- What are Dome9 CloudBots?
What are Dome9 CloudBots?
Dome9 CloudBots are an autoremediation solution for GCP, built on top of the CloudGuard Dome9 Continuous Compliance capabilities.
They can also be used standalone, without Dome9, to remedy issues in AWS and Azure accounts. Details are included how to configure and trigger them.
Refer to this file for a list of the bots, what each one does, and an example of a rule that could be used to trigger it.
- Download ZIP (The GCP Function will require the content zipped).
- If you cloned the repository make sure to Zip the contents.
Create GCP Service Account for cloudbots
- In the GCP console, navigate to IAM & admin, and then select Service accounts.
- Click CREATE SERVICE ACCOUNT to add a service account.
- Enter a name (e.g., Dome9-cloudbots)
- In the Service Account ID field, the name of the service account will be used for the Cloud Function (in the previous step).
- Click Create.
- Navigate to sendgrid.com
- Create a new account, following the instructions on the site.
- Navigate to Settings, and then select API Keys.
- Click Create API Key.
- Enter a name for the key (e.g., Dome9-cloudbots, an select Full Access.
- Click Create Key, then copy the value of the key.
- Click Done.
Create a GCP Function with the CloudBots
- Navigate to Cloud Functions.
- Click CREATE FUNCTION.
- Enter a name for the function (e.g., Dome9-Cloudbot).
- Make sure the Trigger is HTTP.
- In the Source Code section, select ZIP upload.
- In the Runtime section, select Python 3.7.
- In the ZIP file section, browse to the location of zip file created before.
- In the Stage bucket section, click Browse.
- Click +, enter a name for the bucket, and then click CREATE.
- In the Function to execute section, enter main.
- Click Environment variables, networking, timeouts and more at the bottom of the navigation menu, on the left.
- In the Service account field, select the account created above.
- In the Environment variables section, click Add variable, and add the following variables:
- SEND_GRID_API_CLIENT - enter to SendGrid API Key, created above.
- OUPTPUT_EMAIL - the email recipient (for notification emails, generated with SendGrid).
- SEND_LOGS - set to True to send log information to Dome9, for troubleshooting; False to disable this (default is True).
- Click CREATE to create the function for the cloudbots.
Webhook for Function
The cloudbot function in GCP is triggered from Dome9 using a webhook. For this, the URL of the function is required.
- Click on the Cloud Function you created.
- Copy the URL for Dome9 Notification.
You can use CloudBots for several GCP projects, but install it in only one project. The other projects will be accessed from the first by granting IAM permissions.
- Create a GCP Function in one of the GCP projects, following the steps above.
- For each of the other projects, navigate to IAM & admin, and select IAM.
On Dome9 add remediation tags to rules in a Compliance ruleset.
Configure a Dome9 Compliance Ruleset
CloudBots are triggered by findings discovered by Dome9 Compliance rulesets. You must configure a ruleset to trigger the CloudBots.
Follow these steps in your Dome9 account to tag the compliance rules & rulesets to use bots as a remediation step.
In the Dome9 console, navigate to the Rulesets page in the Compliance & Governance menu.
Select the rules for which you want to add a remediation step.
In the Compliance Section add a row with the following string:
AUTO: <bot-name> <params>where bot-name is the name of the bot, and params is a list of arguments for the bot (if any).
AUTO: vm_instance_stopwill run the bot to stop a VM instance.
Configure a Dome9 Continuous Compliance policy
Once the rules in the ruleset have been tagged for remediation, set up a Continuous Compliance policy to run the ruleset, and send findings the GCP function webhook.
- Navigate to the Policies page in the Compliance & Governance menu.
- Click ADD POLICY (on the right).
- Select the account from the list, then click NEXT, this will be the one account in which the bots are deployed.
- Select the ruleset from the list, then click NEXT.
- Click ADD NOTIFICATION.
- Select Webhook integration and enter the URL for the Function, as described above Webhook for Function, and then click SAVE.
Note: Dome9 will send event messages to the webhook for new findings. To send events for previous findings, follow these steps:
- Navigate to the Policies page.
- Find the ruleset and account in the list, and hover over the right of the row, then click on the Send All Alerts icon.
- Select the webhook Notification Type option, and the Notification Policy (the one created above), then click SEND. Dome9 will send event messages to the GCP function webhook.
Log Collection for Troubleshooting
The cloudbots send log information to Dome9, that is used for troubleshooting. By default, this is enabled for all bots. You can disable this in your GCP account. Select the function, and set the environment variable SEND_LOGS to False. This will apply to all bots in the account. By default, this is set to True, enabling logs.
Each account is controlled by the variable for the function configured in that account.