id: Prisma Cloud Remediation - GCP VPC Network Firewall Misconfiguration
version: -1
fromversion: 5.0.0
name: Prisma Cloud Remediation - GCP VPC Network Firewall Misconfiguration
description: |-
  This playbook remediates the following Prisma Cloud GCP VPC Network Firewall alerts.

  Prisma Cloud policies remediated:

   - GCP Firewall rule allows internet traffic to FTP port (21)
   - GCP Firewall rule allows internet traffic to HTTP port (80)
   - GCP Firewall rule allows internet traffic to MongoDB port (27017)
   - GCP Firewall rule allows internet traffic to MySQL DB port (3306)
   - GCP Firewall rule allows internet traffic to Oracle DB port (1521)
   - GCP Firewall rule allows internet traffic to PostgreSQL port (5432)
   - GCP Firewall rule allows internet traffic to RDP port (3389)
   - GCP Firewall rule allows internet traffic to SSH port (22)
   - GCP Firewall rule allows internet traffic to Telnet port (23)
   - GCP Firewall rule allows internet traffic to DNS port (53)
   - GCP Firewall rule allows internet traffic to Microsoft-DS port (445)
   - GCP Firewall rule allows internet traffic to NetBIOS-SSN port (139)
   - GCP Firewall rule allows internet traffic to POP3 port (110)
   - GCP Firewall rule allows internet traffic to SMTP port (25)
   - GCP Default Firewall rule should not have any rules (except http and https)
   - GCP Firewall with Inbound rule overly permissive to All Traffic
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 61bee172-14d4-4a48-815c-913b49bef800
    type: start
    task:
      id: 61bee172-14d4-4a48-815c-913b49bef800
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 630,
          "y": -160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "1":
    id: "1"
    taskid: 3fc02302-4a03-4255-8734-e7e0ff56a942
    type: regular
    task:
      id: 3fc02302-4a03-4255-8734-e7e0ff56a942
      version: -1
      name: Disable the offending FW rule
      description: Updates the specified firewall rule with the data included in the request.
      script: Google Cloud Compute|||gcp-compute-patch-firewall
      type: regular
      iscommand: true
      brand: Google Cloud Compute
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      allowed: {}
      denied: {}
      description: {}
      destinationRanges: {}
      direction: {}
      disabled:
        simple: "true"
      logConfigEnable: {}
      name:
        complex:
          root: GoogleCloudCompute
          accessor: Firewalls.name
      network: {}
      priority: {}
      sourceRanges: {}
      sourceServiceAccounts: {}
      sourceTags: {}
      targetServiceAccounts: {}
      targetTags: {}
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -490,
          "y": 1130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "3":
    id: "3"
    taskid: 1abd9220-e39e-4206-8aa3-dba2695c7f4e
    type: title
    task:
      id: 1abd9220-e39e-4206-8aa3-dba2695c7f4e
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 630,
          "y": 1300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "4":
    id: "4"
    taskid: 3aae1540-7ffb-4822-8aa3-5a2efa0acdb7
    type: regular
    task:
      id: 3aae1540-7ffb-4822-8aa3-5a2efa0acdb7
      version: -1
      name: Get VPC firewall details
      description: Returns the specified firewall.
      script: Google Cloud Compute|||gcp-compute-get-firewall
      type: regular
      iscommand: true
      brand: Google Cloud Compute
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      name:
        complex:
          root: incident
          accessor: labels.resource
          transformers:
          - operator: ParseJSON
          - operator: getField
            args:
              field:
                value:
                  simple: name
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 630,
          "y": 150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "5":
    id: "5"
    taskid: 998f0dfe-3adb-41d8-8324-f75a10b7a6ee
    type: condition
    task:
      id: 998f0dfe-3adb-41d8-8324-f75a10b7a6ee
      version: -1
      name: Execute remediation
      description: Execute the appropriate remediation task.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      commonPorts:
      - "7"
      overlyPermissive:
      - "12"
      webPorts:
      - "11"
    separatecontext: false
    conditions:
    - label: commonPorts
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: fab6a8ee-dc82-49f0-8c2c-a2a5c7666539
        - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: 9f6d22f9-873a-4a71-91a8-41a82e4c9314
        - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: b7ad863b-d54c-4b43-a157-010199a37cac
        - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: 1171a9b9-9648-405a-8e03-83e5025e81d3
        - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: 39f48b70-3f22-481d-be71-13211bc87d98
        - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: b1a3c396-2e03-4050-b7b4-6cf8a7ab5f9b
        - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: 34175634-0e4a-4e9d-9c77-0c75390b8bdc
        - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: 49a154e8-6049-4317-bbb5-0c90cb078f94
        - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: 024045e3-dfa3-4109-9d68-e7fcf3c6c4d1
        - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: dc3dd864-cff5-4730-84ac-11e212f2c1ff
        - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: 1aa8f0f0-139f-49a2-9c9d-41c71a3c806f
        - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: 7afdb939-4a9a-45b0-ba3b-f81dec86bc76
        - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: 094b6b65-a37a-4f3b-b08f-5d313a6f5051
        - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: e35ce679-e427-4e00-a9d2-44d808c694bd
    - label: webPorts
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: 3b814978-44a0-4a5b-9736-492d67ee4994
    - label: overlyPermissive
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: ff6a9cca-8bc5-4a72-9235-ec7b65c547d5
    view: |-
      {
        "position": {
          "x": 630,
          "y": 330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "7":
    id: "7"
    taskid: 6c2eba20-647c-4754-8c42-fddc318c20af
    type: title
    task:
      id: 6c2eba20-647c-4754-8c42-fddc318c20af
      version: -1
      name: Common Ports
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -490,
          "y": 500
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "8":
    id: "8"
    taskid: 027f7a25-4442-4f10-849a-61de6ed7ad96
    type: regular
    task:
      id: 027f7a25-4442-4f10-849a-61de6ed7ad96
      version: -1
      name: Find the port number
      description: Sets a value into the context with the given context key.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      append: {}
      key:
        simple: portNumber
      stringify: {}
      value:
        complex:
          root: incident
          transformers:
          - operator: getField
            args:
              field:
                value:
                  simple: rawName
          - operator: substringFrom
            args:
              from:
                value:
                  simple: port (
          - operator: substringTo
            args:
              to:
                value:
                  simple: )
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -490,
          "y": 660
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "9":
    id: "9"
    taskid: a6f27574-3295-4b37-8715-8771e18b4677
    type: condition
    task:
      id: a6f27574-3295-4b37-8715-8771e18b4677
      version: -1
      name: Check FW rule for public access to common ports
      description: Check the firewall rule for public access.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: containsString
          left:
            value:
              complex:
                root: incident
                accessor: labels.resource
                transformers:
                - operator: ParseJSON
                - operator: getField
                  args:
                    field:
                      value:
                        simple: data
                - operator: getField
                  args:
                    field:
                      value:
                        simple: sourceRanges
            iscontext: true
          right:
            value:
              simple: 0.0.0.0/0
      - - operator: inList
          left:
            value:
              simple: ${portNumber}
            iscontext: true
          right:
            value:
              simple: 21, 80, 27017, 3306, 1521, 5432, 3389, 22, 23, 53, 445, 139, 110, 25
    view: |-
      {
        "position": {
          "x": -490,
          "y": 840
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "10":
    id: "10"
    taskid: f13fa723-aae0-4c54-82e7-8b6507151987
    type: regular
    task:
      id: f13fa723-aae0-4c54-82e7-8b6507151987
      version: -1
      name: Manually update FW rules
      description: |-
        1. Login to GCP Console and from Networking, select VPC network.
        2. Go to Firewall rules and click on Ingress.
        3. Modify, disable, or delete the offending firewall rule.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 380,
          "y": 1130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "11":
    id: "11"
    taskid: 74a304c0-9094-4d9b-8972-2d56f54c8e13
    type: title
    task:
      id: 74a304c0-9094-4d9b-8972-2d56f54c8e13
      version: -1
      name: Default Firewall Rules
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -40,
          "y": 500
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "12":
    id: "12"
    taskid: 6eba9d9a-da40-4348-8f0a-1269d34d1a67
    type: title
    task:
      id: 6eba9d9a-da40-4348-8f0a-1269d34d1a67
      version: -1
      name: Overly Permissive
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 380,
          "y": 500
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "13":
    id: "13"
    taskid: 41bb8983-af56-4858-856f-946ba9880276
    type: condition
    task:
      id: 41bb8983-af56-4858-856f-946ba9880276
      version: -1
      name: Check default FW for HTTP/HTTPS rules
      description: Check the default firewall rule for the web ports; 80 and 443.  If the firewall rule contains either one, or both of these ports, manually update the rule.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "1"
      "yes":
      - "10"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: startWith
          left:
            value:
              complex:
                root: incident
                accessor: labels.resource
                transformers:
                - operator: ParseJSON
                - operator: getField
                  args:
                    field:
                      value:
                        simple: name
            iscontext: true
          right:
            value:
              simple: default
      - - operator: containsString
          left:
            value:
              complex:
                root: incident
                accessor: labels.resource
                transformers:
                - operator: ParseJSON
                - operator: getField
                  args:
                    field:
                      value:
                        simple: data
                - operator: getField
                  args:
                    field:
                      value:
                        simple: sourceRanges
            iscontext: true
          right:
            value:
              simple: 0.0.0.0/0
      - - operator: containsString
          left:
            value:
              complex:
                root: incident
                accessor: labels.resource
                transformers:
                - operator: ParseJSON
                - operator: getField
                  args:
                    field:
                      value:
                        simple: data
                - operator: getField
                  args:
                    field:
                      value:
                        simple: allowed
                - operator: getField
                  args:
                    field:
                      value:
                        simple: ports
            iscontext: true
          right:
            value:
              simple: "80"
        - operator: containsString
          left:
            value:
              complex:
                root: incident
                accessor: labels.resource
                transformers:
                - operator: ParseJSON
                - operator: getField
                  args:
                    field:
                      value:
                        simple: data
                - operator: getField
                  args:
                    field:
                      value:
                        simple: allowed
                - operator: getField
                  args:
                    field:
                      value:
                        simple: ports
            iscontext: true
          right:
            value:
              simple: "443"
    view: |-
      {
        "position": {
          "x": -40,
          "y": 660
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "14":
    id: "14"
    taskid: e9efe2ae-22ce-4705-831c-06a0ab2b7761
    type: condition
    task:
      id: e9efe2ae-22ce-4705-831c-06a0ab2b7761
      version: -1
      name: Check FW rule for public access to all protocols
      description: Check the firewall rule for public access.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: containsString
          left:
            value:
              complex:
                root: incident
                accessor: labels.resource
                transformers:
                - operator: ParseJSON
                - operator: getField
                  args:
                    field:
                      value:
                        simple: data
                - operator: getField
                  args:
                    field:
                      value:
                        simple: sourceRanges
            iscontext: true
          right:
            value:
              simple: 0.0.0.0/0
      - - operator: isEqualString
          left:
            value:
              complex:
                root: incident
                accessor: labels.resource
                transformers:
                - operator: ParseJSON
                - operator: getField
                  args:
                    field:
                      value:
                        simple: data
                - operator: getField
                  args:
                    field:
                      value:
                        simple: allowed
                - operator: getField
                  args:
                    field:
                      value:
                        simple: IPProtocol
            iscontext: true
          right:
            value:
              simple: all
    view: |-
      {
        "position": {
          "x": 380,
          "y": 660
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "15":
    id: "15"
    taskid: b540e8c3-4ffb-4943-8c47-16ef885bd30a
    type: condition
    task:
      id: b540e8c3-4ffb-4943-8c47-16ef885bd30a
      version: -1
      name: Is Google Cloud Compute integration enabled?
      description: "Is Google Cloud Compute integration enabled?"
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Google Cloud Compute
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 630,
          "y": -30
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "13_10_yes": 0.4,
      "13_1_#default#": 0.4,
      "14_10_#default#": 0.48,
      "14_1_yes": 0.23,
      "5_3_#default#": 0.31,
      "5_7_commonPorts": 0.83,
      "9_10_#default#": 0.1,
      "9_1_yes": 0.43
    },
    "paper": {
      "dimensions": {
        "height": 1525,
        "width": 1500,
        "x": -490,
        "y": -160
      }
    }
  }
inputs:
- key: policyId
  value: {}
  required: true
  description: Prisma Cloud policy Id.
outputs: []
tests:
- No Test