Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[ASM] - Parent Playbook Input Typo #36450

Merged
merged 5 commits into from
Sep 25, 2024
Merged

[ASM] - Parent Playbook Input Typo #36450

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
3621e10
fix typo
johnnywilkes Sep 23, 2024
98bbaee
RN
johnnywilkes Sep 23, 2024
596d9a4
RN try 2
johnnywilkes Sep 23, 2024
46046a4
Update Packs/CortexAttackSurfaceManagement/ReleaseNotes/1_7_52.md
johnnywilkes Sep 24, 2024
d50e08a
Merge branch 'contrib/PaloAltoNetworks_ASM-EXPANDR-11327' into ASM-EX…
johnnywilkes Sep 24, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
fix typo
  • Loading branch information
@johnnywilkes
johnnywilkes committed Sep 23, 2024
commit 3621e1014ef81737f19b2bb4cdf488027834c730
6 changes: 3 additions & 3 deletions Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_ASM_Alert.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1966,7 +1966,7 @@ tasks:
right:
value:
complex:
root: inputs.AcceptedRiskDs
root: inputs.AcceptedRiskIDs
iscontext: true
- operator: inList
left:
Expand Down Expand Up @@ -3517,7 +3517,7 @@ inputs:

Set to "True" if you want to bypass. Default is "False".
playbookInputQuery:
- key: AcceptedRiskDs
- key: AcceptedRiskIDs
value: {}
required: false
description: Comma-separated list of instance/VM IDs that are considered an accepted risk and that should be closed.
Expand Down Expand Up @@ -3560,7 +3560,7 @@ inputSections:
- RemediationNotificationSubject
- RemediationNotificationHTMLBody
- BypassDevCheck
- AcceptedRiskDs
- AcceptedRiskIDs
- AcceptedRiskProjects
- AcceptedRiskOther
- JiraProjectKey
Expand Down
4 changes: 2 additions & 2 deletions Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_ASM_Alert_README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,8 +44,8 @@ This playbook does not use any integrations.
| RemediationNotificationSubject | Subject of the notification \(email or ticket\) sent to the service owner after remediation. | A new security risk was addressed on an external service owned by your team | Required |
| RemediationNotificationHTMLBody | Body of the notification \(email or ticket\) sent to the service owner after remediation. | &lt;!DOCTYPE html&gt;<br/>&lt;html lang="en"&gt;<br/>&lt;body&gt;<br/> &lt;p&gt;<br/> Infosec identified a security risk on an external service potentially owned by your<br/> team:&lt;br&gt;&lt;b&gt;${alert.name}&lt;/b&gt;<br/> &lt;/p&gt;<br/> &lt;p&gt;<br/> &lt;b&gt;Alert Details:&lt;/b&gt; ${alert.details}&lt;br&gt;<br/> &lt;b&gt;Action Taken:&lt;/b&gt; ${alert.asmremediation.[0].action}&lt;br&gt;<br/> &lt;b&gt;Action Outcome:&lt;/b&gt; ${alert.asmremediation.[0].outcome}&lt;br&gt;<br/> &lt;/p&gt;<br/>&lt;/body&gt;<br/>&lt;/html&gt; | Required |
| BypassDevCheck | Determine whether to bypass the Dev Check in automated remediation criteria: https://docs-cortex.paloaltonetworks.com/r/Cortex-XPANSE/Cortex-Xpanse-Expander-User-Guide/Automated-Remediation-Capabilities-Matrix<br/><br/>Set to "True" if you want to bypass. Default is "False". | False | Optional |
| AcceptedRiskDs | Comma-separated list of instance/VM IDs that are considered an accepted risk and that should be closed. | | Optional |
| AcceptedRiskProjects | Comma-separated list of projects numbers that are considered an accepted risk and that should be closed. For example, a list of GCP projects and AWS accounts. | | Optional |
| AcceptedRiskIDs | Comma-separated list of instance/VM IDs that are considered an accepted risk and that should be closed. | | Optional |
| AcceptedRiskProjects | Comma-separated list of projects numbers that are considered an accepted risk and that should be closed. For example, a list of GCP projects, names of Azure Resource Groups, and AWS accounts. | | Optional |
| AcceptedRiskOther | Comma-separated list of other items that are considered an accepted risk and that should be closed. For example, a list of folders numbers in GCP and subscription IDs in Azure. | | Optional |
| JiraProjectKey | The Jira project key to associate with the issue. | | Required |
| AWSAssumeRoleName | If assuming roles for AWS, this is the name of the role to assume \(should be the same for all organizations\). | | Optional |
Expand Down