This workflow template addresses the critical need for organizations to maintain cybersecurity by automating the response to potential intrusion events. Specifically, it focuses on handling suspicious AWS Console logins. Upon login, the source IP is checked against VirusTotal for any associated risks. If the login is by the root user, a ServiceNow incident is logged immediately. Otherwise, the user is contacted via Slack to confirm the activity. Unacknowledged logins trigger the deactivation of the user's login profile and access keys, followed by logging a detailed ServiceNow incident for further investigation. This automated process is essential for rapid incident response and minimizing potential security breaches.
Trigger
Amazon SNS
Use Cases
null
Workflow Breakdown
Check Source IP of the Login in VirusTotal
Verify if the login was a root or user login, if root login log a ServiceNow incident
Find the user in Slack and ask to acknowledge login
If acknowledged, open and automatically resolve a ServiceNow Incident
If not acknowledged - disable the users login profile and access keys
Open a ServiceNow incident with the details of the event
Vendors
AWS, Slack, VirusTotal, ServiceNow