Prisma Cloud Remediation - AWS EC2 Instance Misconfiguration v2

This playbook remediates Prisma Cloud AWS EC2 alerts. It calls the following sub-playbooks to perform the remediation: - AWS Default Security Group Does Not Restrict All Traffic (policy id: 2378dbf4-b104-4bda-9b05-7417affbba3f) - AWS Security Group allows all traffic on SSH port (22) (policy id: 617b9138-584b-4e8e-ad15-7fbabafbed1a) - AWS Security Groups allow internet traffic from internet to RDP port (3389) (policy id: b82f90ce-ed8b-4b49-970c-2268b0a6c2e5).

Prisma Cloud by Palo Alto Networks · 13 tasks · 2 inputs · 0 outputs

Details

ID	`Prisma Cloud Remediation - AWS EC2 Instance Misconfiguration v2`
From Version	6.5.0
Tasks	13

README

This playbook remediates Prisma Cloud AWS EC2 alerts. It calls the following sub-playbooks to perform the remediation:

AWS Default Security Group Does Not Restrict All Traffic (policy id: 2378dbf4-b104-4bda-9b05-7417affbba3f)
AWS Security Group allows all traffic on SSH port (22) (policy id: 617b9138-584b-4e8e-ad15-7fbabafbed1a)
AWS Security Groups allow internet traffic from internet to RDP port (3389) (policy id: b82f90ce-ed8b-4b49-970c-2268b0a6c2e5).

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

Prisma Cloud Remediation - AWS Security Groups Allows Internet Traffic To TCP Port
Prisma Cloud Remediation - AWS EC2 Security Group Misconfiguration

Integrations

PrismaCloud v2

Scripts

IsIntegrationAvailable

Commands

closeInvestigation
prisma-cloud-alert-dismiss

Playbook Inputs

Name	Description	Default Value	Required
AutoUpdateEC2	Update AWS EC2 instance automatically?	no	Optional
policyId	Get the Prisma Cloud policy ID.	incident.labels.policy	Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Prisma Cloud Remediation - AWS EC2 Instance Misconfiguration v2

Inputs

policyId — Get the Prisma Cloud policy ID.
AutoUpdateEC2 — Update AWS EC2 instance automatically?

Commands used

closeInvestigation prisma-cloud-alert-dismiss

Flowchart

Source

playbook-PCR_-_AWS_EC2_Instance_Misconfig_v2.yml

Download History Raw

id: Prisma Cloud Remediation - AWS EC2 Instance Misconfiguration v2
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Prisma Cloud Remediation - AWS EC2 Instance Misconfiguration v2
description: |-
  This playbook remediates Prisma Cloud AWS EC2 alerts.  It calls the following sub-playbooks to perform the remediation:
  - AWS Default Security Group Does Not Restrict All Traffic (policy id: 2378dbf4-b104-4bda-9b05-7417affbba3f)
  - AWS Security Group allows all traffic on SSH port (22) (policy id: 617b9138-584b-4e8e-ad15-7fbabafbed1a)
  - AWS Security Groups allow internet traffic from internet to RDP port (3389) (policy id: b82f90ce-ed8b-4b49-970c-2268b0a6c2e5).
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 972c2cba-e9e8-4b4e-8f92-407ca7fb7917
    type: start
    task:
      id: 972c2cba-e9e8-4b4e-8f92-407ca7fb7917
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 930,
          "y": -420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 3bd78b35-5c67-4c29-82d3-56cd93cb2e1a
    type: condition
    task:
      id: 3bd78b35-5c67-4c29-82d3-56cd93cb2e1a
      version: -1
      name: Is AWS - EC2 integration available?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "8"
      "yes":
      - "14"
    scriptarguments:
      brandname:
        simple: AWS - EC2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 930,
          "y": -260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 77885611-1518-41c5-8929-0da5c8de85cb
    type: condition
    task:
      id: 77885611-1518-41c5-8929-0da5c8de85cb
      version: -1
      name: Update EC2 automatically?
      description: Should we auto-remediate?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "10"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.AutoUpdateEC2
                transformers:
                - operator: toLowerCase
            iscontext: true
          right:
            value:
              simple: "yes"
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 80,
          "y": 80
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: a1526b70-d9ce-4d1c-8e36-4aaa1cf5d850
    type: condition
    task:
      id: a1526b70-d9ce-4d1c-8e36-4aaa1cf5d850
      version: -1
      name: Auto remediate?
      description: Determines whether or not to auto-remediate?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "Yes":
      - "10"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 420,
          "y": 250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
        simple: ${incident.id} Autoremediate?
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: false
        completeaftersla: false
      replyOptions:
      - "Yes"
      - "No"
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: f8dfdf9c-3271-4644-89ce-2fdfd9f25e9f
    type: regular
    task:
      id: f8dfdf9c-3271-4644-89ce-2fdfd9f25e9f
      version: -1
      name: Manually remediate EC2
      description: Follow the steps outlined in the appropriate sub-playbook to remediate the issue.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 700,
          "y": 420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 8941af46-893e-47e2-8119-670c65cf561e
    type: regular
    task:
      id: 8941af46-893e-47e2-8119-670c65cf561e
      version: -1
      name: Close investigation
      description: commands.local.cmd.close.inv
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      id:
        complex:
          root: incident
          accessor: id
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 700,
          "y": 1115
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 5bfb7869-0a96-4ca5-875c-1ec4c9072953
    type: title
    task:
      id: 5bfb7869-0a96-4ca5-875c-1ec4c9072953
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 930,
          "y": 1290
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 1b01f096-ed50-4e46-8dfc-1fc611535c7a
    type: condition
    task:
      id: 1b01f096-ed50-4e46-8dfc-1fc611535c7a
      version: -1
      name: Is Prisma Cloud v2 integration enabled?
      description: Is Prisma Cloud v2 integration enabled?
      type: condition
      iscommand: false
      brand: PrismaCloud v2
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "17"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: PrismaCloud v2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 700,
          "y": 765
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 1ac99665-2df1-40fe-8293-7d2513605e2f
    type: condition
    task:
      id: 1ac99665-2df1-40fe-8293-7d2513605e2f
      version: -1
      name: Execute playbook
      description: Execute the appropriate sub-playbook to perform the actual remediation.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      internetPorts:
      - "16"
      securityGroups:
      - "15"
    separatecontext: false
    defaultassigneecomplex: {}
    conditions:
    - label: securityGroups
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: 2378dbf4-b104-4bda-9b05-7417affbba3f
        - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: 617b9138-584b-4e8e-ad15-7fbabafbed1a
    - label: internetPorts
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: b82f90ce-ed8b-4b49-970c-2268b0a6c2e5
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 80,
          "y": 420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 0d732bc3-22a0-4b2e-8b03-4d8aa68b9389
    type: condition
    task:
      id: 0d732bc3-22a0-4b2e-8b03-4d8aa68b9389
      version: -1
      name: Is there a policy to remediate?
      description: Verify that a Prisma Cloud policy ID exists.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "3"
    separatecontext: false
    defaultassigneecomplex: {}
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 700,
          "y": -90
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: b5281377-31ef-472b-8699-6c94c222e807
    type: playbook
    task:
      id: b5281377-31ef-472b-8699-6c94c222e807
      version: -1
      name: Prisma Cloud Remediation - AWS EC2 Security Group Misconfiguration
      playbookName: Prisma Cloud Remediation - AWS EC2 Security Group Misconfiguration
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      policyId:
        complex:
          root: inputs.policyId
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 420,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: 3d9a9afc-e7e3-4be6-8142-57b5ef3bffb2
    type: playbook
    task:
      id: 3d9a9afc-e7e3-4be6-8142-57b5ef3bffb2
      version: -1
      name: Prisma Cloud Remediation - AWS Security Groups Allows Internet Traffic To TCP Port
      playbookName: Prisma Cloud Remediation - AWS Security Groups Allows Internet Traffic To TCP Port
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "9"
    separatecontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -220,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: f8385099-65e3-47ef-818d-0131c61c0d6f
    type: regular
    task:
      id: f8385099-65e3-47ef-818d-0131c61c0d6f
      version: -1
      name: Dismiss Prisma Cloud alert
      description: Dismiss or snooze the alerts matching the given filter. Either policy IDs or alert IDs must be provided. When no absolute time nor relative time arguments are provided, the default time range is all times. For snoozing, provide "snooze_unit" and "snooze_value" arguments.
      script: PrismaCloud v2|||prisma-cloud-alert-dismiss
      type: regular
      iscommand: true
      brand: PrismaCloud v2
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      alert_ids:
        complex:
          root: incident
          accessor: labels
          transformers:
          - operator: getField
            args:
              field:
                value:
                  simple: id
      dismissal_note:
        simple: ${incident.labels.id} has been remediated by Cortex XSOAR.
      policy_ids:
        complex:
          root: incident
          accessor: labels.policy
          transformers:
          - operator: ParseJSON
          - operator: getField
            args:
              field:
                value:
                  simple: policyId
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 940
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
system: true
view: |-
  {
    "linkLabelsPosition": {
      "10_15_securityGroups": 0.54,
      "10_16_internetPorts": 0.56,
      "14_3_yes": 0.49,
      "14_6_#default#": 0.26,
      "1_14_yes": 0.5,
      "1_8_#default#": 0.18,
      "3_10_yes": 0.48,
      "3_5_#default#": 0.48,
      "5_10_Yes": 0.51,
      "5_6_#default#": 0.52,
      "9_7_#default#": 0.59
    },
    "paper": {
      "dimensions": {
        "height": 1775,
        "width": 1530,
        "x": -220,
        "y": -420
      }
    }
  }
inputs:
- key: policyId
  value:
    complex:
      root: incident
      accessor: labels.policy
      transformers:
      - operator: ParseJSON
      - operator: getField
        args:
          field:
            value:
              simple: policyId
  required: false
  description: Get the Prisma Cloud policy ID.
  playbookInputQuery:
- key: AutoUpdateEC2
  value:
    simple: "no"
  required: false
  description: Update AWS EC2 instance automatically?
  playbookInputQuery:
inputSections:
- inputs:
  - policyId
  name: Incident Data
  description: Relevant data regarding the incident.
- inputs:
  - AutoUpdateEC2
  name: Remediation
  description: Remediation settings and data, including containment, eradication, and recovery.
outputSections:
- outputs: []
  name: General (Outputs group)
  description: Generic group for outputs
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.5.0