Prisma Cloud Remediation - GCP VPC Network Firewall Misconfiguration

This playbook remediates the following Prisma Cloud GCP VPC Network Firewall alerts. Prisma Cloud policies remediated: - GCP Firewall rule allows internet traffic to FTP port (21) - GCP Firewall rule allows internet traffic to HTTP port (80) - GCP Firewall rule allows internet traffic to MongoDB port (27017) - GCP Firewall rule allows internet traffic to MySQL DB port (3306) - GCP Firewall rule allows internet traffic to Oracle DB port (1521) - GCP Firewall rule allows internet traffic to PostgreSQL port (5432) - GCP Firewall rule allows internet traffic to RDP port (3389) - GCP Firewall rule allows internet traffic to SSH port (22) - GCP Firewall rule allows internet traffic to Telnet port (23) - GCP Firewall rule allows internet traffic to DNS port (53) - GCP Firewall rule allows internet traffic to Microsoft-DS port (445) - GCP Firewall rule allows internet traffic to NetBIOS-SSN port (139) - GCP Firewall rule allows internet traffic to POP3 port (110) - GCP Firewall rule allows internet traffic to SMTP port (25) - GCP Default Firewall rule should not have any rules (except http and https) - GCP Firewall with Inbound rule overly permissive to All Traffic

Prisma Cloud by Palo Alto Networks · 14 tasks · 1 input · 0 outputs

Details

ID	`Prisma Cloud Remediation - GCP VPC Network Firewall Misconfiguration`
From Version	5.0.0
Tasks	14

README

This playbook remediates the following Prisma Cloud GCP VPC Network Firewall alerts.

Prisma Cloud policies remediated:

GCP Firewall rule allows internet traffic to FTP port (21)
GCP Firewall rule allows internet traffic to HTTP port (80)
GCP Firewall rule allows internet traffic to MongoDB port (27017)
GCP Firewall rule allows internet traffic to MySQL DB port (3306)
GCP Firewall rule allows internet traffic to Oracle DB port (1521)
GCP Firewall rule allows internet traffic to PostgreSQL port (5432)
GCP Firewall rule allows internet traffic to RDP port (3389)
GCP Firewall rule allows internet traffic to SSH port (22)
GCP Firewall rule allows internet traffic to Telnet port (23)
GCP Firewall rule allows internet traffic to DNS port (53)
GCP Firewall rule allows internet traffic to Microsoft-DS port (445)
GCP Firewall rule allows internet traffic to NetBIOS-SSN port (139)
GCP Firewall rule allows internet traffic to POP3 port (110)
GCP Firewall rule allows internet traffic to SMTP port (25)
GCP Default Firewall rule should not have any rules (except http and https)
GCP Firewall with Inbound rule overly permissive to All Traffic

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

Google Cloud Compute

Scripts

This playbook does not use any scripts.

Commands

gcp-compute-get-firewall
gcp-compute-patch-firewall

Playbook Inputs

Name	Description	Default Value	Required
policyId	Prisma Cloud policy Id.		Required

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Inputs

policyId — Prisma Cloud policy Id.

Commands used

gcp-compute-get-firewall gcp-compute-patch-firewall

Flowchart

Source

playbook-PCR_-_GCP_VPC_Network_Firewall_Misconfig.yml

Download History Raw

id: Prisma Cloud Remediation - GCP VPC Network Firewall Misconfiguration
version: -1
fromversion: 5.0.0
name: Prisma Cloud Remediation - GCP VPC Network Firewall Misconfiguration
description: |-
  This playbook remediates the following Prisma Cloud GCP VPC Network Firewall alerts.

  Prisma Cloud policies remediated:

   - GCP Firewall rule allows internet traffic to FTP port (21)
   - GCP Firewall rule allows internet traffic to HTTP port (80)
   - GCP Firewall rule allows internet traffic to MongoDB port (27017)
   - GCP Firewall rule allows internet traffic to MySQL DB port (3306)
   - GCP Firewall rule allows internet traffic to Oracle DB port (1521)
   - GCP Firewall rule allows internet traffic to PostgreSQL port (5432)
   - GCP Firewall rule allows internet traffic to RDP port (3389)
   - GCP Firewall rule allows internet traffic to SSH port (22)
   - GCP Firewall rule allows internet traffic to Telnet port (23)
   - GCP Firewall rule allows internet traffic to DNS port (53)
   - GCP Firewall rule allows internet traffic to Microsoft-DS port (445)
   - GCP Firewall rule allows internet traffic to NetBIOS-SSN port (139)
   - GCP Firewall rule allows internet traffic to POP3 port (110)
   - GCP Firewall rule allows internet traffic to SMTP port (25)
   - GCP Default Firewall rule should not have any rules (except http and https)
   - GCP Firewall with Inbound rule overly permissive to All Traffic
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 61bee172-14d4-4a48-815c-913b49bef800
    type: start
    task:
      id: 61bee172-14d4-4a48-815c-913b49bef800
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 630,
          "y": -160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "1":
    id: "1"
    taskid: 3fc02302-4a03-4255-8734-e7e0ff56a942
    type: regular
    task:
      id: 3fc02302-4a03-4255-8734-e7e0ff56a942
      version: -1
      name: Disable the offending FW rule
      description: Updates the specified firewall rule with the data included in the request.
      script: Google Cloud Compute|||gcp-compute-patch-firewall
      type: regular
      iscommand: true
      brand: Google Cloud Compute
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      allowed: {}
      denied: {}
      description: {}
      destinationRanges: {}
      direction: {}
      disabled:
        simple: "true"
      logConfigEnable: {}
      name:
        complex:
          root: GoogleCloudCompute
          accessor: Firewalls.name
      network: {}
      priority: {}
      sourceRanges: {}
      sourceServiceAccounts: {}
      sourceTags: {}
      targetServiceAccounts: {}
      targetTags: {}
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -490,
          "y": 1130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "3":
    id: "3"
    taskid: 1abd9220-e39e-4206-8aa3-dba2695c7f4e
    type: title
    task:
      id: 1abd9220-e39e-4206-8aa3-dba2695c7f4e
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 630,
          "y": 1300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "4":
    id: "4"
    taskid: 3aae1540-7ffb-4822-8aa3-5a2efa0acdb7
    type: regular
    task:
      id: 3aae1540-7ffb-4822-8aa3-5a2efa0acdb7
      version: -1
      name: Get VPC firewall details
      description: Returns the specified firewall.
      script: Google Cloud Compute|||gcp-compute-get-firewall
      type: regular
      iscommand: true
      brand: Google Cloud Compute
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      name:
        complex:
          root: incident
          accessor: labels.resource
          transformers:
          - operator: ParseJSON
          - operator: getField
            args:
              field:
                value:
                  simple: name
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 630,
          "y": 150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "5":
    id: "5"
    taskid: 998f0dfe-3adb-41d8-8324-f75a10b7a6ee
    type: condition
    task:
      id: 998f0dfe-3adb-41d8-8324-f75a10b7a6ee
      version: -1
      name: Execute remediation
      description: Execute the appropriate remediation task.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      commonPorts:
      - "7"
      overlyPermissive:
      - "12"
      webPorts:
      - "11"
    separatecontext: false
    conditions:
    - label: commonPorts
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: fab6a8ee-dc82-49f0-8c2c-a2a5c7666539
        - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: 9f6d22f9-873a-4a71-91a8-41a82e4c9314
        - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: b7ad863b-d54c-4b43-a157-010199a37cac
        - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: 1171a9b9-9648-405a-8e03-83e5025e81d3
        - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: 39f48b70-3f22-481d-be71-13211bc87d98
        - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: b1a3c396-2e03-4050-b7b4-6cf8a7ab5f9b
        - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: 34175634-0e4a-4e9d-9c77-0c75390b8bdc
        - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: 49a154e8-6049-4317-bbb5-0c90cb078f94
        - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: 024045e3-dfa3-4109-9d68-e7fcf3c6c4d1
        - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: dc3dd864-cff5-4730-84ac-11e212f2c1ff
        - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: 1aa8f0f0-139f-49a2-9c9d-41c71a3c806f
        - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: 7afdb939-4a9a-45b0-ba3b-f81dec86bc76
        - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: 094b6b65-a37a-4f3b-b08f-5d313a6f5051
        - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: e35ce679-e427-4e00-a9d2-44d808c694bd
    - label: webPorts
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: 3b814978-44a0-4a5b-9736-492d67ee4994
    - label: overlyPermissive
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: ff6a9cca-8bc5-4a72-9235-ec7b65c547d5
    view: |-
      {
        "position": {
          "x": 630,
          "y": 330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "7":
    id: "7"
    taskid: 6c2eba20-647c-4754-8c42-fddc318c20af
    type: title
    task:
      id: 6c2eba20-647c-4754-8c42-fddc318c20af
      version: -1
      name: Common Ports
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -490,
          "y": 500
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "8":
    id: "8"
    taskid: 027f7a25-4442-4f10-849a-61de6ed7ad96
    type: regular
    task:
      id: 027f7a25-4442-4f10-849a-61de6ed7ad96
      version: -1
      name: Find the port number
      description: Sets a value into the context with the given context key.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      append: {}
      key:
        simple: portNumber
      stringify: {}
      value:
        complex:
          root: incident
          transformers:
          - operator: getField
            args:
              field:
                value:
                  simple: rawName
          - operator: substringFrom
            args:
              from:
                value:
                  simple: port (
          - operator: substringTo
            args:
              to:
                value:
                  simple: )
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -490,
          "y": 660
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "9":
    id: "9"
    taskid: a6f27574-3295-4b37-8715-8771e18b4677
    type: condition
    task:
      id: a6f27574-3295-4b37-8715-8771e18b4677
      version: -1
      name: Check FW rule for public access to common ports
      description: Check the firewall rule for public access.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: containsString
          left:
            value:
              complex:
                root: incident
                accessor: labels.resource
                transformers:
                - operator: ParseJSON
                - operator: getField
                  args:
                    field:
                      value:
                        simple: data
                - operator: getField
                  args:
                    field:
                      value:
                        simple: sourceRanges
            iscontext: true
          right:
            value:
              simple: 0.0.0.0/0
      - - operator: inList
          left:
            value:
              simple: ${portNumber}
            iscontext: true
          right:
            value:
              simple: 21, 80, 27017, 3306, 1521, 5432, 3389, 22, 23, 53, 445, 139, 110, 25
    view: |-
      {
        "position": {
          "x": -490,
          "y": 840
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "10":
    id: "10"
    taskid: f13fa723-aae0-4c54-82e7-8b6507151987
    type: regular
    task:
      id: f13fa723-aae0-4c54-82e7-8b6507151987
      version: -1
      name: Manually update FW rules
      description: |-
        1. Login to GCP Console and from Networking, select VPC network.
        2. Go to Firewall rules and click on Ingress.
        3. Modify, disable, or delete the offending firewall rule.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 380,
          "y": 1130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "11":
    id: "11"
    taskid: 74a304c0-9094-4d9b-8972-2d56f54c8e13
    type: title
    task:
      id: 74a304c0-9094-4d9b-8972-2d56f54c8e13
      version: -1
      name: Default Firewall Rules
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -40,
          "y": 500
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "12":
    id: "12"
    taskid: 6eba9d9a-da40-4348-8f0a-1269d34d1a67
    type: title
    task:
      id: 6eba9d9a-da40-4348-8f0a-1269d34d1a67
      version: -1
      name: Overly Permissive
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 380,
          "y": 500
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "13":
    id: "13"
    taskid: 41bb8983-af56-4858-856f-946ba9880276
    type: condition
    task:
      id: 41bb8983-af56-4858-856f-946ba9880276
      version: -1
      name: Check default FW for HTTP/HTTPS rules
      description: Check the default firewall rule for the web ports; 80 and 443.  If the firewall rule contains either one, or both of these ports, manually update the rule.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "1"
      "yes":
      - "10"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: startWith
          left:
            value:
              complex:
                root: incident
                accessor: labels.resource
                transformers:
                - operator: ParseJSON
                - operator: getField
                  args:
                    field:
                      value:
                        simple: name
            iscontext: true
          right:
            value:
              simple: default
      - - operator: containsString
          left:
            value:
              complex:
                root: incident
                accessor: labels.resource
                transformers:
                - operator: ParseJSON
                - operator: getField
                  args:
                    field:
                      value:
                        simple: data
                - operator: getField
                  args:
                    field:
                      value:
                        simple: sourceRanges
            iscontext: true
          right:
            value:
              simple: 0.0.0.0/0
      - - operator: containsString
          left:
            value:
              complex:
                root: incident
                accessor: labels.resource
                transformers:
                - operator: ParseJSON
                - operator: getField
                  args:
                    field:
                      value:
                        simple: data
                - operator: getField
                  args:
                    field:
                      value:
                        simple: allowed
                - operator: getField
                  args:
                    field:
                      value:
                        simple: ports
            iscontext: true
          right:
            value:
              simple: "80"
        - operator: containsString
          left:
            value:
              complex:
                root: incident
                accessor: labels.resource
                transformers:
                - operator: ParseJSON
                - operator: getField
                  args:
                    field:
                      value:
                        simple: data
                - operator: getField
                  args:
                    field:
                      value:
                        simple: allowed
                - operator: getField
                  args:
                    field:
                      value:
                        simple: ports
            iscontext: true
          right:
            value:
              simple: "443"
    view: |-
      {
        "position": {
          "x": -40,
          "y": 660
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "14":
    id: "14"
    taskid: e9efe2ae-22ce-4705-831c-06a0ab2b7761
    type: condition
    task:
      id: e9efe2ae-22ce-4705-831c-06a0ab2b7761
      version: -1
      name: Check FW rule for public access to all protocols
      description: Check the firewall rule for public access.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: containsString
          left:
            value:
              complex:
                root: incident
                accessor: labels.resource
                transformers:
                - operator: ParseJSON
                - operator: getField
                  args:
                    field:
                      value:
                        simple: data
                - operator: getField
                  args:
                    field:
                      value:
                        simple: sourceRanges
            iscontext: true
          right:
            value:
              simple: 0.0.0.0/0
      - - operator: isEqualString
          left:
            value:
              complex:
                root: incident
                accessor: labels.resource
                transformers:
                - operator: ParseJSON
                - operator: getField
                  args:
                    field:
                      value:
                        simple: data
                - operator: getField
                  args:
                    field:
                      value:
                        simple: allowed
                - operator: getField
                  args:
                    field:
                      value:
                        simple: IPProtocol
            iscontext: true
          right:
            value:
              simple: all
    view: |-
      {
        "position": {
          "x": 380,
          "y": 660
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "15":
    id: "15"
    taskid: b540e8c3-4ffb-4943-8c47-16ef885bd30a
    type: condition
    task:
      id: b540e8c3-4ffb-4943-8c47-16ef885bd30a
      version: -1
      name: Is Google Cloud Compute integration enabled?
      description: "Is Google Cloud Compute integration enabled?"
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Google Cloud Compute
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 630,
          "y": -30
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "13_10_yes": 0.4,
      "13_1_#default#": 0.4,
      "14_10_#default#": 0.48,
      "14_1_yes": 0.23,
      "5_3_#default#": 0.31,
      "5_7_commonPorts": 0.83,
      "9_10_#default#": 0.1,
      "9_1_yes": 0.43
    },
    "paper": {
      "dimensions": {
        "height": 1525,
        "width": 1500,
        "x": -490,
        "y": -160
      }
    }
  }
inputs:
- key: policyId
  value: {}
  required: true
  description: Prisma Cloud policy Id.
outputs: []
tests:
- No Test