Skip to content

Commit

Permalink
Fixed minor linting issues.
Browse files Browse the repository at this point in the history
  • Loading branch information
@stevemac007
stevemac007 committed Jun 2, 2024
1 parent 15e625d commit 49bf580
Show file tree
Hide file tree
Showing 6 changed files with 54 additions and 67 deletions.
25 changes: 10 additions & 15 deletions src/parsers/guardduty-apicall.js
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2,31 +2,26 @@
// AWS GuardDuty event parser
//
exports.matches = event =>
event.getSource() === "guardduty" && event.getDetailType() === "AWS API Call via CloudTrail"
event.getSource() === "guardduty" && event.getDetailType() === "AWS API Call via CloudTrail";

exports.parse = event => {
const detail = event.get("detail");

let title = _.get(detail, "title");
let description = _.get(detail, "description");
const createdAt = new Date(_.get(detail, "time"));
let accountId = _.get(detail, "accountId");
let region = _.get(detail, "region");
let color = event.COLORS.neutral; //low severity below 4
const fields = [];

const eventName = _.get(detail, "eventName")
const eventName = _.get(detail, "eventName");
const actionedBy = _.get(detail, "userIdentity.principalId");
const accountId = _.get(detail, "recipientAccountId");
const region = _.get(detail, "awsRegion");

let actionedBy = _.get(detail, "userIdentity.principalId")
accountId = _.get(detail, "recipientAccountId");
region = _.get(detail, "awsRegion");
title = "Findings Archived"
description = `Findings Archived by ${actionedBy}`
color = event.COLORS.ok;
let title = "Findings Archived";
let description = `Findings Archived by ${actionedBy}`;
let color = event.COLORS.ok;

if (eventName === "UnarchiveFindings") {
title = "Findings Unarchived"
description = `Findings Unarchived by ${actionedBy}`
title = "Findings Unarchived";
description = `Findings Unarchived by ${actionedBy}`;
color = event.COLORS.warning;
}

Expand Down
38 changes: 15 additions & 23 deletions src/parsers/guardduty-findings.js
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2,21 +2,19 @@
// AWS GuardDuty event parser
//
exports.matches = event =>
event.getSource() === "guardduty" && event.getDetailType() === "GuardDuty Finding"
event.getSource() === "guardduty" && event.getDetailType() === "GuardDuty Finding";

exports.parse = event => {
const detail = event.get("detail");

let title = _.get(detail, "title");
let description = _.get(detail, "description");
const title = _.get(detail, "title");
const description = _.get(detail, "description");
const createdAt = new Date(_.get(detail, "time"));
let accountId = _.get(detail, "accountId");
let region = _.get(detail, "region");
const accountId = _.get(detail, "accountId");
const region = _.get(detail, "region");
let color = event.COLORS.neutral; //low severity below 4
const fields = [];

const eventName = _.get(detail, "eventName")

//const id = _.get(detail, "id");
const severity = _.get(detail, "severity");
//const partition = _.get(event, "partition");
Expand Down Expand Up @@ -133,7 +131,7 @@ exports.parse = event => {

const connectionDirection = _.get(detectedAction, "connectionDirection");
const protocol = _.get(detectedAction, "protocol");
const blocked = _.get(detectedAction, "blocked");
// const blocked = _.get(detectedAction, "blocked");

const ipAddressV4 = _.get(detectedAction, "remoteIpDetails.ipAddressV4");
const isp = _.get(detectedAction, "remoteIpDetails.organization.isp");
Expand All @@ -142,12 +140,12 @@ exports.parse = event => {
const country = _.get(detectedAction, "remoteIpDetails.country.countryName");
const city = _.get(detectedAction, "remoteIpDetails.city.cityName");

const remotePort = _.get(detectedAction, "remotePortDetails.port");
const remotePortName = _.get(detectedAction, "remotePortDetails.portName");
// const remotePort = _.get(detectedAction, "remotePortDetails.port");
// const remotePortName = _.get(detectedAction, "remotePortDetails.portName");

const localIpAddress = _.get(detectedAction, "localIpDetails.ipAddressV4");
const localPort = _.get(detectedAction, "localPortDetails.port");
const localPortName = _.get(detectedAction, "localPortDetails.portName");
// const localPortName = _.get(detectedAction, "localPortDetails.portName");


fields.push({
Expand All @@ -167,12 +165,6 @@ exports.parse = event => {
value: `${country} - ${city}`,
short: true
});
//
// fields.push({
// title: "Remote Details",
// value: `${remotePort} (${remotePortName})`,
// short: true
// });
}
else if (actionType === "KUBERNETES_API_CALL") {

Expand Down Expand Up @@ -313,7 +305,7 @@ exports.parse = event => {

const name = _.get(cluster, "name");
const arn = _.get(cluster, "arn");
const createdAt = _.get(cluster, "createdAt");
// const createdAt = _.get(cluster, "createdAt");
const vpcId = _.get(cluster, "vpcId");
const status = _.get(cluster, "status");

Expand All @@ -329,14 +321,14 @@ exports.parse = event => {
short: true
});

const kubernetesDetails = _.get(detail, "resource.kubernetesDetails")
const workloadDetails = _.get(kubernetesDetails, "kubernetesWorkloadDetails")
const kubernetesDetails = _.get(detail, "resource.kubernetesDetails");
const workloadDetails = _.get(kubernetesDetails, "kubernetesWorkloadDetails");
fields.push({
title: "Workload",
value: workloadDetails,
short: true
});
const userDetails = _.get(kubernetesDetails, "kubernetesUserDetails")
const userDetails = _.get(kubernetesDetails, "kubernetesUserDetails");

const username= _.get(userDetails, "username");
const uid = _.get(userDetails, "uid");
Expand All @@ -355,7 +347,7 @@ exports.parse = event => {
short: true
});

const tags = _.get(cluster , "tags");
const tags = _.get(cluster, "tags");

for (let i = 0; i < tags.length; i++) {
const key = tags[i].key;
Expand All @@ -381,7 +373,7 @@ exports.parse = event => {
if (severity > 4) { //medium seveirty between 4 and 7
color = event.COLORS.warning;
}
if (severity > 7) { //high sevirity above 7
if (severity > 7) { //high sevirity above 7
color = event.COLORS.critical;
}

Expand Down
42 changes: 21 additions & 21 deletions src/parsers/guardduty-kuberuntime.js
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2,28 +2,28 @@
// AWS GuardDuty event parser
//
exports.matches = event =>
event.getSource() === "guardduty" && event.getDetailType().startsWith("GuardDuty Runtime Protection")
event.getSource() === "guardduty" && _.startsWith(event.getDetailType(), "GuardDuty Runtime Protection");

exports.parse = event => {
const detail = event.get("detail");

let title = event.getDetailType();
let description = "";
const title = event.getDetailType();
const description = "";
const fields = [];
const createdAt = new Date(_.get(event, "message.time"));
let accountId = _.get(event, "message.account");
let region = _.get(event, "message.region");
const accountId = _.get(event, "message.account");
const region = _.get(event, "message.region");

let color = event.COLORS.ok;
if (event.getDetailType().indexOf("Unhealthy") !== -1) {
if (_.includes(event.getDetailType(), "Unhealthy")) {
color = event.COLORS.critical;
}

let resource = _.get(detail, "resourceDetails");
const resource = _.get(detail, "resourceDetails");

let previousStatus = _.get(detail, "previousStatus");
let currentStatus = _.get(detail, "currentStatus");
let issue = _.get(detail, "issue");
// const previousStatus = _.get(detail, "previousStatus");
// const currentStatus = _.get(detail, "currentStatus");
const issue = _.get(detail, "issue");

fields.push({
title: "Account",
Expand All @@ -37,7 +37,7 @@ exports.parse = event => {
short: true
});

let resourceType = _.get(resource, "resourceType");
const resourceType = _.get(resource, "resourceType");

fields.push({
title: "Resource Type",
Expand All @@ -46,16 +46,16 @@ exports.parse = event => {
});

if (resourceType === "EKS") {
let eksCluster = _.get(resource, "eksClusterDetails");
const eksCluster = _.get(resource, "eksClusterDetails");

fields.push({
title: "Cluster",
value: _.get(eksCluster, "clusterName"),
short: true
});

let addonVersion = _.get(eksCluster, "addonDetails.addonVersion");
let addonStatus = _.get(eksCluster, "addonDetails.addonStatus");
const addonVersion = _.get(eksCluster, "addonDetails.addonVersion");
const addonStatus = _.get(eksCluster, "addonDetails.addonStatus");

fields.push({
title: "AddOn",
Expand All @@ -64,12 +64,12 @@ exports.parse = event => {
});
}
else if (resourceType === "EC2") {
let ec2Instance = _.get(resource, "ec2InstanceDetails");
let instanceId = _.get(ec2Instance, "instanceId");
let instanceType = _.get(ec2Instance, "instanceType");
let clusterArn = _.get(ec2Instance, "clusterArn");
let agentVersion= _.get(ec2Instance, "agentDetails.version");
let managementType= _.get(ec2Instance, "managementType");
const ec2Instance = _.get(resource, "ec2InstanceDetails");
const instanceId = _.get(ec2Instance, "instanceId");
const instanceType = _.get(ec2Instance, "instanceType");
const clusterArn = _.get(ec2Instance, "clusterArn");
const agentVersion= _.get(ec2Instance, "agentDetails.version");
const managementType= _.get(ec2Instance, "managementType");

fields.push({
title: "Instance",
Expand Down Expand Up @@ -113,7 +113,7 @@ exports.parse = event => {
title: "Issue",
value: issue,
short: false
})
});
}

return event.attachmentWithDefaults({
Expand Down
10 changes: 5 additions & 5 deletions src/parsers/securityhub.js
View file
Original file line number Diff line number Diff line change
Expand Up @@ -17,18 +17,18 @@ exports.parse = event => {
const finding = _.get(detail, "findings")[0];
console.log(`Finding ${JSON.stringify(finding, null, 2)}`);

const id = _.get(finding, "Id");
const generatorId = _.get(finding, "GeneratorId");
// const id = _.get(finding, "Id");
// const generatorId = _.get(finding, "GeneratorId");
const title = _.get(finding, "Title");
const description = _.get(finding, "Description");
const createdAt = new Date(_.get(finding, "CreatedAt"));
const updatedAt = new Date(_.get(finding, "UpdatedAt"));
// const updatedAt = new Date(_.get(finding, "UpdatedAt"));
const firstSeen = new Date(_.get(finding, "FirstObservedAt"));
const lastSeen = new Date(_.get(finding, "LastObservedAt"));
const complianceStatus = _.get(finding, "Compliance.Status");
// const complianceStatus = _.get(finding, "Compliance.Status");
const severity = _.get(finding, "Severity.Normalized");
const severityLabel = _.get(finding, "Severity.Label");
const criticality = _.get(finding, "Criticality");
// const criticality = _.get(finding, "Criticality");

const accountId = _.get(finding, "AwsAccountId");
const resources = _.get(finding, "Resources");
Expand Down
4 changes: 2 additions & 2 deletions src/parsers/ses-bounce.js
View file
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ exports.parse = event => {
const destination = event.get("mail.destination");
const timestamp = event.get("mail.timestamp");
const subject = event.get("mail.commonHeaders.subject");
const content = event.get("content");
// const content = event.get("content");

const fields = [];
if (source) {
Expand All @@ -30,7 +30,7 @@ exports.parse = event => {
});
}

let color = event.COLORS.neutral
let color = event.COLORS.neutral;
if (bounceType === "Transient") {
color = event.COLORS.accent;
}
Expand Down
2 changes: 1 addition & 1 deletion src/parsers/ses-complaint.js
View file
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ exports.parse = event => {
});
}

let color = event.COLORS.critical
const color = event.COLORS.critical;

fields.push({
title: "UserAgent",
Expand Down

0 comments on commit 49bf580

Please sign in to comment.