- What are CloudGuard CloudBots?
- Flow Diagram
- Deploy the CloudBots
- Configure your GCP Projects for CloudBots
- Multiple GCP Accounts
- Configure your CloudGuard account
- Log Collection for Troubleshooting
- What are CloudGuard CloudBots?
What are CloudGuard CloudBots?
CloudGuard CloudBots are an autoremediation solution for GCP, built on top of the CloudGuard CloudGuard Continuous Compliance capabilities.
They can also be used standalone, without Dome9, to remedy issues in AWS and Azure accounts. Details are included how to configure and trigger them.
Refer to this file for a list of the bots, what each one does, and an example of a rule that could be used to trigger it.
Deploy the CloudBots
To use the CloudBots, you have to set up your GCP project, and your CloudGuard account.
Configure your GCP Projects for CloudBots
Follow these steps to configure your GCP Projects:
- download the CloudBots zip file
- Create a GCP Service Account
- Optionally, configure SendGrid to forward notifications by email
- Create a GCP Function for the CloudBots
Download the CloudBots zip file
- Download the CloudBots zip file from this repository (The GCP Function will require the content zipped).
- If you cloned the repository, zip the contents.
Create GCP Service Account for cloudbots
- In the GCP console, navigate to IAM & admin, and then select Service accounts.
- Click CREATE SERVICE ACCOUNT to add a service account.
- Enter a name (e.g., Dome9-cloudbots)
- In the Service Account ID field, the name of the service account will be used for the Cloud Function (in the previous step).
- Click Create.
This step is optional.
- Navigate to sendgrid.com
- Create a new account, following the instructions on the site.
- Navigate to Settings, and then select API Keys.
- Click Create API Key.
- Enter a name for the key (e.g., Dome9-cloudbots, an select Full Access.
- Click Create Key, then copy the value of the key.
- Click Done.
Create a GCP Function with the CloudBots
- Navigate to Cloud Functions.
- Click CREATE FUNCTION.
- Enter a name for the function (e.g., Dome9-Cloudbot).
- Make sure the Trigger is HTTP.
- In the Source Code section, select ZIP upload.
- In the Runtime section, select Python 3.7.
- In the ZIP file section, browse to the location of zip file created before.
- In the Stage bucket section, click Browse.
- Click +, enter a name for the bucket, and then click CREATE.
- In the Function to execute section, enter main.
- Click Environment variables, networking, timeouts and more at the bottom of the navigation menu, on the left.
- In the Service account field, select the account created above.
- In the Environment variables section, click Add variable, and add
the following variables:
- SEND_GRID_API_CLIENT - enter to SendGrid API Key, created above.
- OUPTPUT_EMAIL - the email recipient (for notification emails, generated with SendGrid).
- SEND_LOGS - set to True to send log information to Dome9, for troubleshooting; False to disable this (default is True).
- Click CREATE to create the function for the cloudbots.
Webhook for Function
The cloudbot function in GCP is triggered from CloudGuard using a webhook. For this, the URL of the function is required.
- Click on the Cloud Function you created.
- Copy the URL for CloudGuard Notification.
Multiple GCP Accounts
You can use CloudBots for several GCP projects, but install it in only one project. The other projects will be accessed from the first by granting IAM permissions.
- Create a GCP Function in one of the GCP projects, following the steps above.
- For each of the other projects, navigate to IAM & admin, and select IAM.
Configure your CloudGuard account
On CloudGuard add remediation tags to rules in a Compliance ruleset.
Configure a CloudGuard Compliance Ruleset
CloudBots are triggered by findings discovered by CloudGuard Compliance rulesets. You must configure a ruleset to trigger the CloudBots.
Follow these steps in your CloudGuard account to tag the compliance rules & rulesets to use bots as a remediation step.
In the CloudGuard web app, navigate to the Rulesets page in the Compliance & Governance menu.
Select or create a ruleset that will be used for the cloudbots.
Select the rules for which you want to add a remediation step.
In the Compliance Section add a row with the following string:
AUTO: <bot-name> <params>where bot-name is the name of the bot, and params is a list of arguments for the bot (if any).
AUTO: vm_instance_stopwill run the bot to stop a VM instance.
Configure a CloudGuard Continuous Compliance policy
Once the rules in the ruleset have been tagged for remediation, set up a Continuous Compliance policy to run the ruleset, and send findings the GCP function webhook.
- Navigate to the Policies page in the Compliance & Governance menu.
- Click ADD POLICY (on the right).
- Select the account from the list, then click NEXT, this will be the one account in which the bots are deployed.
- Select the ruleset from the list, then click NEXT.
- Click ADD NOTIFICATION.
- Select Send to HTTP Endpoint and enter the URL for the Function, as described above Webhook for Function, and then click SAVE.
Note: CloudGuard will send event messages to the webhook for new findings. To send events for previous findings, follow these steps:
- Navigate to the Policies page.
- Find the ruleset and account in the list, and hover over the right of the row, then click on the Send All Alerts icon.
- Select the webhook Notification Type option, and the Notification Policy (the one created above), then click SEND. CloudGuard will send event messages to the GCP function webhook.
Log Collection for Troubleshooting
The cloudbots send log information to CloudGuard, that is used for troubleshooting. By default, this is enabled for all bots. You can disable this in your GCP account. Select the function, and set the environment variable SEND_LOGS to False. This will apply to all bots in the account. By default, this is set to True, enabling logs.
Each account is controlled by the variable for the function configured in that account.