Skip to content

Commit df51952

Browse files
idovandijkContent Bot
idovandijk
and
Content Bot
authored
Cloud iam enrichment review fixes (#30753)
* Added playbook with fixes * Formatted playbook and updated playbook readme * RN * Revert pb * Revert pb readme * newline * Added formatted playbook and updated playbook readme * Bump pack from version CommonPlaybooks to 2.4.15. * Bump pack from version CommonPlaybooks to 2.4.16. * Bump pack from version CommonPlaybooks to 2.4.17. * Bump pack from version CommonPlaybooks to 2.4.18. --------- Co-authored-by: Content Bot <[email protected]>
1 parent 08e2556 commit df51952

File tree

4 files changed

+72
-17
lines changed

4 files changed

+72
-17
lines changed

‎Packs/CommonPlaybooks/Playbooks/playbook-Cloud_IAM_Enrichment_-_Generic.yml

Lines changed: 43 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -67,10 +67,10 @@ tasks:
6767
isautoswitchedtoquietmode: false
6868
"6":
6969
id: "6"
70-
taskid: ee5711c0-603e-4de7-8bea-b19f6f61e124
70+
taskid: b8926391-3158-4b4e-880e-4c25beb4752f
7171
type: condition
7272
task:
73-
id: ee5711c0-603e-4de7-8bea-b19f6f61e124
73+
id: b8926391-3158-4b4e-880e-4c25beb4752f
7474
version: -1
7575
name: Select cloud provider
7676
description: Checks the cloud provider.
@@ -121,6 +121,11 @@ tasks:
121121
value:
122122
simple: active
123123
ignorecase: true
124+
- - operator: isNotEmpty
125+
left:
126+
value:
127+
simple: inputs.username
128+
iscontext: true
124129
- label: Azure
125130
condition:
126131
- - operator: isEqualString
@@ -196,6 +201,11 @@ tasks:
196201
value:
197202
simple: active
198203
ignorecase: true
204+
- - operator: isNotEmpty
205+
left:
206+
value:
207+
simple: inputs.username
208+
iscontext: true
199209
- label: GCP
200210
condition:
201211
- - operator: isEqualString
@@ -249,6 +259,11 @@ tasks:
249259
value:
250260
simple: active
251261
ignorecase: true
262+
- - operator: isNotEmpty
263+
left:
264+
value:
265+
simple: inputs.username
266+
iscontext: true
252267
continueonerrortype: ""
253268
view: |-
254269
{
@@ -1128,15 +1143,15 @@ outputs:
11281143
Arn
11291144
CreateDate
11301145
Path
1131-
PasswordLastUsed
1146+
PasswordLastUsed.
11321147
type: unknown
11331148
- contextPath: AWS.IAM.Users.AccessKeys
11341149
description: |-
11351150
AWS IAM Users Access Keys include:
11361151
AccessKeyId
11371152
Status
11381153
CreateDate
1139-
UserName
1154+
UserName.
11401155
type: unknown
11411156
- contextPath: GCPIAM
11421157
description: GCP IAM information.
@@ -1172,7 +1187,30 @@ outputs:
11721187
- contextPath: MSGraphGroup
11731188
description: MSGraph group information.
11741189
type: unknown
1190+
- contextPath: MSGraph.identityProtection.RiskyUserHistory
1191+
description: Risky user history.
1192+
type: unknown
1193+
- contextPath: MSGraph.identityProtection.RiskyUserHistory.userPrincipalName
1194+
description: Risky user principal name.
1195+
- contextPath: MSGraph.identityProtection.RiskyUserHistory.userDisplayName
1196+
description: Risky user display name.
1197+
- contextPath: MSGraph.identityProtection.RiskyUserHistory.riskDetail
1198+
description: Reason why the user is considered a risky user. The possible values are limited to none, adminGeneratedTemporaryPassword, userPerformedSecuredPasswordChange, userPerformedSecuredPasswordReset, adminConfirmedSigninSafe, aiConfirmedSigninSafe, userPassedMFADrivenByRiskBasedPolicy, adminDismissedAllRiskForUser, adminConfirmedSigninCompromised, hidden, adminConfirmedUserCompromised, and unknownFutureValue.
1199+
- contextPath: MSGraph.identityProtection.RiskyUserHistory.riskstate
1200+
description: State of the user's risk. The possible values are none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, and unknownFutureValue.
1201+
- contextPath: MSGraph.identityProtection.RiskyUserHistory.riskLevel
1202+
description: Risk level of the detected risky user. The possible values are low, medium, high, hidden, none, and unknownFutureValue.
1203+
- contextPath: MSGraph.identityProtection.RiskyUserHistory.riskLastUpdatedDateTime
1204+
description: The date and time that the risky user was last updated. The DateTimeOffset type represents date and time information using the ISO 8601 format and is always in UTC time.
1205+
- contextPath: MSGraph.identityProtection.RiskyUserHistory.isProcessing
1206+
description: Indicates whether a user's risky state is being processed by the backend.
1207+
- contextPath: MSGraph.identityProtection.RiskyUserHistory.isDeleted
1208+
description: Indicates whether the user is deleted.
1209+
- contextPath: MSGraph.identityProtection.RiskyUserHistory.id
1210+
description: Unique ID of the risky user.
11751211
quiet: true
11761212
tests:
11771213
- No tests (auto formatted)
1178-
fromversion: 6.8.0
1214+
fromversion: 6.8.0
1215+
contentitemexportablefields:
1216+
contentitemfields: {}

‎Packs/CommonPlaybooks/Playbooks/playbook-Cloud_IAM_Enrichment_-_Generic_README.md

Lines changed: 21 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -18,19 +18,19 @@ This playbook does not use any scripts.
1818

1919
### Commands
2020

21-
* aws-iam-get-user
22-
* gcp-iam-service-accounts-get
21+
* msgraph-identity-protection-risky-user-history-list
22+
* aws-iam-list-access-keys-for-user
2323
* gsuite-user-get
24-
* gcp-iam-service-account-keys-get
25-
* gcp-iam-project-role-list
24+
* aws-iam-get-user
2625
* gsuite-role-assignment-list
27-
* aws-iam-list-user-policies
2826
* aws-iam-list-groups-for-user
29-
* msgraph-user-get
30-
* msgraph-identity-protection-risky-user-history-list
31-
* msgraph-groups-list-groups
32-
* aws-iam-list-access-keys-for-user
3327
* aws-iam-list-attached-user-policies
28+
* gcp-iam-service-account-keys-get
29+
* gcp-iam-service-accounts-get
30+
* aws-iam-list-user-policies
31+
* msgraph-groups-list-groups
32+
* gcp-iam-project-role-list
33+
* msgraph-user-get
3434

3535
## Playbook Inputs
3636

@@ -49,8 +49,8 @@ This playbook does not use any scripts.
4949

5050
| **Path** | **Description** | **Type** |
5151
| --- | --- | --- |
52-
| AWS.IAM.Users | AWS AM Users include:<br/>UserId<br/>Arn<br/>CreateDate<br/>Path<br/>PasswordLastUsed | unknown |
53-
| AWS.IAM.Users.AccessKeys | AWS IAM Users Access Keys include:<br/>AccessKeyId<br/>Status<br/>CreateDate<br/>UserName | unknown |
52+
| AWS.IAM.Users | AWS AM Users include:<br/>UserId<br/>Arn<br/>CreateDate<br/>Path<br/>PasswordLastUsed. | unknown |
53+
| AWS.IAM.Users.AccessKeys | AWS IAM Users Access Keys include:<br/>AccessKeyId<br/>Status<br/>CreateDate<br/>UserName. | unknown |
5454
| GCPIAM | GCP IAM information. | unknown |
5555
| GSuite | GSuite user information. | unknown |
5656
| GSuite.PageToken | Token to specify the next page in the list. | unknown |
@@ -63,6 +63,16 @@ This playbook does not use any scripts.
6363
| AWS.IAM.UserPolicies | AWS IAM - user inline policies. | unknown |
6464
| AWS.IAM.AttachedUserPolicies | AWS IAM - User attached policies. | unknown |
6565
| MSGraphGroup | MSGraph group information. | unknown |
66+
| MSGraph.identityProtection.RiskyUserHistory | Risky user history. | unknown |
67+
| MSGraph.identityProtection.RiskyUserHistory.userPrincipalName | Risky user principal name. | unknown |
68+
| MSGraph.identityProtection.RiskyUserHistory.userDisplayName | Risky user display name. | unknown |
69+
| MSGraph.identityProtection.RiskyUserHistory.riskDetail | Reason why the user is considered a risky user. The possible values are limited to none, adminGeneratedTemporaryPassword, userPerformedSecuredPasswordChange, userPerformedSecuredPasswordReset, adminConfirmedSigninSafe, aiConfirmedSigninSafe, userPassedMFADrivenByRiskBasedPolicy, adminDismissedAllRiskForUser, adminConfirmedSigninCompromised, hidden, adminConfirmedUserCompromised, and unknownFutureValue. | unknown |
70+
| MSGraph.identityProtection.RiskyUserHistory.riskstate | State of the user's risk. The possible values are none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, and unknownFutureValue. | unknown |
71+
| MSGraph.identityProtection.RiskyUserHistory.riskLevel | Risk level of the detected risky user. The possible values are low, medium, high, hidden, none, and unknownFutureValue. | unknown |
72+
| MSGraph.identityProtection.RiskyUserHistory.riskLastUpdatedDateTime | The date and time that the risky user was last updated. The DateTimeOffset type represents date and time information using the ISO 8601 format and is always in UTC time. | unknown |
73+
| MSGraph.identityProtection.RiskyUserHistory.isProcessing | Indicates whether a user's risky state is being processed by the backend. | unknown |
74+
| MSGraph.identityProtection.RiskyUserHistory.isDeleted | Indicates whether the user is deleted. | unknown |
75+
| MSGraph.identityProtection.RiskyUserHistory.id | Unique ID of the risky user. | unknown |
6676

6777
## Playbook Image
6878

‎Packs/CommonPlaybooks/ReleaseNotes/2_4_18.md

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
2+
#### Playbooks
3+
4+
##### Cloud IAM Enrichment - Generic
5+
6+
- Fixed an issue where the playbook would attempt to enrich users even when the username input was empty.
7+
- Added additional sub-outputs related to the risky user history to the declared outputs of the playbook.

‎Packs/CommonPlaybooks/pack_metadata.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"name": "Common Playbooks",
33
"description": "Frequently used playbooks pack.",
44
"support": "xsoar",
5-
"currentVersion": "2.4.17",
5+
"currentVersion": "2.4.18",
66
"author": "Cortex XSOAR",
77
"url": "https://www.paloaltonetworks.com/cortex",
88
"email": "",

0 commit comments

Comments
 (0)