Prisma Cloud Remediation - GCP VPC Network Project Misconfiguration

This playbook remediates the following Prisma Cloud GCP VPC Network Project alerts. Prisma Cloud policies remediated: - GCP project is using the default network

Prisma Cloud by Palo Alto Networks · 10 tasks · 1 input · 0 outputs

Details

IDPrisma Cloud Remediation - GCP VPC Network Project Misconfiguration
From Version5.0.0
Tasks10

README

This playbook remediates the following Prisma Cloud GCP VPC Network Project alerts.

Prisma Cloud policies remediated:

  • GCP project is using the default network

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

  • Google Cloud Compute

Scripts

  • isError

Commands

  • gcp-compute-get-network
  • gcp-compute-delete-network

Playbook Inputs

Name Description Default Value Required
policyId Prisma Cloud policy Id.   Required

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Playbook Image

Inputs

  • policyId — Prisma Cloud policy Id.

Commands used

gcp-compute-delete-network gcp-compute-get-network

Flowchart

default yes no yes yes Start Start Attempt to delete default VPC network - gcp-compute-delete-network Attempt to delete default... gcp-compute-delete-network Done Done Get VPC network details - gcp-compute-get-network Get VPC network details gcp-compute-get-network Execute remediation Execute remediation Default Network Default Network Check for default VPC network? Check for default VPC net... Did we encounter an error? - isError Did we encounter an error? isError Manually remove default VPC and its resources Manually remove default V... Is Google Cloud Compute integration enabled? Is Google Cloud Compute i...

Source

playbook-PCR_-_GCP_VPC_Network_Project_Misconfig.yml
Download History Raw 
id: Prisma Cloud Remediation - GCP VPC Network Project Misconfiguration
version: -1
fromversion: 5.0.0
name: Prisma Cloud Remediation - GCP VPC Network Project Misconfiguration
description: |-
  This playbook remediates the following Prisma Cloud GCP VPC Network Project alerts.

  Prisma Cloud policies remediated:

   - GCP project is using the default network
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 61bee172-14d4-4a48-815c-913b49bef800
    type: start
    task:
      id: 61bee172-14d4-4a48-815c-913b49bef800
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 630,
          "y": -160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "1":
    id: "1"
    taskid: e0c6d561-84ef-40a0-8c33-46b1cd7facbc
    type: regular
    task:
      id: e0c6d561-84ef-40a0-8c33-46b1cd7facbc
      version: -1
      name: Attempt to delete default VPC network
      description: Deletes the specified network.
      script: Google Cloud Compute|||gcp-compute-delete-network
      type: regular
      iscommand: true
      brand: Google Cloud Compute
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      network:
        complex:
          root: GoogleCloudCompute
          accessor: Networks.name
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 130,
          "y": 820
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "3":
    id: "3"
    taskid: 1abd9220-e39e-4206-8aa3-dba2695c7f4e
    type: title
    task:
      id: 1abd9220-e39e-4206-8aa3-dba2695c7f4e
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 630,
          "y": 1330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "4":
    id: "4"
    taskid: c6481460-c0e5-4518-8c78-c7d1403aae3e
    type: regular
    task:
      id: c6481460-c0e5-4518-8c78-c7d1403aae3e
      version: -1
      name: Get VPC network details
      description: Returns the specified network.
      script: Google Cloud Compute|||gcp-compute-get-network
      type: regular
      iscommand: true
      brand: Google Cloud Compute
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      network:
        complex:
          root: incident
          accessor: labels.resource
          transformers:
          - operator: ParseJSON
          - operator: getField
            args:
              field:
                value:
                  simple: name
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 630,
          "y": 150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "5":
    id: "5"
    taskid: a27e47fb-063c-48ad-8e76-0b3fb6d7f446
    type: condition
    task:
      id: a27e47fb-063c-48ad-8e76-0b3fb6d7f446
      version: -1
      name: Execute remediation
      description: Execute the appropriate remediation task.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      default:
      - "7"
    separatecontext: false
    conditions:
    - label: default
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: c2cf4439-9ac2-44b8-a0d2-7076cf82c29a
    view: |-
      {
        "position": {
          "x": 630,
          "y": 330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "7":
    id: "7"
    taskid: 191c3374-6528-442f-87d6-e7bc615b53d5
    type: title
    task:
      id: 191c3374-6528-442f-87d6-e7bc615b53d5
      version: -1
      name: Default Network
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 250,
          "y": 505
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "8":
    id: "8"
    taskid: ca0198e7-2228-4e75-8b90-8d8822edfe1e
    type: condition
    task:
      id: ca0198e7-2228-4e75-8b90-8d8822edfe1e
      version: -1
      name: Check for default VPC network?
      description: Verify that this is the project default network.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: GoogleCloudCompute
                accessor: Networks.name
            iscontext: true
          right:
            value:
              simple: default
    view: |-
      {
        "position": {
          "x": 380,
          "y": 650
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "9":
    id: "9"
    taskid: 8457fd75-d770-4c23-8c2c-d32e3aa523d8
    type: condition
    task:
      id: 8457fd75-d770-4c23-8c2c-d32e3aa523d8
      version: -1
      name: Did we encounter an error?
      description: Checks whether the given entry/entries returned an error. Use ${lastCompletedTaskEntries} to check the previous task entries. If an array is provided, it returns 'yes' if one of the entries returned an error.
      scriptName: isError
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "3"
      "yes":
      - "10"
    scriptarguments:
      entryId:
        simple: ${lastCompletedTaskEntries}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -50,
          "y": 990
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "10":
    id: "10"
    taskid: bdc74c5f-447e-47bd-8111-c7e89194d74a
    type: regular
    task:
      id: bdc74c5f-447e-47bd-8111-c7e89194d74a
      version: -1
      name: Manually remove default VPC and its resources
      description: Manually remove all existing resources from your default VPC network.  Then delete the default network.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 380,
          "y": 1160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "11":
    id: "11"
    taskid: c8cc511a-d4da-4e44-86a2-eca1d1a26855
    type: condition
    task:
      id: c8cc511a-d4da-4e44-86a2-eca1d1a26855
      version: -1
      name: Is Google Cloud Compute integration enabled?
      description: "Is Google Cloud Compute integration enabled?"
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Google Cloud Compute
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 630,
          "y": -30
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "5_3_#default#": 0.16,
      "5_7_default": 0.56,
      "8_10_#default#": 0.39,
      "8_1_yes": 0.47,
      "9_10_yes": 0.54,
      "9_3_no": 0.17
    },
    "paper": {
      "dimensions": {
        "height": 1555,
        "width": 1060,
        "x": -50,
        "y": -160
      }
    }
  }
inputs:
- key: policyId
  value: {}
  required: true
  description: Prisma Cloud policy Id.
outputs: []
tests:
- No Test