Prisma Cloud Remediation - AWS IAM Policy Misconfiguration v2

This playbook remediates Prisma Cloud AWS IAM policy alerts. It uses sub-playbooks that perform the remediation steps.
Prisma Cloud by Palo Alto Networks · 13 tasks · 2 inputs · 0 outputs
Details

ID	`Prisma Cloud Remediation - AWS IAM Policy Misconfiguration v2`
From Version	6.5.0
Tasks	13
README

This playbook remediates Prisma Cloud AWS IAM policy alerts. It uses sub-playbooks that perform the remediation steps.
Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks

Prisma Cloud Remediation - AWS IAM Password Policy Misconfiguration
Prisma Cloud Remediation - AWS IAM User Policy Misconfiguration
Integrations

PrismaCloudV2
Scripts

This playbook does not use any scripts.
Commands

aws-iam-get-account-password-policy
prisma-cloud-alert-dismiss
closeInvestigation
Playbook Inputs

Name	Description	Default Value	Required
AutoUpdatePasswordPolicy	Update AWS IAM password policy automatically?	no	Optional
policyId	Get the Prisma Cloud policy ID.	incident.labels.policy	Optional
Playbook Outputs

There are no outputs for this playbook.
Playbook Image

Prisma Cloud Remediation - AWS IAM Policy Misconfiguration v2
Inputs

policyId — Get the Prisma Cloud policy ID.
AutoUpdatePasswordPolicy — Update AWS IAM password policy automatically?
Commands used

aws-iam-get-account-password-policy closeInvestigation prisma-cloud-alert-dismiss
Flowchart

Source

playbook-PCR_-_AWS_IAM_Policy_Misconfig_v2.yml
Download History Raw
id: Prisma Cloud Remediation - AWS IAM Policy Misconfiguration v2
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Prisma Cloud Remediation - AWS IAM Policy Misconfiguration v2
description: This playbook remediates Prisma Cloud AWS IAM policy alerts. It uses sub-playbooks that perform the remediation steps.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 972c2cba-e9e8-4b4e-8f92-407ca7fb7917
    type: start
    task:
      id: 972c2cba-e9e8-4b4e-8f92-407ca7fb7917
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 690,
          "y": -180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 5da95853-5c28-4f84-824d-38b0e1c0e9c9
    type: condition
    task:
      id: 5da95853-5c28-4f84-824d-38b0e1c0e9c9
      version: -1
      name: Is AWS - IAM integration enabled?
      description: Verifies that AWS - IAM integration is enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "8"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: AWS - IAM
                accessor: brand
            iscontext: true
          right:
            value:
              simple: AWS - IAM
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 690,
          "y": -50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: aff07456-1840-40d5-8b24-53c75bf75e62
    type: regular
    task:
      id: aff07456-1840-40d5-8b24-53c75bf75e62
      version: -1
      name: Get IAM password policy
      description: Get AWS account's password policy.
      script: '|||aws-iam-get-account-password-policy'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 711289d0-3db3-43d7-8527-39112d8bae61
    type: condition
    task:
      id: 711289d0-3db3-43d7-8527-39112d8bae61
      version: -1
      name: Update IAM password policy automatically?
      description: Should we auto-remediate?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "10"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.AutoUpdatePasswordPolicy
                transformers:
                - operator: toLowerCase
            iscontext: true
          right:
            value:
              simple: "yes"
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 150,
          "y": 290
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: d7495e19-5781-4bbf-88e1-7c4be19f9ad8
    type: condition
    task:
      id: d7495e19-5781-4bbf-88e1-7c4be19f9ad8
      version: -1
      name: Auto remediate?
      description: Determine whether or not to auto-remediate?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "Yes":
      - "10"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
        simple: ${incident.id} Autoremediate?
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: false
        completeaftersla: false
      replyOptions:
      - "Yes"
      - "No"
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 1214b667-e9c5-4efe-8503-d92b4f36cc0a
    type: regular
    task:
      id: 1214b667-e9c5-4efe-8503-d92b4f36cc0a
      version: -1
      name: Manually update IAM password policy
      description: |-
        1. Login to the AWS console and navigate to the IAM dashboard
        2. On the left navigation panel, click on Account Settings
        3. Check Prevent password reuse and enter remember 5 passwords
        4. Click on Apply password policy
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 800
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 599730fe-9f1e-4a63-89c5-e941732683b6
    type: regular
    task:
      id: 599730fe-9f1e-4a63-89c5-e941732683b6
      version: -1
      name: Close investigation
      description: Close the current incident.
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      id:
        complex:
          root: incident
          accessor: id
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: a8d06dc1-f186-4459-87b6-3d05d85f70d0
    type: title
    task:
      id: a8d06dc1-f186-4459-87b6-3d05d85f70d0
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 690,
          "y": 1520
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 84a57f97-7df7-43e4-8ef4-b7abee45a9fe
    type: regular
    task:
      id: 84a57f97-7df7-43e4-8ef4-b7abee45a9fe
      version: -1
      name: Dismiss Prisma Cloud alert
      description: Dismiss or snooze the alerts matching the given filter. Either policy IDs or alert IDs must be provided. When no absolute time nor relative time arguments are provided, the default time range is all times. For snoozing, provide "snooze_unit" and "snooze_value" arguments.
      script: '|||prisma-cloud-alert-dismiss'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      alert_ids:
        complex:
          root: incident
          accessor: labels
          transformers:
          - operator: getField
            args:
              field:
                value:
                  simple: id
      dismissal_note:
        simple: ${incident.labels.id} has been remediated by Cortex XSOAR.
      policy_ids:
        complex:
          root: incident
          accessor: labels.policy
          transformers:
          - operator: ParseJSON
          - operator: getField
            args:
              field:
                value:
                  simple: policyId
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 60,
          "y": 1180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 47348d70-6e0a-4efc-80d8-4f1f37d9561a
    type: condition
    task:
      id: 47348d70-6e0a-4efc-80d8-4f1f37d9561a
      version: -1
      name: Get Prisma Cloud policy id
      description: Verify that a Prisma Cloud policy ID exists.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      passwdPolicy:
      - "11"
      userPolicy:
      - "12"
    separatecontext: false
    defaultassigneecomplex: {}
    conditions:
    - label: passwdPolicy
      condition:
      - - operator: isNotEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: e809c246-2ef5-4319-bba9-2c5735d88aa8
    - label: userPolicy
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: e809c246-2ef5-4319-bba9-2c5735d88aa8
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 150,
          "y": 630
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 95edff8c-bcac-4296-80c9-293d77209f66
    type: playbook
    task:
      id: 95edff8c-bcac-4296-80c9-293d77209f66
      version: -1
      name: Prisma Cloud Remediation - AWS IAM Password Policy Misconfiguration
      description: |-
        This playbook remediates the following Prisma Cloud AWS IAM password policy alerts.

        Prisma Cloud policies remediated:
        - AWS IAM password policy allows password reuse
        - AWS IAM password policy does not expire in 90 days
        - AWS IAM password policy does not have a lowercase character
        - AWS IAM password policy does not have a minimum of 14 characters
        - AWS IAM password policy does not have a number
        - AWS IAM password policy does not have a symbol
        - AWS IAM password policy does not have a uppercase character
        - AWS IAM password policy does not have password expiration period
        - AWS IAM Password policy is insecure
      playbookName: Prisma Cloud Remediation - AWS IAM Password Policy Misconfiguration
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      policyId:
        complex:
          root: inputs.policyId
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 10,
          "y": 840
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: ac6bdd4a-0d17-49b5-8d5e-ca830175b5a9
    type: playbook
    task:
      id: ac6bdd4a-0d17-49b5-8d5e-ca830175b5a9
      version: -1
      name: Prisma Cloud Remediation - AWS IAM User Policy Misconfiguration
      description: |-
        This playbook remediates the following Prisma Cloud AWS IAM User alerts.

        Prisma Cloud policies remediated:

         - AWS IAM user has two active Access Keys
      playbookName: Prisma Cloud Remediation - AWS IAM User Policy Misconfiguration
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      policyId:
        complex:
          root: inputs.policyId
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": -450,
          "y": 800
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 06bdb957-83d6-4613-8589-376daa6136c1
    type: condition
    task:
      id: 06bdb957-83d6-4613-8589-376daa6136c1
      version: -1
      name: Is Prisma Cloud v2 integration enabled?
      description: Is Prisma Cloud v2 integration enabled?
      type: condition
      iscommand: false
      brand: PrismaCloud v2
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "9"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: PrismaCloud v2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1010
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
system: true
view: |-
  {
    "linkLabelsPosition": {
      "10_11_passwdPolicy": 0.39,
      "10_6_#default#": 0.54,
      "1_2_yes": 0.49,
      "1_8_#default#": 0.21,
      "3_10_yes": 0.48,
      "3_5_#default#": 0.48,
      "5_10_Yes": 0.51,
      "5_6_#default#": 0.42
    },
    "paper": {
      "dimensions": {
        "height": 1765,
        "width": 1520,
        "x": -450,
        "y": -180
      }
    }
  }
inputs:
- key: policyId
  value:
    complex:
      root: incident
      accessor: labels.policy
      transformers:
      - operator: ParseJSON
      - operator: getField
        args:
          field:
            value:
              simple: policyId
  required: false
  description: Get the Prisma Cloud policy ID.
  playbookInputQuery:
- key: AutoUpdatePasswordPolicy
  value:
    simple: "no"
  required: false
  description: Update AWS IAM password policy automatically?
  playbookInputQuery:
inputSections:
- inputs:
  - policyId
  name: Incident Data
  description: Relevant data regarding the incident.
- inputs:
  - AutoUpdatePasswordPolicy
  name: Remediation
  description: Remediation settings and data, including containment, eradication, and recovery.
outputSections:
- outputs: []
  name: General (Outputs group)
  description: Generic group for outputs
outputs: []
tests:
- Prisma Cloud V2 Test
fromversion: 6.5.0