import json
import demistomock as demisto # noqa: F401
from CommonServerPython import * # noqa: F401
def extract_aws_info(event):
arn = event.get("userIdentity", {}).get("arn")
access_key_id = event.get("userIdentity", {}).get("accessKeyId")
resource_name = event.get("userIdentity", {}).get("instanceId")
source_ip = event.get("sourceIPAddress")
username = event.get("userIdentity", {}).get("sessionContext", {}).get("sessionIssuer", {}).get("userName")
event_name = event.get("eventName")
user_agent = event.get("userAgent")
return arn, access_key_id, resource_name, source_ip, username, event_name, user_agent
def extract_gcp_info(event):
resource_name = event.get("protoPayload", {}).get("resourceName")
source_ip = event.get("protoPayload", {}).get("requestMetadata", {}).get("callerIp")
username = event.get("protoPayload", {}).get("authenticationInfo", {}).get("principalEmail")
event_name = event.get("protoPayload", {}).get("methodName")
user_agent = event.get("protoPayload", {}).get("requestMetadata", {}).get("callerSuppliedUserAgent")
return resource_name, source_ip, username, event_name, user_agent
def extract_event_info(event):
if event.get("eventSource") and "amazonaws.com" in event.get("eventSource"):
return "AWS", extract_aws_info(event)
elif event.get("logName", "").startswith("projects/"):
return "GCP", extract_gcp_info(event)
else:
raise ValueError("Unknown event type")
def main(): # pragma: no cover
try:
args = demisto.args()
json_data = args.get("json_data")
data = json.loads(json_data) if isinstance(json_data, str) else json_data
results = None
# Extract information from AWS event
event_type, event_info = extract_event_info(data)
if event_type == "AWS":
results = CommandResults(
outputs_prefix="CloudIndicators",
outputs={
"arn": event_info[0],
"access_key_id": event_info[1],
"resource_name": event_info[2],
"source_ip": event_info[3],
"username": event_info[4],
"event_name": event_info[5],
"user_agent": event_info[6],
},
)
# Extract information from GCP event
elif event_type == "GCP":
results = CommandResults(
outputs_prefix="CloudIndicators",
outputs={
"resource_name": event_info[0],
"source_ip": event_info[1],
"username": event_info[2],
"event_name": event_info[3],
"user_agent": event_info[4],
},
)
return_results(results)
except Exception as e:
return_error(f"An error occurred: {e!s}")
if __name__ in ("__builtin__", "builtins", "__main__"):
main()