The "Handle Gem Alert for EC2 Instance 'Write' Actions on IAM Entities" workflow template ensures immediate and conditional response to potential security incidents triggered by specific EC2 instance behaviors. When a Gem Security alert is received, the workflow automatically creates snapshots of all volumes attached to the implicated EC2 instance for potential forensic analysis. A critical aspect involves collaboration with the DevOps team via Slack to determine whether these snapshots are to be preserved. Absence of confirmation within 7 days results in the automated deletion of these snapshots, aligning with best practices for resource management and security. This workflow streamlines incident response, aids in efficient evidence preservation, and enforces organizational security protocols.
Trigger
Gem
Use Cases
CSPM
Workflow Breakdown
Get metadata for all volumes attached to the alert's EC2 Instance
Take a snapshot of each volume
Validate with DevOps in Slack whether or not to keep the snapshots.
If the request is denied, or no approval is given within 7 days, delete all snapshots.
Vendors
AWS, Slack, Utils, Gem