Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/jmfuchs/aws-guardduty-processing
A serverless application for processing AWS GuardDuty findings.
https://github.com/jmfuchs/aws-guardduty-processing
aws elasticsearch guardduty lambda logging serverless-framework
Last synced: about 2 months ago
JSON representation
A serverless application for processing AWS GuardDuty findings.
- Host: GitHub
- URL: https://github.com/jmfuchs/aws-guardduty-processing
- Owner: jmfuchs
- License: apache-2.0
- Created: 2018-05-28T03:13:01.000Z (over 6 years ago)
- Default Branch: master
- Last Pushed: 2018-09-07T15:53:47.000Z (about 6 years ago)
- Last Synced: 2024-06-28T08:36:21.128Z (3 months ago)
- Topics: aws, elasticsearch, guardduty, lambda, logging, serverless-framework
- Language: Python
- Homepage:
- Size: 231 KB
- Stars: 11
- Watchers: 4
- Forks: 2
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# Processing Guardduty Findings with Lambda
This serverless application creates the necessary resources and integrations for processing [Amazon GuardDuty](https://aws.amazon.com/guardduty/) findings. The below architecture showcases how logs are post-processed, and pushed to Elasticsearch.
## Architecture
## Prerequisites
Below are the necessary prerequisites:
* [AWS Account](https://aws.amazon.com/premiumsupport/knowledge-center/create-and-activate-aws-account/)
* [Serverless Framework](https://serverless.com/)
* An [Amazon Elasticsearch](https://aws.amazon.com/elasticsearch-service/) cluster. This application builds on [aws-cloudtrail-processing](https://github.com/jmfuchs/aws-cloudtrail-processing) in an effort to consolidate more AWS native log sources but can also be run independently.
### Cloud9 Environment
If you have trouble installing any of the prerequisites or dependencies, you can spin up an [AWS Cloud9](https://aws.amazon.com/cloud9/) environment, which is a cloud-based IDE that comes prepackaged with a number of essential packages. After which you can run the following command to install the Serverless Framework.
```
npm install -g serverless
```
## Set Variables
Clone the repo and open up **environment/dev.yml** and add in the appropiate variables.
> You can add new files for different environments.
## Enrich Logs
Since the Lambda Function parses through the GuardDuty finding, you can enrich the finding by adding additional information to complement data points and add context. This can either be static data hardcoded in the Lambda function or it can be dynamically pulled from a DynamoDB table or 3rd party threat intelligence feed.
Open **guardduty.py**, find the section of code below, and add additional metadata as necessary:
```
############# Add additional metadata to event #############
# Example: Add AWS Account type
i["accountType"] = "Production"
############################################################
```
## Install Dependencies
Ensure you are in the aws-ct-processing directory and run the following to install the dependencies:
```
pip install -r requirements.txt -t ./
```
## Deploy
To deploy the serverless application, run the following command:
```
sls deploy -s dev -r us-west-2
```
> If you've created different environment files that reference other aws profiles or you want to deploy to different regions, you can replace *dev* and *us-west-2* as necessary.
## Access
After to the application has been successfully deployed you can view the logs in Kibana by doing the following:
* Go to the [AWS Elasticsearch](https://us-west-2.console.aws.amazon.com/es/home?region=us-west-2) console.
* Click on the Domain that starts with **sls-aws-ct-processing**.
* Click the link next to **Kibana**.
Once you are in Kibana:
* Click **Management** in the left Navigation.
* Click **Index Patterns**
* For Step 1 (Define index pattern) type **logs-\***.
* For Step 2 (Configure Settings) select **@timestamp**.
* Click **Create Index Pattern**.
* On the left navigation, click **Discover** to view your events.
## Cleanup
Below are the steps to cleanup this application:
* Run the below command to delete the serverless application
```
sls remove -s dev -r us-west-2
```