AWS Systems Manager - Get Missing Patches for EC2 Instances

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Content Index

When an incident is created in Microsoft Sentinel, this playbook gets triggered and perform the following actions: 1. Get the Hostnames and Private IP addresses from incident entities. 2. Get the Instance IDs from AWS EC2 using the Hostnames and Private IP Addresses. 3. Get the missing patches for the Instance IDs. 4. Add the missing patches to the incident comment.

Attribute Value
Type Playbook
Solution AWS Systems Manager
Source View on GitHub

Additional Documentation

📄 Source: AWSSystemsManagerPlaybooks/AWS-SSM-GetInstancePatches/readme.md

AWS-SSM-GetInstancePatches

Summary

When a new sentinel incident is created, this playbook gets triggered and performs the following actions:

  1. Get the Hostnames and Private IP addresses from incident entities.
  2. Get the Instance IDs of Managed EC2 instances using the Hostnames and Private IP Addresses.
  3. Get the missing patches for the Instance IDs.
  4. Add the missing patches to the incident comment.



Prerequisites

  1. Prior to the deployment of this playbook, AWS Systems Manager API Function App Connector needs to be deployed under the same subscription.
  2. Refer to AWS Systems Manager API Function App Connector documentation to obtain AWS Access Key ID, Secret Access Key and Region.

Deployment instructions

  1. To deploy the Playbook, click the Deploy to Azure button. This will launch the ARM Template deployment wizard.
  2. Fill in the required parameters:
    • Playbook Name
    • Functions App Name

Deploy to Azure Deploy to Azure

Post-Deployment instructions

a. Authorize connections

Once deployment is complete, authorize each connection.

  1. Click the Microsoft Sentinel connection resource
  2. Click edit API connection
  3. Click Authorize
  4. Sign in
  5. Click Save
  6. Repeat steps for other connections

b. Configure Playbook in Microsoft Sentinel

  1. In Microsoft sentinel, analytical rules should be configured to trigger an incident that contains IP Addresses or Hostnames. In the Entity mapping section of the analytics rule creation workflow, IP Address should be mapped to Address identifier of the IP entity type and Hostname should be mapped to Hostname identifier of the Host entity type. Check the documentation to learn more about mapping entities.
  2. Configure the automation rules to trigger the playbook. Check the documentation to learn more about automation rules.

c. Assign Playbook Microsoft Sentinel Responder Role

  1. Select the Playbook (Logic App) resource
  2. Click on Identity Blade
  3. Choose System assigned tab
  4. Click on Azure role assignments
  5. Click on Add role assignments
  6. Select Scope - Resource group
  7. Select Subscription - where Playbook has been created
  8. Select Resource group - where Playbook has been created
  9. Select Role - Microsoft Sentinel Responder
  10. Click Save

d. Function App Settings Update Instructions

Refer to AWS Systems Manager API Function App Connector documentation for Function App Application Settings (Access Key ID, Secret Access Key and Region) update instruction.

e. Additional instruction while playbook configuration:

When configuring the playbook, ensure that pagination is disabled for GetInventory, as pagination is already handled by the connector.

alt text

References

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Playbooks · Back to AWS Systems Manager