AWS - GuardDuty Event Collector

Amazon Web Services Guard Duty Service (gd) event collector integration for Cortex XSIAM.

Analytics & SIEM · AWS - GuardDuty

Details

IDAWS - GuardDuty Event Collector
ProviderAmazon
CategoryAnalytics & SIEM
From Version6.8.0
Docker Imagedemisto/boto3py3:1.0.0.10221838
Supported ModulesAgentix XSIAM

README

Amazon Web Services Guard Duty Service Event Collector integration for Cortex XSIAM.

This is the default integration for this content pack when configured by the Data Onboarder in Cortex XSIAM.

Configure AWS - GuardDuty Event Collector in Cortex

Parameter Description Required
AWS Default Region The AWS Region for this instance of the integration. For example, us-west-2 True
Role ARN The Amazon Resource Name (ARN) role used for EC2 instance authentication. If this is used, an access key and secret key are not required. False
Role Session Name A descriptive name for the assumed role session. For example, xsiam-IAM.integration-Role_SESSION False
Role Session Duration The maximum length of each session in seconds. Default: 900 seconds. The Cortex XSOAR integration will have the permissions assigned only when the session is initiated and for the defined duration. False
Access Key The access key ID used for authentication, that was configured during IAM user configuration. If this is used, Role ARN is not required. False
Secret Key The secret key used for authentication, that was configured during IAM user configuration. If this is used, Role ARN is not required. False
Timeout The time in seconds until a timeout exception is reached. You can specify just the read timeout (for example 60) or also the connect timeout preceded by a comma (for example 60,10). If a connect timeout is not specified, a default of 10 seconds will be used. False
Retries The maximum number of retry attempts when connection or throttling errors are encountered. Set to 0 to disable retries. The default value is 5 and the limit is 10. Note: Increasing the number of retries will increase the execution time. False
First fetch time First fetch query <number> <time unit>, e.g., 7 days. Default 3 days. False
Number of events to fetch per fetch. Default is 10. False
Guard Duty Severity level The severity level or higher of findings to be fetched: Low, Medium, or High. For example, if you set the severity level to Medium, only findings with severity level Medium or High will be fetched. True
Trust any certificate (not secure)   False
Use system proxy settings   False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

aws-gd-get-events

Manual command to fetch events and display them.

Base Command

aws-gd-get-events

Input

Argument Name Description Required
should_push_events Set this argument to True to create events, otherwise the command will only display them. Possible values are: true, false. Default is false. Required
severity The minimum severity of the events to fetch (inclusive). Possible values are: Low, Medium, High. Default is Low. Required
collect_from The date to start collecting the events from. Optional
limit The maximum amount of events to return. Optional

Context Output

There is no context output for this command.

Command example

!aws-gd-get-events severity=Low should_push_events=false limit=1 collect_from="60 days ago"

Human Readable Output

AWSGuardDuty Logs
Account Id Arn Created At Description Id Partition Region Resource Schema Version Service Severity Title Type Updated At
SomeAccountId SomeArn 2022-08-16T07:22:39.877Z A container with a sensitive host path mounted inside was launched on EKS Cluster SomeFindingEKSClusterName. If this behavior is not expected, it may indicate that your credentials are compromised. aws EksClusterDetails: {“Name”: “SomeFindingEKSClusterName”, “Arn”: “SomeFindingEKSClusterArn”, “VpcId”: “SomeFindingEKSClusterVpcId”, “Status”: “ACTIVE”, “Tags”: [{“Key”: “SomeFindingEKSClusterTag1”, “Value”: “SomeFindingEKSClusterTagValue1”}, {“Key”: “SomeFindingEKSClusterTag2”, “Value”: “SomeFindingEKSClusterTagValue2”}, {“Key”: “SomeFindingEKSClusterTag3”, “Value”: “SomeFindingEKSClusterTagValue3”}], “CreatedAt”: “2021-11-11T10:15:55.218000”}
KubernetesDetails: {“KubernetesUserDetails”: {“Username”: “SomeFindingUserName”, “Uid”: “SomeFindingUID”, “Groups”: [“SomeFindingUserGroup”]}, “KubernetesWorkloadDetails”: {“Name”: “SomeFindingKubernetesWorkloadName”, “Type”: “SomeFindingKubernetesWorkloadType”, “Uid”: “SomeFindingKubernetesWorkloadUID”, “Namespace”: “SomeFindingKubernetesWorkloadNamespace”, “Containers”: [{“Name”: “SomeFindingContainerName”, “Image”: “SomeFindingContainerImage”, “ImagePrefix”: “SomeFindingContainerImagePrefix”, “VolumeMounts”: [{“Name”: “SomeFindingVolumeName”, “MountPath”: “SomeFindingVolumeMountPath”}]}], “Volumes”: [{“Name”: “SomeFindingVolumeName”, “HostPath”: {“Path”: “SomeFindingHostPath”}}]}}
ResourceType: EKSCluster		 2.0 Action: {“ActionType”: “KUBERNETES_API_CALL”, “KubernetesApiCallAction”: {“RequestUri”: “SomeFindingRequestURI”, “Verb”: “create”, “UserAgent”: “”, “RemoteIpDetails”: {“City”: {“CityName”: “SomeFindingCityName”}, “Country”: {“CountryName”: “SomeFindingCountryName”}, “GeoLocation”: {“Lat”: 0, “Lon”: 0}, “IpAddressV4”: “1.1.1.1”, “Organization”: {“Asn”: “0”, “AsnOrg”: “SomeFindingASNOrg”, “Isp”: “SomeFindingISP”, “Org”: “SomeFindingORG”}}, “StatusCode”: 201}}
Archived: true
Count: 1
DetectorId: detectorid
EventFirstSeen: 2022-08-16T07:22:39.000Z
EventLastSeen: 2022-08-16T07:22:39.000Z
ResourceRole: TARGET
ServiceName: guardduty
AdditionalInfo: {“Value”: “{"sample":true}”, “Type”: “default”}		 5 Container launched with a sensitive host path mounted inside. Persistence:Kubernetes/ContainerWithSensitiveMount 2022-08-16T07:22:39.877Z

Configuration parameters

  • defaultRegion — AWS Default Region (required)
  • roleArn — Role ARN
  • roleSessionName — Role Session Name
  • sessionDuration — Role Session Duration
  • credentials — Access Key
  • timeout — Timeout
  • retries — Retries
  • endpoint_url — PrivateLink service URL.
  • sts_endpoint_url — STS PrivateLink URL.
  • sts_regional_endpoint — AWS STS Regional Endpoints
  • first_fetch — First fetch time
  • limit — Number of events to fetch per fetch.
  • gd_severity — Guard Duty Severity level (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • exclude_archived — Exclude archived/suppressed findings
  • isFetchEvents — Fetch Events
  • eventFetchInterval — Events Fetch Interval

Commands (1)

  • aws-gd-get-events

    Manual command used to fetch events and display them.

Source

AWSGuardDutyEventCollector.py AWSGuardDutyEventCollector_test.py AWSGuardDutyEventCollector.yml AWSGuardDutyEventCollector_description.md command_examples.txt
Download History Raw 
name: AWS - GuardDuty Event Collector
display: AWS - GuardDuty Event Collector
category: Analytics & SIEM
provider: Amazon
sectionorder:
- Connect
- Collect
commonfields:
  id: AWS - GuardDuty Event Collector
  version: -1
configuration:
- display: AWS Default Region
  additionalinfo: The AWS region for this instance of the integration. For example, us-west-2
  name: defaultRegion
  required: true
  type: 0
  section: Connect
- display: Role ARN
  additionalinfo: The Amazon Resource Name (ARN) role used for EC2 instance authentication. If this is used, an access key and secret key are not required.
  name: roleArn
  type: 0
  required: false
  section: Connect
- display: Role Session Name
  additionalinfo: A descriptive name for the assumed role session. For example, xsiam-IAM.integration-Role_SESSION
  name: roleSessionName
  type: 0
  required: false
  section: Connect
- display: Role Session Duration
  additionalinfo: 'The maximum length of each session in seconds. The integration will have the permissions assigned only when the session is initiated and for the defined duration.'
  name: sessionDuration
  type: 0
  required: false
  section: Connect
- display: Access Key
  additionalinfo: The access key ID and secret key used for authentication that was configured during IAM user configuration. If this is used, Role ARN is not required.
  name: credentials
  displaypassword: Secret Key
  type: 9
  required: false
  section: Connect
- display: Timeout
  name: timeout
  additionalinfo: The time in seconds until a timeout exception is reached. You can specify just the read timeout (for example 60) or also the connect timeout preceded by a comma (for example 60,10). If a connect timeout is not specified, a default of 10 seconds will be used.
  defaultvalue: 60,10
  type: 0
  required: false
  section: Connect
  advanced: true
- display: Retries
  name: retries
  defaultvalue: 5
  additionalinfo: "The maximum number of retry attempts when connection or throttling errors are encountered. Set to 0 to disable retries. The default value is 5 and the limit is 10. Note: Increasing the number of retries will increase the execution time."
  type: 0
  required: false
  section: Connect
  advanced: true
- display: PrivateLink service URL.
  name: endpoint_url
  type: 0
  section: Connect
  advanced: true
  required: false
- display: STS PrivateLink URL.
  name: sts_endpoint_url
  type: 0
  section: Connect
  advanced: true
  required: false
- display: AWS STS Regional Endpoints
  additionalinfo: Sets the AWS_STS_REGIONAL_ENDPOINTS environment variable to specify the AWS STS endpoint resolution logic. By default, this option is set to “legacy” in AWS. Leave empty if the environment variable is already set using server configuration.
  name: sts_regional_endpoint
  options:
  - legacy
  - regional
  type: 15
  section: Connect
  required: false
- display: First fetch time
  name: first_fetch
  defaultvalue: '3 days ago'
  type: 0
  required: false
  section: Collect
- display: Number of events to fetch per fetch.
  name: limit
  type: 0
  defaultvalue: 1000
  required: false
  section: Collect
- display: Guard Duty Severity level
  name: gd_severity
  required: true
  type: 15
  additionalinfo: 'The severity level or higher of findings to be fetched. Possible values: Low, Medium, or High. For example, if you set the severity level to Medium, only findings with severity level Medium or High will be fetched.'
  options:
  - 'Low'
  - 'Medium'
  - 'High'
  defaultvalue: 'Low'
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Exclude archived/suppressed findings
  name: exclude_archived
  type: 8
  required: false
  defaultvalue: 'false'
  additionalinfo: When selected, findings that have been archived in GuardDuty (including those archived by suppression rules) are not fetched.
  section: Collect
- display: Fetch Events
  name: isFetchEvents
  type: 8
  required: false
  section: Collect
  hidden:
  - xsoar
- display: Events Fetch Interval
  name: eventFetchInterval
  type: 19
  required: false
  defaultvalue: '1'
  section: Collect
  advanced: true
  hidden:
  - xsoar
description: Amazon Web Services Guard Duty Service (gd) event collector integration for Cortex XSIAM.
script:
  script: ""
  type: python
  commands:
  - arguments:
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Set this argument to True to create events, otherwise the command will only display them.
      name: should_push_events
      predefined:
      - 'true'
      - 'false'
      required: true
    - auto: PREDEFINED
      defaultValue: 'Low'
      description: The minimum severity of the events to fetch (inclusive).
      name: severity
      predefined:
      - 'Low'
      - 'Medium'
      - 'High'
      required: true
    - description: The date to start collecting the events from.
      name: collect_from
    - description: The maximum amount of events to return.
      name: limit
    description: Manual command used to fetch events and display them.
    name: aws-gd-get-events
  dockerimage: demisto/boto3py3:1.0.0.10221838
  isfetchevents: true
  subtype: python3
marketplaces:
- marketplacev2
- platform
tests:
- No test
fromversion: 6.8.0
supportedModules:
- xsiam