackblock list to send a user notification displaying risk information. - DSPMCreateRiskSlackBlocks Create a Slackblock list ... DSPMCreateRiskSlackBlocks Removing ${block_list_name} list from XSOAR LIST - core-api-post Removing ${block_list_nam... core-api-post Error while retrieving DSPM risk details? - DSPMCheckAndSetErrorEntries Error while retrieving DS... DSPMCheckAndSetErrorEntries Errors occurred when developing the Slack block list for the incident ID : ${incident.id} - DSPMCheckAndSetErrorEntries Errors occurred when deve... DSPMCheckAndSetErrorEntries closeInvestigation - closeInvestigation closeInvestigation closeInvestigation DSPM notify user in case of error - DSPM notify user in case of error DSPM notify user in case ... DSPM notify user in case of e... Delete incident from INCIDENT LIST - DSPMIncidentList Delete incident from INCI... DSPMIncidentList Check if the user action is invalid? Check if the user action ... Is there any error occurred in DSPM Invalid Response playbook? - isError Is there any error occurr... isError Create Slack block sending notification to user. - DSPMCreateSimpleSlackMessageBlock Create Slack block sendin... DSPMCreateSimpleSlackMessageB... Identify User-Selected Action Identify User-Selected Ac... DSPM Valid User Response - DSPM Valid User Response DSPM Valid User Response DSPM Valid User Response Sending notification to ${userSlackEmail} - SlackBlockBuilder Sending notification to $... SlackBlockBuilder Done Done Check list exists for Incident ID : ${incident.id} - getList Check list exists for Inc... getList Create new XSOAR list for Incident ID : ${incident.id} - createList Create new XSOAR list for... createList Save the customised slack block to the new XSOAR list. - createList Save the customised slack... createList Save the above slack block to the XSOAR list. - setList Save the above slack bloc... setList DSPM Send Slack Notification to User - DSPM Send Slack Notification to User DSPM Send Slack Notificat... DSPM Send Slack Notification ... DSPM Send Slack Notification to User - DSPM Send Slack Notification to User DSPM Send Slack Notificat... DSPM Send Slack Notification ... Notify user about error Notify user about error Create slack block message to send user Create slack block messag... Send slack notification to user Send slack notification t... Remediate Risk or Create Jira ticket Remediate Risk or Create ... Send an invalid response notification to the user and resend the remediation notification form to the user Send an invalid response ... Is Slack Integration available? - IsIntegrationAvailable Is Slack Integration avai... IsIntegrationAvailable Get DSPM Incident List - getList Get DSPM Incident List getList Create DSPM Incident list - createList Create DSPM Incident list createList Add incident for re-run - DSPMIncidentList Add incident for re-run DSPMIncidentList Get DSPM Incident List - getList Get DSPM Incident List getList Check incident list status? Check incident list status? Add incident in DSPM Incident list - addToList Add incident in DSPM Inc... addToList Clear previous all context data! - DeleteContext Clear previous all contex... DeleteContext Deleting slack block from context data after saving into xsoar list. - DeleteContext Deleting slack block from... DeleteContext Deleting slack block from context after saving into xsoar list. - DeleteContext Deleting slack block from... DeleteContext