Prisma Cloud Remediation - GCP Kubernetes Engine Misconfiguration Deprecated Hidden

Deprecated. Use Prisma Cloud Remediation - GCP Kubernetes Engine Misconfiguration v2 instead. This playbook remediates Prisma Cloud GCP Kubernetes Engine alerts. It calls sub-playbooks that perform the actual remediation steps. Remediation: * GCP Kubernetes Engine Clusters Basic Authentication is set to Enabled * GCP Kubernetes Engine Clusters have HTTP load balancing disabled * GCP Kubernetes Engine Clusters have Legacy Authorization enabled * GCP Kubernetes Engine Clusters have Master authorized networks disabled * GCP Kubernetes Engine Clusters have Network policy disabled * GCP Kubernetes Engine Clusters have Stackdriver Logging disabled * GCP Kubernetes Engine Clusters have Stackdriver Monitoring disabled * GCP Kubernetes Engine Clusters have binary authorization disabled * GCP Kubernetes Engine Clusters web UI/Dashboard is set to Enabled * GCP Kubernetes cluster intra-node visibility disabled

Prisma Cloud by Palo Alto Networks · 12 tasks · 2 inputs · 0 outputs

Details

IDPrisma Cloud Remediation - GCP Kubernetes Engine Misconfiguration
From Version5.0.0
Tasks12

README

This playbook remediates Prisma Cloud GCP Kubernetes Engine alerts. It calls sub-playbooks that perform the actual remediation steps.

Remediation:

  • GCP Kubernetes Engine Clusters Basic Authentication is set to Enabled
  • GCP Kubernetes Engine Clusters have HTTP load balancing disabled
  • GCP Kubernetes Engine Clusters have Legacy Authorization enabled
  • GCP Kubernetes Engine Clusters have Master authorized networks disabled
  • GCP Kubernetes Engine Clusters have Network policy disabled
  • GCP Kubernetes Engine Clusters have Stackdriver Logging disabled
  • GCP Kubernetes Engine Clusters have Stackdriver Monitoring disabled
  • GCP Kubernetes Engine Clusters have binary authorization disabled
  • GCP Kubernetes Engine Clusters web UI/Dashboard is set to Enabled
  • GCP Kubernetes cluster intra-node visibility disabled

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Prisma Cloud Remediation - GCP Kubernetes Engine Cluster Misconfiguration

Integrations

  • PrismaCloud v2

Scripts

This playbook does not use any scripts.

Commands

  • closeInvestigation
  • redlock-dismiss-alerts

Playbook Inputs

Name Description Default Value Required
AutoRemediateKubernetesEngine Execute GCP Kubernetes Engine remediation automatically? no Optional
policyId Grab the Prima Cloud policy Id. incident.labels.policy Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Prisma Cloud Remediation - GCP Kubernetes Engine Misconfiguration

Inputs

  • AutoRemediateKubernetesEngine — Execute GCP Kubernetes Engine remediation automatically?
  • policyId — Grab the Prima Cloud policy Id.

Commands used

closeInvestigation redlock-dismiss-alerts

Flowchart

yes yes Yes cluster yes yes Start Start Done Done Is there a policy to remediate? Is there a policy to reme... Update Kubernetes Engine automatically? Update Kubernetes Engine ... Auto remediate? Auto remediate? Execute playbook Execute playbook Manually update Kubernetes Engine Manually update Kubernete... Close investigation - closeInvestigation Close investigation closeInvestigation Is Prisma Cloud v2 integration enabled? Is Prisma Cloud v2 integr... Dismiss Prisma Cloud alert - redlock-dismiss-alerts Dismiss Prisma Cloud alert redlock-dismiss-alerts Prisma Cloud Remediation - GCP Kubernetes Engine Cluster Misconfiguration - Prisma Cloud Remediation - GCP Kubernetes Engine Cluster Misconfiguration Prisma Cloud Remediation ... Prisma Cloud Remediation - GC... Is Google Kubernetes Engine integration enabled? Is Google Kubernetes Engi...

Source

playbook-PCR_-_GCP_Kub_Engine_Misconfig.yml playbook-PCR_-_GCP_Kub_Engine_Misconfig_v2.yml playbook-PCR_-_GCP_Kub_Engine_Misconfig_v2_README.md
Download History Raw 
This playbook remediates Prisma Cloud GCP Kubernetes Engine alerts.  It calls sub-playbooks that perform the actual remediation steps.

Remediation:
* GCP Kubernetes Engine Clusters Basic Authentication is set to Enabled
* GCP Kubernetes Engine Clusters have HTTP load balancing disabled
* GCP Kubernetes Engine Clusters have Legacy Authorization enabled
* GCP Kubernetes Engine Clusters have Master authorized networks disabled
* GCP Kubernetes Engine Clusters have Network policy disabled
* GCP Kubernetes Engine Clusters have Stackdriver Logging disabled
* GCP Kubernetes Engine Clusters have Stackdriver Monitoring disabled
* GCP Kubernetes Engine Clusters have binary authorization disabled
* GCP Kubernetes Engine Clusters web UI/Dashboard is set to Enabled
* GCP Kubernetes cluster intra-node visibility disabled


## Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

### Sub-playbooks

Prisma Cloud Remediation - GCP Kubernetes Engine Cluster Misconfiguration

### Integrations

PrismaCloud v2

### Scripts

This playbook does not use any scripts.

### Commands

* prisma-cloud-alert-dismiss
* closeInvestigation

## Playbook Inputs

---

| **Name** | **Description** | **Default Value** | **Required** |
| --- | --- | --- | --- |
| AutoRemediateKubernetesEngine | Execute GCP Kubernetes Engine remediation automatically? | no | Optional |
| policyId | Grab the Prima Cloud policy ID. | incident.labels.policy | Optional |

## Playbook Outputs

---
There are no outputs for this playbook.

## Playbook Image

---

![Prisma Cloud Remediation - GCP Kubernetes Engine Misconfiguration v2](../doc_files/Prisma_Cloud_Remediation_-_GCP_Kubernetes_Engine_Misconfiguration_v2.png)