Prisma Cloud Remediation - GCP VPC Network Firewall Misconfiguration

This playbook remediates the following Prisma Cloud GCP VPC Network Firewall alerts. Prisma Cloud policies remediated: - GCP Firewall rule allows internet traffic to FTP port (21) - GCP Firewall rule allows internet traffic to HTTP port (80) - GCP Firewall rule allows internet traffic to MongoDB port (27017) - GCP Firewall rule allows internet traffic to MySQL DB port (3306) - GCP Firewall rule allows internet traffic to Oracle DB port (1521) - GCP Firewall rule allows internet traffic to PostgreSQL port (5432) - GCP Firewall rule allows internet traffic to RDP port (3389) - GCP Firewall rule allows internet traffic to SSH port (22) - GCP Firewall rule allows internet traffic to Telnet port (23) - GCP Firewall rule allows internet traffic to DNS port (53) - GCP Firewall rule allows internet traffic to Microsoft-DS port (445) - GCP Firewall rule allows internet traffic to NetBIOS-SSN port (139) - GCP Firewall rule allows internet traffic to POP3 port (110) - GCP Firewall rule allows internet traffic to SMTP port (25) - GCP Default Firewall rule should not have any rules (except http and https) - GCP Firewall with Inbound rule overly permissive to All Traffic

Prisma Cloud by Palo Alto Networks · 14 tasks · 1 input · 0 outputs

Inputs

  • policyId — Prisma Cloud policy Id.

Commands used

gcp-compute-get-firewall gcp-compute-patch-firewall

Flowchart

commonPorts overlyPermissive webPorts yes yes yes yes Start Start Disable the offending FW rule - gcp-compute-patch-firewall Disable the offending FW ... gcp-compute-patch-firewall Done Done Get VPC firewall details - gcp-compute-get-firewall Get VPC firewall details gcp-compute-get-firewall Execute remediation Execute remediation Common Ports Common Ports Find the port number - Set Find the port number Set Check FW rule for public access to common ports Check FW rule for public ... Manually update FW rules Manually update FW rules Default Firewall Rules Default Firewall Rules Overly Permissive Overly Permissive Check default FW for HTTP/HTTPS rules Check default FW for HTTP... Check FW rule for public access to all protocols Check FW rule for public ... Is Google Cloud Compute integration enabled? Is Google Cloud Compute i...