id: Prisma Cloud Remediation - GCP VPC Network Project Misconfiguration
version: -1
fromversion: 5.0.0
name: Prisma Cloud Remediation - GCP VPC Network Project Misconfiguration
description: |-
  This playbook remediates the following Prisma Cloud GCP VPC Network Project alerts.

  Prisma Cloud policies remediated:

   - GCP project is using the default network
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 61bee172-14d4-4a48-815c-913b49bef800
    type: start
    task:
      id: 61bee172-14d4-4a48-815c-913b49bef800
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 630,
          "y": -160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "1":
    id: "1"
    taskid: e0c6d561-84ef-40a0-8c33-46b1cd7facbc
    type: regular
    task:
      id: e0c6d561-84ef-40a0-8c33-46b1cd7facbc
      version: -1
      name: Attempt to delete default VPC network
      description: Deletes the specified network.
      script: Google Cloud Compute|||gcp-compute-delete-network
      type: regular
      iscommand: true
      brand: Google Cloud Compute
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      network:
        complex:
          root: GoogleCloudCompute
          accessor: Networks.name
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 130,
          "y": 820
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "3":
    id: "3"
    taskid: 1abd9220-e39e-4206-8aa3-dba2695c7f4e
    type: title
    task:
      id: 1abd9220-e39e-4206-8aa3-dba2695c7f4e
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 630,
          "y": 1330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "4":
    id: "4"
    taskid: c6481460-c0e5-4518-8c78-c7d1403aae3e
    type: regular
    task:
      id: c6481460-c0e5-4518-8c78-c7d1403aae3e
      version: -1
      name: Get VPC network details
      description: Returns the specified network.
      script: Google Cloud Compute|||gcp-compute-get-network
      type: regular
      iscommand: true
      brand: Google Cloud Compute
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      network:
        complex:
          root: incident
          accessor: labels.resource
          transformers:
          - operator: ParseJSON
          - operator: getField
            args:
              field:
                value:
                  simple: name
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 630,
          "y": 150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "5":
    id: "5"
    taskid: a27e47fb-063c-48ad-8e76-0b3fb6d7f446
    type: condition
    task:
      id: a27e47fb-063c-48ad-8e76-0b3fb6d7f446
      version: -1
      name: Execute remediation
      description: Execute the appropriate remediation task.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      default:
      - "7"
    separatecontext: false
    conditions:
    - label: default
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.policyId
            iscontext: true
          right:
            value:
              simple: c2cf4439-9ac2-44b8-a0d2-7076cf82c29a
    view: |-
      {
        "position": {
          "x": 630,
          "y": 330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "7":
    id: "7"
    taskid: 191c3374-6528-442f-87d6-e7bc615b53d5
    type: title
    task:
      id: 191c3374-6528-442f-87d6-e7bc615b53d5
      version: -1
      name: Default Network
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 250,
          "y": 505
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "8":
    id: "8"
    taskid: ca0198e7-2228-4e75-8b90-8d8822edfe1e
    type: condition
    task:
      id: ca0198e7-2228-4e75-8b90-8d8822edfe1e
      version: -1
      name: Check for default VPC network?
      description: Verify that this is the project default network.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: GoogleCloudCompute
                accessor: Networks.name
            iscontext: true
          right:
            value:
              simple: default
    view: |-
      {
        "position": {
          "x": 380,
          "y": 650
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "9":
    id: "9"
    taskid: 8457fd75-d770-4c23-8c2c-d32e3aa523d8
    type: condition
    task:
      id: 8457fd75-d770-4c23-8c2c-d32e3aa523d8
      version: -1
      name: Did we encounter an error?
      description: Checks whether the given entry/entries returned an error. Use ${lastCompletedTaskEntries} to check the previous task entries. If an array is provided, it returns 'yes' if one of the entries returned an error.
      scriptName: isError
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "3"
      "yes":
      - "10"
    scriptarguments:
      entryId:
        simple: ${lastCompletedTaskEntries}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -50,
          "y": 990
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "10":
    id: "10"
    taskid: bdc74c5f-447e-47bd-8111-c7e89194d74a
    type: regular
    task:
      id: bdc74c5f-447e-47bd-8111-c7e89194d74a
      version: -1
      name: Manually remove default VPC and its resources
      description: Manually remove all existing resources from your default VPC network.  Then delete the default network.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 380,
          "y": 1160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "11":
    id: "11"
    taskid: c8cc511a-d4da-4e44-86a2-eca1d1a26855
    type: condition
    task:
      id: c8cc511a-d4da-4e44-86a2-eca1d1a26855
      version: -1
      name: Is Google Cloud Compute integration enabled?
      description: "Is Google Cloud Compute integration enabled?"
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Google Cloud Compute
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 630,
          "y": -30
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "5_3_#default#": 0.16,
      "5_7_default": 0.56,
      "8_10_#default#": 0.39,
      "8_1_yes": 0.47,
      "9_10_yes": 0.54,
      "9_3_no": 0.17
    },
    "paper": {
      "dimensions": {
        "height": 1555,
        "width": 1060,
        "x": -50,
        "y": -160
      }
    }
  }
inputs:
- key: policyId
  value: {}
  required: true
  description: Prisma Cloud policy Id.
outputs: []
tests:
- No Test