Skip to content

Create custom auto-remediation solutions using serverless functions in the cloud.

License

Notifications You must be signed in to change notification settings

PaloAltoNetworks/Prisma-Enhanced-Remediation

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

81 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Prisma Enhanced Remediation

Create custom auto-remediation solutions for Prisma Cloud using serverless functions in the cloud.

Summary

What are Serverless Functions?

Serverless functions is a service offered by Cloud Service Providers (CSPs) that let you run code (e.g. Python scripts) without provisioning or managing servers. You pay only for the compute time you consume. Serverless has the benefit of letting you focus more on the code itself; the infrastructure, scaling, and availability factors are all taken care of automatically by the CSP.

Why Remediate Using Serverless?

Serverless functions are a simple way to create custom auto-remediation solutions based on Prisma Cloud alerts. Using Prisma Cloud's built-in integrations to CSPs (e.g. AWS SQS), you can quickly and easily remediate misconfigurations in your cloud environment with the flexibility of a full-fledged coding environment.

For example, on top of automatically blocking public access to an insecure AWS S3 bucket, you could also create a Jira ticket notifying your DevOps team with more details; perhaps you want to send a Slack notification after enabling VPC flow logs. Both of these are possible using serverless auto-remediation. Our GitHub repo gives you the starting point to build your own custom auto-remediation capabilities.

Getting Started

There are different setup instructions depending on your CSP (Cloud Service Provider):

Prerequisites

Using our out-of-the-box runbooks takes minimal programming knowledge and can be set up by following our step-by-step instructions. Developing your own runbooks will require familiarity with your CSP's relevant SDK.

Support

This template/solution are released under an as-is, best effort, support policy. These scripts should be seen as community supported and Palo Alto Networks will contribute our expertise as and when possible. Please read SUPPORT.md for more details on this project's support policy.

Built With

Contributing

We value your contributions! Please read CONTRIBUTING.md for details on how to contribute, and the process for submitting pull requests to us. If you have a custom runbook you would like to contribute, feel free to make a pull request and it'll be reviewed for future releases.

Maintainers

Thank you to all the contributors who participated in this project.

Acknowledgments

  • Kasi Annamalai
  • Antony Setiawan