Azure_-_Network_Security_Group_Remediation.yml

id: Azure - Network Security Group Remediation
version: -1
name: Azure - Network Security Group Remediation
description: |-
  This playbook adds new Azure Network Security Groups (NSG) rules to NSGs attached to a NIC. The new rules will give access only to a private IP address range and block traffic that's exposed to the public internet ([using the private IP of the VM as stated in Azure documentation](https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview)). For example, if RDP is exposed to the public internet, this playbook adds new firewall rules that only allows traffic from private IP address and blocks the rest of the RDP traffic.

  Conditions and limitations:
  - Limited to one resource group.
  - 200 Azure rules viewed at once to find offending rule.
  - 2 priorities lower than the offending rule priority must be available.
  - Adds rules to NSGs associated to NICs.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 6ce17739-3f39-4681-8310-fd45ba54b9bb
    type: start
    task:
      id: 6ce17739-3f39-4681-8310-fd45ba54b9bb
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 510,
          "y": -700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 1adc8ea1-823e-440b-82da-b83a8d7451d2
    type: regular
    task:
      id: 1adc8ea1-823e-440b-82da-b83a8d7451d2
      version: -1
      name: Retrieve Rules from NSG Associated to Public IP
      description: List all rules of the specified security groups.
      script: Azure Network Security Groups|||azure-nsg-security-rules-list
      type: regular
      iscommand: true
      brand: Azure Network Security Groups
    nexttasks:
      '#none#':
      - "22"
    scriptarguments:
      limit:
        simple: "200"
      offset:
        simple: "1"
      security_group_name:
        simple: ${inputs.AzureSecurityGroup}
      resource_group_name:
        complex:
          root: inputs.ResourceGroup
          transformers:
          - args:
              applyIfEmpty: {}
              defaultValue: {}
            operator: SetIfEmpty
      subscription_id:
        complex:
          root: inputs.SubscriptionID
          transformers:
          - args:
              applyIfEmpty: {}
              defaultValue: {}
            operator: SetIfEmpty
      using:
        simple: ${inputs.instance_name}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 510,
          "y": -380
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 55bbd540-d880-4a5a-8a0a-4cb49be396ba
    type: condition
    task:
      id: 55bbd540-d880-4a5a-8a0a-4cb49be396ba
      version: -1
      name: Is Azure Network Security Groups and Input Value Defined?
      description: Determines if the Azure Network Security Groups integration instance is configured and input values are defined to pull in data required for remediation.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "47"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: containsGeneral
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Azure Network Security Groups
                - - operator: containsGeneral
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 510,
          "y": -570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 7482a072-0101-4618-83f9-1dd8189b715e
    type: title
    task:
      id: 7482a072-0101-4618-83f9-1dd8189b715e
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 710,
          "y": 2410
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: 8b08e2be-7090-4530-8d81-840e906cbbff
    type: condition
    task:
      id: 8b08e2be-7090-4530-8d81-840e906cbbff
      version: -1
      name: Does offending rule exist?
      description: Checks whether the last command returned rules or not.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "47"
      "yes":
      - "43"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: AzureNSG.Rule
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: AzureNSG.Rule.access
                      iscontext: true
                    right:
                      value:
                        simple: Allow
                - - operator: isEqualString
                    left:
                      value:
                        simple: AzureNSG.Rule.direction
                      iscontext: true
                    right:
                      value:
                        simple: Inbound
                - - operator: isEqualString
                    left:
                      value:
                        simple: AzureNSG.Rule.destinationPortRange
                      iscontext: true
                    right:
                      value:
                        simple: inputs.RemotePort
                      iscontext: true
                  - left:
                      iscontext: true
                      value:
                        simple: AzureNSG.Rule.destinationPortRange
                    operator: isEqualString
                    right:
                      value:
                        simple: '*'
                - - operator: isEqualString
                    left:
                      value:
                        simple: AzureNSG.Rule.protocol
                      iscontext: true
                    right:
                      value:
                        simple: inputs.RemoteProtocol
                      iscontext: true
                  - left:
                      iscontext: true
                      value:
                        simple: AzureNSG.Rule.protocol
                    operator: isEqualString
                    right:
                      value:
                        simple: '*'
                - - operator: isEqualString
                    left:
                      value:
                        simple: AzureNSG.Rule.sourceAddressPrefix
                      iscontext: true
                    right:
                      value:
                        simple: '*'
                  - operator: isEqualString
                    left:
                      value:
                        simple: AzureNSG.Rule.sourceAddressPrefix
                      iscontext: true
                    right:
                      value:
                        simple: Internet
                  - left:
                      iscontext: true
                      value:
                        simple: AzureNSG.Rule.sourceAddressPrefix
                    operator: isEqualString
                    right:
                      value:
                        simple: 0.0.0.0/0
                transformers:
                - operator: getField
                  args:
                    field:
                      value:
                        simple: name
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 510,
          "y": -220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "30":
    id: "30"
    taskid: 84c801f2-2f65-4cac-851c-50e9feabd680
    type: title
    task:
      id: 84c801f2-2f65-4cac-851c-50e9feabd680
      version: -1
      name: Retrieve and Update Allow Rule
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "31"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 250,
          "y": 890
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "31":
    id: "31"
    taskid: 7f84ef2a-e391-4f94-828f-3eff285e8fd3
    type: regular
    task:
      id: 7f84ef2a-e391-4f94-828f-3eff285e8fd3
      version: -1
      name: Set variable for existing allow rule name
      description: Set a variable for the existing allow rule.
      type: regular
      iscommand: false
      brand: ""
      script: Set
    nexttasks:
      '#none#':
      - "32"
    scriptarguments:
      key:
        simple: existingAllowRule
      value:
        complex:
          root: AzureNSG.Rule
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: AzureNSG.Rule.direction
                iscontext: true
              right:
                value:
                  simple: Inbound
          - - operator: isEqualString
              left:
                value:
                  simple: AzureNSG.Rule.access
                iscontext: true
              right:
                value:
                  simple: Allow
          - - operator: containsGeneral
              left:
                value:
                  simple: AzureNSG.Rule.name
                iscontext: true
              right:
                value:
                  simple: remediation-allow-port
          - - operator: containsGeneral
              left:
                value:
                  simple: AzureNSG.Rule.name
                iscontext: true
              right:
                value:
                  simple: ${inputs.RemotePort}
                iscontext: true
          - - operator: containsGeneral
              left:
                value:
                  simple: AzureNSG.Rule.name
                iscontext: true
              right:
                value:
                  simple: ${inputs.RemoteProtocol}
                iscontext: true
          - - operator: notContainsGeneral
              left:
                value:
                  simple: AzureNSG.Rule.destinationAddressPrefix
                iscontext: true
              right:
                value:
                  simple: ${inputs.AzureVMPrivateIP}
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 250,
          "y": 1030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "32":
    id: "32"
    taskid: b5146806-4b94-4d33-8277-5ea7d3e51bdf
    type: regular
    task:
      id: b5146806-4b94-4d33-8277-5ea7d3e51bdf
      version: -1
      name: Update existing remediation allow rule
      description: |-
        Update an existing security allow rule that denies all internet traffic to exposed public IPs (using the private IP) with an additional public IP (using the private IP). If one does not exist, it will be created.

        Private IPs are used in NSG rules in place of public IPs, as explained in [Microsoft Azure's documentation](https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview).
      script: Azure Network Security Groups|||azure-nsg-security-rule-update
      type: regular
      iscommand: true
      brand: Azure Network Security Groups
    nexttasks:
      '#none#':
      - "34"
    scriptarguments:
      destination:
        complex:
          root: existingAllowRule
          accessor: destinationAddressPrefix
          transformers:
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ','
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ${inputs.AzureVMPrivateIP}
                iscontext: true
      security_group_name:
        complex:
          root: inputs.AzureSecurityGroup
      security_rule_name:
        complex:
          root: existingAllowRule
          accessor: name
      resource_group_name:
        complex:
          root: inputs.ResourceGroup
          transformers:
          - args:
              applyIfEmpty: {}
              defaultValue: {}
            operator: SetIfEmpty
      subscription_id:
        complex:
          root: inputs.SubscriptionID
          transformers:
          - args:
              applyIfEmpty: {}
              defaultValue: {}
            operator: SetIfEmpty
      using:
        simple: ${inputs.instance_name}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 250,
          "y": 1195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "34":
    id: "34"
    taskid: e405270b-7ea3-416b-8c2e-526ae28552f3
    type: condition
    task:
      id: e405270b-7ea3-416b-8c2e-526ae28552f3
      version: -1
      name: Does remediation deny rule exist?
      description: Determines whether a remediation deny rule already exists or not.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "45"
      Update:
      - "35"
      "yes":
      - "46"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: AzureNSG.Rule
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: AzureNSG.Rule.access
                      iscontext: true
                    right:
                      value:
                        simple: Allow
                - - operator: containsGeneral
                    left:
                      value:
                        simple: AzureNSG.Rule.name
                      iscontext: true
                    right:
                      value:
                        simple: remediation-deny-port
                - - operator: containsGeneral
                    left:
                      value:
                        simple: AzureNSG.Rule.name
                      iscontext: true
                    right:
                      value:
                        simple: ${inputs.RemotePort}
                      iscontext: true
                - - operator: containsGeneral
                    left:
                      value:
                        simple: AzureNSG.Rule.name
                      iscontext: true
                    right:
                      value:
                        simple: ${inputs.RemoteProtocol}
                      iscontext: true
                - - operator: containsGeneral
                    left:
                      value:
                        simple: AzureNSG.Rule.destinationAddressPrefix
                      iscontext: true
                    right:
                      value:
                        simple: ${inputs.AzureVMPrivateIP}
                      iscontext: true
                transformers:
                - operator: getField
                  args:
                    field:
                      value:
                        simple: name
            iscontext: true
          right:
            value: {}
    - label: Update
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: AzureNSG.Rule
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: AzureNSG.Rule.access
                      iscontext: true
                    right:
                      value:
                        simple: Allow
                - - operator: containsGeneral
                    left:
                      value:
                        simple: AzureNSG.Rule.name
                      iscontext: true
                    right:
                      value:
                        simple: remediation-allow-port
                - - operator: containsGeneral
                    left:
                      value:
                        simple: AzureNSG.Rule.name
                      iscontext: true
                    right:
                      value:
                        simple: ${inputs.RemotePort}
                      iscontext: true
                - - operator: containsGeneral
                    left:
                      value:
                        simple: AzureNSG.Rule.name
                      iscontext: true
                    right:
                      value:
                        simple: ${inputs.RemoteProtocol}
                      iscontext: true
                - - operator: notContainsGeneral
                    left:
                      value:
                        simple: AzureNSG.Rule.destinationAddressPrefix
                      iscontext: true
                    right:
                      value:
                        simple: ${inputs.AzureVMPrivateIP}
                      iscontext: true
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 510,
          "y": 1365
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "35":
    id: "35"
    taskid: 3bbfdb59-7718-4513-8c30-c076faad9bc4
    type: title
    task:
      id: 3bbfdb59-7718-4513-8c30-c076faad9bc4
      version: -1
      name: Retrieve and Update Allow Rule
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "36"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 510,
          "y": 1585
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "36":
    id: "36"
    taskid: 3c54060e-7e7a-4245-84e3-ea6116775c5c
    type: regular
    task:
      id: 3c54060e-7e7a-4245-84e3-ea6116775c5c
      version: -1
      name: Set variable for existing deny rule name
      description: Set a variable for the existing deny rule.
      type: regular
      iscommand: false
      brand: ""
      script: Set
    nexttasks:
      '#none#':
      - "37"
    scriptarguments:
      key:
        simple: existingDenyRule
      value:
        complex:
          root: AzureNSG.Rule
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: AzureNSG.Rule.direction
                iscontext: true
              right:
                value:
                  simple: Inbound
          - - operator: isEqualString
              left:
                value:
                  simple: AzureNSG.Rule.access
                iscontext: true
              right:
                value:
                  simple: Deny
          - - operator: containsGeneral
              left:
                value:
                  simple: AzureNSG.Rule.name
                iscontext: true
              right:
                value:
                  simple: remediation-deny-port
          - - operator: containsGeneral
              left:
                value:
                  simple: AzureNSG.Rule.name
                iscontext: true
              right:
                value:
                  simple: "3389"
          - - operator: containsGeneral
              left:
                value:
                  simple: AzureNSG.Rule.name
                iscontext: true
              right:
                value:
                  simple: TCP
          - - operator: notContainsGeneral
              left:
                value:
                  simple: AzureNSG.Rule.destinationAddressPrefix
                iscontext: true
              right:
                value:
                  simple: ${inputs.AzureVMPrivateIP}
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 510,
          "y": 1720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "37":
    id: "37"
    taskid: 1a7d4cac-6979-4cf3-8705-ec356925dda6
    type: regular
    task:
      id: 1a7d4cac-6979-4cf3-8705-ec356925dda6
      version: -1
      name: Update existing remediation deny rule
      description: |-
        Update an existing security rule that denies all internet traffic to exposed public IPs (using the private IP) with an additional public IP (using the private IP). If one does not exist, it will be created.

        Private IPs are used in NSG rules in place of public IPs, as explained in [Microsoft Azure's documentation](https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview).
      script: Azure Network Security Groups|||azure-nsg-security-rule-update
      type: regular
      iscommand: true
      brand: Azure Network Security Groups
    nexttasks:
      '#none#':
      - "46"
    scriptarguments:
      destination:
        complex:
          root: existingDenyRule
          accessor: destinationAddressPrefix
          transformers:
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ','
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ${inputs.AzureVMPrivateIP}
                iscontext: true
      security_group_name:
        complex:
          root: inputs.AzureSecurityGroup
      security_rule_name:
        complex:
          root: existingDenyRule
          accessor: name
      resource_group_name:
        complex:
          root: inputs.ResourceGroup
          transformers:
          - args:
              applyIfEmpty: {}
              defaultValue: {}
            operator: SetIfEmpty
      subscription_id:
        complex:
          root: inputs.SubscriptionID
          transformers:
          - args:
              applyIfEmpty: {}
              defaultValue: {}
            operator: SetIfEmpty
      using:
        simple: ${inputs.instance_name}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 510,
          "y": 1880
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "38":
    id: "38"
    taskid: e982f863-79e1-4b9e-8916-38eafb22159e
    type: condition
    task:
      id: e982f863-79e1-4b9e-8916-38eafb22159e
      version: -1
      name: Does remediation allow rule exist?
      description: Determines whether a remediation allow rule already exists or not.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "39"
      Update:
      - "30"
      "yes":
      - "34"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: AzureNSG.Rule
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: AzureNSG.Rule.access
                      iscontext: true
                    right:
                      value:
                        simple: Allow
                - - operator: containsGeneral
                    left:
                      value:
                        simple: AzureNSG.Rule.name
                      iscontext: true
                    right:
                      value:
                        simple: remediation-allow-port
                - - operator: containsGeneral
                    left:
                      value:
                        simple: AzureNSG.Rule.name
                      iscontext: true
                    right:
                      value:
                        simple: ${inputs.RemotePort}
                      iscontext: true
                - - operator: containsGeneral
                    left:
                      value:
                        simple: AzureNSG.Rule.name
                      iscontext: true
                    right:
                      value:
                        simple: ${inputs.RemoteProtocol}
                      iscontext: true
                - - operator: containsGeneral
                    left:
                      value:
                        simple: AzureNSG.Rule.destinationAddressPrefix
                      iscontext: true
                    right:
                      value:
                        simple: ${inputs.AzureVMPrivateIP}
                      iscontext: true
                transformers:
                - operator: getField
                  args:
                    field:
                      value:
                        simple: name
            iscontext: true
          right:
            value: {}
    - label: Update
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: AzureNSG.Rule
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: AzureNSG.Rule.access
                      iscontext: true
                    right:
                      value:
                        simple: Allow
                - - operator: containsGeneral
                    left:
                      value:
                        simple: AzureNSG.Rule.name
                      iscontext: true
                    right:
                      value:
                        simple: remediation-allow-port
                - - operator: containsGeneral
                    left:
                      value:
                        simple: AzureNSG.Rule.name
                      iscontext: true
                    right:
                      value:
                        simple: ${inputs.RemotePort}
                      iscontext: true
                - - operator: containsGeneral
                    left:
                      value:
                        simple: AzureNSG.Rule.name
                      iscontext: true
                    right:
                      value:
                        simple: ${inputs.RemoteProtocol}
                      iscontext: true
                - - operator: notContainsGeneral
                    left:
                      value:
                        simple: AzureNSG.Rule.destinationAddressPrefix
                      iscontext: true
                    right:
                      value:
                        simple: ${inputs.AzureVMPrivateIP}
                      iscontext: true
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 510,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "39":
    id: "39"
    taskid: 62d2b0b1-5d6c-4218-86c9-2b8babd7b23d
    type: title
    task:
      id: 62d2b0b1-5d6c-4218-86c9-2b8babd7b23d
      version: -1
      name: Create Allow Rule
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "42"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 780,
          "y": 890
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "40":
    id: "40"
    taskid: 9bb91f4f-7790-482c-8671-d9e0b22bdf49
    type: regular
    task:
      id: 9bb91f4f-7790-482c-8671-d9e0b22bdf49
      version: -1
      name: Create list of priorities of all returned Azure rules
      description: Creates a list of priorities from the list of rules found.
      type: regular
      iscommand: false
      brand: ""
      script: Set
    nexttasks:
      '#none#':
      - "41"
    scriptarguments:
      key:
        simple: prioritiesAzureRules
      value:
        complex:
          root: AzureNSG.Rule
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: AzureNSG.Rule.direction
                iscontext: true
              right:
                value:
                  simple: Inbound
          accessor: priority
          transformers:
          - operator: sort
            args:
              descending: {}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 510,
          "y": 400
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "41":
    id: "41"
    taskid: fa68287b-bca8-4561-8034-1383ce60869a
    type: regular
    task:
      id: fa68287b-bca8-4561-8034-1383ce60869a
      version: -1
      name: Retrieve available priorities
      description: This script takes in a list of numbers that represent Azure priorities for NSG rules, a target priority number, and a number available priorities to return available priorities from the provided list.
      type: regular
      iscommand: false
      brand: ""
      script: AzureFindAvailableNSGPriorities
    nexttasks:
      '#none#':
      - "38"
    scriptarguments:
      list_of_priorities_from_rules:
        simple: ${prioritiesAzureRules}
      number_of_available_priorities_to_retrieve:
        simple: "2"
      target_rule_priority:
        simple: ${azureOffendingRulePriority}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 510,
          "y": 560
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "42":
    id: "42"
    taskid: f871b58d-6155-4b03-880a-1889551b6b00
    type: regular
    task:
      id: f871b58d-6155-4b03-880a-1889551b6b00
      version: -1
      name: Add allow rule for port ${inputs.RemotePort} and ${inputs.RemoteProtocol}
      description: |-
        Create a security allow rule that denies all internet traffic to exposed public IPs (using the private IP) with an additional public IP (using the private IP). If one does not exist, it will be created.

        Private IPs are used in NSG rules in place of public IPs, as explained in [Microsoft Azure's documentation](https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview).
      script: Azure Network Security Groups|||azure-nsg-security-rule-create
      type: regular
      iscommand: true
      brand: Azure Network Security Groups
    nexttasks:
      '#none#':
      - "34"
    scriptarguments:
      action:
        simple: Allow
      destination:
        complex:
          root: ${inputs
          accessor: AzureVMPrivateIP}
      destination_ports:
        complex:
          root: inputs.RemotePort
      direction:
        simple: Inbound
      priority:
        complex:
          root: AvailableAzureNSGPriorities
          transformers:
          - operator: atIndex
            args:
              index:
                value:
                  simple: "1"
      protocol:
        complex:
          root: inputs.RemoteProtocol
      security_group_name:
        complex:
          root: inputs.AzureSecurityGroup
      security_rule_name:
        complex:
          root: inputs.RemotePort
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: remediation-allow-port-
              suffix:
                value:
                  simple: '-'
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ${inputs.RemoteProtocol}
                iscontext: true
      source:
        simple: ${inputs.RemediationAllowRanges}
      resource_group_name:
        complex:
          root: inputs.ResourceGroup
          transformers:
          - args:
              applyIfEmpty: {}
              defaultValue: {}
            operator: SetIfEmpty
      subscription_id:
        complex:
          root: inputs.SubscriptionID
          transformers:
          - args:
              applyIfEmpty: {}
              defaultValue: {}
            operator: SetIfEmpty
      using:
        simple: ${inputs.instance_name}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 780,
          "y": 1020
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "43":
    id: "43"
    taskid: c98dc204-241c-4c23-8de5-f9e778ac7395
    type: regular
    task:
      id: c98dc204-241c-4c23-8de5-f9e778ac7395
      version: -1
      name: Set variable for offending rule priority
      description: Sets variable for the offending rule priority in the list of rules returned.
      type: regular
      iscommand: false
      brand: ""
      script: Set
    nexttasks:
      '#none#':
      - "48"
    scriptarguments:
      key:
        simple: azureOffendingRulePriority
      value:
        complex:
          root: AzureNSG.Rule
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: AzureNSG.Rule.direction
                iscontext: true
              right:
                value:
                  simple: Inbound
          - - operator: isEqualString
              left:
                value:
                  simple: AzureNSG.Rule.destinationPortRange
                iscontext: true
              right:
                value:
                  simple: inputs.RemotePort
                iscontext: true
            - left:
                iscontext: true
                value:
                  simple: AzureNSG.Rule.destinationPortRange
              operator: isEqualString
              right:
                value:
                  simple: '*'
          - - operator: isEqualString
              left:
                value:
                  simple: AzureNSG.Rule.protocol
                iscontext: true
              right:
                value:
                  simple: inputs.RemoteProtocol
                iscontext: true
            - left:
                iscontext: true
                value:
                  simple: AzureNSG.Rule.protocol
              operator: isEqualString
              right:
                value:
                  simple: '*'
          - - operator: isEqualString
              left:
                value:
                  simple: AzureNSG.Rule.sourceAddressPrefix
                iscontext: true
              right:
                value:
                  simple: '*'
            - left:
                iscontext: true
                value:
                  simple: AzureNSG.Rule.sourceAddressPrefix
              operator: isEqualString
              right:
                value:
                  simple: Internet
            - left:
                iscontext: true
                value:
                  simple: AzureNSG.Rule.sourceAddressPrefix
              operator: isEqualString
              right:
                value:
                  simple: 0.0.0.0/0
          - - operator: isEqualString
              left:
                value:
                  simple: AzureNSG.Rule.access
                iscontext: true
              right:
                value:
                  simple: Allow
          transformers:
          - operator: getField
            args:
              field:
                value:
                  simple: priority
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 510,
          "y": -40
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "44":
    id: "44"
    taskid: 76be7dd2-448b-47b5-8ad1-8e5197e74bc8
    type: regular
    task:
      id: 76be7dd2-448b-47b5-8ad1-8e5197e74bc8
      version: -1
      name: Add block rule for port ${inputs.RemotePort}
      description: |-
        Create a security rule that denies all internet traffic to exposed public IPs (using the private IP) with an additional public IP (using the private IP). If one does not exist, it will be created.

        Private IPs are used in NSG rules in place of public IPs, as explained in [Microsoft Azure's documentation](https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview).
      script: Azure Network Security Groups|||azure-nsg-security-rule-create
      type: regular
      iscommand: true
      brand: Azure Network Security Groups
    nexttasks:
      '#none#':
      - "46"
    scriptarguments:
      action:
        simple: Deny
      destination:
        complex:
          root: inputs.AzureVMPrivateIP
      destination_ports:
        complex:
          root: inputs.RemotePort
      direction:
        simple: Inbound
      priority:
        complex:
          root: AvailableAzureNSGPriorities
          transformers:
          - operator: atIndex
            args:
              index:
                value:
                  simple: "0"
      protocol:
        complex:
          root: inputs.RemoteProtocol
      security_group_name:
        complex:
          root: inputs.AzureSecurityGroup
      security_rule_name:
        complex:
          root: inputs.RemotePort
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: remediation-deny-port-
              suffix:
                value:
                  simple: '-'
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ${inputs.RemoteProtocol}
      source:
        simple: Internet
      source_ports:
        simple: '*'
      resource_group_name:
        complex:
          root: inputs.ResourceGroup
          transformers:
          - args:
              applyIfEmpty: {}
              defaultValue: {}
            operator: SetIfEmpty
      subscription_id:
        complex:
          root: inputs.SubscriptionID
          transformers:
          - args:
              applyIfEmpty: {}
              defaultValue: {}
            operator: SetIfEmpty
      using:
        simple: ${inputs.instance_name}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 960,
          "y": 1720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "45":
    id: "45"
    taskid: f9dd66ef-8a63-4f79-855a-c33bf6f69ebc
    type: title
    task:
      id: f9dd66ef-8a63-4f79-855a-c33bf6f69ebc
      version: -1
      name: Create Deny Rule
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "44"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 960,
          "y": 1585
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "46":
    continueonerrortype: ""
    id: "46"
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - "5"
    note: false
    quietmode: 0
    scriptarguments:
      key:
        simple: remediatedFlag
      stringify:
        simple: "false"
      value:
        simple: "true"
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Set a value in context under the key you entered.
      id: cfbd8031-0897-427a-8801-aa8784d41da1
      iscommand: false
      name: Set remediatedFlag to true
      script: Set
      type: regular
      version: -1
    taskid: cfbd8031-0897-427a-8801-aa8784d41da1
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 210,
          "y": 2230
        }
      }
  "47":
    continueonerrortype: ""
    id: "47"
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - "5"
    note: false
    quietmode: 0
    scriptarguments:
      key:
        simple: remediatedFlag
      stringify:
        simple: "false"
      value:
        simple: "false"
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Set a value in context under the key you entered.
      id: cfcf7d60-5bea-4f24-8b19-3a8b5f7f926e
      iscommand: false
      name: Set remediatedFlag to false
      script: Set
      type: regular
      version: -1
    taskid: cfcf7d60-5bea-4f24-8b19-3a8b5f7f926e
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1370,
          "y": 2240
        }
      }
  "48":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              simple: ${azureOffendingRulePriority}
          operator: isEqualString
          right:
            value:
              simple: "100"
      label: "yes"
    continueonerrortype: ""
    id: "48"
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#default#':
      - "40"
      "yes":
      - "49"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Checks whether the the offending rule's priority is 100 (highest).
      id: a398e163-bf7b-4353-8492-43da8d89fca2
      iscommand: false
      name: Is offending rule priority 100?
      type: condition
      version: -1
    taskid: a398e163-bf7b-4353-8492-43da8d89fca2
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 510,
          "y": 150
        }
      }
  "49":
    continueonerrortype: ""
    id: "49"
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - "47"
    note: false
    quietmode: 0
    scriptarguments:
      key:
        simple: remediatedReason
      value:
        simple: Offending rule priority of 100
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Set a value in context under the key you entered.
      id: 11568067-90be-45c1-81a7-f22d1e6cd356
      iscommand: false
      name: Set remediatedReason
      script: Set
      type: regular
      version: -1
    taskid: 11568067-90be-45c1-81a7-f22d1e6cd356
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 910,
          "y": 400
        }
      }
view: |-
  {
    "linkLabelsPosition": {
      "22_43_yes": 0.63,
      "22_47_#default#": 0.34,
      "34_35_Update": 0.65,
      "38_39_#default#": 0.58,
      "4_1_yes": 0.46,
      "4_47_#default#": 0.35
    },
    "paper": {
      "dimensions": {
        "height": 3175,
        "width": 1540,
        "x": 210,
        "y": -700
      }
    }
  }
inputs:
- key: AzureSecurityGroup
  value: {}
  required: true
  description: The Azure Network Security Group that will have new rules created or updated.
  playbookInputQuery:
- key: AzureVMPrivateIP
  value: {}
  required: true
  description: The private IP of the Azure Virtual Machine.
  playbookInputQuery:
- key: RemoteProtocol
  value: {}
  required: true
  description: The remote protocol that is publicly exposed.
  playbookInputQuery:
- key: RemotePort
  value: {}
  required: true
  description: The remote port that is publicly exposed.
  playbookInputQuery:
- description: The Azure subscription ID (optional).
  key: SubscriptionID
  playbookInputQuery:
  required: false
  value: {}
- description: The Azure resource group (optional).
  key: ResourceGroup
  playbookInputQuery:
  required: false
  value: {}
- description: Azure Network Security Groups integration instance to use if you have multiple instances configured (optional).
  key: instance_name
  playbookInputQuery:
  required: false
  value: {}
- description: Comma separated list of IPv4 network ranges to be used as source addresses for the `remediation-allow-port-<port#>-<tcp|udp>` rule to be created.  Typically this will be private IP ranges (to allow access within the vnet and bastion hosts) but other networks can be added as needed.
  key: RemediationAllowRanges
  playbookInputQuery:
  required: false
  value:
    simple: 172.16.0.0/12,10.0.0.0/8,192.168.0.0/16
outputs:
- contextPath: remediatedFlag
  description: Output key to determine if remediation was successfully done.
  type: boolean
- contextPath: remediatedReason
  description: Reason remediation was done or not done.
  type: string
fromversion: 6.5.0
tests:
- No tests (auto formatted)
inputSections:
- description: Generic group for inputs
  inputs:
  - AzureSecurityGroup
  - AzureVMPrivateIP
  - RemoteProtocol
  - RemotePort
  - SubscriptionID
  - ResourceGroup
  - instance_name
  - RemediationAllowRanges
  name: General (Inputs group)
outputSections:
- description: Generic group for outputs
  name: General (Outputs group)
  outputs:
  - remediatedFlag
  - remediatedReason
contentitemexportablefields:
  contentitemfields: {}