Prisma Cloud Remediation - Azure Storage Misconfiguration Deprecated Hidden

Deprecated. Use Prisma Cloud Remediation - Azure Storage Misconfiguration v2 instead. This playbook remediates Prisma Cloud Azure Storage alerts. It calls sub-playbooks that perform the actual remediation steps. Remediation: - Azure storage account has a blob container with public access - Azure storage account logging for blobs is disabled - Azure Storage Accounts without Secure transfer enabled - Azure storage account logging for queues is disabled - Azure storage account logging for tables is disabled #95

Prisma Cloud by Palo Alto Networks · 12 tasks · 2 inputs · 0 outputs

Details

IDPrisma Cloud Remediation - Azure Storage Misconfiguration
From Version5.0.0
Tasks12

README

This playbook remediates Prisma Cloud Azure Storage alerts. It calls sub-playbooks that perform the actual remediation steps.

Remediation:

  • Azure storage account has a blob container with public access
  • Azure storage account logging for blobs is disabled
  • Azure Storage Accounts without Secure transfer enabled
  • Azure storage account logging for queues is disabled
  • Azure storage account logging for tables is disabled #95

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Prisma Cloud Remediation - Azure Storage Blob Misconfiguration

Integrations

  • PrismaCloud v2

Scripts

  • IsIntegrationAvailable

Commands

  • closeInvestigation
  • redlock-dismiss-alerts

Playbook Inputs

Name Description Default Value Required
AutoRemediateAzureStorage Execute Azure Storage remediation automatically? no Optional
policyId Grab the Prisma Cloud policy Id. incident.labels.policy Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Prisma Cloud Remediation - Azure Storage Misconfiguration

Inputs

  • AutoRemediateAzureStorage — Execute Azure Storage remediation automatically?
  • policyId — Grab the Prisma Cloud policy Id.

Commands used

closeInvestigation redlock-dismiss-alerts

Flowchart

yes yes yes Yes blob yes Start Start Is Azure Storage integration enabled? - IsIntegrationAvailable Is Azure Storage integrat... IsIntegrationAvailable Done Done Is there a policy to remediate? Is there a policy to reme... Update Storage automatically? Update Storage automatica... Auto remediate? Auto remediate? Execute playbook Execute playbook Manually update Storage Manually update Storage Close investigation - closeInvestigation Close investigation closeInvestigation Is Prisma Cloud v2 integration enabled? Is Prisma Cloud v2 integr... Dismiss Prisma Cloud alert - redlock-dismiss-alerts Dismiss Prisma Cloud alert redlock-dismiss-alerts Prisma Cloud Remediation - Azure Storage Blob Misconfiguration - Prisma Cloud Remediation - Azure Storage Blob Misconfiguration Prisma Cloud Remediation ... Prisma Cloud Remediation - Az...

Source

playbook-PCR_-_Azure_Storage_Misconfig.yml playbook-PCR_-_Azure_Storage_Misconfig_v2.yml playbook-PCR_-_Azure_Storage_Misconfig_v2_README.md
Download History Raw 
This playbook remediates Prisma Cloud Azure Storage alerts.  It calls sub-playbooks that perform the actual remediation steps.

Remediation:

- Azure storage account has a blob container with public access
- Azure storage account logging for blobs is disabled
- Azure Storage Accounts without Secure transfer enabled
- Azure storage account logging for queues is disabled
- Azure storage account logging for tables is disabled

## Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

### Sub-playbooks

Prisma Cloud Remediation - Azure Storage Blob Misconfiguration

### Integrations

PrismaCloud v2

### Scripts

IsIntegrationAvailable

### Commands

* prisma-cloud-alert-dismiss
* closeInvestigation

## Playbook Inputs

---

| **Name** | **Description** | **Default Value** | **Required** |
| --- | --- | --- | --- |
| AutoRemediateAzureStorage | Execute Azure Storage remediation automatically? | no | Optional |
| policyId | Grab the Prisma Cloud policy ID. | incident.labels.policy | Optional |

## Playbook Outputs

---
There are no outputs for this playbook.

## Playbook Image

---

![Prisma Cloud Remediation - Azure Storage Misconfiguration v2](../doc_files/Prisma_Cloud_Remediation_-_Azure_Storage_Misconfiguration_v2.png)