Cloud user investigation #28843
Merged
Cloud user investigation #28843
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
OmriItzhak
requested review from
melamedbn
and removed request for
michalgold and
idovandijk
This PR was automatically updated by a GitHub Action
To stop automatic version bumps, add the |
This PR was automatically updated by a GitHub Action
To stop automatic version bumps, add the |
This PR was automatically updated by a GitHub Action
To stop automatic version bumps, add the |
Packs/AWS-Enrichment-Remediation/Playbooks/playbook-AWS_-_User_Investigation.yml
Outdated
Show resolved
Hide resolved
Packs/AWS-Enrichment-Remediation/Playbooks/playbook-AWS_-_User_Investigation.yml
Outdated
Show resolved
Hide resolved
Packs/AWS-Enrichment-Remediation/Playbooks/playbook-AWS_-_User_Investigation.yml
Outdated
Show resolved
Hide resolved
Packs/AWS-Enrichment-Remediation/Playbooks/playbook-AWS_-_User_Investigation.yml
Outdated
Show resolved
Hide resolved
Packs/AWS-Enrichment-Remediation/Playbooks/playbook-AWS_-_User_Investigation.yml
Outdated
Show resolved
Hide resolved
Packs/CommonPlaybooks/Playbooks/playbook-Cloud_User_Investigation_-_Generic.yml
Outdated
Show resolved
Hide resolved
Packs/CommonPlaybooks/Playbooks/playbook-Cloud_User_Investigation_-_Generic.yml
Outdated
Show resolved
Hide resolved
Packs/CommonPlaybooks/Playbooks/playbook-Cloud_User_Investigation_-_Generic.yml
Outdated
Show resolved
Hide resolved
Packs/CommonPlaybooks/Playbooks/playbook-Cloud_User_Investigation_-_Generic.yml
Outdated
Show resolved
Hide resolved
Packs/CommonPlaybooks/Playbooks/playbook-Cloud_User_Investigation_-_Generic.yml
Outdated
Show resolved
Hide resolved
Packs/CommonPlaybooks/Playbooks/playbook-Cloud_User_Investigation_-_Generic.yml
Outdated
Show resolved
Hide resolved
Packs/CommonPlaybooks/Playbooks/playbook-Cloud_User_Investigation_-_Generic.yml
Outdated
Show resolved
Hide resolved
Packs/CommonPlaybooks/Playbooks/playbook-Cloud_User_Investigation_-_Generic.yml
Outdated
Show resolved
Hide resolved
Packs/CommonPlaybooks/Playbooks/playbook-Cloud_User_Investigation_-_Generic.yml
Outdated
Show resolved
Hide resolved
Packs/CommonPlaybooks/Playbooks/playbook-Cloud_User_Investigation_-_Generic.yml
Outdated
Show resolved
Hide resolved
Packs/GCP-Enrichment-Remediation/Playbooks/playbook-GCP_-_User_Investigation_README.md
Outdated
Show resolved
Hide resolved
Packs/GCP-Enrichment-Remediation/Playbooks/playbook-GCP_-_User_Investigation_README.md
Outdated
Show resolved
Hide resolved
Packs/CommonPlaybooks/Playbooks/playbook-Cloud_User_Investigation_-_Generic_README.md
Show resolved
Hide resolved
Packs/GCP-Enrichment-Remediation/Playbooks/playbook-GCP_-_User_Investigation.yml
Outdated
Show resolved
Hide resolved
|
@melamedbn Doc review completed. |
…nvestigation � Conflicts: � Packs/CommonPlaybooks/ReleaseNotes/2_3_88.md � Packs/GCP-Enrichment-Remediation/ReleaseNotes/1_1_5.md
Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>
Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>
Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>
Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>
Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>
… into Cloud_User_Investigation
melamedbn
reviewed
Aug 13, 2023
Packs/AWS-Enrichment-Remediation/Playbooks/playbook-AWS_-_User_Investigation.yml
Outdated
Show resolved
Hide resolved
|
For all of the AWS filters (API Access, Failed Login, etc.) I think we should elaborate in the task details what's our goal and what are we searching for. |
melamedbn
reviewed
Aug 13, 2023
Packs/Azure-Enrichment-Remediation/Playbooks/playbook-Azure_-_User_Investigation.yml
Show resolved
Hide resolved
melamedbn
reviewed
Aug 13, 2023
Packs/Azure-Enrichment-Remediation/Playbooks/playbook-Azure_-_User_Investigation.yml
Show resolved
Hide resolved
melamedbn
reviewed
Aug 13, 2023
Packs/Azure-Enrichment-Remediation/Playbooks/playbook-Azure_-_User_Investigation.yml
Show resolved
Hide resolved
|
Azure - |
melamedbn
reviewed
Aug 13, 2023
Packs/Azure-Enrichment-Remediation/Playbooks/playbook-Azure_-_User_Investigation.yml
Outdated
Show resolved
Hide resolved
|
Azure, AWS and GCP - all of the playbook descriptions should be formatted and more informative. |
This PR was automatically updated by a GitHub Action
To stop automatic version bumps, add the |
melamedbn
approved these changes
Aug 14, 2023
Packs/AWS-Enrichment-Remediation/Playbooks/playbook-AWS_-_User_Investigation.yml
Outdated
Show resolved
Hide resolved
Packs/AWS-Enrichment-Remediation/Playbooks/playbook-AWS_-_User_Investigation.yml
Outdated
Show resolved
Hide resolved
Packs/AWS-Enrichment-Remediation/Playbooks/playbook-AWS_-_User_Investigation.yml
Outdated
Show resolved
Hide resolved
Packs/AWS-Enrichment-Remediation/Playbooks/playbook-AWS_-_User_Investigation.yml
Outdated
Show resolved
Hide resolved
Packs/AWS-Enrichment-Remediation/Playbooks/playbook-AWS_-_User_Investigation.yml
Outdated
Show resolved
Hide resolved
Packs/Azure-Enrichment-Remediation/Playbooks/playbook-Azure_-_User_Investigation.yml
Show resolved
Hide resolved
Packs/Azure-Enrichment-Remediation/Playbooks/playbook-Azure_-_User_Investigation_README.md
Outdated
Show resolved
Hide resolved
Packs/Azure-Enrichment-Remediation/Playbooks/playbook-Azure_-_User_Investigation_README.md
Outdated
Show resolved
Hide resolved
Packs/GCP-Enrichment-Remediation/Playbooks/playbook-GCP_-_User_Investigation.yml
Outdated
Show resolved
Hide resolved
Packs/GCP-Enrichment-Remediation/Playbooks/playbook-GCP_-_User_Investigation.yml
Show resolved
Hide resolved
|
@melamedbn Doc review completed. |
Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>
…_Investigation.yml Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>
xsoar-bot
pushed a commit
to xsoar-contrib/content
that referenced
this pull request
Oct 5, 2023
* PB + RM cloud user investigation * RN for the Playbooks cloud user investigation * update skipifunavailable * Bump pack from version CommonPlaybooks to 2.3.88. * Bump pack from version CommonPlaybooks to 2.3.89. * Bump pack from version GCP-Enrichment-Remediation to 1.1.6. * Apply suggestions from code review Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * fix after doc review * Apply suggestions from code review Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * fix after review * fix after review * fix after review * Bump pack from version CommonPlaybooks to 2.3.90. * Apply suggestions from code review Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/GCP-Enrichment-Remediation/Playbooks/playbook-GCP_-_User_Investigation.yml Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update playbook-AWS_-_User_Investigation.yml --------- Co-authored-by: Content Bot <bot@demisto.com> Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Status
Related Issues
fixes: link to the issue
Description
These playbooks perform an investigation on a specific user in cloud environments, using queries and logs from Azure Log Analytics, AWS CloudTrail, G Suite Auditor, and GCP Logging.
Must have