sxo_aws_ir - Incident Response for EC2 in AWS

This workflow simplifies and automates incident response procedures for Amazon EC2 instances. If a compromise is suspected, the workflow can automate incident response procedures that are detailed in the published Amazon AWS Incident Response Guide, including:

Enabling Termination Proctection
Moving the compromised instance to an isolated security group.
Removing the instance from auto-scaling groups (ASGs).
Removing the instance from an elastic load balancer (ELB).
Creating forensic snapshots of elastic block devices.
Adding tags to compromised hosts.

Required Targets

Amazon Web Services

Required Local Variables

Isolation Security Group ID
Target ELB ARN

Setup instructions

Browse to your SecureX orchestration instance. This will be a different URL depending on the region your account is in:

Import main workflow

In the left pane menu, select Workflows. Click on IMPORT to import the workflow.
Click on Browse and copy paste the content of the name-json-file.json file inside of the text window. Select IMPORT AS A NEW WORKFLOW (CLONE) and click on IMPORT.
Next steps, like updating targets / account keys and setting a trigger / running the workflow.

Update local variables, targets, and credentials

This workflow relies on details from your AWS environment including authentication, region, quarantine security group, and ELB detail.

Workflow

Notes

Please test this properly before implementing in a production environment. This is a sample workflow!

Use Case

Streamline Incident Response Using SecureX

Simplify, automate, and streamline incident response by integrating Secure X, Service Now, WebEx, with Umbrella & Cloud Security Analytics.

Use Case Description

CloudAIR simplifies and automates incident response procedures for Amazon EC2 instances. Running the workflow on a schedule, it will query Cisco Umbrella, Cisco Secure Cloud Analytics (formerly known as Stealthwatch Cloud), and Amazon GuardDuty to detect indications of compromise. If a compromise is suspected, the workflow will create a ServiceNow ticket, generate a remediation request and push instance details and request WebEx room.

Incident response procedures are detailed in the published Amazon AWS Incident Response Guide and include:

  • Enabling Termination Protection
• Moving the compromised instance to an isolated security group.
• Removing the instance from auto-scaling groups (ASGs).
• Removing the instance from an elastic load balancer (ELB).
• Creating forensic snapshots of elastic block devices.• • Adding tags to compromised hosts.

•Please see the serverless relay module installation information here

•Code Exchange submission for this project