Cortex Exposure Management AWS Virtual Machine Remediation

This automation rule is responsible for handling remediation of Cortex Exposure Management issues for Virtual Machines in AWS EC2.

Cortex Exposure Management

Details

ID714a581ffd144106a948bc9ad0cbd5ef
From Version6.10.0
Runs PlaybookCortex EM - AWS VM Exposure Remediation
Suggestion ReasonRecommended for remediation of Cortex Exposure Management issues on VM instances in AWS.

Alert conditions (all must match)

Field Operator Value
alert_source EQ XPANSE
alert_domain EQ DOMAIN_POSTURE
alert_category CONTAINS CONFIGURATION
asset_providers CONTAINS_IN_LIST AWS
{
    "trigger_id": "714a581ffd144106a948bc9ad0cbd5ef",
    "playbook_id": "Cortex EM - AWS VM Exposure Remediation",
    "suggestion_reason": "Recommended for remediation of Cortex Exposure Management issues on VM instances in AWS.",
    "description": "This automation rule is responsible for handling remediation of Cortex Exposure Management issues for Virtual Machines in AWS EC2.",
    "trigger_name": "Cortex Exposure Management AWS Virtual Machine Remediation",
    "alerts_filter": {
        "filter": {
            "AND": [
                {
                    "SEARCH_FIELD": "alert_source",
                    "SEARCH_TYPE": "EQ",
                    "SEARCH_VALUE": "XPANSE"
                },
                {
                    "SEARCH_FIELD": "alert_domain",
                    "SEARCH_TYPE": "EQ",
                    "SEARCH_VALUE": "DOMAIN_POSTURE"
                },
                {
                    "SEARCH_FIELD": "alert_category",
                    "SEARCH_TYPE": "CONTAINS",
                    "SEARCH_VALUE": "CONFIGURATION"
                },
                {
                    "OR": [
                        {
                            "SEARCH_FIELD": "matching_service_rule_id",
                            "SEARCH_TYPE": "CONTAINS",
                            "SEARCH_VALUE": "SshServer"
                        },
                        {
                            "SEARCH_FIELD": "matching_service_rule_id",
                            "SEARCH_TYPE": "CONTAINS",
                            "SEARCH_VALUE": "RdpServer"
                        },
                        {
                            "SEARCH_FIELD": "matching_service_rule_id",
                            "SEARCH_TYPE": "CONTAINS",
                            "SEARCH_VALUE": "KubernetesControlPlaneComponent"
                        },
                        {
                            "SEARCH_FIELD": "matching_service_rule_id",
                            "SEARCH_TYPE": "CONTAINS",
                            "SEARCH_VALUE": "LDAPServer"
                        },
                        {
                            "SEARCH_FIELD": "matching_service_rule_id",
                            "SEARCH_TYPE": "CONTAINS",
                            "SEARCH_VALUE": "NetBiosNameServer"
                        },
                        {
                            "SEARCH_FIELD": "matching_service_rule_id",
                            "SEARCH_TYPE": "CONTAINS",
                            "SEARCH_VALUE": "NfsRpcBindServer"
                        },
                        {
                            "SEARCH_FIELD": "matching_service_rule_id",
                            "SEARCH_TYPE": "CONTAINS",
                            "SEARCH_VALUE": "RpcBindServer"
                        },
                        {
                            "SEARCH_FIELD": "matching_service_rule_id",
                            "SEARCH_TYPE": "CONTAINS",
                            "SEARCH_VALUE": "SmbServer"
                        },
                        {
                            "SEARCH_FIELD": "matching_service_rule_id",
                            "SEARCH_TYPE": "CONTAINS",
                            "SEARCH_VALUE": "SnmpServer"
                        },
                        {
                            "SEARCH_FIELD": "matching_service_rule_id",
                            "SEARCH_TYPE": "CONTAINS",
                            "SEARCH_VALUE": "TelnetServer"
                        },
                        {
                            "SEARCH_FIELD": "matching_service_rule_id",
                            "SEARCH_TYPE": "CONTAINS",
                            "SEARCH_VALUE": "UnencryptedFtpServer"
                        },
                        {
                            "SEARCH_FIELD": "matching_service_rule_id",
                            "SEARCH_TYPE": "CONTAINS",
                            "SEARCH_VALUE": "MysqlServer"
                        },
                        {
                            "SEARCH_FIELD": "matching_service_rule_id",
                            "SEARCH_TYPE": "CONTAINS",
                            "SEARCH_VALUE": "MongoServer"
                        },
                        {
                            "SEARCH_FIELD": "matching_service_rule_id",
                            "SEARCH_TYPE": "CONTAINS",
                            "SEARCH_VALUE": "PostgresServer"
                        },
                        {
                            "SEARCH_FIELD": "matching_service_rule_id",
                            "SEARCH_TYPE": "CONTAINS",
                            "SEARCH_VALUE": "ElasticsearchServer"
                        },
                        {
                            "SEARCH_FIELD": "matching_service_rule_id",
                            "SEARCH_TYPE": "CONTAINS",
                            "SEARCH_VALUE": "TftpServer"
                        },
                        {
                            "SEARCH_FIELD": "matching_service_rule_id",
                            "SEARCH_TYPE": "CONTAINS",
                            "SEARCH_VALUE": "InsecureSFTPGo"
                        }
                    ]
                },
                {
                    "SEARCH_FIELD": "asset_providers",
                    "SEARCH_TYPE": "CONTAINS_IN_LIST",
                    "SEARCH_VALUE": "AWS"
                }
            ]
        }
    },
    "fromVersion": "6.10.0"
}