Identification of runtime credential requirements
Described herein are systems, methods, and software to enhance incident response in an information technology (IT) environment. In one example, an incident service identifies a course of action to respond to an incident in the IT environment. The incident service further identifies a particular step in the course of action associated with a credential requirement based on traits associated with the particular step, and generates a credential request to obtain credentials to support the credential requirement.
1. A computer-implemented method implemented by an incident service computing system, the method comprising:
obtaining, by the incident service computing system, an indication of an incident in an IT environment, the IT environment including a plurality of computing assets, the incident encountered in one or more of the plurality of computing assets in the IT environment;
selecting, by the incident service computing system, a course of action, from a plurality of courses of action, to respond to the incident in the IT environment, wherein the course of action is selected based on a parameter associated with the incident, wherein the course of action comprises one or more steps, and wherein the incident service computing system issues the one or more steps to the plurality of computing assets for execution by the plurality of computing assets;
during execution of the course of action, determining, by the incident service computing system, prior to execution of a particular step of the one or more steps, that the particular step of the one or more steps is associated with a credential requirement based on one or more traits associated with the particular step;
generating, by the incident service computing system, a credential request to satisfy the credential requirement;
obtaining, by the incident service computing system, a credential in response to the credential request; and
resuming, by the incident service computing system, execution of the course of action, wherein the resuming includes using the credential to perform the particular step.
2. The method of claim 1 further comprising:
causing display of the credential request.
3. The method of claim 2
wherein resuming execution of the course of action further comprises:
determining that the credential satisfies the credential requirement; and
when the credential requirement is satisfied, continuing the execution of the course of action.
4. The method of claim 2 further comprising:
wherein resuming execution of the course of action further comprises:
determining that the credential fails to satisfy the credential requirement; and
when the credential fails to satisfy the credential requirement, preventing execution of at least a portion of the course of action.
5. The method of claim 1 , wherein the credential requirement comprises at least a username and password.
6. The method of claim 1 further comprising receiving input to generate the course of action, wherein the input defines sequencing information for the one or more steps.
7. The method of claim 1 , wherein the one or more traits comprise an identifier associated with the particular step.
8. The method of claim 1 , wherein the one or more traits comprise at least one component identifier associated with components with configurations to be modified by the particular step.
9. The method of claim 1 , wherein selecting the course of action comprises receiving a selection of the course of action, wherein the one or more traits comprise an analyst associated with the selection.
10. The method of claim 9 , wherein the method further comprises:
causing display of the credential request on a device associated with the analyst,
wherein the credential is obtained in response to the display.
11. The method of claim 1 , wherein selecting the course of action comprises receiving a selection of the course of action, and wherein the one or more traits comprise a time stamp associated with the selection.
12. The method of claim 1 , wherein selecting the course of action comprises receiving a selection of the course of action, and wherein the one or more traits comprise a role of an analyst associated with the selection.
13. The method of claim 1 , wherein the one or more traits comprise a threat level associated with the IT environment.
14. The method of claim 13 , wherein the threat level is determined based on a quantity of incidents identified in the IT environment, sources of incidents in the IT environment, or types of incidents in the IT environment.
15. The method of claim 1 , wherein selecting the course of action comprises receiving a selection of the course of action, and wherein the method further comprises:
causing display of the credential request, wherein the credential requirement is associated with a component of the IT environment or an approval of the particular step.
16. A system comprising:
a processor;
a non-transitory computer readable storage medium storing instructions which,
when executed by the processor, cause the processor to:
obtain an indication of an incident in an IT environment, the IT environment including a plurality of computing assets, the incident encountered in one or more of the plurality of computing assets in the IT environment;
select a course of action, from a plurality of courses of action, to respond to the incident in the information technology (IT) environment, wherein the course of action is selected based on a parameter associated with the incident, wherein the course of action comprises one or more steps, and wherein the system issues the one or more steps to the plurality of computing assets for execution by the plurality of computing assets;
during execution of the course of action, determine one or more traits associated with the one or more steps;
determine, prior to execution of a particular step of the one or more steps, that the particular step of the one or more steps is associated with a credential requirement based on one or more traits associated with the particular step;
generate a credential request to satisfy the credential requirement;
obtain a credential to satisfy the credential request in response to the credential request; and
resume execution of the course of action, wherein the resuming includes using the credential to perform the particular step.
17. The system of claim 16 , wherein the instructions, when executed by the processor, further cause the processor to:
initiate execution of the course of action; and
in response to the course of action reaching the particular step, pause execution of a path in the course of action associated with the particular step.
18. The system of claim 16 , wherein the instructions, when executed by the processor, further cause the processor to cause display of the credential request.
19. The system of claim 16 , wherein the instructions, when executed by the processor, further cause the processor to, when the credential fails to satisfy the credential requirement, generate a notification indicating a failure to satisfy the credential requirement.
20. The system of claim 16 , wherein the one or more traits comprise one or more identifiers associated with the one or more steps.
21. The system of claim 16 , wherein the one or more traits comprise one or more component identifiers associated with components to be modified by the one or more steps.
22. The system of claim 16 , wherein the one or more traits comprise a threat level associated with the IT environment.
23. A non-transitory computer readable storage medium storing instructions which, when executed by a processor, cause the processor to perform operations comprising:
obtaining an indication of an incident in an IT environment, the IT environment including a plurality of computing assets, the incident encountered in one or more of the plurality of computing assets in the IT environment;
selecting a course of action, from a plurality of courses of action, to respond to the incident in the information technology (IT) environment, wherein the course of action is selected based on a parameter associated with the incident, wherein the course of action comprises one or more steps to be issued to and executed by the plurality of computing assets in the IT environment;
during execution of the course of action, determining, prior to execution of a particular step of the one or more steps, that the particular step of the one or more steps is associated with a credential requirement based on one or more traits associated with the particular step;
generating a credential request to satisfy the credential requirement;
obtaining a credential in response to the credential request; and
resuming execution of the course of action, wherein the resuming includes using the credential to perform the particular step.
24. The non-transitory computer readable storage medium of claim 23 , wherein the instructions further cause the processor to perform operations comprising:
causing display of the credential request; and
wherein resuming execution of the course of action comprises:
determining that the credential satisfies the credential requirement; and
when the credential requirement is satisfied, continuing the execution of the course of action.
25. The non-transitory computer readable storage medium of claim 23 , wherein the credential requirement comprises at least a username and password.
26. The non-transitory computer readable storage medium of claim 23 , wherein the instructions further cause the processor to perform operations comprising receiving input to generate the course of action, wherein the input defines sequencing information for the one or more steps.
27. The non-transitory computer readable storage medium of claim 23 , wherein the one or more traits comprise an identifier associated with the particular step.
28. The non-transitory computer readable storage medium of claim 23 , wherein the one or more traits comprise at least one component identifier associated with components with configurations to be modified by the particular step.
29. The non-transitory computer readable storage medium of claim 23 , wherein selecting the course of action comprises receiving a selection of the course of action, wherein the one or more traits comprise an analyst associated with the selection.
30. The non-transitory computer readable storage medium of claim 23 , wherein the one or more traits comprise a threat level associated with the IT environment.