Skip to main content

Cloud IAM Enrichment - Generic

This Playbook is part of the Common Playbooks Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.8.0 and later.

This playbook is responsible for collecting and enriching data on Identity Access Management (IAM) in cloud environments (AWS, Azure, and GCP).

Dependencies#

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks#

This playbook does not use any sub-playbooks.

Integrations#

  • AWS - IAM

Scripts#

This playbook does not use any scripts.

Commands#

  • aws-iam-get-user
  • gcp-iam-service-accounts-get
  • gsuite-user-get
  • gcp-iam-service-account-keys-get
  • gcp-iam-project-role-list
  • gsuite-role-assignment-list
  • aws-iam-list-user-policies
  • aws-iam-list-groups-for-user
  • msgraph-user-get
  • msgraph-identity-protection-risky-user-history-list
  • msgraph-groups-list-groups
  • aws-iam-list-access-keys-for-user
  • aws-iam-list-attached-user-policies

Playbook Inputs#


NameDescriptionDefault ValueRequired
usernameUser name.Optional
GCPProjectNameThe GCP project name.Optional
cloudProviderThe cloud service provider involved.Optional
cloudIdentityTypeThe cloud identity type.Optional

Playbook Outputs#


PathDescriptionType
AWS.IAM.UsersAWS AM Users include:
UserId
Arn
CreateDate
Path
PasswordLastUsed
unknown
AWS.IAM.Users.AccessKeysAWS IAM Users Access Keys include:
AccessKeyId
Status
CreateDate
UserName
unknown
GCPIAMGCP IAM information.unknown
GSuiteGSuite user information.unknown
GSuite.PageTokenToken to specify the next page in the list.unknown
MSGraphUserMSGraph user information.unknown
MSGraphGroupsMSGraph groups information.unknown
MSGraph.identityProtectionMSGraph identity protection - risky user history.unknown
AWS.IAM.Users.AccessKeys.CreateDateThe date when the access key was created.unknown
AWS.IAM.Users.AccessKeys.UserNameThe name of the IAM user that the key is associated with.unknown
AWS.IAM.Users.GroupsAWS IAM - User groups.unknown
AWS.IAM.UserPoliciesAWS IAM - user inline policies.unknown
AWS.IAM.AttachedUserPoliciesAWS IAM - User attached policies.unknown
MSGraphGroupMSGraph group information.unknown

Playbook Image#


Cloud IAM Enrichment - Generic