Skip to main content

Cloud Compute Enrichment - Generic

This Playbook is part of the Common Playbooks Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.8.0 and later.

This playbook provides a generic enrichment of AWS, GCP, and Azure compute resources.


This playbook uses the following sub-playbooks, integrations, and scripts.


This playbook does not use any sub-playbooks.


This playbook does not use any integrations.


This playbook does not use any scripts.


  • aws-ec2-describe-instances
  • gcp-compute-get-instance
  • azure-vm-get-instance-details

Playbook Inputs#

NameDescriptionDefault ValueRequired
cloudProviderThe cloud provider involved.Optional
instanceNameThe instance name.Optional
instanceIDThe instance ID.Optional
zoneThe zone holding the instance.Optional
regionThe region holding the instance.Optional
azureResourceGroupThe instance's resource group.Optional

Playbook Outputs#

AWS.EC2.InstancesThe instances.unknown
AWS.EC2.Instances.MonitoringThe monitoring for the instance.unknown
AWS.EC2.Instances.StateThe current state of the instance.unknown
AWS.EC2.Instances.IamInstanceProfileThe IAM instance profile associated with the instance, if applicable.unknown
AWS.EC2.Instances.NetworkInterfacesThe network interfaces for the instance.unknown
AWS.EC2.Instances.NetworkInterfaces.PrivateIpAddressesThe private IPv4 addresses associated with the network interface.unknown
AWS.EC2.Instances.SecurityGroupsThe security groups for the instance.unknown
AWS.EC2.Instances.StateReasonThe reason for the most recent state transition.unknown
AWS.EC2.Instances.TagsAny tags assigned to the instance.unknown
GoogleCloudCompute.InstancesThe instances.unknown
GoogleCloudCompute.Instances.tagsTags to apply to this instance. Tags are used to identify valid sources or targets for network firewalls and are specified by the client during instance creation. The tags can be later modified by the setTags method. Each tag within the list must comply with RFC1035. Multiple tags can be specified via the tags.items field.unknown
GoogleCloudCompute.Instances.networkInterfacesAn array of network configurations for this instance. These specify how interfaces are configured to interact with other network services, such as connecting to the internet. Multiple interfaces are supported per instance.unknown
GoogleCloudCompute.Instances.networkInterfaces.aliasIpRangesAn array of alias IP ranges for this network interface. Can only be specified for network interfaces on subnet-mode networks.unknown
GoogleCloudCompute.Instances.disksArray of disks associated with this instance. Persistent disks must be created before you can assign them.unknown
GoogleCloudCompute.Instances.disks.initializeParamsSpecifies the parameters for a new disk that will be created alongside the new instance. Use initialization parameters to create boot disks or local SSDs attached to the new instance.unknown
GoogleCloudCompute.Instances.disks.initializeParams.sourceImageEncryptionKeyThe customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.unknown
GoogleCloudCompute.Instances.disks.initializeParams.labelsLabels to apply to this disk. These can be later modified by the disks.setLabels method. This field is only applicable for persistent disks.unknown
GoogleCloudCompute.Instances.disks.guestOsFeaturesA list of features to enable on the guest operating system. Applicable only for bootable images. Read Enabling guest operating system features to see a list of available options.unknown
GoogleCloudCompute.Instances.disks.diskEncryptionKeyEncrypts or decrypts a disk using a customer-supplied encryption key.unknown
GoogleCloudCompute.Instances.metadataThe metadata key/value pairs assigned to this instance. This includes custom metadata and predefined keys.unknown
GoogleCloudCompute.Instances.metadata.itemsArray of key/value pairs. The total size of all keys and values must be less than 512 KB.unknown
GoogleCloudCompute.Instances.serviceAccountsA list of service accounts, with their specified scopes, authorized for this instance. Only one service account per VM instance is supported.unknown
GoogleCloudCompute.Instances.schedulingSets the scheduling options for this instance.unknown
GoogleCloudCompute.Instances.scheduling.nodeAffinitiesA set of node affinity and anti-affinity.unknown
GoogleCloudCompute.Instances.labelsLabels to apply to this instance. These can be later modified by the setLabels method.unknown
GoogleCloudCompute.Instances.guestAcceleratorsA list of the type and count of accelerator cards attached to the instance.unknown
Azure.ComputeThe VMs.unknown

Playbook Image#

Cloud Compute Enrichment - Generic