Security Orchestration Automation and Response

Bronze Certified

Solution

0 reviews

Version:1.1

Overview Reviews Questions

Versions

Summary

Workflow Solution built on top of the official UiPath IT Automation activities for automating the resolution of Azure brute force attacks security incidents targeting public facing virtual machines.

Overview

Azure public-facing Virtual Machines can be secured from brute force attacks with the solution’s ready to use workflows that block attacker IP addresses in the Virtual Machine’s Network Security Groups. The Azure Security Center Alerts types that can be processed automatically are:
Suspicious authentication activity
Possible incoming SQL brute force attempts detected
Web Fingerprint Detected
Failed SSH brute force attack
Solution Workflows:

1. AzureCreateNSGsForNIs
creates NSGs for the Virtual Machines that don't have at least one associated with one of its Network Interfaces
(optional) it can be scheduled to run 1st - the other workflows will have no effect froma security resolution point of view if deny security rules cant be created for the attacked VM
2. GetAzureSecurityCenterAlerts
gets the Azure Security Center alerts for the supported Brute Force attack types and adds them to an Orchestrator Queue for processing
3. AzureVMsAttackersBlock_AddSecurityRuleToNSG
retrieves the pending Orchestrator queue items 
the new Security Rules have their priority computed dynamically
if the attacker IP is already blocked in an NSG, it will be skipped
4. Block_AttackerIP_in_VM_NSGs
the workflow can be executed on-demand from the Orchestrator web or mobile apps
the specified IP is blocked in all the Network Security Groups associated with the input Virtual Machine

Benefits

Published: 30 Jun 2020 | Updated: 24 Dec 2020

UiPath

Trusted Source

License

MIT

Code Language

Visual Basic

Runtime

.NET Framework

Microsoft Azure…

Custom Activity

Official UiPath activities for Azure cloud resources provisioning, configuration and management: virtual machines, storage, networking, security.…

1.6k

Gold Certified

Supported by Publisher

IT Automation for Public, Private & Hybrid Clouds…

Solution

Workflows that enable organizations from all industries to accelerate the automation of their IT ecosystem in the areas of Cloud, Server Virtualization, User Management, Security, Networking and more.…

245

Bronze Certified

Supported by Publisher

Amazon Web Services (AWS)…

Custom Activity

Official UiPath activities for Amazon Web Services (AWS) cloud resources provisioning, configuration and management: virtual machines EC2 Instances, S3 storage, networking. …