Prisma Cloud Remediation - AWS EC2 Security Group Misconfiguration

This playbook remediates the Prisma Cloud AWS EC2 alerts generated by the following policies: - AWS Default Security Group Does Not Restrict All Traffic - AWS Security Group allows all traffic on SSH port (22).

Prisma Cloud by Palo Alto Networks · 13 tasks · 1 input · 0 outputs

Details

IDPrisma Cloud Remediation - AWS EC2 Security Group Misconfiguration
From Version5.0.0
Tasks13

README

Remediates the Prisma Cloud AWS EC2 alerts generated by the following policies:

  • AWS Default Security Group Does Not Restrict All Traffic
  • AWS Security Groups Allow Internet Traffic
  • AWS Security Groups With Inbound Rule Overly Permissive To All Traffic
  • AWS Security Group allows all traffic on SSH port (22)

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

  • isError
  • Sleep

Commands

  • aws-ec2-revoke-security-group-ingress-rule
  • aws-ec2-describe-security-groups

Playbook Inputs

Name Description Required
policyId Returns the Prisma Cloud policy ID. Required

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

![PCR_AWS_EC2SG_Misconfig](../doc_files/Prisma_Cloud_Remediation-_AWS_EC2_Security_Group_Misconfiguration.png)

Inputs

  • policyId — Provides the Prisma Cloud policy Id.

Commands used

aws-ec2-describe-security-groups aws-ec2-revoke-security-group-ingress-rule

Flowchart

no yes yes alltraffic-port22 defaultSG yes no yes Start Start Get security group details - aws-ec2-describe-security-groups Get security group details aws-ec2-describe-security-groups Revoke all security group ingress rules - aws-ec2-revoke-security-group-ingress-rule Revoke all security group... aws-ec2-revoke-security-group... Done Done Did we encounter an error? - isError Did we encounter an error? isError Is there a default security group? Is there a default securi... Execute remediation Execute remediation Manually update security group Manually update security ... Default SG Does Not Restrict All Traffic Default SG Does Not Restr... Is AWS - EC2 integration available? - IsIntegrationAvailable Is AWS - EC2 integration ... IsIntegrationAvailable All Traffic Allowed on SSH Port All Traffic Allowed on SS... Revoke the 22 ingress rule - aws-ec2-revoke-security-group-ingress-rule Revoke the 22 ingress rule aws-ec2-revoke-security-group... Did we encounter an error? - isError Did we encounter an error? isError

Source

playbook-PCR_-_AWS_EC2_SG_Misconfig.yml
Download History Raw 
id: Prisma Cloud Remediation - AWS EC2 Security Group Misconfiguration
version: -1
fromversion: 5.0.0
name: Prisma Cloud Remediation - AWS EC2 Security Group Misconfiguration
description: |-
  This playbook remediates the Prisma Cloud AWS EC2 alerts generated by the following policies:
   - AWS Default Security Group Does Not Restrict All Traffic
   - AWS Security Group allows all traffic on SSH port (22).
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 92a448cc-b058-4323-8821-bd598d893d29
    type: start
    task:
      id: 92a448cc-b058-4323-8821-bd598d893d29
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "28"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 710,
          "y": -270
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "2":
    id: "2"
    taskid: d0b6286b-9877-4b2b-84c7-90c6e2a0c1e8
    type: regular
    task:
      id: d0b6286b-9877-4b2b-84c7-90c6e2a0c1e8
      version: -1
      name: Get security group details
      description: Describes one or more of the security groups.
      script: '|||aws-ec2-describe-security-groups'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      groupIds:
        complex:
          root: incident
          accessor: labels.resource
          transformers:
          - operator: ParseJSON
          - operator: getField
            args:
              field:
                value:
                  simple: data
          - operator: getField
            args:
              field:
                value:
                  simple: groupId
      region:
        complex:
          root: incident
          accessor: labels.resource
          transformers:
          - operator: ParseJSON
          - operator: getField
            args:
              field:
                value:
                  simple: regionId
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1210,
          "y": 100
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "3":
    id: "3"
    taskid: 5a0fe336-4d38-4c7d-8250-b7165f183d8e
    type: regular
    task:
      id: 5a0fe336-4d38-4c7d-8250-b7165f183d8e
      version: -1
      name: Revoke all security group ingress rules
      description: Removes ingress rules from a security group. To remove a rule, the values that you specify (for example, ports) must match the existing rules' values exactly.
      script: '|||aws-ec2-revoke-security-group-ingress-rule'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      cidrIp:
        complex:
          root: AWS
          accessor: EC2.SecurityGroups.IpPermissions.IpRanges.CidrIp
      fromPort:
        complex:
          root: AWS
          accessor: EC2.SecurityGroups.IpPermissions.FromPort
      groupId:
        complex:
          root: AWS
          accessor: EC2.SecurityGroups.GroupId
      ipProtocol:
        complex:
          root: AWS
          accessor: EC2.SecurityGroups.IpPermissions.IpProtocol
      region:
        complex:
          root: incident
          accessor: labels.resource
          transformers:
          - operator: ParseJSON
          - operator: getField
            args:
              field:
                value:
                  simple: regionId
      sourceSecurityGroupName:
        complex:
          root: AWS
          accessor: EC2.SecurityGroups.IpPermissions.UserIdGroupPairs.GroupName
      toPort:
        complex:
          root: AWS
          accessor: EC2.SecurityGroups.IpPermissions.ToPort
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 950,
          "y": 825
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "9":
    id: "9"
    taskid: 1cf94ac2-9dfe-48c6-8fef-8deabb65238a
    type: title
    task:
      id: 1cf94ac2-9dfe-48c6-8fef-8deabb65238a
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 710,
          "y": 1610
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "12":
    id: "12"
    taskid: bb7658d0-6f23-46c1-8b3d-ad0cbbee43ef
    type: condition
    task:
      id: bb7658d0-6f23-46c1-8b3d-ad0cbbee43ef
      version: -1
      name: Did we encounter an error?
      description: Checks whether given entries returned an error. Use ${lastCompletedTaskEntries} to check the previous task entries. If an array is provided, a value of yes indicates that one of the entries returned an error.
      scriptName: isError
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "9"
      "yes":
      - "20"
    scriptarguments:
      entryId:
        simple: ${lastCompletedTaskEntries}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 950,
          "y": 1015
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "14":
    id: "14"
    taskid: 8576666e-db4d-465f-825e-4b105d48068d
    type: condition
    task:
      id: 8576666e-db4d-465f-825e-4b105d48068d
      version: -1
      name: Is there a default security group?
      description: Check whether the VPC security group is the default.  If not, manually define a default security group.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "20"
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: AWS
                accessor: EC2.SecurityGroups.GroupName
            iscontext: true
          right:
            value:
              simple: default
    view: |-
      {
        "position": {
          "x": 950,
          "y": 605
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "15":
    id: "15"
    taskid: 13c8b02d-09b5-4315-8a3e-19b25b716632
    type: condition
    task:
      id: 13c8b02d-09b5-4315-8a3e-19b25b716632
      version: -1
      name: Execute remediation
      description: Remediate the appropriate Prisma Cloud policy based on the policy Id.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      alltraffic-port22:
      - "29"
      defaultSG:
      - "27"
    separatecontext: false
    conditions:
    - label: defaultSG
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: 2378dbf4-b104-4bda-9b05-7417affbba3f
    - label: alltraffic-port22
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: 617b9138-584b-4e8e-ad15-7fbabafbed1a
    view: |-
      {
        "position": {
          "x": 1210,
          "y": 270
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "20":
    id: "20"
    taskid: 3681e8ec-3ee0-4a3d-8258-4c221cea314a
    type: regular
    task:
      id: 3681e8ec-3ee0-4a3d-8258-4c221cea314a
      version: -1
      name: Manually update security group
      description: |-
        1. Sign into the AWS console.
        2. Select the specific region from the region drop down on the top right corner.
        3. Navigate to the VPC Dashboard.
        4. Click on Security Groups in the left window pane.
        5. Click on the security group in question.
        6. Make the appropriate changes..
        7. Click Save rules.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 950,
          "y": 1340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "27":
    id: "27"
    taskid: 20a0adc7-86c1-42c0-839a-3148bbafca74
    type: title
    task:
      id: 20a0adc7-86c1-42c0-839a-3148bbafca74
      version: -1
      name: Default SG Does Not Restrict All Traffic
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "14"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 950,
          "y": 455
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "28":
    id: "28"
    taskid: bf81822b-44d6-4a0d-8798-1308b75a90be
    type: condition
    task:
      id: bf81822b-44d6-4a0d-8798-1308b75a90be
      version: -1
      name: Is AWS - EC2 integration available?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "2"
    scriptarguments:
      brandname:
        simple: AWS - EC2
    results:
    - brandInstances
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 710,
          "y": -120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "29":
    id: "29"
    taskid: 41280bdc-7d46-431f-80bc-9b5e0efa82b1
    type: title
    task:
      id: 41280bdc-7d46-431f-80bc-9b5e0efa82b1
      version: -1
      name: All Traffic Allowed on SSH Port
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "30"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1530,
          "y": 455
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "30":
    id: "30"
    taskid: 749cbfcb-24a1-4f9e-84dd-30577d851ff0
    type: regular
    task:
      id: 749cbfcb-24a1-4f9e-84dd-30577d851ff0
      version: -1
      name: Revoke the 22 ingress rule
      description: Removes egress rule from a security group. To remove a rule, the values that you specify (for example, ports) must match the existing rule's values exactly.
      script: '|||aws-ec2-revoke-security-group-ingress-rule'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "31"
    scriptarguments:
      cidrIp:
        simple: 0.0.0.0/0
      fromPort:
        simple: "22"
      groupId:
        complex:
          root: AWS.EC2.SecurityGroups
          accessor: GroupId
      ipProtocol:
        simple: tcp
      toPort:
        simple: "22"
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1530,
          "y": 605
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "31":
    id: "31"
    taskid: 020c1d19-094f-4a3c-8206-7d6573e48f51
    type: condition
    task:
      id: 020c1d19-094f-4a3c-8206-7d6573e48f51
      version: -1
      name: Did we encounter an error?
      description: Checks whether given entries returned an error. Use ${lastCompletedTaskEntries} to check the previous task entries. If an array is provided, a value of yes indicates that one of the entries returned an error.
      scriptName: isError
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "9"
      "yes":
      - "20"
    scriptarguments:
      entryId:
        simple: ${lastCompletedTaskEntries}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1530,
          "y": 1015
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
view: |-
  {
    "linkLabelsPosition": {
      "12_20_yes": 0.65,
      "12_9_no": 0.26,
      "14_20_#default#": 0.18,
      "14_3_yes": 0.52,
      "15_27_defaultSG": 0.66,
      "31_20_yes": 0.48,
      "31_9_no": 0.36
    },
    "paper": {
      "dimensions": {
        "height": 1945,
        "width": 1200,
        "x": 710,
        "y": -270
      }
    }
  }
inputs:
- key: policyId
  value: {}
  required: true
  description: Provides the Prisma Cloud policy Id.
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
contentitemexportablefields:
  contentitemfields: {}