id: Prisma Cloud Remediation - AWS IAM Policy Misconfiguration
version: -1
fromversion: 5.0.0
name: Prisma Cloud Remediation - AWS IAM Policy Misconfiguration
description: Deprecated. Use Prisma Cloud Remediation - AWS IAM Policy Misconfiguration v2 instead. This playbook remediates Prisma Cloud AWS IAM policy alerts.  It uses
  sub-playbooks that perform the remediation steps.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 972c2cba-e9e8-4b4e-8f92-407ca7fb7917
    type: start
    task:
      id: 972c2cba-e9e8-4b4e-8f92-407ca7fb7917
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 690,
          "y": -180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "1":
    id: "1"
    taskid: 5da95853-5c28-4f84-824d-38b0e1c0e9c9
    type: condition
    task:
      id: 5da95853-5c28-4f84-824d-38b0e1c0e9c9
      version: -1
      name: Is AWS - IAM integration enabled?
      description: Verifies that AWS - IAM integration is enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "8"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: AWS - IAM
                accessor: brand
            iscontext: true
          right:
            value:
              simple: AWS - IAM
    view: |-
      {
        "position": {
          "x": 690,
          "y": -50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "2":
    id: "2"
    taskid: aff07456-1840-40d5-8b24-53c75bf75e62
    type: regular
    task:
      id: aff07456-1840-40d5-8b24-53c75bf75e62
      version: -1
      name: Get IAM password policy
      description: Get AWS account's password policy.
      script: '|||aws-iam-get-account-password-policy'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "3":
    id: "3"
    taskid: 711289d0-3db3-43d7-8527-39112d8bae61
    type: condition
    task:
      id: 711289d0-3db3-43d7-8527-39112d8bae61
      version: -1
      name: Update IAM password policy automatically?
      description: Should we auto-remediate?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "10"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.AutoUpdatePasswordPolicy
                transformers:
                - operator: toLowerCase
            iscontext: true
          right:
            value:
              simple: "yes"
    view: |-
      {
        "position": {
          "x": 150,
          "y": 290
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "5":
    id: "5"
    taskid: d7495e19-5781-4bbf-88e1-7c4be19f9ad8
    type: condition
    task:
      id: d7495e19-5781-4bbf-88e1-7c4be19f9ad8
      version: -1
      name: Auto remediate?
      description: Determine whether or not to auto-remediate?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "Yes":
      - "10"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to: null
      subject: null
      body:
        simple: ${incident.id} Autoremediate?
      methods: []
      format: ""
      bcc: null
      cc: null
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
      replyOptions:
      - "Yes"
      - "No"
  "6":
    id: "6"
    taskid: 1214b667-e9c5-4efe-8503-d92b4f36cc0a
    type: regular
    task:
      id: 1214b667-e9c5-4efe-8503-d92b4f36cc0a
      version: -1
      name: Manually update IAM password policy
      description: |-
        1. Login to the AWS console and navigate to the IAM dashboard
        2. On the left navigation panel, click on Account Settings
        3. Check Prevent password reuse and enter remember 5 passwords
        4. Click on Apply password policy
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 800
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "7":
    id: "7"
    taskid: 599730fe-9f1e-4a63-89c5-e941732683b6
    type: regular
    task:
      id: 599730fe-9f1e-4a63-89c5-e941732683b6
      version: -1
      name: Close investigation
      description: Close the current incident.
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      assetid: {}
      closeNotes: {}
      closeReason: {}
      emailclassification: {}
      id:
        complex:
          root: incident
          accessor: id
      phishingsubtype: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "8":
    id: "8"
    taskid: a8d06dc1-f186-4459-87b6-3d05d85f70d0
    type: title
    task:
      id: a8d06dc1-f186-4459-87b6-3d05d85f70d0
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 690,
          "y": 1520
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "9":
    id: "9"
    taskid: bd2eb7f2-5e30-4623-8e11-ea91b99c23d8
    type: regular
    task:
      id: bd2eb7f2-5e30-4623-8e11-ea91b99c23d8
      version: -1
      name: Dismiss Prisma Cloud alert
      description: Dismiss the alerts matching the given filter. Must provide either
        policy IDs or alert IDs.
      script: PrismaCloud v2|||redlock-dismiss-alerts
      type: regular
      iscommand: true
      brand: PrismaCloud v2
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      alert-id:
        complex:
          root: incident
          accessor: labels
          transformers:
          - operator: getField
            args:
              field:
                value:
                  simple: id
      alert-rule-name: {}
      alert-status: {}
      cloud-account: {}
      cloud-region: {}
      cloud-type: {}
      dismissal-note:
        simple: ${incident.labels.id} has been remediated by Demisto.
      policy-compliance-standard: {}
      policy-id:
        complex:
          root: incident
          accessor: labels.policy
          transformers:
          - operator: ParseJSON
          - operator: getField
            args:
              field:
                value:
                  simple: policyId
      policy-label: {}
      policy-name: {}
      policy-severity: {}
      policy-type: {}
      resource-id: {}
      resource-name: {}
      resource-type: {}
      risk-grade: {}
      time-range-date-from: {}
      time-range-date-to: {}
      time-range-unit: {}
      time-range-value: {}
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 60,
          "y": 1180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "10":
    id: "10"
    taskid: 47348d70-6e0a-4efc-80d8-4f1f37d9561a
    type: condition
    task:
      id: 47348d70-6e0a-4efc-80d8-4f1f37d9561a
      version: -1
      name: Get Prisma Cloud policy id
      description: Verify that a Prisma Cloud policy ID exists.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      passwdPolicy:
      - "11"
      userPolicy:
      - "12"
    separatecontext: false
    defaultassigneecomplex: {}
    conditions:
    - label: passwdPolicy
      condition:
      - - operator: isNotEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: e809c246-2ef5-4319-bba9-2c5735d88aa8
    - label: userPolicy
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: e809c246-2ef5-4319-bba9-2c5735d88aa8
    view: |-
      {
        "position": {
          "x": 150,
          "y": 630
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "11":
    id: "11"
    taskid: 95edff8c-bcac-4296-80c9-293d77209f66
    type: playbook
    task:
      id: 95edff8c-bcac-4296-80c9-293d77209f66
      version: -1
      name: Prisma Cloud Remediation - AWS IAM Password Policy Misconfiguration
      description: |-
        This playbook remediates the following Prisma Cloud AWS IAM password policy alerts.

        Prisma Cloud policies remediated:
        - AWS IAM password policy allows password reuse
        - AWS IAM password policy does not expire in 90 days
        - AWS IAM password policy does not have a lowercase character
        - AWS IAM password policy does not have a minimum of 14 characters
        - AWS IAM password policy does not have a number
        - AWS IAM password policy does not have a symbol
        - AWS IAM password policy does not have a uppercase character
        - AWS IAM password policy does not have password expiration period
        - AWS IAM Password policy is insecure
      playbookName: Prisma Cloud Remediation - AWS IAM Password Policy Misconfiguration
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      policyId:
        complex:
          root: inputs.policyId
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 10,
          "y": 840
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "12":
    id: "12"
    taskid: ac6bdd4a-0d17-49b5-8d5e-ca830175b5a9
    type: playbook
    task:
      id: ac6bdd4a-0d17-49b5-8d5e-ca830175b5a9
      version: -1
      name: Prisma Cloud Remediation - AWS IAM User Policy Misconfiguration
      description: |-
        This playbook remediates the following Prisma Cloud AWS IAM User alerts.

        Prisma Cloud policies remediated:

         - AWS IAM user has two active Access Keys
      playbookName: Prisma Cloud Remediation - AWS IAM User Policy Misconfiguration
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      policyId:
        complex:
          root: inputs.policyId
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": -450,
          "y": 800
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "13":
    id: "13"
    taskid: 06bdb957-83d6-4613-8589-376daa6136c1
    type: condition
    task:
      id: 06bdb957-83d6-4613-8589-376daa6136c1
      version: -1
      name: Is Prisma Cloud v2 integration enabled?
      description: Is Prisma Cloud v2 integration enabled?
      type: condition
      iscommand: false
      brand: PrismaCloud v2
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "9"
    continueonerror: true
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: PrismaCloud v2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1010
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "10_11_passwdPolicy": 0.39,
      "10_6_#default#": 0.54,
      "1_2_yes": 0.49,
      "1_8_#default#": 0.21,
      "3_10_yes": 0.48,
      "3_5_#default#": 0.48,
      "5_10_Yes": 0.51,
      "5_6_#default#": 0.42
    },
    "paper": {
      "dimensions": {
        "height": 1765,
        "width": 1520,
        "x": -450,
        "y": -180
      }
    }
  }
inputs:
- key: AutoUpdatePasswordPolicy
  value:
    simple: "no"
  required: false
  description: Update AWS IAM password policy automatically?
- key: policyId
  value:
    complex:
      root: incident
      accessor: labels.policy
      transformers:
      - operator: ParseJSON
      - operator: getField
        args:
          field:
            value:
              simple: policyId
  required: false
  description: Get the Prisma Cloud policy ID.
outputs: []
tests:
- No Test (deprecated)
deprecated: true
hidden: true