This workflow simplifies and automates incident response procedures for Amazon EC2 instances. If a compromise is suspected, the workflow can automate incident response procedures that are detailed in the published Amazon AWS Incident Response Guide, including:
Browse to your SecureX orchestration instance. This will be a different URL depending on the region your account is in:
This workflow relies on details from your AWS environment including authentication, region, quarantine security group, and ELB detail.
Please test this properly before implementing in a production environment. This is a sample workflow!
Streamline Incident Response Using SecureX
Simplify, automate, and streamline incident response by integrating Secure X, Service Now, WebEx, with Umbrella & Cloud Security Analytics.
Use Case Description
CloudAIR simplifies and automates incident response procedures for Amazon EC2 instances. Running the workflow on a schedule, it will query Cisco Umbrella, Cisco Secure Cloud Analytics (formerly known as Stealthwatch Cloud), and Amazon GuardDuty to detect indications of compromise. If a compromise is suspected, the workflow will create a ServiceNow ticket, generate a remediation request and push instance details and request WebEx room.
Incident response procedures are detailed in the published Amazon AWS Incident Response Guide and include:
• Enabling Termination Protection
• Moving the compromised instance to an isolated security group.
• Removing the instance from auto-scaling groups (ASGs).
• Removing the instance from an elastic load balancer (ELB).
• Creating forensic snapshots of elastic block devices.• • Adding tags to compromised hosts.
•Please see the serverless relay module installation information here
•Code Exchange submission for this project
White Paper
AWS IR Whitepaper
From Complex to Cohesive
Watch Brian Sak & Brennan Bouchard present at Devnet Create
Anyone may create a SecureX account for free.
DevNet Learning Labs
Get Started with theses SecureX Modules on Devnet
Solutions on Ecosystem Exchange
More SecureX solutions on Cisco Ecosystem Exchange here
Author(s)
This project was written and is maintained by the following individuals: