Prisma Cloud Remediation - GCP VPC Network Misconfiguration Deprecated Hidden

Deprecated. Use Prisma Cloud Remediation - GCP VPC Network Misconfiguration v2 instead. This playbook remediates Prisma Cloud GCP VPC Network alerts. It calls sub-playbooks that perform the actual remediation steps. Remediation: - GCP project is using the default network - GCP Firewall rule allows internet traffic to FTP port (21) - GCP Firewall rule allows internet traffic to HTTP port (80) - GCP Firewall rule allows internet traffic to MongoDB port (27017) - GCP Firewall rule allows internet traffic to MySQL DB port (3306) - GCP Firewall rule allows internet traffic to Oracle DB port (1521) - GCP Firewall rule allows internet traffic to PostgreSQL port (5432) - GCP Firewall rule allows internet traffic to RDP port (3389) - GCP Firewall rule allows internet traffic to SSH port (22) - GCP Firewall rule allows internet traffic to Telnet port (23) - GCP Firewall rule allows internet traffic to DNS port (53) - GCP Firewall rule allows internet traffic to Microsoft-DS port (445) - GCP Firewall rule allows internet traffic to NetBIOS-SSN port (139) - GCP Firewall rule allows internet traffic to POP3 port (110) - GCP Firewall rule allows internet traffic to SMTP port (25) - GCP Default Firewall rule should not have any rules (except http and https) - GCP Firewall with Inbound rule overly permissive to All Traffic

Prisma Cloud by Palo Alto Networks · 13 tasks · 2 inputs · 0 outputs

Details

IDPrisma Cloud Remediation - GCP VPC Network Misconfiguration
From Version5.0.0
Tasks13

README

This playbook remediates Prisma Cloud GCP VPC Network alerts. It calls sub-playbooks that perform the actual remediation steps.

Remediation:

  • GCP project is using the default network
  • GCP Firewall rule allows internet traffic to FTP port (21)
  • GCP Firewall rule allows internet traffic to HTTP port (80)
  • GCP Firewall rule allows internet traffic to MongoDB port (27017)
  • GCP Firewall rule allows internet traffic to MySQL DB port (3306)
  • GCP Firewall rule allows internet traffic to Oracle DB port (1521)
  • GCP Firewall rule allows internet traffic to PostgreSQL port (5432)
  • GCP Firewall rule allows internet traffic to RDP port (3389)
  • GCP Firewall rule allows internet traffic to SSH port (22)
  • GCP Firewall rule allows internet traffic to Telnet port (23)
  • GCP Firewall rule allows internet traffic to DNS port (53)
  • GCP Firewall rule allows internet traffic to Microsoft-DS port (445)
  • GCP Firewall rule allows internet traffic to NetBIOS-SSN port (139)
  • GCP Firewall rule allows internet traffic to POP3 port (110)
  • GCP Firewall rule allows internet traffic to SMTP port (25)
  • GCP Default Firewall rule should not have any rules (except http and https)
  • GCP Firewall with Inbound rule overly permissive to All Traffic

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Prisma Cloud Remediation - GCP VPC Network Project Misconfiguration
  • Prisma Cloud Remediation - GCP VPC Network Firewall Misconfiguration

Integrations

  • Builtin
  • PrismaCloud v2

Scripts

This playbook does not use any scripts.

Commands

  • redlock-dismiss-alerts
  • closeInvestigation

Playbook Inputs

Name Description Default Value Required
AutoRemediateVPCNetwork Execute GCP Compute Engine remediation automatically? no Optional
policyId Grab the Prisma Cloud policy ID. incident.labels.policy Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Playbook Image

Inputs

  • AutoRemediateVPCNetwork — Execute GCP Compute Engine remediation automatically?
  • policyId — Grab the Prisma Cloud policy Id.

Commands used

closeInvestigation redlock-dismiss-alerts

Flowchart

yes yes yes Yes firewall project yes Start Start Is Google Cloud Compute integration enabled? Is Google Cloud Compute i... Done Done Is there a policy to remediate? Is there a policy to reme... Update VPC network automatically? Update VPC network automa... Auto remediate? Auto remediate? Execute playbook Execute playbook Manually update VPC network Manually update VPC network Close investigation - closeInvestigation Close investigation closeInvestigation Is Prisma Cloud v2 integration enabled? Is Prisma Cloud v2 integr... Prisma Cloud Remediation - GCP VPC Network Project Misconfiguration - Prisma Cloud Remediation - GCP VPC Network Project Misconfiguration Prisma Cloud Remediation ... Prisma Cloud Remediation - GC... Prisma Cloud Remediation - GCP VPC Network Firewall Misconfiguration - Prisma Cloud Remediation - GCP VPC Network Firewall Misconfiguration Prisma Cloud Remediation ... Prisma Cloud Remediation - GC... Dismiss Prisma Cloud alert - redlock-dismiss-alerts Dismiss Prisma Cloud alert redlock-dismiss-alerts

Source

playbook-PCR_-_GCP_VPC_Network_Misconfig.yml playbook-PCR_-_GCP_VPC_Network_Misconfig_v2.yml playbook-PCR_-_GCP_VPC_Network_Misconfig_v2_README.md
Download History Raw 
This playbook remediates Prisma Cloud GCP VPC Network alerts.  It calls sub-playbooks that perform the actual remediation steps.

Remediation:

 - GCP project is using the default network
 - GCP Firewall rule allows internet traffic to FTP port (21)
 - GCP Firewall rule allows internet traffic to HTTP port (80)
 - GCP Firewall rule allows internet traffic to MongoDB port (27017)
 - GCP Firewall rule allows internet traffic to MySQL DB port (3306)
 - GCP Firewall rule allows internet traffic to Oracle DB port (1521)
 - GCP Firewall rule allows internet traffic to PostgreSQL port (5432)
 - GCP Firewall rule allows internet traffic to RDP port (3389)
 - GCP Firewall rule allows internet traffic to SSH port (22)
 - GCP Firewall rule allows internet traffic to Telnet port (23)
 - GCP Firewall rule allows internet traffic to DNS port (53)
 - GCP Firewall rule allows internet traffic to Microsoft-DS port (445)
 - GCP Firewall rule allows internet traffic to NetBIOS-SSN port (139)
 - GCP Firewall rule allows internet traffic to POP3 port (110)
 - GCP Firewall rule allows internet traffic to SMTP port (25)
 - GCP Default Firewall rule should not have any rules (except http and https)
 - GCP Firewall with Inbound rule overly permissive to All Traffic

## Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

### Sub-playbooks

* Prisma Cloud Remediation - GCP VPC Network Firewall Misconfiguration
* Prisma Cloud Remediation - GCP VPC Network Project Misconfiguration

### Integrations
* Builtin
* PrismaCloud v2

### Scripts

This playbook does not use any scripts.

### Commands

* prisma-cloud-alert-dismiss
* closeInvestigation

## Playbook Inputs

---

| **Name** | **Description** | **Default Value** | **Required** |
| --- | --- | --- | --- |
| AutoRemediateVPCNetwork | Execute GCP Compute Engine remediation automatically? | no | Optional |
| policyId | Grab the Prisma Cloud policy ID. | incident.labels.policy | Optional |

## Playbook Outputs

---
There are no outputs for this playbook.

## Playbook Image

---

![Prisma Cloud Remediation - GCP VPC Network Misconfiguration v2](../doc_files/Prisma_Cloud_Remediation_-_GCP_VPC_Network_Misconfiguration_v2.png)