Skip to content

Latest commit

 

History

History
50 lines (31 loc) · 1.34 KB

playbook-PCR_-_AWS_CloudTrail_Misconfig_README.md

File metadata and controls

50 lines (31 loc) · 1.34 KB
Raw

This playbook remediates Prisma Cloud AWS CloudTrail alerts. It calls sub-playbooks that perform the actual remediation steps.

Remediation:

  • AWS CloudTrail Trail Log Validation Is Not Enabled In All Regions
  • AWS CloudTrail is not enabled in all regions
  • AWS CloudTrail Trail Is Not Integrated With CloudWatch Logs
  • AWS CloudTrail is not enabled on the account

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Prisma Cloud Remediation - AWS CloudTrail Is Not Integrated With CloudWatch Logs
  • Prisma Cloud Remediation - AWS CloudTrail is not Enabled on the Account
  • Prisma Cloud Remediation - AWS CloudTrail Trail Misconfiguration

Integrations

  • PrismaCloud v2

Scripts

This playbook does not use any scripts.

Commands

  • redlock-dismiss-alerts
  • closeInvestigation

Playbook Inputs

Name Description Default Value Required
AutoUpdateCloudTrail Update AWS CloudTrail automatically? no Optional
policyId Get the Prisma Cloud policy ID. incident.labels.policy Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Prisma Cloud Remediation - AWS CloudTrail Misconfiguration