forked from stevemac007/aws-to-slack
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #2 from cevoaustralia/guardduty-archived-findings
Added support for alerting on Archiving GuardDuty alerts.
- Loading branch information
Showing
13 changed files
with
517 additions
and
39 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,66 @@ | ||
| // | ||
| // AWS GuardDuty event parser | ||
| // | ||
| exports.matches = event => | ||
| event.getSource() === "guardduty" && event.getDetailType() === "AWS API Call via CloudTrail"; | ||
|
|
||
| exports.parse = event => { | ||
| const detail = event.get("detail"); | ||
|
|
||
| const createdAt = new Date(_.get(detail, "time")); | ||
| const fields = []; | ||
|
|
||
| const eventName = _.get(detail, "eventName"); | ||
| const actionedBy = _.get(detail, "userIdentity.principalId"); | ||
| const accountId = _.get(detail, "recipientAccountId"); | ||
| const region = _.get(detail, "awsRegion"); | ||
|
|
||
| let title = "Findings Archived"; | ||
| let description = `Findings Archived by ${actionedBy}`; | ||
| let color = event.COLORS.ok; | ||
|
|
||
| if (eventName === "UnarchiveFindings") { | ||
| title = "Findings Unarchived"; | ||
| description = `Findings Unarchived by ${actionedBy}`; | ||
| color = event.COLORS.warning; | ||
| } | ||
|
|
||
| fields.push({ | ||
| title: "Account", | ||
| value: accountId, | ||
| short: true | ||
| }); | ||
|
|
||
| fields.push({ | ||
| title: "Region", | ||
| value: region, | ||
| short: true | ||
| }); | ||
|
|
||
| fields.push({ | ||
| title: "Actioned by", | ||
| value: actionedBy, | ||
| short: false | ||
| }); | ||
|
|
||
| const findings = _.get(detail, "requestParameters.findingIds"); | ||
|
|
||
| for (const finding of findings) { | ||
| fields.push({ | ||
| title: "Finding ID", | ||
| value: finding, | ||
| short: false | ||
| }); | ||
| } | ||
|
|
||
|
|
||
| return event.attachmentWithDefaults({ | ||
| author_name: "Amazon GuardDuty", | ||
| fallback: `${title} ${description}`, | ||
| color: color, | ||
| title: title, | ||
| fields: fields, | ||
| mrkdwn_in: ["title", "text"], | ||
| ts: createdAt, | ||
| }); | ||
| }; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,128 @@ | ||
| // | ||
| // AWS GuardDuty event parser | ||
| // | ||
| exports.matches = event => | ||
| event.getSource() === "guardduty" && _.startsWith(event.getDetailType(), "GuardDuty Runtime Protection"); | ||
|
|
||
| exports.parse = event => { | ||
| const detail = event.get("detail"); | ||
|
|
||
| const title = event.getDetailType(); | ||
| const description = ""; | ||
| const fields = []; | ||
| const createdAt = new Date(_.get(event, "message.time")); | ||
| const accountId = _.get(event, "message.account"); | ||
| const region = _.get(event, "message.region"); | ||
|
|
||
| let color = event.COLORS.ok; | ||
| if (_.includes(event.getDetailType(), "Unhealthy")) { | ||
| color = event.COLORS.critical; | ||
| } | ||
|
|
||
| const resource = _.get(detail, "resourceDetails"); | ||
|
|
||
| // const previousStatus = _.get(detail, "previousStatus"); | ||
| // const currentStatus = _.get(detail, "currentStatus"); | ||
| const issue = _.get(detail, "issue"); | ||
|
|
||
| fields.push({ | ||
| title: "Account", | ||
| value: accountId, | ||
| short: true | ||
| }); | ||
|
|
||
| fields.push({ | ||
| title: "Region", | ||
| value: region, | ||
| short: true | ||
| }); | ||
|
|
||
| const resourceType = _.get(resource, "resourceType"); | ||
|
|
||
| fields.push({ | ||
| title: "Resource Type", | ||
| value: resourceType, | ||
| short: true | ||
| }); | ||
|
|
||
| if (resourceType === "EKS") { | ||
| const eksCluster = _.get(resource, "eksClusterDetails"); | ||
|
|
||
| fields.push({ | ||
| title: "Cluster", | ||
| value: _.get(eksCluster, "clusterName"), | ||
| short: true | ||
| }); | ||
|
|
||
| const addonVersion = _.get(eksCluster, "addonDetails.addonVersion"); | ||
| const addonStatus = _.get(eksCluster, "addonDetails.addonStatus"); | ||
|
|
||
| fields.push({ | ||
| title: "AddOn", | ||
| value: `${addonVersion} - ${addonStatus}`, | ||
| short: true | ||
| }); | ||
| } | ||
| else if (resourceType === "EC2") { | ||
| const ec2Instance = _.get(resource, "ec2InstanceDetails"); | ||
| const instanceId = _.get(ec2Instance, "instanceId"); | ||
| const instanceType = _.get(ec2Instance, "instanceType"); | ||
| const clusterArn = _.get(ec2Instance, "clusterArn"); | ||
| const agentVersion= _.get(ec2Instance, "agentDetails.version"); | ||
| const managementType= _.get(ec2Instance, "managementType"); | ||
|
|
||
| fields.push({ | ||
| title: "Instance", | ||
| value: instanceId, | ||
| short: true | ||
| }); | ||
| fields.push({ | ||
| title: "Instance Type", | ||
| value: instanceType, | ||
| short: true | ||
| }); | ||
| fields.push({ | ||
| title: "ClusterArn", | ||
| value: clusterArn, | ||
| short: false | ||
| }); | ||
| fields.push({ | ||
| title: "Agent Version", | ||
| value: agentVersion, | ||
| short: true | ||
| }); | ||
| fields.push({ | ||
| title: "Management Type", | ||
| value: managementType, | ||
| short: true | ||
| }); | ||
| } | ||
| else { | ||
| console.log(`Unknown GuardDuty resourceType '${resourceType}'`); | ||
|
|
||
| fields.push({ | ||
| title: `Unknown Resource Type (${resourceType})`, | ||
| value: JSON.stringify(resource, null, 2), | ||
| short: false | ||
| }); | ||
| } | ||
|
|
||
|
|
||
| if (issue) { | ||
| fields.push({ | ||
| title: "Issue", | ||
| value: issue, | ||
| short: false | ||
| }); | ||
| } | ||
|
|
||
| return event.attachmentWithDefaults({ | ||
| author_name: "Amazon GuardDuty", | ||
| fallback: `${title} ${description}`, | ||
| color: color, | ||
| title: title, | ||
| fields: fields, | ||
| mrkdwn_in: ["title", "text"], | ||
| ts: createdAt, | ||
| }); | ||
| }; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.