DSPM Remediation for Empty storage asset

This playbook is designed to remediate risks associated with empty storage assets across AWS, Azure, and GCP environments. It identifies the cloud provider for the asset and proceeds to delete the storage container or bucket accordingly. Additionally, it sends notifications via Slack to inform stakeholders about the status of the remediation process.

DSPM · 23 tasks · 0 inputs · 0 outputs

Commands used

aws-s3-delete-bucket dspm-update-risk-finding-status gcs-delete-bucket setList

Flowchart

AWS Azure GCP no yes no yes no yes no yes Start Start Delete Google Cloud Storage bucket - gcs-delete-bucket Delete Google Cloud Stora... gcs-delete-bucket Delete AWS - S3 bucket - aws-s3-delete-bucket Delete AWS - S3 bucket aws-s3-delete-bucket Check the Cloud Provider of asset Check the Cloud Provider ... Is AWS - S3 Integration Available? - IsIntegrationAvailable Is AWS - S3 Integration A... IsIntegrationAvailable Is Google Cloud Storage Integration Available? - IsIntegrationAvailable Is Google Cloud Storage I... IsIntegrationAvailable AWS AWS Azure Azure Google Cloud Provider (GCP) Google Cloud Provider (GCP) Have you encountered any errors with mitigating asset risk? - DSPMCheckAndSetErrorEntries Have you encountered any ... DSPMCheckAndSetErrorEntries Updating DSPM risk - ${incident.riskFindingId} status to 'INVESTIGATING'. - dspm-update-risk-finding-status Updating DSPM risk - ${in... dspm-update-risk-finding-status Have encountered any errors while updating risk status on DSPM portal? - DSPMCheckAndSetErrorEntries Have encountered any erro... DSPMCheckAndSetErrorEntries Add incident for re-run - DSPMIncidentList Add incident for re-run DSPMIncidentList Done Done Create Slack block for sending success message notification to user. - DSPMCreateSimpleSlackMessageBlock Create Slack block for se... DSPMCreateSimpleSlackMessageB... Save the above slack block to the XSOAR list. - setList Save the above slack bloc... setList Create Slack block for sending error message notification to user. - DSPMCreateSimpleSlackMessageBlock Create Slack block for se... DSPMCreateSimpleSlackMessageB... Create Slack block for sending error message notification to user. - DSPMCreateSimpleSlackMessageBlock Create Slack block for se... DSPMCreateSimpleSlackMessageB... Save the above slack block to the XSOAR list. - setList Save the above slack bloc... setList Create Slack block for sending error message notification to user. - DSPMCreateSimpleSlackMessageBlock Create Slack block for se... DSPMCreateSimpleSlackMessageB... Deleting slack block from context data after saving into xsoar list. - DeleteContext Deleting slack block from... DeleteContext Deleting slack block from context data after saving into xsoar list. - DeleteContext Deleting slack block from... DeleteContext Create Slack block for Azure Empty Storage notification - DSPMCreateSimpleSlackMessageBlock Create Slack block for Az... DSPMCreateSimpleSlackMessageB...