isabella232 / deprecated-patrol-rules-guardduty

AWS-Lambda powered Patrol functions for AWS GuardDuty.

⚠️ DEPRECATED ⚠️

patrol-rules-guardduty

A set of Patrol functions for AWS GuardDuty. Patrol-rules-guardduty publishes SNS messages to Dispatch for interactive alarm routing.

Functions

minimumThreshold

• Description - Processes new AWS GuardDuty alerts and sends alerts meeting a minimum serverity threshold to an SNS topic.
• Trigger - aws.guardduty API calls
• Parameters
  • dispatchSnsArn - SNS topic ARN for your dispatch-incoming AWS Lambda function
  • pagerdutyServiceId - PagerDuty service ID
  • minimumThreshold - A number for the minimum severity threshold for GuardDuty alerts. To receive all GuardDuty alerts, use 2. For medium alerts and above, use 5. For high, use 8.

Deploying to AWS

Prequisites

To deploy patrol-rules-guardduty, you'll need to install lambda-cfn locally as well as setup and deploy Dispatch on your AWS infrastructure.

This project uses lambda-cfn to manage and deploy AWS CloudFormation templates. Check out the lambda-cfn and Patrol README's for instructions on how to use lambda-cfn with Patrol projects.

Install lambda-cfn

To install lambda-cfn on your machine, run npm install -g @mapbox/lambda-cfn.

More instructions are available in the lambda-cfn README.

Deploy Dispatch

Check out the Dispatch setup instructions for detailed instructions on how to deploy Dispatch to your AWS infrastructure.

Deploy patrol-rules-guardduty functions

Use lambda-cfn to deploy each patrol-rules-guardduty function. Each AWS Lambda function is its own AWS CloudFormation stack.

For example, to create a development stack for the minimumThreshold function:

git clone [e-mail]:mapbox/patrol-rules-guardduty.git
cd patrol-rules-guardduty/minimumThreshold
lambda-cfn create dev

Lambda-cfn will ask for parameter values when creating new CloudFormation stacks. Check out the guide to lambda-cfn parameter values and the functions section for help.

Local Development

Tests

Patrol-rules-guardduty uses eslint for linting and tape for tests. It mocks HTTP requests with nock. Tests run on Travis CI after every commit.

• npm test will run eslint then tape.
• npm run lint will only run eslint.
• npm run unit-test will only run tape tests.