id: Prisma Cloud Remediation - Azure AKS Misconfiguration
version: -1
fromversion: 5.0.0
contentitemexportablefields:
  contentitemfields: {}
name: Prisma Cloud Remediation - Azure AKS Misconfiguration
description: |
  Deprecated. Use Prisma Cloud Remediation - Azure AKS Misconfiguration v2 instead.
  This playbook remediates Prisma Cloud Azure AKS alerts.  It calls sub-playbooks that perform the actual remediation steps.

  Remediation:
  - Azure AKS cluster monitoring not enabled
  - Azure AKS cluster HTTP application routing enabled
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 61bee172-14d4-4a48-815c-913b49bef800
    type: start
    task:
      id: 61bee172-14d4-4a48-815c-913b49bef800
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 630,
          "y": 0
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: 792a6a96-0d68-4feb-80cb-beabe2d48df9
    type: condition
    task:
      id: 792a6a96-0d68-4feb-80cb-beabe2d48df9
      version: -1
      name: Is Azure Kubernetes Services integration enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns
        'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "4"
    scriptarguments:
      brandname:
        simple: Azure Kubernetes Services
    results:
    - brandInstances
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 630,
          "y": 140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 1abd9220-e39e-4206-8aa3-dba2695c7f4e
    type: title
    task:
      id: 1abd9220-e39e-4206-8aa3-dba2695c7f4e
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 630,
          "y": 1670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: 7b8af710-d3f1-47db-8ed0-13cd281e5fcf
    type: condition
    task:
      id: 7b8af710-d3f1-47db-8ed0-13cd281e5fcf
      version: -1
      name: Is there a policy to remediate?
      description: Checks for a Prisma Cloud policy Id.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "8"
      "yes":
      - "5"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
    view: |-
      {
        "position": {
          "x": 350,
          "y": 310
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: 223581df-ba64-4269-8106-bb59ee39ff7a
    type: condition
    task:
      id: 223581df-ba64-4269-8106-bb59ee39ff7a
      version: -1
      name: Update AKS automatically?
      description: Auto remediate?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "7"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.AutoRemediateAzureAKS
                transformers:
                - operator: toLowerCase
            iscontext: true
          right:
            value:
              simple: "yes"
    view: |-
      {
        "position": {
          "x": -200,
          "y": 480
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: 010afabc-1338-4af0-8e6f-73669e94dae7
    type: condition
    task:
      id: 010afabc-1338-4af0-8e6f-73669e94dae7
      version: -1
      name: Auto remediate?
      description: Remediate automatically or manually update?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "8"
      "Yes":
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 90,
          "y": 650
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
        simple: ${incident.id} Autoremediate?
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
      replyOptions:
      - "Yes"
      - "No"
    skipunavailable: false
    quietmode: 0
  "7":
    id: "7"
    taskid: 7fda9780-599c-4ed2-81ab-6a595e1f285c
    type: condition
    task:
      id: 7fda9780-599c-4ed2-81ab-6a595e1f285c
      version: -1
      name: Execute playbook
      description: Execute the appropriate remediation sub-playbook based on the Prisma
        Cloud policy Id.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "8"
      cluster:
      - "15"
    separatecontext: false
    conditions:
    - label: cluster
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: be55c11a-981a-4f34-a2e7-81ce40d71aa5
        - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: 0429670c-5d2d-4d0f-ab33-59eb5e000305
    view: |-
      {
        "position": {
          "x": -200,
          "y": 820
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "8":
    id: "8"
    taskid: 1d094fa9-2603-45c3-8869-af2e0194da65
    type: regular
    task:
      id: 1d094fa9-2603-45c3-8869-af2e0194da65
      version: -1
      name: Manually update AKS
      description: |-
        1. Sign in to the Azure portal.
        2. Goto the Kubernetes Service and select your cluster.
        3. Click Insights in the left window pane.
        4. If you have an existing Log Analytics workspace in the same subscription as the cluster, select it in the drop-down list.
        5. Select Enable.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 350,
          "y": 990
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "9":
    id: "9"
    taskid: c3d736e6-e9ab-4cfc-8ed0-7276f754c074
    type: regular
    task:
      id: c3d736e6-e9ab-4cfc-8ed0-7276f754c074
      version: -1
      name: Close investigation
      description: Close the current incident.
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      assetid: {}
      closeNotes: {}
      closeReason: {}
      emailclassification: {}
      id:
        complex:
          root: incident
          accessor: id
      mndadone: {}
      phishingsubtype: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 350,
          "y": 1500
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "11":
    id: "11"
    taskid: edf547ca-7606-4d2b-8c3c-fc5cb0348c6e
    type: condition
    task:
      id: edf547ca-7606-4d2b-8c3c-fc5cb0348c6e
      version: -1
      name: Is Prisma Cloud v2 integration enabled?
      description: Is Prisma Cloud v2 integration enabled?
      type: condition
      iscommand: false
      brand: PrismaCloud v2
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "14"
    continueonerror: true
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: PrismaCloud v2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 350,
          "y": 1160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "14":
    id: "14"
    taskid: 5eb90a78-eb8e-4c19-8e15-d4fbacae6996
    type: regular
    task:
      id: 5eb90a78-eb8e-4c19-8e15-d4fbacae6996
      version: -1
      name: Dismiss Prisma Cloud alert
      description: Dismiss the alerts matching the given filter. Must provide either
        policy IDs or alert IDs.
      script: PrismaCloud v2|||redlock-dismiss-alerts
      type: regular
      iscommand: true
      brand: PrismaCloud v2
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      alert-id:
        complex:
          root: incident
          accessor: labels
          transformers:
          - operator: getField
            args:
              field:
                value:
                  simple: id
      alert-rule-name: {}
      alert-status: {}
      cloud-account: {}
      cloud-region: {}
      cloud-type: {}
      dismissal-note:
        simple: ${incident.labels.id} has been remediated by Demisto.
      policy-compliance-standard: {}
      policy-id: {}
      policy-label: {}
      policy-name: {}
      policy-severity: {}
      policy-type: {}
      resource-id: {}
      resource-name: {}
      resource-type: {}
      risk-grade: {}
      snooze-unit: {}
      snooze-value: {}
      time-range-date-from: {}
      time-range-date-to: {}
      time-range-unit: {}
      time-range-value: {}
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 110,
          "y": 1330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "15":
    id: "15"
    taskid: 8290524b-0b84-4298-8939-20bba38caadf
    type: playbook
    task:
      id: 8290524b-0b84-4298-8939-20bba38caadf
      version: -1
      name: Prisma Cloud Remediation - Azure AKS Cluster Misconfiguration
      description: |-
        This playbook remediates the following Prisma Cloud Azure AKS cluster alerts.

        Prisma Cloud policies remediated:

        - Azure AKS cluster monitoring not enabled
        - Azure AKS cluster HTTP application routing enabled
      playbookName: Prisma Cloud Remediation - Azure AKS Cluster Misconfiguration
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      policyId:
        complex:
          root: inputs.policyId
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -480,
          "y": 990
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "11_14_yes": 0.61,
      "11_9_#default#": 0.53,
      "2_3_#default#": 0.2,
      "2_4_yes": 0.52,
      "4_5_yes": 0.3,
      "4_8_#default#": 0.22,
      "5_6_#default#": 0.55,
      "5_7_yes": 0.46,
      "6_7_Yes": 0.46,
      "6_8_#default#": 0.35,
      "7_15_cluster": 0.58,
      "7_8_#default#": 0.24
    },
    "paper": {
      "dimensions": {
        "height": 1735,
        "width": 1490,
        "x": -480,
        "y": 0
      }
    }
  }
inputs:
- key: AutoRemediateAzureAKS
  value:
    simple: "no"
  required: false
  description: Execute Azure AKS remediation automatically?
  playbookInputQuery:
- key: policyId
  value:
    complex:
      root: incident
      accessor: labels.policy
      transformers:
      - operator: ParseJSON
      - operator: getField
        args:
          field:
            value:
              simple: policyId
  required: false
  description: Grab the Prisma Cloud policy Id.
  playbookInputQuery:
outputs:
- contextPath: incident.labels.resource.name
  description: AKS cluster name.
  type: string
tests:
- No Test (deprecated)
deprecated: true
hidden: true