Cspm network exposure playbooks by aneeshamore · Pull Request #44266 · demisto/content

aneeshamore · 2026-05-11T22:01:50Z

3 new playbooks to automatically remediate public network exposure of AWS, Azure and GCP vm instances detected in Cortex XSIAM and Cortex Cloud.

content-bot · 2026-05-11T22:03:12Z

🤖 AI-Powered Code Review Available

You can leverage AI-powered code review to assist with this PR!

Available Commands:

@marketplace-ai-reviewer start review - Initiate a full AI code review
@marketplace-ai-reviewer re-review - Incremental review for new commits

julieschwartz18

@mikejrizzo @aneeshamore Doc review complete. Please check the comments and regenerate README files from the yaml files (if relevant). Please note, there are links to XSOAR documentation. OPP version should be set to 8.12 (I think I caught them all, but please confirm). There are no links to XSIAM documentation. Let me know if you want to include that. In the meantime, adding the label docs-approved

julieschwartz18 · 2026-05-13T05:46:46Z

+      id: 7ce15ff3-2f9e-47c4-8198-314a20199f91
+      version: -1
+      name: Identify Affected EC2 Interface and Security Groups
+      description: Determines which interface on an EC2 instance has a specific public IP and identify its associated security groups.


Suggested change

description: Determines which interface on an EC2 instance has a specific public IP and identify its associated security groups.

description: Determines which interface on an EC2 instance has a specific public IP and identifies its associated security groups.

julieschwartz18 · 2026-05-13T05:48:32Z

+      id: b44e79cd-68e8-411d-8ba1-2d56479f69b2
+      version: -1
+      name: Update Security Groups on EC2 Network Interface
+      description: Modifies a specified network interface attribute. You can specify only one attribute at a time. You can use this script to attach and detach security groups from an existing EC2 instance.


Suggested change

description: Modifies a specified network interface attribute. You can specify only one attribute at a time. You can use this script to attach and detach security groups from an existing EC2 instance.

description: Modifies a specified network interface attribute. You can specify only one attribute at a time. Use this script to attach and detach security groups from an existing EC2 instance.

julieschwartz18 · 2026-05-13T05:48:57Z

+      id: e88cf9ea-1952-4cdd-8076-2d019cf23078
+      version: -1
+      name: Is AWS Integration Enabled?
+      description: Verify the required AWS integration is configured and enabled.


Suggested change

description: Verify the required AWS integration is configured and enabled.

description: Verifies the required AWS integration is configured and enabled.

julieschwartz18 · 2026-05-13T05:49:19Z

+      id: 6b703256-0ef4-49a5-817c-7ed41c4d72be
+      version: -1
+      name: Is there a list of replacement SGs to apply to the VM?
+      description: Check that new security group(s) have been created and are ready to be assigned to the EC2 instance.


Suggested change

description: Check that new security group(s) have been created and are ready to be assigned to the EC2 instance.

description: Checks that new security groups have been created and are ready to be assigned to the EC2 instance.

julieschwartz18 · 2026-05-13T05:49:44Z

+      id: 0f66fec7-135d-401d-82d4-125d4c4880ec
+      version: -1
+      name: Set remediatedFlag to false
+      description: Set a value in context under the key you entered.


Suggested change

description: Set a value in context under the key you entered.

description: Sets a value in context under the key you entered.

julieschwartz18 · 2026-05-13T11:08:48Z

+    skipunavailable: false
+    task:
+      brand: ""
+      description: Checks if remediation was completed from the previous playbook.


Suggested change

description: Checks if remediation was completed from the previous playbook.

description: Checks whether remediation was completed from the previous playbook.

julieschwartz18 · 2026-05-13T11:09:05Z

+    skipunavailable: false
+    task:
+      brand: Cortex Core - Platform
+      description: Gets asset information.


Suggested change

description: Gets asset information.

description: Retrieves asset information.

julieschwartz18 · 2026-05-13T11:09:20Z

+    skipunavailable: false
+    task:
+      brand: ""
+      description: Checks if an asset was returned from the last command.


Suggested change

description: Checks if an asset was returned from the last command.

description: Checks whether an asset was returned from the last command.

julieschwartz18 · 2026-05-13T11:09:34Z

+    skipunavailable: false
+    task:
+      brand: Cortex Core - Platform
+      description: Gets asset information.


Suggested change

description: Gets asset information.

description: Retrieves asset information.

julieschwartz18 · 2026-05-13T11:10:26Z

+
+##### Cortex Exposure Management GCP Virtual Machine Remediation
+
+- Updated the ***triggers recommendation - Cortex Exposure Management GCP Virtual Machine Remediation*** automation rule to remediate Cortex Exposure Management issues for VMs in GCP. This replaces an issue filter that previously handled only RDP server exposures.


Suggested change

- Updated the ***triggers recommendation - Cortex Exposure Management GCP Virtual Machine Remediation*** automation rule to remediate Cortex Exposure Management issues for VMs in GCP. This replaces an issue filter that previously handled only RDP server exposures.

Updated the ***triggers recommendation - Cortex Exposure Management GCP Virtual Machine Remediation*** automation rule to remediate Cortex Exposure Management issues for VMs in GCP. This replaces an issue filter that previously handled only RDP server exposures.

julieschwartz18

@mikejrizzo @aneeshamore Doc review complete. Please check the comments and regenerate README files from the yaml files (if relevant). Please note, there are links to XSOAR documentation. OPP version should be set to 8.12 (I think I caught them all, but please confirm). There are no links to XSIAM documentation. Let me know if you want to include that. In the meantime, adding the label docs-approved

…ack metadata.

aneeshamore · 2026-05-14T18:03:47Z

@marketplace-ai-reviewer skip playbooks

aneeshamore · 2026-05-14T18:06:28Z

@marketplace-ai-reviewer start review and skip playbooks

aneeshamore · 2026-05-14T18:07:20Z

@marketplace-ai-reviewer start review

aneeshamore · 2026-05-14T18:18:38Z

@marketplace-ai-reviewer start review

marketplace-ai-reviewer · 2026-05-14T18:21:03Z

🤖 Analysis started. Please wait for results...

marketplace-ai-reviewer · 2026-05-14T18:31:45Z

🤖 AI Review Disclaimer

This review was generated by an AI-powered tool and may contain inaccuracies. Please be advised, and we extend our sincere apologies for any inconvenience this may cause.

marketplace-ai-reviewer

Hi there, thanks for contributing these new CSPM auto-remediation playbooks!

I've reviewed the PR and left a few notes, primarily regarding minor inconsistencies across the AWS, Azure, and GCP playbooks, such as mismatched README defaults, quiet mode settings, and case-sensitivity in conditions. Please also review the Notify_Stakeholders playbook to fix routing logic that could cause duplicate or empty notifications, and ensure the release notes and pack metadata follow standard formatting guidelines.

Great work overall, let me know if you need any help resolving these!

Additionally, please address the following file-level notes:

Packs/CloudSecurityPostureManagement/Playbooks/Notify_Stakeholders.yml: The playbook README should be updated to reflect the new inputs and functionality.
Packs/CloudSecurityPostureManagement/pack_metadata.json: - The mandatory key created is missing from the pack metadata.
The vendor name is missing from the keywords array.

@mikejrizzo, @julieschwartz18, @aneeshamore, @marketplace-ai-reviewer please review and approve the results generated by the AI Reviewer by responding 👍 on this comment.

aneeshamore · 2026-05-14T20:35:47Z

@marketplace-ai-reviewer re-review

marketplace-ai-reviewer · 2026-05-14T20:41:25Z

🤖 Analysis started. Please wait for results...

marketplace-ai-reviewer · 2026-05-14T20:42:31Z

🤖 AI Review Disclaimer

This review was generated by an AI-powered tool and may contain inaccuracies. Please be advised, and we extend our sincere apologies for any inconvenience this may cause.

marketplace-ai-reviewer

🔄 Re-reviewing updates...

Important

To maintain review integrity, threads marked as Resolved without accompanying changes or explanations will be automatically unresolved for further verification.

Thank you for your contribution! Re-reviewed your PR, No new issues found. Great work! 👍
Please check the previous comments to ensure all feedback has been resolved.

@julieschwartz18, @aneeshamore, @mikejrizzo, @marketplace-ai-reviewer please review and approve the results generated by the AI Reviewer by responding 👍 on this comment.

content-bot · 2026-05-14T20:53:16Z

Validate summary
The following errors were reported as warnings: BC117.
BC117 validation requires PM review due to changes to supportedModules.
The following errors were thrown as a part of this pr: .
If the AG100 validation in the pre-commit GitHub Action fails, the pull request cannot be force-merged.

Verdict: PR can be force merged from validate perspective? ✅

content-bot · 2026-05-14T21:52:03Z

🔍 AI Triage Report Available

An automated triage report has been generated for this pipeline.

Status: success
Report ID: ca8ecf77436c1d00

📋 Triage Report

⚠️ AI-generated triage. Validate before acting.

aneeshamore requested review from mikejrizzo and richardbluestone May 11, 2026 22:02

This comment has been minimized.

Sign in to view

richardbluestone requested review from julieschwartz18 and removed request for richardbluestone May 12, 2026 05:20

This comment has been minimized.

Sign in to view

aneeshamore force-pushed the cspm-network-exposure-playbooks branch from c25a08c to dccc9bf Compare May 12, 2026 21:38

This comment has been minimized.

Sign in to view

julieschwartz18 reviewed May 13, 2026

View reviewed changes

julieschwartz18 added the docs-approved label May 13, 2026

aneeshamore added 7 commits May 13, 2026 14:30

4 new playbooks with README, screenshot and trigger files.

f8bcac9

Updated release notes for v2.0.0

c5e6cb9

Added fromversion to playbook yml files.

8f308d0

Removed supportedModules from playbook files to let it inherit from p…

9ac2102

…ack metadata.

Fixed validation errors in yml files. Updated Azure playbook png.

343ffd4

Fixed typo in version.

8e8ed2a

Added missing description field to a task in the AWS playbook file

6b97808

aneeshamore force-pushed the cspm-network-exposure-playbooks branch from dccc9bf to 6b97808 Compare May 13, 2026 21:32

This comment has been minimized.

Sign in to view

Docs review fixes.

4fde6f4

This comment has been minimized.

Sign in to view

aneeshamore added the ready-for-pipeline-running Whether the pr is ready for running the whole pipeline, including testing on SAAS machines label May 14, 2026

aneeshamore requested a review from marketplace-ai-reviewer May 14, 2026 18:04

aneeshamore added the ready-for-ai-review The PR is ready for reviewing the PR with the AI Reviewer. label May 14, 2026

marketplace-ai-reviewer removed the ready-for-ai-review The PR is ready for reviewing the PR with the AI Reviewer. label May 14, 2026

marketplace-ai-reviewer reviewed May 14, 2026

View reviewed changes

demisto deleted a comment from marketplace-ai-reviewer May 14, 2026

AI Review fixes.

43fc8ec

marketplace-ai-reviewer reviewed May 14, 2026

View reviewed changes

	description: Determines which interface on an EC2 instance has a specific public IP and identify its associated security groups.
	description: Determines which interface on an EC2 instance has a specific public IP and identifies its associated security groups.

	description: Modifies a specified network interface attribute. You can specify only one attribute at a time. You can use this script to attach and detach security groups from an existing EC2 instance.
	description: Modifies a specified network interface attribute. You can specify only one attribute at a time. Use this script to attach and detach security groups from an existing EC2 instance.

	description: Verify the required AWS integration is configured and enabled.
	description: Verifies the required AWS integration is configured and enabled.

	description: Check that new security group(s) have been created and are ready to be assigned to the EC2 instance.
	description: Checks that new security groups have been created and are ready to be assigned to the EC2 instance.

	description: Set a value in context under the key you entered.
	description: Sets a value in context under the key you entered.

	description: Checks if remediation was completed from the previous playbook.
	description: Checks whether remediation was completed from the previous playbook.

	description: Gets asset information.
	description: Retrieves asset information.

	description: Checks if an asset was returned from the last command.
	description: Checks whether an asset was returned from the last command.


		##### Cortex Exposure Management GCP Virtual Machine Remediation

		- Updated the *triggers recommendation - Cortex Exposure Management GCP Virtual Machine Remediation* automation rule to remediate Cortex Exposure Management issues for VMs in GCP. This replaces an issue filter that previously handled only RDP server exposures.

	- Updated the *triggers recommendation - Cortex Exposure Management GCP Virtual Machine Remediation* automation rule to remediate Cortex Exposure Management issues for VMs in GCP. This replaces an issue filter that previously handled only RDP server exposures.
	Updated the *triggers recommendation - Cortex Exposure Management GCP Virtual Machine Remediation* automation rule to remediate Cortex Exposure Management issues for VMs in GCP. This replaces an issue filter that previously handled only RDP server exposures.

Conversation

aneeshamore commented May 11, 2026

Uh oh!

content-bot commented May 11, 2026

🤖 AI-Powered Code Review Available

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

julieschwartz18 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

julieschwartz18 left a comment

Choose a reason for hiding this comment

Uh oh!

This comment has been minimized.

This comment has been minimized.

aneeshamore commented May 14, 2026

Uh oh!

aneeshamore commented May 14, 2026

Uh oh!

aneeshamore commented May 14, 2026

Uh oh!

aneeshamore commented May 14, 2026

Uh oh!

marketplace-ai-reviewer commented May 14, 2026

Uh oh!

marketplace-ai-reviewer commented May 14, 2026

Uh oh!

marketplace-ai-reviewer left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

aneeshamore commented May 14, 2026

Uh oh!

marketplace-ai-reviewer commented May 14, 2026

Uh oh!

marketplace-ai-reviewer commented May 14, 2026

Uh oh!

marketplace-ai-reviewer left a comment

Choose a reason for hiding this comment

🔄 Re-reviewing updates...

Uh oh!

content-bot commented May 14, 2026

Uh oh!

content-bot commented May 14, 2026

🔍 AI Triage Report Available

Uh oh!

Reviewers

Assignees

Labels