Skip to content

Commit 484ee5a

Browse files
content-botjohnnywilkesContent Bot
authored and
ostolero
committed
[ASM] Expander 5777 (#29647)
* [ASM] Expander 5777 (#29619) * first * RN * Bump pack from version CortexAttackSurfaceManagement to 1.6.36. --------- Co-authored-by: johnnywilkes <[email protected]> Co-authored-by: Content Bot <[email protected]>
1 parent bacdd27 commit 484ee5a

File tree

5 files changed

+170
-30
lines changed

5 files changed

+170
-30
lines changed

‎Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_Remediation.yml

Lines changed: 157 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,10 @@ starttaskid: "0"
66
tasks:
77
"0":
88
id: "0"
9-
taskid: d1735507-de4e-495b-8480-d5706b9c0bbd
9+
taskid: 59fd772a-8663-4f65-894b-ce0d9d594d3a
1010
type: start
1111
task:
12-
id: d1735507-de4e-495b-8480-d5706b9c0bbd
12+
id: 59fd772a-8663-4f65-894b-ce0d9d594d3a
1313
version: -1
1414
name: ""
1515
iscommand: false
@@ -36,10 +36,10 @@ tasks:
3636
isautoswitchedtoquietmode: false
3737
"3":
3838
id: "3"
39-
taskid: 1e668467-bde2-483b-8523-b8409d9eaff8
39+
taskid: abeca2ef-0997-4c7d-8f50-fe1ed91d0446
4040
type: condition
4141
task:
42-
id: 1e668467-bde2-483b-8523-b8409d9eaff8
42+
id: abeca2ef-0997-4c7d-8f50-fe1ed91d0446
4343
version: -1
4444
name: What provider is this service?
4545
description: Determines which cloud provider the service is in order to direct to the correct enrichment.
@@ -50,7 +50,7 @@ tasks:
5050
'#default#':
5151
- "4"
5252
AWS:
53-
- "8"
53+
- "10"
5454
GCP:
5555
- "9"
5656
Azure:
@@ -130,10 +130,10 @@ tasks:
130130
isautoswitchedtoquietmode: false
131131
"4":
132132
id: "4"
133-
taskid: ed351bc8-42f2-4168-8623-e0573f6911e5
133+
taskid: 2130db27-44cb-4de8-8b9e-45ca3c14c404
134134
type: title
135135
task:
136-
id: ed351bc8-42f2-4168-8623-e0573f6911e5
136+
id: 2130db27-44cb-4de8-8b9e-45ca3c14c404
137137
version: -1
138138
name: Completed
139139
type: title
@@ -146,7 +146,7 @@ tasks:
146146
{
147147
"position": {
148148
"x": 450,
149-
"y": 790
149+
"y": 860
150150
}
151151
}
152152
note: false
@@ -158,10 +158,10 @@ tasks:
158158
isautoswitchedtoquietmode: false
159159
"6":
160160
id: "6"
161-
taskid: f0cba2e4-b4de-450d-806a-3145e1ce4999
161+
taskid: 0280f013-e0ff-41b4-8fed-68d95b3ee6dd
162162
type: playbook
163163
task:
164-
id: f0cba2e4-b4de-450d-806a-3145e1ce4999
164+
id: 0280f013-e0ff-41b4-8fed-68d95b3ee6dd
165165
version: -1
166166
name: Azure - Network Security Group Remediation
167167
description: |-
@@ -242,10 +242,10 @@ tasks:
242242
isautoswitchedtoquietmode: false
243243
"7":
244244
id: "7"
245-
taskid: 67959d21-de62-43ad-814b-a2bf61b5a280
245+
taskid: 072e7951-1e71-4d9e-8972-9bf7324f1d6d
246246
type: playbook
247247
task:
248-
id: 67959d21-de62-43ad-814b-a2bf61b5a280
248+
id: 072e7951-1e71-4d9e-8972-9bf7324f1d6d
249249
version: -1
250250
name: AWS - Unclaimed S3 Bucket Remediation
251251
description: The playbook will create the unclaimed S3 bucket.
@@ -280,8 +280,8 @@ tasks:
280280
view: |-
281281
{
282282
"position": {
283-
"x": -200,
284-
"y": 460
283+
"x": 220,
284+
"y": 470
285285
}
286286
}
287287
note: false
@@ -293,10 +293,10 @@ tasks:
293293
isautoswitchedtoquietmode: false
294294
"8":
295295
id: "8"
296-
taskid: 409f127a-6417-41a9-8c53-e35dbfc32f53
296+
taskid: 7138c0ac-6cc2-4494-817f-1a5130a79c2a
297297
type: playbook
298298
task:
299-
id: 409f127a-6417-41a9-8c53-e35dbfc32f53
299+
id: 7138c0ac-6cc2-4494-817f-1a5130a79c2a
300300
version: -1
301301
name: AWS - Security Group Remediation v2
302302
description: This playbook takes in some information about an EC2 instance (ID and public_ip) and with provided port and protocol, determines what security groups on the primary interface of an EC2 instance are over-permissive. It uses an automation to determine what interface on an EC2 instance has an over-permissive security group on, determine which security groups have over-permissive rules and to replace them with a copy of the security group that has only the over-permissive portion removed. Over-permissive is defined as sensitive ports (SSH, RDP, etc) being exposed to the internet via IPv4.
@@ -345,8 +345,8 @@ tasks:
345345
view: |-
346346
{
347347
"position": {
348-
"x": 230,
349-
"y": 470
348+
"x": -120,
349+
"y": 670
350350
}
351351
}
352352
note: false
@@ -358,10 +358,10 @@ tasks:
358358
isautoswitchedtoquietmode: false
359359
"9":
360360
id: "9"
361-
taskid: d7ea937a-8db4-4b32-87d9-7f02b626c16d
361+
taskid: 1100e81a-1ff6-49f4-8f7e-aaf059697952
362362
type: playbook
363363
task:
364-
id: d7ea937a-8db4-4b32-87d9-7f02b626c16d
364+
id: 1100e81a-1ff6-49f4-8f7e-aaf059697952
365365
version: -1
366366
name: GCP - Firewall Remediation
367367
playbookName: GCP - Firewall Remediation
@@ -447,22 +447,153 @@ tasks:
447447
quietmode: 0
448448
isoversize: false
449449
isautoswitchedtoquietmode: false
450+
"10":
451+
id: "10"
452+
taskid: 6334ec1b-b8f4-4498-84b2-80049ebcc585
453+
type: condition
454+
task:
455+
id: 6334ec1b-b8f4-4498-84b2-80049ebcc585
456+
version: -1
457+
name: Is AWSAssumeRoleName Input defined?
458+
description: Determines which cloud provider the service is in order to direct to the correct enrichment.
459+
type: condition
460+
iscommand: false
461+
brand: ""
462+
nexttasks:
463+
'#default#':
464+
- "8"
465+
"yes":
466+
- "11"
467+
separatecontext: false
468+
conditions:
469+
- label: "yes"
470+
condition:
471+
- - operator: isNotEmpty
472+
left:
473+
value:
474+
complex:
475+
root: inputs.AWSAssumeRoleName
476+
iscontext: true
477+
continueonerrortype: ""
478+
view: |-
479+
{
480+
"position": {
481+
"x": -300,
482+
"y": 440
483+
}
484+
}
485+
note: false
486+
timertriggers: []
487+
ignoreworker: false
488+
skipunavailable: false
489+
quietmode: 0
490+
isoversize: false
491+
isautoswitchedtoquietmode: false
492+
"11":
493+
id: "11"
494+
taskid: ad50baec-b4d2-4969-8933-d60086859a91
495+
type: playbook
496+
task:
497+
id: ad50baec-b4d2-4969-8933-d60086859a91
498+
version: -1
499+
name: AWS - Security Group Remediation v2
500+
description: This playbook takes in some information about an EC2 instance (ID and public_ip) and with provided port and protocol, determines what security groups on the primary interface of an EC2 instance are over-permissive. It uses an automation to determine what interface on an EC2 instance has an over-permissive security group on, determine which security groups have over-permissive rules and to replace them with a copy of the security group that has only the over-permissive portion removed. Over-permissive is defined as sensitive ports (SSH, RDP, etc) being exposed to the internet via IPv4.
501+
playbookName: AWS - Security Group Remediation v2
502+
type: playbook
503+
iscommand: false
504+
brand: ""
505+
nexttasks:
506+
'#none#':
507+
- "4"
508+
scriptarguments:
509+
AWSAssumeArn:
510+
complex:
511+
root: alert.asmcloud
512+
accessor: project
513+
transformers:
514+
- operator: FirstArrayElement
515+
- operator: concat
516+
args:
517+
prefix:
518+
value:
519+
simple: 'arn:aws:iam::'
520+
suffix:
521+
value:
522+
simple: :role/
523+
- operator: concat
524+
args:
525+
prefix: {}
526+
suffix:
527+
value:
528+
simple: inputs.AWSAssumeRoleName
529+
iscontext: true
530+
InstanceID:
531+
complex:
532+
root: alert.asmsystemids
533+
filters:
534+
- - operator: isEqualString
535+
left:
536+
value:
537+
simple: alert.asmsystemids.type
538+
iscontext: true
539+
right:
540+
value:
541+
simple: ASSET-ID
542+
accessor: id
543+
Port:
544+
complex:
545+
root: alert
546+
accessor: remoteport
547+
Protocol:
548+
complex:
549+
root: alert
550+
accessor: protocol
551+
transformers:
552+
- operator: toLowerCase
553+
PublicIP:
554+
complex:
555+
root: alert
556+
accessor: remoteip
557+
separatecontext: true
558+
continueonerrortype: ""
559+
loop:
560+
iscommand: false
561+
exitCondition: ""
562+
wait: 1
563+
max: 100
564+
view: |-
565+
{
566+
"position": {
567+
"x": -550,
568+
"y": 670
569+
}
570+
}
571+
note: false
572+
timertriggers: []
573+
ignoreworker: false
574+
skipunavailable: true
575+
quietmode: 0
576+
isoversize: false
577+
isautoswitchedtoquietmode: false
450578
view: |-
451579
{
452580
"linkLabelsPosition": {},
453581
"paper": {
454582
"dimensions": {
455-
"height": 805,
456-
"width": 1680,
457-
"x": -200,
583+
"height": 875,
584+
"width": 2030,
585+
"x": -550,
458586
"y": 50
459587
}
460588
}
461589
}
462-
inputs: []
590+
inputs:
591+
- key: AWSAssumeRoleName
592+
value: {}
593+
required: false
594+
description: If assuming roles for AWS, this is the name of the role to assume (should be the same for all organizations)
595+
playbookInputQuery:
463596
outputs: []
464597
tests:
465598
- No tests (auto formatted)
466599
fromversion: 6.5.0
467-
contentitemexportablefields:
468-
contentitemfields: {}

‎Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_Remediation_README.md

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,9 @@ This playbook uses the following sub-playbooks, integrations, and scripts.
66

77
### Sub-playbooks
88

9-
* AWS - Unclaimed S3 Bucket Remediation
109
* GCP - Firewall Remediation
1110
* AWS - Security Group Remediation v2
11+
* AWS - Unclaimed S3 Bucket Remediation
1212
* Azure - Network Security Group Remediation
1313

1414
### Integrations
@@ -26,7 +26,10 @@ This playbook does not use any commands.
2626
## Playbook Inputs
2727

2828
---
29-
There are no inputs for this playbook.
29+
30+
| **Name** | **Description** | **Default Value** | **Required** |
31+
| --- | --- | --- | --- |
32+
| AWSAssumeRoleName | If assuming roles for AWS, this is the name of the role to assume \(should be the same for all organizations\) | | Optional |
3033

3134
## Playbook Outputs
3235

@@ -37,4 +40,4 @@ There are no outputs for this playbook.
3740

3841
---
3942

40-
![Cortex ASM - Remediation](../doc_files/Cortex_ASM_-_Remediation.png)
43+
![Cortex ASM - Remediation](../doc_files/Cortex_ASM_-_Remediation.png)

‎Packs/CortexAttackSurfaceManagement/ReleaseNotes/1_6_36.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
2+
#### Playbooks
3+
4+
##### Cortex ASM - Remediation
5+
6+
- Added the **AWSAssumeRoleName** optional input in case a roleArn needs to be passed in.

‎Packs/CortexAttackSurfaceManagement/doc_files/Cortex_ASM_-_Remediation.png

15.8 KB
Loading

‎Packs/CortexAttackSurfaceManagement/pack_metadata.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"name": "Cortex Attack Surface Management",
33
"description": "Content for working with Attack Surface Management (ASM).",
44
"support": "xsoar",
5-
"currentVersion": "1.6.35",
5+
"currentVersion": "1.6.36",
66
"author": "Cortex XSOAR",
77
"url": "https://www.paloaltonetworks.com/cortex",
88
"email": "",

0 commit comments

Comments
 (0)