Trigger - Azure Network Exposure

Recommends the Azure Network Exposure - Auto-remediate playbook to automatically remediate the network exposure of Azure VM by updating the network security group of the VM instance, adding a Deny rule on top of the one that causes public exposure to block access to that specific VM instance. It also adds an Allow rule to permit access to the instance from internal IPs.

Cloud Security Posture Management Playbooks

Details

ID	`b0e015068c81ec707403037a3534355c`
Runs Playbook	`Azure Network Exposure - Auto-remediate`
Suggestion Reason	Apply this rule to automatically remediate the network exposure of Azure resources by adding restrictive rules on top of the offending security rule that causes public exposure.

Source

Trigger_-_Azure_Network_Exposure.json

Download History Raw

{
  "trigger_id": "b0e015068c81ec707403037a3534355c",
  "trigger_name": "Trigger - Azure Network Exposure",
  "playbook_id": "Azure Network Exposure - Auto-remediate",
  "suggestion_reason": "Apply this rule to automatically remediate the network exposure of Azure resources by adding restrictive rules on top of the offending security rule that causes public exposure.",
  "description": "Recommends the Azure Network Exposure - Auto-remediate playbook to automatically remediate the network exposure of Azure VM by updating the network security group of the VM instance, adding a Deny rule on top of the one that causes public exposure to block access to that specific VM instance. It also adds an Allow rule to permit access to the instance from internal IPs.",
  "alerts_filter": {
    "filter": {
        "OR": [
            {
            "SEARCH_FIELD": "matching_service_rule_id",
            "SEARCH_TYPE": "WILDCARD",
            "SEARCH_VALUE": "ed599fb6-8956-49eb-a37a-a6201296087a"
            }
        ]
        }
    }
}