Prisma Cloud - VM Alert Prioritization

This playbook handles incidents related to dozens of Prisma Cloud public VM alerts. It determines the severity of the ingested alert based on data returned from Cortex XSOAR commands interacting with the Prisma Cloud API and creates new issues in either Slack or Jira, with all of the relevant information. The playbook updates the Cortex XSOAR incident’s layout with information the analyst can use to investigate the alert. It also extracts and enriches indicators using existing configured integrations and then closes the investigation. The flow of this playbook is as following: 1) Check the CSP type. 2) Check whether there's a public IP associated to the instance. In case there is, it will continue to other steps, if not, it will set the severity of the incident to "Low" and will close the incident. 3) Check if there are any vulnerabilities or findings related to the instance. 4) Check if there are any IAM permissions associated to the instance. 5) Set the incident severity based on the results: - Low - No public IP was found. - Medium - Public IP was found, other checks didn't return results. - High - Public IP was found and also one of the other checks returned results. - Critical - Public IP was found and both of the other checks returned results. 6) Notifications and ticketing with 3rd party systems. 7) Close the incident. This playbook will run when a new incident is created with the **Prisma Cloud - VM Alert Prioritization** incident type which also includes a dedicated layout.

Prisma Cloud by Palo Alto Networks · 35 tasks · 5 inputs · 0 outputs

Inputs

  • JiraProjectName — The project name with which to associate the issue.
  • JiraIssueTypeName — The name of the issue type to be opened.
  • CloseIncidentAfterNotification — Whether to close the incident after Jira/Slack issue was opened. Default value is "True".
  • SlackChannelName — The name of the Slack channel to which to send the message.
  • SlackChannelID — The ID of the Slack channel to which to send the message.

Commands used

closeInvestigation jira-create-issue prisma-cloud-config-search prisma-cloud-host-finding-list prisma-cloud-permission-list send-notification setIncident

Flowchart

aws azure gcp Critical High yes yes yes yes yes yes yes Start Start Check CSP type Check CSP type Verify if public IP exists (GCP) - prisma-cloud-config-search Verify if public IP exist... prisma-cloud-config-search Verify if public IP exists (Azure) - prisma-cloud-config-search Verify if public IP exist... prisma-cloud-config-search AWS AWS GCP GCP Azure Azure Check if any findings exist - prisma-cloud-host-finding-list Check if any findings exist prisma-cloud-host-finding-list Check if any IAM permissions attached to resource - prisma-cloud-permission-list Check if any IAM permissi... prisma-cloud-permission-list Check severity based on results Check severity based on r... Set severity as Critical - setIncident Set severity as Critical setIncident Set severity as High - setIncident Set severity as High setIncident Set severity as Medium - setIncident Set severity as Medium setIncident Set severity as Low - setIncident Set severity as Low setIncident Notifications and ticketing Notifications and ticketing Done Done Create a Jira issue - jira-create-issue Create a Jira issue jira-create-issue Set IAM results grid - SetGridField Set IAM results grid SetGridField Set findings results grid - SetGridField Set findings results grid SetGridField Close XSOAR incident? Close XSOAR incident? Close investigation - closeInvestigation Close investigation closeInvestigation Check for IAM permissions and vulnerabilities Check for IAM permissions... Was a public IP found? Was a public IP found? Jira Jira Slack Slack Send a slack message - send-notification Send a slack message send-notification Format IAM Permissions as markdown table - SetAndHandleEmpty Format IAM Permissions as... SetAndHandleEmpty Format findings as markdown table - SetAndHandleEmpty Format findings as markdo... SetAndHandleEmpty Any results for IAM query? Any results for IAM query? Any results for findings query? Any results for findings ... Verify if public IP exists (AWS) - prisma-cloud-config-search Verify if public IP exist... prisma-cloud-config-search Is this a network interface? Is this a network interface? Verify if public IP of related instance exists (AWS) - prisma-cloud-config-search Verify if public IP of re... prisma-cloud-config-search Open Jira issue? Open Jira issue? Send a Slack message? Send a Slack message?