id: Cloud Credentials Rotation - Azure
version: -1
name: Cloud Credentials Rotation - Azure
description: |-
  ## **Azure Credentials Rotation Playbook**

  ### **IAM Remediation**
  Protect your identity and access management:
  - **Reset Password**: Resets the user password to halt any unauthorized access.

  - **Revoke Session**: Terminates current active sessions to ensure the malicious actor is locked out.

  - **Combo Action**: Resets the password and terminates all active sessions.

  ### **Service Principal Remediation**
  Guard your applications:
  - **Password Regeneration**: Generate a new password for the service principal, making sure the old one becomes obsolete.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 44de7b7b-6a93-4318-86c0-fd5242772161
    type: start
    task:
      id: 44de7b7b-6a93-4318-86c0-fd5242772161
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "18"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 620,
          "y": -80
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: cfd89e24-29c0-421e-856e-13b9e94d9a49
    type: regular
    task:
      id: cfd89e24-29c0-421e-856e-13b9e94d9a49
      version: -1
      name: Reset password
      description: |-
        Updates the properties of a user object.
        Permissions: - User.ReadWrite (Delegated & Application)
      script: '|||msgraph-user-update'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      updated_fields:
        simple: 'passwordProfile: forceChangePasswordNextSignIn=true, password=${NEW_PASSWORD}'
      user:
        complex:
          root: inputs.userID
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 930,
          "y": 860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: ba96f9ab-7419-450e-8dc4-56d941385c82
    type: regular
    task:
      id: ba96f9ab-7419-450e-8dc4-56d941385c82
      version: -1
      name: Revoke session
      description: |-
        Revoke a user session- Invalidates all the refresh tokens issued to applications for a user.
        Permission: Directory.AccessAsUser.All(Delegated)
      script: '|||msgraph-user-session-revoke'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      user:
        complex:
          root: inputs.userID
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1350,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: daf80df8-2d73-4de6-8bff-93c21a978c75
    type: title
    task:
      id: daf80df8-2d73-4de6-8bff-93c21a978c75
      version: -1
      name: IAM Users
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "8"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 930,
          "y": 230
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 689c1495-e695-4b88-8151-3f625345ad05
    type: condition
    task:
      id: 689c1495-e695-4b88-8151-3f625345ad05
      version: -1
      name: Check remediation type
      description: Checks the remediation type provided by the user.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      ALL:
      - "17"
      Reset Password:
      - "16"
      Revoke Session:
      - "3"
    separatecontext: false
    conditions:
    - label: Reset Password
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.IAMRemediationType
            iscontext: true
          right:
            value:
              simple: Reset
    - label: Revoke Session
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.IAMRemediationType
            iscontext: true
          right:
            value:
              simple: Revoke
    - label: ALL
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.IAMRemediationType
            iscontext: true
          right:
            value:
              simple: ALL
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 930,
          "y": 380
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: f424dee6-ce56-48d2-80ce-dc9e9bc67e40
    type: title
    task:
      id: f424dee6-ce56-48d2-80ce-dc9e9bc67e40
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 620,
          "y": 1030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: a439157f-37d2-47be-882d-dde93d9099d5
    type: title
    task:
      id: a439157f-37d2-47be-882d-dde93d9099d5
      version: -1
      name: Service Principals
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "11"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 300,
          "y": 220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: d90a9e64-8ba7-47a7-8001-2aa0c94e4394
    type: regular
    task:
      id: d90a9e64-8ba7-47a7-8001-2aa0c94e4394
      version: -1
      name: Get the service principal
      description: Retrieve the properties and relationships of a servicePrincipal object.
      script: '|||msgraph-apps-service-principal-get'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      app_id:
        complex:
          root: inputs.appID
      id:
        complex:
          root: inputs.objectID
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 300,
          "y": 360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 6161eb05-12cd-4e34-8ebb-2ce5bcf0e090
    type: regular
    task:
      id: 6161eb05-12cd-4e34-8ebb-2ce5bcf0e090
      version: -1
      name: Unlock the service principal configuration
      description: Unlock configuration of a service principal.
      script: '|||msgraph-apps-service-principal-unlock-configuration'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    scriptarguments:
      id:
        complex:
          root: MSGraphApplication
          accessor: id
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 300,
          "y": 520
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: c1aee4c9-eb27-4401-85d3-dc7f5b8dfc8d
    type: regular
    task:
      id: c1aee4c9-eb27-4401-85d3-dc7f5b8dfc8d
      version: -1
      name: Add new password to the service principal
      description: Add a strong password or secret to a service principal. To allow this command, use msgraph-apps-service-principal-unlock-configuration. The password will be expired in 1 hour by default.
      script: '|||msgraph-apps-service-principal-password-add'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      app_id:
        complex:
          root: MSGraphApplication
          accessor: appId
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 300,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: c297534a-534b-4d72-8640-4e36d83cd4ef
    type: regular
    task:
      id: c297534a-534b-4d72-8640-4e36d83cd4ef
      version: -1
      name: Generate password
      description: "This function generates a password and allows various parameters to customize the properties of the password depending on the use case (e.g. password complexity requirements).  The default behavior is to generate a password of  *random length* including all four character classes (upper, lower, digits, symbols) with at least five and at most ten characters per class. \n\nThe min_* values all default to 0. This means that if the command is executed in this way:\n!GeneratePassword max_lcase=10\nIt is possible that a password of length zero could be generated. It is therefore recommended to always include a min_* parameter that matches. \n\nThe debug parameter will print certain properties of the command into the WarRoom for easy diagnostics."
      scriptName: GeneratePassword
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    scriptarguments:
      min_digits:
        simple: "5"
      min_lcase:
        simple: "5"
      min_symbols:
        simple: "1"
      min_ucase:
        simple: "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 930,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: c99cf073-a673-497b-8b42-e78cdf7739f2
    type: title
    task:
      id: c99cf073-a673-497b-8b42-e78cdf7739f2
      version: -1
      name: ALL
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "16"
      - "3"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1730,
          "y": 550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: 1423427f-02ea-4e80-8c54-0aa434688e44
    type: condition
    task:
      id: 1423427f-02ea-4e80-8c54-0aa434688e44
      version: -1
      name: Check identity type
      description: Checks the identity type that was part of the alert.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      IAM:
      - "7"
      SP:
      - "10"
    separatecontext: false
    conditions:
    - label: SP
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.identityType
            iscontext: true
          right:
            value:
              simple: Application
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.appID
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.objectID
            iscontext: true
    - label: IAM
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.identityType
            iscontext: true
          right:
            value:
              simple: IAM
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.userID
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 620,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: a20b5dd2-9d50-4573-8627-5c9d5ba0885f
    type: regular
    task:
      id: a20b5dd2-9d50-4573-8627-5c9d5ba0885f
      version: -1
      name: Lock the service principal configuration
      description: Lock configuration of a service principal.
      script: '|||msgraph-apps-service-principal-lock-configuration'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      id:
        complex:
          root: MSGraphApplication
          accessor: id
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 300,
          "y": 860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "18_10_SP": 0.53,
      "18_7_IAM": 0.67,
      "18_9_#default#": 0.11,
      "8_16_Reset Password": 0.63,
      "8_17_ALL": 0.33
    },
    "paper": {
      "dimensions": {
        "height": 1175,
        "width": 1810,
        "x": 300,
        "y": -80
      }
    }
  }
inputs:
- key: IAMRemediationType
  value: {}
  required: false
  description: |-
    The response playbook provides the following remediation actions using MSGraph Users:

    Reset: By entering "Reset" in the input, the playbook will execute password reset.

    Revoke: By entering "Revoke" in the input, the playbook will revoke the user's session.

    ALL: By entering "ALL" in the input, the playbook will execute the reset password and revoke session tasks.
  playbookInputQuery:
- key: appID
  value: {}
  required: false
  description: This is the unique application (client) ID of the application.
  playbookInputQuery:
- key: objectID
  value: {}
  required: false
  description: This is the unique ID of the service principal object associated with the application.
  playbookInputQuery:
- key: userID
  value: {}
  required: false
  description: The user ID or user principal name.
  playbookInputQuery:
- key: identityType
  value: {}
  required: false
  description: |-
    The type of identity involved. Usually mapped to incident field named 'cloudidentitytype'.
    e.g.
    IAM,APPLICATION
  playbookInputQuery:
outputs:
- contextPath: MSGraphUser
  description: The Microsoft Graph Users information.
  type: unknown
- contextPath: MSGraphApplication
  description: The Microsoft Graph Application information.
  type: unknown
tests:
- No tests (auto formatted)
fromversion: 6.9.0