Prisma Cloud Remediation - AWS CloudTrail Misconfiguration Deprecated Hidden

Deprecated. Use Prisma Cloud Remediation - AWS CloudTrail Misconfiguration v2 instead. This playbook remediates Prisma Cloud AWS CloudTrail alerts. It calls sub-playbooks that perform the actual remediation steps. Remediation: - AWS CloudTrail Trail Log Validation Is Not Enabled In All Regions - AWS CloudTrail is not enabled in all regions - AWS CloudTrail Trail Is Not Integrated With CloudWatch Logs - AWS CloudTrail is not enabled on the account

Prisma Cloud by Palo Alto Networks · 14 tasks · 2 inputs · 0 outputs

Details

IDPrisma Cloud Remediation - AWS CloudTrail Misconfiguration
From Version5.0.0
Tasks14

README

This playbook remediates Prisma Cloud AWS CloudTrail alerts. It calls sub-playbooks that perform the actual remediation steps.

Remediation:

  • AWS CloudTrail Trail Log Validation Is Not Enabled In All Regions
  • AWS CloudTrail is not enabled in all regions
  • AWS CloudTrail Trail Is Not Integrated With CloudWatch Logs
  • AWS CloudTrail is not enabled on the account

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Prisma Cloud Remediation - AWS CloudTrail Is Not Integrated With CloudWatch Logs
  • Prisma Cloud Remediation - AWS CloudTrail is not Enabled on the Account
  • Prisma Cloud Remediation - AWS CloudTrail Trail Misconfiguration

Integrations

  • PrismaCloud v2

Scripts

This playbook does not use any scripts.

Commands

  • redlock-dismiss-alerts
  • closeInvestigation

Playbook Inputs

Name Description Default Value Required
AutoUpdateCloudTrail Update AWS CloudTrail automatically? no Optional
policyId Get the Prisma Cloud policy ID. incident.labels.policy Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Prisma Cloud Remediation - AWS CloudTrail Misconfiguration

Inputs

  • AutoUpdateCloudTrail — Update AWS CloudTrail automatically?
  • policyId — Get the Prisma Cloud policy ID.

Commands used

closeInvestigation redlock-dismiss-alerts

Flowchart

yes yes Yes yes account integrationCW trailMisconfig yes Start Start Is AWS - CloudTrail integration enabled? Is AWS - CloudTrail integ... Update CloudTrail automatically? Update CloudTrail automat... Auto remediate? Auto remediate? Manually update CloudTrail Manually update CloudTrail Close investigation - closeInvestigation Close investigation closeInvestigation Done Done Is Prisma Cloud v2 integration enabled? Is Prisma Cloud v2 integr... Execute playbook Execute playbook Is there a policy to remediate? Is there a policy to reme... Prisma Cloud Remediation - AWS CloudTrail Trail Misconfiguration - Prisma Cloud Remediation - AWS CloudTrail Trail Misconfiguration Prisma Cloud Remediation ... Prisma Cloud Remediation - AW... Prisma Cloud Remediation - AWS CloudTrail is not Enabled on the Account - Prisma Cloud Remediation - AWS CloudTrail is not Enabled on the Account Prisma Cloud Remediation ... Prisma Cloud Remediation - AW... Prisma Cloud Remediation - AWS CloudTrail Is Not Integrated With CloudWatch Logs - Prisma Cloud Remediation - AWS CloudTrail Is Not Integrated With CloudWatch Logs Prisma Cloud Remediation ... Prisma Cloud Remediation - AW... Dismiss Prisma Cloud alert - redlock-dismiss-alerts Dismiss Prisma Cloud alert redlock-dismiss-alerts

Source

playbook-PCR_-_AWS_CloudTrail_Misconfig.yml playbook-PCR_-_AWS_CloudTrail_Misconfig_v2.yml playbook-PCR_-_AWS_CloudTrail_Misconfig_v2_README.md
Download History Raw 
This playbook remediates Prisma Cloud AWS CloudTrail alerts.  It calls sub-playbooks that perform the actual remediation steps.

Remediation:
 - AWS CloudTrail Trail Log Validation Is Not Enabled In All Regions
 - AWS CloudTrail is not enabled in all regions
 - AWS CloudTrail Trail Is Not Integrated With CloudWatch Logs
 - AWS CloudTrail is not enabled on the account.

## Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

### Sub-playbooks

* Prisma Cloud Remediation - AWS CloudTrail Trail Misconfiguration
* Prisma Cloud Remediation - AWS CloudTrail is not Enabled on the Account
* Prisma Cloud Remediation - AWS CloudTrail Is Not Integrated With CloudWatch Logs

### Integrations

* PrismaCloud v2

### Scripts

This playbook does not use any scripts.

### Commands

* closeInvestigation
* prisma-cloud-alert-dismiss

## Playbook Inputs

---

| **Name** | **Description** | **Default Value** | **Required** |
| --- | --- | --- | --- |
| AutoUpdateCloudTrail | Update AWS CloudTrail automatically? | no | Optional |
| policyId | Get the Prisma Cloud policy ID. | incident.labels.policy | Optional |

## Playbook Outputs

---
There are no outputs for this playbook.

## Playbook Image

---

![Prisma Cloud Remediation - AWS CloudTrail Misconfiguration v2](../doc_files/Prisma_Cloud_Remediation_-_AWS_CloudTrail_Misconfiguration_v2.png)