Handle Shadow IT Incident

This Playbook is used to handle a Shadow IT incident. A Shadow IT incident occurs when a resource attributed to the organization that is not sanctioned by IT nor protected by the InfoSec team is found. This playbook handles the incident by helping the analyst to find the owner of the resource based on existing evidence. The playbook also marks the service indicators (IP or FQDN) with a Shadow IT tag. The possible owner and their manager are notified and onboarding of the asset on Prisma Cloud is triggered through a manual process.

Shadow IT · 44 tasks · 4 inputs · 0 outputs

Inputs

  • Notify Manager — Notify user's manager
  • ShadowITIndicatorTags — Tags to add to indicators to identify potential Shadow IT assets
  • ManagerNotificationSubjectPrefix — This input is added as prefix to the owner name to build the subject of the email sent to the owner's manager.
  • ManagerNotificationBody — Body of the email to send to the owner's manager.

Commands used

appendIndicatorField findIndicators send-mail setIncident

Flowchart

yes AWS AZURE GCP ADD-NEW UNKNOWN yes yes yes yes yes yes yes ✅ Yes ❌ No ✅ Yes ❌ No yes Start Start Collect Service details from Asset owner Collect Service details f... Is owner known? Is owner known? Print Potential Asset Owners Print Potential Asset Owners Cloud Type Cloud Type Manually handling of Shadow IT incident Manually handling of Shad... Done Collecting Information Done Collecting Information Collect information Collect information Done Prisma Cloud Onboarding Done Prisma Cloud Onboarding Done Done Onboard Cloud Account on Prisma Cloud Onboard Cloud Account on ... Onboard Azure Cloud Account on Prisma Cloud Onboard Azure Cloud Accou... Onboard GCP Cloud Account on Prisma Cloud Onboard GCP Cloud Account... Choose Asset Owner Choose Asset Owner Add new owner? Add new owner? Insert owner name and email Insert owner name and email Set asset owner name and email in incident - setIncident Set asset owner name and ... setIncident Set asset owner name and email in incident - setIncident Set asset owner name and ... setIncident Set Incident Information based on responses - setIncident Set Incident Information ... setIncident Does the service contain sensitive information? Does the service contain ... Set Shadow IT Risk and Severity to Critical - setIncident Set Shadow IT Risk and Se... setIncident Did the user confirm they own the asset? Did the user confirm they... Find owner and collect information manually Find owner and collect in... Notify Manager Notify Manager Active Directory - Get User Manager Details - Active Directory - Get User Manager Details Active Directory - Get Us... Active Directory - Get User M... Shall we notify user's manager? Shall we notify user's ma... Done Notify Manager Done Notify Manager Did we find the user's manager? Did we find the user's ma... Notify User's manager - send-mail Notify User's manager send-mail Tag Shadow IT Indicators Tag Shadow IT Indicators Is there an IP? Is there an IP? Find IP Indicator - findIndicators Find IP Indicator findIndicators Is there a FQDN? Is there a FQDN? Find FQDN Indicator - findIndicators Find FQDN Indicator findIndicators Are there Shadow IT Indicators? Are there Shadow IT Indic... Tag Shadow IT Indicators - appendIndicatorField Tag Shadow IT Indicators appendIndicatorField Done Tagging Shadow IT Indicators Done Tagging Shadow IT In... Identify Owner Identify Owner Done Identifying Owner Done Identifying Owner Restrict outgoing traffic to this service? Restrict outgoing traffic... Onboard this account on Prisma Cloud? Onboard this account on P... Onboard AWS Cloud Account on Prisma Cloud Onboard AWS Cloud Account... Prisma Cloud Onboarding Prisma Cloud Onboarding Do we have suggested owners? Do we have suggested owners?