Prisma Cloud Remediation - Azure Network Misconfiguration Deprecated Hidden

Deprecated. Use Prisma Cloud Remediation - Azure Network Misconfiguration v2 instead. This playbook remediates Prisma Cloud Azure Network alerts. It calls sub-playbooks that perform the actual remediation steps. Remediation: - Azure Network Security Group (NSG) having Inbound rule overly permissive to allow all traffic from any source on any protocol - Azure Network Security Group (NSG) having Inbound rule overly permissive to allow all traffic from any source on TCP protocol - Azure Network Security Group (NSG) having Inbound rule overly permissive to allow all traffic from any source on UDP protocol - Azure Network Security Group (NSG) allows SSH traffic from internet on port 22 - Azure Network Security Group (NSG) allows traffic from internet on port 3389 - Azure Network Security Group allows DNS (TCP Port 53) - Azure Network Security Group allows FTP (TCP Port 21) - Azure Network Security Group allows FTP-Data (TCP Port 20) - Azure Network Security Group allows MSQL (TCP Port 4333) - Azure Network Security Group allows MySQL (TCP Port 3306) - Azure Network Security Group allows Windows RPC (TCP Port 135) - Azure Network Security Group allows Windows SMB (TCP Port 445) - Azure Network Security Group allows PostgreSQL (TCP Port 5432) - Azure Network Security Group allows SMTP (TCP Port 25) - Azure Network Security Group allows SqlServer (TCP Port 1433) - Azure Network Security Group allows Telnet (TCP Port 23) - Azure Network Security Group allows VNC Listener (TCP Port 5500) - Azure Network Security Group allows all traffic on ICMP (Ping) - Azure Network Security Group allows CIFS (UDP Port 445) - Azure Network Security Group allows NetBIOS (UDP Port 137) - Azure Network Security Group allows NetBIOS (UDP Port 138) - Azure Network Security Group allows SQLServer (UDP Port 1434) - Azure Network Security Group allows DNS (UDP Port 53)

Prisma Cloud by Palo Alto Networks · 12 tasks · 3 inputs · 1 output

Inputs

  • AutoRemediateAzureNetwork — Execute Azure Network remediation automatically?
  • policyId — Grab the Prisma Cloud policy Id.
  • portNumber — Port number.

Outputs

  • incident.resourcename — Security group name.

Commands used

closeInvestigation redlock-dismiss-alerts

Flowchart

yes yes yes Yes securityGroup yes Start Start Is Azure Network Security Groups integration enabled? - IsIntegrationAvailable Is Azure Network Security... IsIntegrationAvailable Done Done Is there a policy to remediate? Is there a policy to reme... Update network automatically? Update network automatica... Auto remediate? Auto remediate? Execute playbook Execute playbook Manually update network Manually update network Close investigation - closeInvestigation Close investigation closeInvestigation Is Prisma Cloud v2 integration enabled? Is Prisma Cloud v2 integr... Dismiss Prisma Cloud alert - redlock-dismiss-alerts Dismiss Prisma Cloud alert redlock-dismiss-alerts Prisma Cloud Remediation - Azure Network Security Group Misconfiguration - Prisma Cloud Remediation - Azure Network Security Group Misconfiguration Prisma Cloud Remediation ... Prisma Cloud Remediation - Az...