IP Whitelist - AWS Security Group

Sync a list of IP addresses to an AWS Security Group.

AWS - EC2 · 18 tasks · 4 inputs · 0 outputs

Details

IDIP Whitelist - AWS Security Group
From Version5.5.0
Tasks18

README

Sync a list of IP addresses to an AWS Security Group.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

  • AWS - EC2
  • AWS-EC2

Scripts

  • Set
  • CompareLists

Commands

  • removeIndicatorField
  • aws-ec2-describe-security-groups
  • aws-ec2-revoke-security-group-ingress-rule
  • setIndicator
  • aws-ec2-authorize-security-group-ingress-rule

Playbook Inputs

Name Description Default Value Required
Indicator Query Indicators matching the indicator query will be used as playbook input   Optional
IP IP addresses to set in the allow list   Required
SecurityGroupName Name of the AWS Security Group to update   Required
IndicatorTagName Name of the Indicator Tag to apply to any IPs allowed by this playbook. AWS_IP_Whitelist Required

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

IP Whitelist - AWS Security Group

Inputs

  • —
  • IP — IP addresses to set in the allow list
  • SecurityGroupName — Name of the AWS Security Group to update
  • IndicatorTagName — Name of the Indicator Tag to apply to any IPs allowed by this playbook.

Commands used

aws-ec2-authorize-security-group-ingress-rule aws-ec2-describe-security-groups aws-ec2-revoke-security-group-ingress-rule removeIndicatorField setIndicator

Flowchart

yes yes yes yes yes Start Start Allow IPs on AWS (Sec Group Ingress) Allow IPs on AWS (Sec Gro... Add allowed Tag - setIndicator Add allowed Tag setIndicator Describe Security Groups - aws-ec2-describe-security-groups Describe Security Groups aws-ec2-describe-security-groups Add IPs to AWS Security Group - aws-ec2-authorize-security-group-ingress-rule Add IPs to AWS Security G... aws-ec2-authorize-security-gr... Map IPs as CIDR ranges - Set Map IPs as CIDR ranges Set Revoke IPs from AWS Security Group - aws-ec2-revoke-security-group-ingress-rule Revoke IPs from AWS Secur... aws-ec2-revoke-security-group... Remove allowed Tag - removeIndicatorField Remove allowed Tag removeIndicatorField Compare IP list with current AWS allow list - CompareLists Compare IP list with curr... CompareLists Is AWS EC2 integration enabled? Is AWS EC2 integration en... Any IPs to allow which are not already in AWS? Any IPs to allow which ar... Any IPs in AWS allow list that should be removed? Any IPs in AWS allow list... Done Done Security Group retrieved successfully? Security Group retrieved ... Security Group not found Security Group not found Engineer - Fix Security Group Name and rerun Engineer - Fix Security G... Is the Security Group empty? Is the Security Group empty? Set new list of IP addresses - Set Set new list of IP addresses Set

Source

playbook-IP_Whitelist_-_AWS_Security_Group.yml
Download History Raw 
id: IP Whitelist - AWS Security Group
version: -1
name: IP Whitelist - AWS Security Group
description: Sync a list of IP addresses to an AWS Security Group.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: c85f856f-9810-4ab0-8729-ee1dfac7485c
    type: start
    task:
      id: c85f856f-9810-4ab0-8729-ee1dfac7485c
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 690,
          "y": -300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: 84551e34-e39d-49af-8f9c-519daf296254
    type: title
    task:
      id: 84551e34-e39d-49af-8f9c-519daf296254
      version: -1
      name: Allow IPs on AWS (Sec Group Ingress)
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "28"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 690,
          "y": -150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "8":
    id: "8"
    taskid: 5ce745a5-3013-44aa-8f88-fd2c7ea0243e
    type: regular
    task:
      id: 5ce745a5-3013-44aa-8f88-fd2c7ea0243e
      version: -1
      name: Add allowed Tag
      description: Adds the tag defined in inputs.IndicatorTagName.
      script: Builtin|||setIndicator
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "34"
    scriptarguments:
      a: {}
      actor: {}
      admincountry: {}
      adminemail: {}
      adminname: {}
      adminphone: {}
      alexcustom: {}
      asn: {}
      associatedfilenames: {}
      associations: {}
      biosversion: {}
      companysize: {}
      creationdate: {}
      custom: {}
      customFields: {}
      cvedescription: {}
      cvemodified: {}
      cvss: {}
      description: {}
      detectionengines: {}
      devicemodel: {}
      dhcpserver: {}
      displayname: {}
      dns: {}
      domainname: {}
      domainstatus: {}
      emailaddress: {}
      entryid: {}
      expiration: {}
      expirationdate: {}
      feedthreattype: {}
      fileextension: {}
      filetype: {}
      firstseenbysource: {}
      geocountry: {}
      geolocation: {}
      groups: {}
      hostname: {}
      id: {}
      indicatorcategory: {}
      indicatoridentification: {}
      internal: {}
      ipaddress: {}
      lastseenbysource: {}
      macaddress: {}
      malwarefamily: {}
      md5: {}
      memory: {}
      name: {}
      namefield: {}
      nameservers: {}
      office365category: {}
      office365expressroute: {}
      office365required: {}
      operatingsystem: {}
      operatingsystemversion: {}
      organization: {}
      organizationalunitou: {}
      osversion: {}
      path: {}
      port: {}
      positivedetections: {}
      processor: {}
      processors: {}
      published: {}
      quarantined: {}
      recordedfutureevidencedetails: {}
      region: {}
      registrantcountry: {}
      registrantemail: {}
      registrantname: {}
      registrantphone: {}
      registrarabuseemail: {}
      registrarabusephone: {}
      registrarname: {}
      reportedby: {}
      reputation: {}
      service: {}
      sha1: {}
      sha256: {}
      sha512: {}
      signatureauthentihash: {}
      signaturecopyright: {}
      signaturedescription: {}
      signaturefileversion: {}
      signatureinternalname: {}
      signed: {}
      size: {}
      sourceoriginalseverity: {}
      ssdeep: {}
      subdomains: {}
      tags:
        simple: ${inputs.IndicatorTagName}
      threattypes: {}
      trafficlightprotocol: {}
      trafficlightprotocoltlp: {}
      type: {}
      updateddate: {}
      username: {}
      value:
        complex:
          root: ${ListCompare
          accessor: LeftOnly}
          transformers:
          - operator: Cut
            args:
              delimiter:
                value:
                  simple: /
              fields:
                value:
                  simple: "-1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1190,
          "y": 1575
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "14":
    id: "14"
    taskid: 3f3f330a-fab8-4067-8aff-95a1e6b0e813
    type: regular
    task:
      id: 3f3f330a-fab8-4067-8aff-95a1e6b0e813
      version: -1
      name: Describe Security Groups
      description: Describes one or more of your security groups.
      script: AWS - EC2|||aws-ec2-describe-security-groups
      type: regular
      iscommand: true
      brand: AWS - EC2
    nexttasks:
      '#none#':
      - "35"
    scriptarguments:
      filters: {}
      groupIds: {}
      groupNames:
        simple: ${inputs.SecurityGroupName}
      region: {}
      roleArn: {}
      roleSessionDuration: {}
      roleSessionName: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1012.5,
          "y": 160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "19":
    id: "19"
    taskid: 59c54288-6d6a-4793-8777-9baaeae2af74
    type: regular
    task:
      id: 59c54288-6d6a-4793-8777-9baaeae2af74
      version: -1
      name: Add IPs to AWS Security Group
      description: Adds ingress rule to a security group.
      script: '|||aws-ec2-authorize-security-group-ingress-rule'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      IpPermissionsIpProtocol: {}
      IpPermissionsToPort: {}
      IpPermissionsfromPort: {}
      IpRangesCidrIp: {}
      IpRangesDesc: {}
      Ipv6RangesCidrIp: {}
      Ipv6RangesDesc: {}
      PrefixListId: {}
      PrefixListIdDesc: {}
      UserIdGroupPairsDescription: {}
      UserIdGroupPairsGroupId: {}
      UserIdGroupPairsGroupName: {}
      UserIdGroupPairsPeeringStatus: {}
      UserIdGroupPairsUserId: {}
      UserIdGroupPairsVpcId: {}
      UserIdGroupPairsVpcPeeringConnectionId: {}
      cidrIp:
        simple: ${ListCompare.LeftOnly}
      fromPort: {}
      groupId:
        complex:
          root: AWS
          accessor: EC2.SecurityGroups.GroupId
          transformers:
          - operator: atIndex
            args:
              index:
                value:
                  simple: "0"
      ipProtocol:
        simple: "-1"
      region: {}
      roleArn: {}
      roleSessionDuration: {}
      roleSessionName: {}
      sourceSecurityGroupName: {}
      toPort: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1190,
          "y": 1400
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "20":
    id: "20"
    taskid: f239a3a3-482a-4e21-85ff-321537aa71e4
    type: regular
    task:
      id: f239a3a3-482a-4e21-85ff-321537aa71e4
      version: -1
      name: Map IPs as CIDR ranges
      description: Sets a value into the context with the given context key
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "38"
    scriptarguments:
      append: {}
      key:
        simple: AllowedCIDRs
      stringify: {}
      value:
        complex:
          root: ${inputs
          accessor: IP}
          transformers:
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: /32
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 802.5,
          "y": 535
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "21":
    id: "21"
    taskid: 8a1ec2e1-2f6c-4ab1-86dc-7f587b6fd52a
    type: regular
    task:
      id: 8a1ec2e1-2f6c-4ab1-86dc-7f587b6fd52a
      version: -1
      name: Revoke IPs from AWS Security Group
      description: Removes egress rule from a security group. To remove a rule, the values that you specify (for example, ports) must match the existing rule's values exactly.
      script: '|||aws-ec2-revoke-security-group-ingress-rule'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "25"
    scriptarguments:
      cidrIp:
        simple: ${ListCompare.RightOnly}
      fromPort: {}
      groupId:
        complex:
          root: AWS
          accessor: EC2.SecurityGroups.GroupId
          transformers:
          - operator: atIndex
            args:
              index:
                value:
                  simple: "0"
      ipProtocol:
        simple: "-1"
      region: {}
      roleArn: {}
      roleSessionDuration: {}
      roleSessionName: {}
      sourceSecurityGroupName: {}
      toPort: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 640,
          "y": 1400
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "25":
    id: "25"
    taskid: 224e4558-67e0-4a68-828a-781414358c9b
    type: regular
    task:
      id: 224e4558-67e0-4a68-828a-781414358c9b
      version: -1
      name: Remove allowed Tag
      description: Removes the tag defined in inputs.IndicatorTagName.
      script: Builtin|||removeIndicatorField
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "34"
    scriptarguments:
      field:
        simple: tags
      fieldValue:
        simple: ${inputs.IndicatorTagName}
      indicatorsValues:
        complex:
          root: ${ListCompare
          accessor: RightOnly}
          transformers:
          - operator: Cut
            args:
              delimiter:
                value:
                  simple: /
              fields:
                value:
                  simple: "-1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 640,
          "y": 1575
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "26":
    id: "26"
    taskid: d7869678-c140-4948-8f5a-6daa317373a4
    type: regular
    task:
      id: d7869678-c140-4948-8f5a-6daa317373a4
      version: -1
      name: Compare IP list with current AWS allow list
      scriptName: CompareLists
      type: regular
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "33"
      - "32"
    scriptarguments:
      left:
        simple: ${AllowedCIDRs}
      right:
        simple: ${AWS.EC2.SecurityGroups.IpPermissions.[0].IpRanges.CidrIp}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 810,
          "y": 900
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "28":
    id: "28"
    taskid: 8846755b-df88-477e-8075-dfbe8349b807
    type: condition
    task:
      id: 8846755b-df88-477e-8075-dfbe8349b807
      version: -1
      name: Is AWS EC2 integration enabled?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "34"
      "yes":
      - "14"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: AWS - EC2
                accessor: brand
            iscontext: true
          right:
            value:
              simple: AWS - EC2
    view: |-
      {
        "position": {
          "x": 690,
          "y": -25
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "32":
    id: "32"
    taskid: 63f88ed9-a184-4062-8ed7-de7c170a81d8
    type: condition
    task:
      id: 63f88ed9-a184-4062-8ed7-de7c170a81d8
      version: -1
      name: Any IPs to allow which are not already in AWS?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "34"
      "yes":
      - "19"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: ListCompare.LeftOnly
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1190,
          "y": 1075
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "33":
    id: "33"
    taskid: ded851c7-5bc7-4f2e-8238-e57849966324
    type: condition
    task:
      id: ded851c7-5bc7-4f2e-8238-e57849966324
      version: -1
      name: Any IPs in AWS allow list that should be removed?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "34"
      "yes":
      - "21"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: ListCompare.RightOnly
            iscontext: true
    view: |-
      {
        "position": {
          "x": 650,
          "y": 1075
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "34":
    id: "34"
    taskid: 1e8d132f-c94a-4418-8056-64e102d4ed17
    type: title
    task:
      id: 1e8d132f-c94a-4418-8056-64e102d4ed17
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 270,
          "y": 1870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "35":
    id: "35"
    taskid: ea3c38a0-8354-492d-8c1d-8c9eec68cb4f
    type: condition
    task:
      id: ea3c38a0-8354-492d-8c1d-8c9eec68cb4f
      version: -1
      name: Security Group retrieved successfully?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "36"
      "yes":
      - "20"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: AWS.EC2.SecurityGroups.GroupName
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1012.5,
          "y": 330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "36":
    id: "36"
    taskid: 2a06ac93-6908-46b6-82d1-234ec106abf1
    type: title
    task:
      id: 2a06ac93-6908-46b6-82d1-234ec106abf1
      version: -1
      name: Security Group not found
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "37"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1520,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "37":
    id: "37"
    taskid: c28c2363-66e7-435c-826c-2d52dffecded
    type: regular
    task:
      id: c28c2363-66e7-435c-826c-2d52dffecded
      version: -1
      name: Engineer - Fix Security Group Name and rerun
      type: regular
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1520,
          "y": 700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "38":
    id: "38"
    taskid: 810ac836-5ce8-4568-8f9b-6c3fda6ad566
    type: condition
    task:
      id: 810ac836-5ce8-4568-8f9b-6c3fda6ad566
      version: -1
      name: Is the Security Group empty?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "26"
      "yes":
      - "39"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEmpty
          left:
            value:
              simple: AWS.EC2.SecurityGroups.IpPermissions.[0].IpRanges.CidrIp
            iscontext: true
    view: |-
      {
        "position": {
          "x": 802.5,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "39":
    id: "39"
    taskid: 51ed900a-7f88-46aa-8532-4237e6a7daad
    type: regular
    task:
      id: 51ed900a-7f88-46aa-8532-4237e6a7daad
      version: -1
      name: Set new list of IP addresses
      description: Sets a value into the context with the given context key
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "32"
    scriptarguments:
      append: {}
      key:
        simple: ListCompare.LeftOnly
      stringify: {}
      value:
        simple: ${AllowedCIDRs}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1260,
          "y": 900
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
system: true
view: |-
  {
    "linkLabelsPosition": {
      "28_14_yes": 0.54,
      "28_34_#default#": 0.58,
      "32_34_#default#": 0.1,
      "33_21_yes": 0.54,
      "33_34_#default#": 0.11,
      "35_20_yes": 0.69,
      "38_26_#default#": 0.65
    },
    "paper": {
      "dimensions": {
        "height": 2235,
        "width": 1630,
        "x": 270,
        "y": -300
      }
    }
  }
inputs:
- key: ""
  value: {}
  required: false
  description: ""
  playbookInputQuery:
    query: ""
    queryEntity: indicators
    results:
    daterange:
      fromdate: 0001-01-01T00:00:00Z
      todate: 0001-01-01T00:00:00Z
      period:
        by: ""
        byto: ""
        byfrom: ""
        tovalue:
        fromvalue:
        field: ""
      fromdatelicenseval: 0001-01-01T00:00:00Z
    runFromLastJobTime: false
- key: IP
  value: {}
  required: true
  playbookInputQuery:
  description: IP addresses to set in the allow list
- key: SecurityGroupName
  value: {}
  required: true
  description: Name of the AWS Security Group to update
  playbookInputQuery:
- key: IndicatorTagName
  value:
    simple: AWS_IP_Whitelist
  required: true
  playbookInputQuery:
  description: Name of the Indicator Tag to apply to any IPs allowed by this playbook.
outputs: []
fromversion: 5.5.0
tests:
- No tests (auto formatted)
marketplaces:
- xsoar
- marketplacev2
- platform
supportedModules:
- agentix
- xsiam
- asm
- exposure_management