Prisma Access Whitelist Egress IPs on SaaS Services

Retrieve Prisma Access Egress IP for specific geographic zones and populate in security groups within cloud services.

Palo Alto Networks - Strata Cloud Manager · 11 tasks · 4 inputs · 0 outputs

Details

IDPrisma Access Whitelist Egress IPs on SaaS Services
From Version5.5.0
Tasks11

README

Retrieve Prisma Access Egress IP for specific geographic Zones and populate in security groups within cloud services.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • IP Whitelist - AWS Security Group
  • IP Whitelist - GCP Firewall
  • Allow IP - Okta Zone

Integrations

  • PrismaAccessEgressIPFeed

Scripts

This playbook does not use any scripts.

Commands

  • prisma-access-get-indicators
  • closeInvestigation

Playbook Inputs

Name Description Default Value Required
Indicator Query Indicators matching the indicator query will be used as playbook input   Optional
AWSSecurityGroupName Name of the AWS Security Group to update with the IPs.   Optional
GCPFirewallName     Optional
OktaZoneID ID of the Okta Zone to update. Use !okta-list-zones to obtain   Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Prisma Access Whitelist Egress IPs on SaaS Services

Inputs

  • —
  • AWSSecurityGroupName — Name of the AWS Security Group to update with the IPs.
  • GCPFirewallName — Name of the GCP Firewall to update with the IPs.
  • OktaZoneID — ID of the Okta Zone to update. Use !okta-list-zones to obtain

Commands used

closeInvestigation prisma-access-get-indicators

Flowchart

yes yes yes yes Start Start Is Prisma Access integration enabled? Is Prisma Access integrat... Close incident - closeInvestigation Close incident closeInvestigation IP Whitelist - AWS Security Group - IP Whitelist - AWS Security Group IP Whitelist - AWS Securi... IP Whitelist - AWS Security G... IP Whitelist - GCP Firewall - IP Whitelist - GCP Firewall IP Whitelist - GCP Firewall IP Whitelist - GCP Firewall Prisma Access Egress IP Feed - Get IPs - prisma-access-get-indicators Prisma Access Egress IP F... prisma-access-get-indicators Allow IP - Okta Zone - Allow IP - Okta Zone Allow IP - Okta Zone Allow IP - Okta Zone Is the Okta Zone ID input set? Is the Okta Zone ID input... Is the AWS Security Group input set? Is the AWS Security Group... Is the GCP Firewall Name input set? Is the GCP Firewall Name ... Done Done

Source

playbook-Prisma_Access_Whitelist_Egress_IPs_on_SaaS_Services.yml
Download History Raw 
id: Prisma Access Whitelist Egress IPs on SaaS Services
version: -1
name: Prisma Access Whitelist Egress IPs on SaaS Services
description: Retrieve Prisma Access Egress IP for specific geographic zones and populate in security groups within cloud services.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 01a1ecce-c3d8-46a8-84f9-0a7d6f214ecc
    type: start
    task:
      id: 01a1ecce-c3d8-46a8-84f9-0a7d6f214ecc
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "27"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 60,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "27":
    id: "27"
    taskid: c681a06b-367e-4964-84e0-e7bc8fd89855
    type: condition
    task:
      id: c681a06b-367e-4964-84e0-e7bc8fd89855
      version: -1
      name: Is Prisma Access integration enabled?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "34"
      "yes":
      - "40"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Prisma Access Egress IP feed
                accessor: brand
            iscontext: true
          right:
            value:
              simple: Prisma Access Egress IP feed
    view: |-
      {
        "position": {
          "x": 60,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "34":
    id: "34"
    taskid: 1b3817f1-b459-4fb5-8132-d7b0a8fa6405
    type: regular
    task:
      id: 1b3817f1-b459-4fb5-8132-d7b0a8fa6405
      version: -1
      name: Close incident
      description: Closes the incident.
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "45"
    scriptarguments:
      assetid: {}
      closeNotes: {}
      closeReason: {}
      code42alerttype: {}
      emailclassification: {}
      id: {}
      phishingsubtype: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1100
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "35":
    id: "35"
    taskid: d38a143a-83e7-40e6-8b3e-50f86fe28732
    type: playbook
    task:
      id: d38a143a-83e7-40e6-8b3e-50f86fe28732
      version: -1
      name: IP Whitelist - AWS Security Group
      description: Sync a list of IP addresses to an AWS Security Group.
      playbookName: IP Whitelist - AWS Security Group
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "34"
    scriptarguments:
      IP:
        simple: ${PrismaAccess.Egress.IP(["US West","Argentina"].indexOf(val.Zone)>=0).Address}
      IndicatorTagName:
        simple: AWS_Prisma_IP_Whitelist
      SecurityGroupName:
        simple: ${inputs.AWSSecurityGroupName}
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -790,
          "y": 915
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 2
  "36":
    id: "36"
    taskid: 3e5c16ff-bf04-4e03-8419-ace47c265b34
    type: playbook
    task:
      id: 3e5c16ff-bf04-4e03-8419-ace47c265b34
      version: -1
      name: IP Whitelist - GCP Firewall
      description: Set a list of IP addresses in GCP firewall.
      playbookName: IP Whitelist - GCP Firewall
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "34"
    scriptarguments:
      GCPFirewallName:
        simple: ${inputs.GCPFirewallName}
      IP:
        simple: ${PrismaAccess.Egress.IP(["US West","Argentina"].indexOf(val.Zone)>=0).Address}
      IndicatorTagName:
        simple: GCP_Prisma_IP_Whitelist
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -1290,
          "y": 915
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
  "40":
    id: "40"
    taskid: fab04a1f-5cad-416b-878b-ec87a6fc6409
    type: regular
    task:
      id: fab04a1f-5cad-416b-878b-ec87a6fc6409
      version: -1
      name: Prisma Access Egress IP Feed - Get IPs
      description: Gets indicators from the feed.
      script: '|||prisma-access-get-indicators'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "42"
      - "43"
      - "44"
    scriptarguments:
      limit:
        simple: "1000"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -300,
          "y": 380
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
  "41":
    id: "41"
    taskid: 70af2aa4-8c91-4705-88ef-1deba78c1ee4
    type: playbook
    task:
      id: 70af2aa4-8c91-4705-88ef-1deba78c1ee4
      version: -1
      name: Allow IP - Okta Zone
      description: "Sync a list of IP addresses to the Okta Network Zone with the given ID. \nExisting IPs in the Okta Zone which are not in the input list will be removed and the indicator will be untagged in Cortex XSOAR.\nIDs can be retrieved  using !okta-list-zones. This playbook supports CIDR notation only (1.1.1.1/32) and not range notation (1.1.1.1-1.1.1.1)"
      playbookName: Allow IP - Okta Zone
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "34"
    scriptarguments:
      IP:
        simple: ${PrismaAccess.Egress.IP(["US West","Argentina"].indexOf(val.Zone)>=0).Address}
      IndicatorTagName:
        simple: Prisma_Access_Okta_Zone
      ZoneID:
        simple: ${inputs.OktaZoneID}
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -300,
          "y": 915
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 2
  "42":
    id: "42"
    taskid: e1d2c731-1efe-4786-880f-38d3644a3ced
    type: condition
    task:
      id: e1d2c731-1efe-4786-880f-38d3644a3ced
      version: -1
      name: Is the Okta Zone ID input set?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "34"
      "yes":
      - "41"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.OktaZoneID
            iscontext: true
    view: |-
      {
        "position": {
          "x": -300,
          "y": 580
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "43":
    id: "43"
    taskid: c998f782-d62b-40eb-841f-f2771d701dd6
    type: condition
    task:
      id: c998f782-d62b-40eb-841f-f2771d701dd6
      version: -1
      name: Is the AWS Security Group input set?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "34"
      "yes":
      - "35"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.AWSSecurityGroupName
            iscontext: true
    view: |-
      {
        "position": {
          "x": -790,
          "y": 580
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "44":
    id: "44"
    taskid: a8f01ce4-9ee3-4343-8a4d-5bab9c0f1867
    type: condition
    task:
      id: a8f01ce4-9ee3-4343-8a4d-5bab9c0f1867
      version: -1
      name: Is the GCP Firewall Name input set?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "34"
      "yes":
      - "36"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.GCPFirewallName
            iscontext: true
    view: |-
      {
        "position": {
          "x": -1290,
          "y": 580
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "45":
    id: "45"
    taskid: d265c933-47a8-4836-8304-a00a0d651ff2
    type: title
    task:
      id: d265c933-47a8-4836-8304-a00a0d651ff2
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "27_34_#default#": 0.11,
      "42_34_#default#": 0.25,
      "43_34_#default#": 0.15,
      "44_34_#default#": 0.1
    },
    "paper": {
      "dimensions": {
        "height": 1265,
        "width": 1730,
        "x": -1290,
        "y": 50
      }
    }
  }
inputs:
- key: ""
  value: {}
  required: false
  description: ""
  playbookInputQuery:
    query: ""
    queryEntity: indicators
    results:
    daterange:
      fromdate: 0001-01-01T00:00:00Z
      todate: 0001-01-01T00:00:00Z
      period:
        by: ""
        byto: ""
        byfrom: ""
        tovalue:
        fromvalue:
        field: ""
      fromdatelicenseval: 0001-01-01T00:00:00Z
    runFromLastJobTime: false
- key: AWSSecurityGroupName
  value: {}
  required: false
  description: Name of the AWS Security Group to update with the IPs.
  playbookInputQuery:
- key: GCPFirewallName
  value: {}
  required: false
  description: Name of the GCP Firewall to update with the IPs.
  playbookInputQuery:
- key: OktaZoneID
  value: {}
  required: false
  description: ID of the Okta Zone to update. Use !okta-list-zones to obtain
  playbookInputQuery:
outputs: []
fromversion: 5.5.0
tests:
- No tests
supportedModules:
- agentix
- xsiam