XCloud Cryptojacking

id: XCloud Cryptomining
version: -1
name: XCloud Cryptojacking
description: "Investigates a Cortex XDR incident containing Cloud Cryptojacking related alert. \nThe playbook supports AWS, Azure, and GCP and executes the following:\n\n- Cloud enrichment:\n\n    -Collects info about the involved resources\n\n    -Collects info about the involved identities\n\n    -Collects info about the involved IPs\n\n\n- Verdict decision tree\n\n\n- Verdict handling:\n\n -Handle False Positives\n\n -Handle True Positives\n\n -Cloud Response - Generic sub-playbook.\n\n- Notifies the SOC if a malicious verdict was found"
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: c1c09dc8-6340-4782-80fb-ceaab5e45309
    type: start
    task:
      id: c1c09dc8-6340-4782-80fb-ceaab5e45309
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "39"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 720,
          "y": -200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: e7062263-5ddf-470e-8a2b-b01082d6513c
    type: title
    task:
      id: e7062263-5ddf-470e-8a2b-b01082d6513c
      version: -1
      name: Set verdict
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "48"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 720,
          "y": 540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "27":
    id: "27"
    taskid: 0e878c77-92fd-4ca9-81f9-56d977cb10d6
    type: regular
    task:
      id: 0e878c77-92fd-4ca9-81f9-56d977cb10d6
      version: -1
      name: Set Incident Severity to High
      description: commands.local.cmd.set.parent.incident.field
      script: Builtin|||setParentIncidentFields
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "56"
    scriptarguments:
      key:
        simple: manual_severity
      value:
        simple: high
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1310,
          "y": 1210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "28":
    id: "28"
    taskid: b3b786b8-c446-4170-8557-722d96186c75
    type: regular
    task:
      id: b3b786b8-c446-4170-8557-722d96186c75
      version: -1
      name: Set the alert severity to Low
      description: Optionally increases the incident severity to the new value if it is greater than the existing severity.
      scriptName: IncreaseIncidentSeverity
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "55"
    scriptarguments:
      severity:
        simple: Low
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 720,
          "y": 1210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "29":
    id: "29"
    taskid: 094de1e9-2358-4b97-8d22-2562700a03f9
    type: condition
    task:
      id: 094de1e9-2358-4b97-8d22-2562700a03f9
      version: -1
      name: Manual verdict verification
      description: Manual verdict decision.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      APPROVED:
      - "28"
      UNAPPROVED:
      - "27"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 720,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "32":
    id: "32"
    taskid: 75197169-f9d1-4275-8c30-3fe1fdf79504
    type: regular
    task:
      id: 75197169-f9d1-4275-8c30-3fe1fdf79504
      version: -1
      name: Set SOC message for malicious activity
      description: Sends an email using EWS.
      script: '|||send-mail'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "36"
      - "58"
    scriptarguments:
      body:
        simple: |-
          XSIAM Notification

          XSIAM has detected activity related to Cryptojacking.
          After careful analysis, XSIAM found the activity malicious.

          Please enter XSIAM alert ID ${alert.id} for further investigation and response.
      subject:
        simple: Cryptojacking activity detected by XSIAM
      to:
        complex:
          root: inputs.SOCEmailAddress
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1310,
          "y": 1710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "36":
    id: "36"
    taskid: c8b1eeb5-76a5-4c17-8234-72278db6cbc1
    type: playbook
    task:
      id: c8b1eeb5-76a5-4c17-8234-72278db6cbc1
      version: -1
      name: Cloud Response - Generic
      description: |-
        This playbook provides response playbooks for:
        - AWS
        - Azure
        - GCP

        The response actions available are:
        - Terminate/Shut down/Power off an instance
        - Delete/Disable a user
        - Delete/Revoke/Disable credentials
        - Block indicators
      playbookName: Cloud Response - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "40"
    scriptarguments:
      AWS-accessKeyRemediationType:
        complex:
          root: inputs.AWS-accessKeyRemediationType
      AWS-resourceRemediationType:
        complex:
          root: inputs.AWS-resourceRemediationType
      AWS-userRemediationType:
        complex:
          root: inputs.AWS-userRemediationType
      Azure-resourceRemediationType:
        complex:
          root: inputs.Azure-resourceRemediationType
      Azure-userRemediationType:
        complex:
          root: inputs.Azure-userRemediationType
      GCP-accessKeyRemediationType:
        complex:
          root: inputs.GCP-accessKeyRemediationType
      GCP-resourceRemediationType:
        complex:
          root: inputs.GCP-resourceRemediationType
      GCP-userRemediationType:
        complex:
          root: inputs.GCP-userRemediationType
      accessKeyId:
        complex:
          root: alertJson._all_events._aws_specific_fields
          accessor: access_key_id
      autoAccessKeyRemediation:
        complex:
          root: inputs.autoAccessKeyRemediation
      autoBlockIndicators:
        complex:
          root: inputs.autoBlockIndicators
      autoResourceRemediation:
        complex:
          root: inputs.autoResourceRemediation
      autoUserRemediation:
        complex:
          root: inputs.autoUserRemediation
      cloudProvider:
        complex:
          root: inputs.cloudProvider
      region:
        complex:
          root: alertJson._all_events
          accessor: region
      resourceGroup:
        complex:
          root: alertJson._all_events
          accessor: referenced_resource
          transformers:
          - operator: Cut
            args:
              delimiter:
                value:
                  simple: /
              fields:
                value:
                  simple: "5"
      resourceName:
        complex:
          root: alertJson._all_events
          accessor: referenced_resource_name
      resourceZone:
        complex:
          root: alertJson._all_events
          accessor: zone
      username:
        complex:
          root: alertJson._all_events
          accessor: actor_effective_username
          transformers:
          - operator: If-Then-Else
            args:
              condition:
                value:
                  simple: lhs==rhs
              conditionB: {}
              conditionInBetween: {}
              else:
                value:
                  simple: alertJson._all_events.actor_effective_username
                iscontext: true
              equals: {}
              lhs:
                value:
                  simple: alert.cloudprovide
                iscontext: true
              lhsB: {}
              options: {}
              optionsB: {}
              rhs:
                value:
                  simple: GCP
              rhsB: {}
              then:
                value:
                  simple: alertJson._all_events.identity_name
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1540,
          "y": 1880
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "37":
    id: "37"
    taskid: 4f25d397-81b2-4268-892c-3e58222e26bc
    type: playbook
    task:
      id: 4f25d397-81b2-4268-892c-3e58222e26bc
      version: -1
      name: XCloud Alert Enrichment
      description: |-
        This playbook is responsible for data collection and enrichment.

        The playbook collects or enriches the following data:

        - Account enrichment


        - Network enrichment

           -Attacker IP

           -Geolocation

           -ASN
      playbookName: XCloud Alert Enrichment
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "25"
    scriptarguments:
      InternalRange:
        complex:
          root: inputs.InternalRange
      ResolveIP:
        complex:
          root: inputs.ResolveIP
    separatecontext: false
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 720,
          "y": 380
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "38":
    id: "38"
    taskid: 25d56772-694c-43c4-80f8-ef54c5abbbef
    type: title
    task:
      id: 25d56772-694c-43c4-80f8-ef54c5abbbef
      version: -1
      name: Enrichment & Investigation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "37"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 720,
          "y": 250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "39":
    id: "39"
    taskid: fec7c0c4-a75e-481c-8972-5e3c8d3d6a45
    type: regular
    task:
      id: fec7c0c4-a75e-481c-8972-5e3c8d3d6a45
      version: -1
      name: Fetch alert extra data
      description: Returns information about each alert ID.
      script: '|||core-get-cloud-original-alerts'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "46"
    scriptarguments:
      alert_ids:
        complex:
          root: inputs.alert_id
      extend-context:
        simple: alertData=
      filter_alert_fields:
        simple: "false"
      ignore-outputs:
        simple: "false"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 720,
          "y": -70
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "40":
    id: "40"
    taskid: ec88f114-435d-4c5c-83c2-1774e853ea4e
    type: condition
    task:
      id: ec88f114-435d-4c5c-83c2-1774e853ea4e
      version: -1
      name: Should wait for the analyst's review?
      description: Checks if the analyst chose to wait for a manual review.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "54"
      "yes":
      - "41"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.requireAnalystReview
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1320,
          "y": 2250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "41":
    id: "41"
    taskid: 75cef98b-5136-49c8-8100-8a9b62d42304
    type: condition
    task:
      id: 75cef98b-5136-49c8-8100-8a9b62d42304
      version: -1
      name: Analyst review - Should close as True Positive?
      description: Checks manually with the user if the alert should be closed as True Positive.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "43"
      "Yes":
      - "54"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1320,
          "y": 2435
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "43":
    id: "43"
    taskid: 960461ef-88bd-4ae2-85c9-f4ae12435644
    type: title
    task:
      id: 960461ef-88bd-4ae2-85c9-f4ae12435644
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 720,
          "y": 2790
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "46":
    id: "46"
    taskid: 58fad950-53b1-4d9d-82d1-02fbb6109272
    type: regular
    task:
      id: 58fad950-53b1-4d9d-82d1-02fbb6109272
      version: -1
      name: Load alert JSON
      description: Loads a json from string input, and returns a json object result
      scriptName: LoadJSON
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "38"
    scriptarguments:
      extend-context:
        simple: alertJson=
      ignore-outputs:
        simple: "true"
      input:
        complex:
          root: alertData.alerts
          accessor: original_alert_json
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 720,
          "y": 90
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "48":
    id: "48"
    taskid: dfa1bd6f-e9c9-4422-8d6d-e31cfd7e3558
    type: playbook
    task:
      id: dfa1bd6f-e9c9-4422-8d6d-e31cfd7e3558
      version: -1
      name: XCloud Cryptojacking - Set Verdict
      description: "This playbook sets the alert's verdict as malicious if one of the following conditions is true:\n1. If the source IP address is malicious\n2. If the incident includes both \"Unusual allocation of multiple cloud compute resources\" AND \"Cloud identity reached a throttling API rate\" (medium/high severity)\n3. If the incident includes both \"Unusual allocation of multiple cloud compute resources\" AND \"Suspicious heavy allocation of compute resources - possible mining activity\" \n4. If the incident includes \"Unusual allocation of multiple cloud compute resources\" with medium/high severity, the source ASN isn't known, and the source IP isn't known as well.\n5. If the incident includes both \"Unusual allocation of multiple cloud compute resources\" AND \"A cloud compute instance was created in a dormant region\"\n\nIf none of the conditions is true, the playbook will wait for an analyst's decision."
      playbookName: XCloud Cryptojacking - Set Verdict
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "49"
    scriptarguments:
      sourceIP:
        complex:
          root: Core.OriginalAlert.event
          accessor: caller_ip
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 720,
          "y": 670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "49":
    id: "49"
    taskid: d52086b0-9eb3-4154-8a2a-50236c8957dc
    type: condition
    task:
      id: d52086b0-9eb3-4154-8a2a-50236c8957dc
      version: -1
      name: Check alert verdict
      description: Checks the outcome of the alert Cryptojacking - Set Verdict playbook.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      Malicious:
      - "27"
      User Verification:
      - "29"
    separatecontext: false
    conditions:
    - label: Malicious
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: alertVerdict
            iscontext: true
          right:
            value:
              simple: Malicious
          ignorecase: true
    - label: User Verification
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: alertVerdict
            iscontext: true
          right:
            value:
              simple: userVerification
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 720,
          "y": 830
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "54":
    id: "54"
    taskid: 741176fb-7a63-4d03-85aa-6cc387b18714
    type: regular
    task:
      id: 741176fb-7a63-4d03-85aa-6cc387b18714
      version: -1
      name: Close incident as True Positive
      description: commands.local.cmd.close.inv
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "43"
    scriptarguments:
      closeReason:
        simple: Resolved - True Positive
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1320,
          "y": 2620
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "55":
    id: "55"
    taskid: 35512734-45a5-4d02-8ee1-b9f0fc678ea4
    type: playbook
    task:
      id: 35512734-45a5-4d02-8ee1-b9f0fc678ea4
      version: -1
      name: Handle False Positive Alerts
      description: |
        This playbook handles false positive alerts.
        It creates an alert exclusion or alert exception, or adds a file to an allow list based on the alert fields and playbook inputs.
      playbookName: Handle False Positive Alerts
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "43"
    scriptarguments:
      ShouldCloseAutomatically:
        complex:
          root: inputs.ShouldCloseAutomatically
      ShouldHandleFPautomatically:
        complex:
          root: inputs.ShouldHandleFPautomatically
      alertName:
        complex:
          root: alert
          accessor: name
      sourceIP:
        complex:
          root: alert
          accessor: hostip
      username:
        complex:
          root: alert
          accessor: username
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 720,
          "y": 1370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "56":
    id: "56"
    taskid: 2a1de480-6851-4a84-8b80-261cc1d08a9f
    type: condition
    task:
      id: 2a1de480-6851-4a84-8b80-261cc1d08a9f
      version: -1
      name: Should open a ticket automatically in a ticketing system?
      description: Checks whether to open a ticket automatically in a ticketing system.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "32"
      "yes":
      - "57"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.ShouldOpenTicket
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1310,
          "y": 1370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "57":
    id: "57"
    taskid: 97e8e4e3-001f-4da9-88cc-8132d92863e0
    type: playbook
    task:
      id: 97e8e4e3-001f-4da9-88cc-8132d92863e0
      version: -1
      name: Ticket Management - Generic
      description: "`Ticket Management - Generic` allows you to open new tickets or
        update comments to the existing ticket in the following ticketing systems:\n-ServiceNow
        \n-Zendesk \nusing the following sub-playbooks:\n-`ServiceNow - Ticket Management`\n-`Zendesk
        - Ticket Management`\n"
      playbookName: Ticket Management - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "32"
    scriptarguments:
      CommentToAdd:
        complex:
          root: inputs.CommentToAdd
      ZendeskAssigne:
        complex:
          root: inputs.ZendeskAssigne
      ZendeskCollaborators:
        complex:
          root: inputs.ZendeskCollaborators
      ZendeskPriority:
        complex:
          root: inputs.ZendeskPriority
      ZendeskRequester:
        complex:
          root: inputs.ZendeskRequester
      ZendeskStatus:
        complex:
          root: inputs.ZendeskStatus
      ZendeskSubject:
        complex:
          root: inputs.ZendeskSubject
      ZendeskTags:
        complex:
          root: inputs.ZendeskTags
      ZendeskType:
        complex:
          root: inputs.ZendeskType
      addCommentPerEndpoint:
        complex:
          root: inputs.addCommentPerEndpoint
      description:
        complex:
          root: inputs.description
      serviceNowAssignmentGroup:
        complex:
          root: inputs.serviceNowAssignmentGroup
      serviceNowCategory:
        complex:
          root: inputs.serviceNowCategory
      serviceNowImpact:
        complex:
          root: inputs.serviceNowImpact
      serviceNowSeverity:
        complex:
          root: inputs.serviceNowSeverity
      serviceNowShortDescription:
        complex:
          root: inputs.serviceNowShortDescription
      serviceNowTicketType:
        complex:
          root: inputs.serviceNowTicketType
      serviceNowUrgency:
        complex:
          root: inputs.serviceNowUrgency
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1600,
          "y": 1540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "58":
    id: "58"
    taskid: ad5076a5-7198-4fbe-8003-e288bfd83048
    type: condition
    task:
      id: ad5076a5-7198-4fbe-8003-e288bfd83048
      version: -1
      name: Should rotate the credentials automatically?
      description: Whether to rotate the credentials automatically.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "yes":
      - "59"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.autoAccessKeyRemediation
            iscontext: true
          right:
            value:
              simple: "true"
          ignorecase: true
        - operator: isEqualString
          left:
            value:
              simple: inputs.autoUserRemediation
            iscontext: true
          right:
            value:
              simple: "true"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1110,
          "y": 1880
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "59":
    id: "59"
    taskid: c9cef60f-31d3-45b8-8c99-a2e977258a43
    type: playbook
    task:
      id: c9cef60f-31d3-45b8-8c99-a2e977258a43
      version: -1
      name: Cloud Credentials Rotation - Generic
      description: |-
        ## **Cloud Credentials Rotation - Generic**

        This comprehensive playbook combines the remediation steps from AWS, Azure, and GCP sub-playbooks into a single, cohesive guide. Regardless of which Cloud Service Provider (CSP) you're working with, this playbook will direct you to the relevant steps, ensuring swift and effective response.

        The primary objective is to offer an efficient way to address compromised credentials across different cloud platforms. By consolidating the key steps from AWS, Azure, and GCP, it minimizes the time spent searching for platform-specific procedures and accelerates the remediation process, ensuring the highest level of security for your cloud environments.

        ## **Integrations for Each Sub-Playbook**

        In order to seamlessly execute the actions mentioned in each sub-playbook, specific integrations are essential. These integrations facilitate the automated tasks and processes that the playbook carries out. Here are the required integrations for each sub-playbook:

        ### **AWS Sub-Playbook:**
        1. [**AWS - IAM**](https://xsoar.pan.dev/docs/reference/integrations/aws---iam): Used to manage AWS Identity and Access Management.
        2. [**AWS - EC2**](https://xsoar.pan.dev/docs/reference/integrations/aws---ec2): Essential for managing Amazon Elastic Compute Cloud (EC2) instances.

        ### **GCP Sub-Playbook:**
        1. [**Google Workspace Admin**](https://xsoar.pan.dev/docs/reference/integrations/g-suite-admin): Manages users, groups, and other entities within Google Workspace.
        2. [**GCP-IAM**](https://xsoar.pan.dev/docs/reference/integrations/gcp-iam): Ensures management and control of GCP's Identity and Access Management.

        ### **Azure Sub-Playbook:**
        1. [**Microsoft Graph Users**](https://xsoar.pan.dev/docs/reference/integrations/microsoft-graph-user): Manages users and related entities in Microsoft Graph.
        2. [**Microsoft Graph Applications**](https://xsoar.pan.dev/docs/reference/integrations/microsoft-graph-applications): Manages applications within Microsoft Graph.
      playbookName: Cloud Credentials Rotation - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "40"
    scriptarguments:
      AWS-accessKeyID:
        simple: ${Core.OriginalAlert.event.identity_orig.accessKeyId}
      AWS-instanceID:
        complex:
          root: alert.username
          filters:
          - - operator: containsGeneral
              left:
                value:
                  simple: alert.username
                iscontext: true
              right:
                value:
                  simple: i-
          transformers:
          - operator: Cut
            args:
              delimiter:
                value:
                  simple: /
              fields:
                value:
                  simple: "2"
      AWS-newInstanceProfileName:
        simple: ${inputs.AWS-newInstanceProfileName}
      AWS-newRoleName:
        simple: ${inputs.AWS-newRoleName}
      AWS-roleNameToRestrict:
        simple: ${inputs.AWS-roleNameToRestrict}
      AWS-userID:
        simple: ${alert.username}
      Azure-AppID:
        simple: ${Core.OriginalAlert.event.identity_orig.claims.appid}
      Azure-ObjectID:
        complex:
          root: Core.OriginalAlert.event.identity_orig
          accessor: claims
          transformers:
          - operator: Stringify
          - operator: RegexExtractAll
            args:
              error_if_no_match: {}
              ignore_case: {}
              multi_line: {}
              period_matches_newline: {}
              regex:
                value:
                  simple: http://schemas.microsoft.com/identity/claims/objectidentifier":"\w{8}\-\w{4}\-\w{4}\-\w{4}\-\w{12}
              unpack_matches: {}
          - operator: ExtractInbetween
            args:
              from:
                value:
                  simple: http://schemas.microsoft.com/identity/claims/objectidentifier":"
              to:
                value:
                  simple: '"'
      Azure-userID:
        simple: ${alert.username}
      GCP-SAEmail:
        simple: ${Core.OriginalAlert.event.identity_orig.principalEmail}
      GCP-cloudProject:
        simple: ${alert.cloudproject}
      GCP-userID:
        simple: ${alert.username}
      GCP-zone:
        simple: ${Core.OriginalAlert.event.zone}
      RemediationType:
        simple: ${inputs.credentialsRemediationType}
      cloudProvider:
        simple: ${alert.cloudprovider}
      identityType:
        simple: ${alert.cloudidentitytype}
      shouldCloneSA:
        simple: ${inputs.shouldCloneSA}
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1110,
          "y": 2080
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
system: true
view: |-
  {
    "linkLabelsPosition": {
      "40_41_yes": 0.52,
      "40_54_#default#": 0.57,
      "41_43_#default#": 0.42,
      "41_54_Yes": 0.42,
      "49_27_Malicious": 0.62,
      "49_29_User Verification": 0.61,
      "56_32_#default#": 0.49,
      "58_59_yes": 0.44
    },
    "paper": {
      "dimensions": {
        "height": 3055,
        "width": 1260,
        "x": 720,
        "y": -200
      }
    }
  }
inputs:
- key: SOCEmailAddress
  value: {}
  required: false
  description: The SOC email address to use for the alert status notification.
  playbookInputQuery:
- key: requireAnalystReview
  value:
    simple: "True"
  required: false
  description: Whether to require an analyst review after the alert remediation.
  playbookInputQuery:
- key: ShouldCloseAutomatically
  value:
    simple: "False"
  required: false
  description: Should we automatically close false positive alerts? Specify true/false.
  playbookInputQuery:
- key: ShouldHandleFPautomatically
  value:
    simple: "False"
  required: false
  description: Should we automatically handle false positive alerts? Specify true/false.
  playbookInputQuery:
- key: cloudProvider
  value:
    complex:
      root: alert
      accessor: cloudprovider
  required: false
  description: The cloud service provider involved.
  playbookInputQuery:
- key: alert_id
  value: {}
  required: false
  description: The alert ID.
  playbookInputQuery:
- key: ResolveIP
  value:
    simple: "True"
  required: false
  description: Determines whether to convert the IP address to a hostname using a DNS query (True/ False).
  playbookInputQuery:
- key: InternalRange
  value:
    complex:
      root: lists
      accessor: PrivateIPs
      transformers:
      - operator: RegexExtractAll
        args:
          error_if_no_match: {}
          ignore_case: {}
          multi_line: {}
          period_matches_newline: {}
          regex:
            value:
              simple: (\b(?:\d{1,3}\.){3}\d{1,3}\b/\d{1,2})
          unpack_matches: {}
      - operator: join
        args:
          separator:
            value:
              simple: ','
  required: false
  description: "A list of internal IP ranges to check IP addresses against. \nFor IP Enrichment - Generic v2 playbook."
  playbookInputQuery:
- key: autoAccessKeyRemediation
  value:
    simple: "False"
  required: false
  description: Whether to execute the user remediation flow automatically.
  playbookInputQuery:
- key: autoBlockIndicators
  value:
    simple: "False"
  required: false
  description: Whether to block the indicators automatically.
  playbookInputQuery:
- key: autoResourceRemediation
  value:
    simple: "False"
  required: false
  description: Whether to execute the resource remediation flow automatically.
  playbookInputQuery:
- key: autoUserRemediation
  value:
    simple: "False"
  required: false
  description: Whether to execute the user remediation flow automatically.
  playbookInputQuery:
- key: credentialsRemediationType
  value:
    simple: "Reset"
  required: false
  description: |-
    The response playbook provides the following remediation actions using AWS, MSGraph Users, GCP and GSuite Admin:

    Reset: By entering "Reset" in the input, the playbook will execute password reset.
    Supports: AWS, MSGraph Users, GCP and GSuite Admin.

    Revoke: By entering "Revoke" in the input, the GCP will revoke the access key, GSuite Admin will revoke the access token and the MSGraph Users will revoke the session.
    Supports: GCP, GSuite Admin and MSGraph Users.

    Deactivate - By entering "Deactivate" in the input, the playbook will execute access key deactivation.
    Supports: AWS.

    ALL: By entering "ALL" in the input, the playbook will execute the all remediation actions provided for each CSP.
  playbookInputQuery:
- key: AWS-accessKeyRemediationType
  value:
    simple: Disable
  required: false
  description: |-
    Choose the remediation type for the user's access key.

    AWS available types:
    Disable - for disabling the user's access key.
    Delete - for the user's access key deletion.
  playbookInputQuery:
- key: AWS-resourceRemediationType
  value:
    simple: Stop
  required: false
  description: |-
    Choose the remediation type for the instances created.

    AWS available types:
    Stop - for stopping the instances.
    Terminate - for terminating the instances.
  playbookInputQuery:
- key: AWS-userRemediationType
  value:
    simple: Revoke
  required: false
  description: |-
    Choose the remediation type for the user involved.

    AWS available types:
    Delete - for the user deletion.
    Revoke - for revoking the user's credentials.
  playbookInputQuery:
- key: shouldCloneSA
  value: {}
  required: false
  description: |-
    Whether to clone the compromised SA before putting a deny policy to it.
    True/False
  playbookInputQuery:
- key: AWS-newRoleName
  value: {}
  required: false
  description: The name of the new role to create if the analyst decides to clone the service account.
  playbookInputQuery:
- key: AWS-newInstanceProfileName
  value: {}
  required: false
  description: The name of the new instance profile to create if the analyst decides to clone the service account.
  playbookInputQuery:
- key: AWS-roleNameToRestrict
  value: {}
  required: false
  description: If provided, the role will be attached with a deny policy without the compute instance analysis flow.
  playbookInputQuery:
- key: Azure-resourceRemediationType
  value:
    simple: Poweroff
  required: false
  description: |-
    Choose the remediation type for the instances created.

    Azure available types:
    Poweroff - for shutting down the instances.
    Delete - for deleting the instances.
  playbookInputQuery:
- key: Azure-userRemediationType
  value:
    simple: Disable
  required: false
  description: |-
    Choose the remediation type for the user involved.

    Azure available types:
    Disable - for disabling the user.
    Delete - for deleting the user.
  playbookInputQuery:
- key: GCP-accessKeyRemediationType
  value:
    simple: Disable
  required: false
  description: |-
    Choose the remediation type for the user's access key.

    GCP available types:
    Disable - For disabling the user's access key.
    Delete - For the deleting user's access key.
  playbookInputQuery:
- key: GCP-resourceRemediationType
  value:
    simple: Stop
  required: false
  description: |-
    Choose the remediation type for the instances created.

    GCP available types:
    Stop - For stopping the instances.
    Delete - For deleting the instances.
  playbookInputQuery:
- key: GCP-userRemediationType
  value:
    simple: Disable
  required: false
  description: |-
    Choose the remediation type for the user involved.

    GCP available types:
    Delete - For deleting the user.
    Disable - For disabling the user.
  playbookInputQuery:
- key: ShouldOpenTicket
  value:
    simple: "False"
  required: false
  description: Whether to open a ticket automatically in a ticketing system. (True/False).
  playbookInputQuery:
- key: serviceNowShortDescription
  value:
    simple: XSIAM Incident ID - ${parentIncidentFields.incident_id}
  required: false
  description: A short description of the ticket.
  playbookInputQuery:
- key: serviceNowImpact
  value: {}
  required: false
  description: The impact for the new ticket. Leave empty for ServiceNow default impact.
  playbookInputQuery:
- key: serviceNowUrgency
  value: {}
  required: false
  description: The urgency of the new ticket. Leave empty for ServiceNow default urgency.
  playbookInputQuery:
- key: serviceNowSeverity
  value: {}
  required: false
  description: The severity of the new ticket. Leave empty for ServiceNow default severity.
  playbookInputQuery:
- key: serviceNowTicketType
  value: {}
  required: false
  description: The ServiceNow ticket type. Options are "incident", "problem", "change_request", "sc_request", "sc_task", or "sc_req_item". Default is "incident".
  playbookInputQuery:
- key: serviceNowCategory
  value: {}
  required: false
  description: The category of the ServiceNow ticket.
  playbookInputQuery:
- key: serviceNowAssignmentGroup
  value: {}
  required: false
  description: The group to which to assign the new ticket.
  playbookInputQuery:
- key: ZendeskPriority
  value: {}
  required: false
  description: The urgency with which the ticket should be addressed. Allowed values are "urgent", "high", "normal", or "low".
  playbookInputQuery:
- key: ZendeskRequester
  value: {}
  required: false
  description: The user who requested this ticket.
  playbookInputQuery:
- key: ZendeskStatus
  value: {}
  required: false
  description: The state of the ticket. Allowed values are "new", "open", "pending", "hold", "solved", or "closed".
  playbookInputQuery:
- key: ZendeskSubject
  value:
    simple: XSIAM Incident ID - ${parentIncidentFields.incident_id}
  required: false
  description: The value of the subject field for this ticket.
  playbookInputQuery:
- key: ZendeskTags
  value: {}
  required: false
  description: The array of tags applied to this ticket.
  playbookInputQuery:
- key: ZendeskType
  value: {}
  required: false
  description: The type of this ticket. Allowed values are "problem", "incident", "question", or "task".
  playbookInputQuery:
- key: ZendeskAssigne
  value: {}
  required: false
  description: The agent currently assigned to the ticket.
  playbookInputQuery:
- key: ZendeskCollaborators
  value: {}
  required: false
  description: The users currently CC'ed on the ticket.
  playbookInputQuery:
- key: description
  value:
    simple: ${parentIncidentFields.description}. ${parentIncidentFields.xdr_url}
  required: false
  description: The ticket description.
  playbookInputQuery:
- key: addCommentPerEndpoint
  value:
    simple: "True"
  required: false
  description: 'Whether to append a new comment to the ticket for each endpoint in the incident. Possible values: True/False.'
  playbookInputQuery:
- key: CommentToAdd
  value:
    simple: '${alert.name}. Alert ID: ${alert.id}'
  required: false
  description: Comment for the ticket.
  playbookInputQuery:
inputSections:
- inputs:
  - SOCEmailAddress
  - requireAnalystReview
  - ShouldCloseAutomatically
  - ShouldHandleFPautomatically
  - cloudProvider
  - alert_id
  name: Alert Management
  description: Alert management settings and data, including escalation processes, user engagements, and ticketing methods.
- inputs:
  - ResolveIP
  - InternalRange
  name: Enrichment
  description: Enrichment settings and data, including assets and indicators enrichment using third-party enrichers.
- inputs:
  - autoAccessKeyRemediation
  - autoBlockIndicators
  - autoResourceRemediation
  - autoUserRemediation
  - credentialsRemediationType
  name: Remediation
  description: Remediation settings and data, including containment, eradication, and recovery.
- inputs:
  - AWS-accessKeyRemediationType
  - AWS-resourceRemediationType
  - AWS-userRemediationType
  - shouldCloneSA
  - AWS-newRoleName
  - AWS-newInstanceProfileName
  - AWS-roleNameToRestrict
  name: AWS Remediation
  description: AWS Remediation settings and data, including containment, eradication, and recovery.
- inputs:
  - Azure-resourceRemediationType
  - Azure-userRemediationType
  name: Azure Remediation
  description: Azure Remediation settings and data, including containment, eradication, and recovery.
- inputs:
  - GCP-accessKeyRemediationType
  - GCP-resourceRemediationType
  - GCP-userRemediationType
  name: GCP Remediation
  description: GCP Remediation settings and data, including containment, eradication, and recovery.
- inputs:
  - ShouldOpenTicket
  - serviceNowShortDescription
  - serviceNowImpact
  - serviceNowUrgency
  - serviceNowSeverity
  - serviceNowTicketType
  - serviceNowCategory
  - serviceNowAssignmentGroup
  - ZendeskPriority
  - ZendeskRequester
  - ZendeskStatus
  - ZendeskSubject
  - ZendeskTags
  - ZendeskType
  - ZendeskAssigne
  - ZendeskCollaborators
  - description
  - addCommentPerEndpoint
  - CommentToAdd
  name: Ticket Management
  description: Ticket management settings and data.
outputSections:
- outputs: []
  name: General (Outputs group)
  description: Generic group for outputs
outputs: []
tests:
- No tests (auto formatted)
marketplaces: 
- marketplacev2
- platform
fromversion: 6.6.0
supportedModules:
- xsiam