Cloud IAM User Access Investigation

This trigger is responsible for handling Cloud IAM user access investigation alerts

Cloud Incident Response

Details

ID39f9b9dce947a6af186c75c72709c716
Runs PlaybookCloud IAM User Access Investigation
Suggestion ReasonRecommended for Cloud IAM user access alerts

Source

Trigger_-_Cloud_IAM_User_Access_Investigation.json
Download History Raw 
{
  "trigger_id": "39f9b9dce947a6af186c75c72709c716",
  "playbook_id": "Cloud IAM User Access Investigation",
  "suggestion_reason": "Recommended for Cloud IAM user access alerts",
  "description": "This trigger is responsible for handling Cloud IAM user access investigation alerts",
  "trigger_name": "Cloud IAM User Access Investigation",
  "alerts_filter": {
    "filter": {
      "OR": [
        {
          "SEARCH_FIELD": "alert_name",
          "SEARCH_TYPE": "CONTAINS",
          "SEARCH_VALUE": "Penetration testing tool activity"
        },
        {
          "SEARCH_FIELD": "alert_name",
          "SEARCH_TYPE": "CONTAINS",
          "SEARCH_VALUE": "Penetration testing tool attempt"
        },
        {
          "SEARCH_FIELD": "alert_name",
          "SEARCH_TYPE": "CONTAINS",
          "SEARCH_VALUE": "Suspicious API call from a Tor exit node"
        }
      ]
    }
  },
  "supportedModules": [
    "xsiam"
  ]
}