Prisma Cloud Remediation - AWS Security Groups Allows Internet Traffic To TCP Port

This playbook extracts the TCP public Security Groups rule and provides manual/automatic options to have the rules revoked.

Prisma Cloud by Palo Alto Networks · 12 tasks · 1 input · 0 outputs

Inputs

  • AutoRevokeRule — If set to: - yes: public security group rules will be automatically revoked - no: analyst will be prompted whether or not to allow automatic removal of the rules.

Commands used

aws-ec2-describe-security-groups aws-ec2-revoke-security-group-ingress-rule closeInvestigation

Flowchart

YES yes yes yes Start Start Get TCP public Security Group rules from incident data - AwsEC2GetPublicSGRules Get TCP public Security G... AwsEC2GetPublicSGRules Run command to automatically revoke public Security Group rules? Run command to automatica... Is AWS - EC2 enabled? Is AWS - EC2 enabled? Revoke public TCP ingress rules - aws-ec2-revoke-security-group-ingress-rule Revoke public TCP ingress... aws-ec2-revoke-security-group... Manually remove public TCP ingress rules Manually remove public TC... Get the latest Security Group IP permissions - aws-ec2-describe-security-groups Get the latest Security G... aws-ec2-describe-security-groups Get TCP public Security Group Rules - AwsEC2GetPublicSGRules Get TCP public Security G... AwsEC2GetPublicSGRules Are there any public rules? Are there any public rules? Close investigation - closeInvestigation Close investigation closeInvestigation Done Done Auto removal of public Security Group rules? Auto removal of public Se...