DEPRECATED

patrol-rules-guardduty

A set of Patrol functions for AWS GuardDuty. Patrol-rules-guardduty publishes SNS messages to Dispatch for interactive alarm routing.

Functions

Description - Processes new AWS GuardDuty alerts and sends alerts meeting a minimum serverity threshold to an SNS topic.
Trigger - aws.guardduty API calls
Parameters
- dispatchSnsArn - SNS topic ARN for your dispatch-incoming AWS Lambda function
- pagerdutyServiceId - PagerDuty service ID
- minimumThreshold - A number for the minimum severity threshold for GuardDuty alerts. To receive all GuardDuty alerts, use 2. For medium alerts and above, use 5. For high, use 8.

To deploy patrol-rules-guardduty, you’ll need to install lambda-cfn locally as well as setup and deploy Dispatch on your AWS infrastructure.

This project uses lambda-cfn to manage and deploy AWS CloudFormation templates. Check out the lambda-cfn and Patrol README’s for instructions on how to use lambda-cfn with Patrol projects.

To install lambda-cfn on your machine, run npm install -g @mapbox/lambda-cfn.

More instructions are available in the lambda-cfn README.

Check out the Dispatch setup instructions for detailed instructions on how to deploy Dispatch to your AWS infrastructure.

Use lambda-cfn to deploy each patrol-rules-guardduty function. Each AWS Lambda function is its own AWS CloudFormation stack.

For example, to create a development stack for the minimumThreshold function:

git clone git@github.com:mapbox/patrol-rules-guardduty.git
cd patrol-rules-guardduty/minimumThreshold
lambda-cfn create dev

Lambda-cfn will ask for parameter values when creating new CloudFormation stacks. Check out the guide to lambda-cfn parameter values and the functions section for help.

Patrol-rules-guardduty uses eslint for linting and tape for tests. It mocks HTTP requests with nock. Tests run on Travis CI after every commit.