/*
Copyright (Apache License 2.0): Ventz Petkov
Repository: https://github.com/ventz/guardduty-slack-notify
Initial Release: 9-15-2019
*/
Configure in 4 easy steps, and make sure to edit Lambda function with your own Slack Incoming Webhook URL.
1.) Enable GuardDuty and configure 5-minute subsequent findings:
Notifications for subsequent finding occurrences – By default, for every finding with a unique finding ID, GuardDuty aggregates all subsequent occurrences of a particular finding that take place in 6-hour intervals into a single event. GuardDuty then sends a notification about these subsequent occurrences based on this event. In other words, by default, for the subsequent occurrences of the existing findings, GuardDuty sends notifications based on CloudWatch events every 6 hours. You can configure this for: 15 minutes, 1 hour, or the default 6 hours. It is recommended to use 15 minutes (via GuardDuty Console -> Settings)!
You can enable the next three steps in the Console via point-and-click, or via the CLI:
2.) Enable CloudWatch rule to send events for all GuardDuty findings:
aws events put-rule --name GuardDuty --event-pattern "{\"source\":[\"aws.guardduty\"]}"
3.) Attach the Lambda function as a target foro the rule:
aws events put-targets --rule GuardDuty --targets Id=1,Arn=arn:aws:lambda:us-east-1:111122223333:function:<your_function_name>
4.) Add permissions to invoke the target:
aws lambda add-permission --function-name <your_function> --statement-id 1 --action 'lambda:InvokeFunction' --principal events.amazonaws.com
https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_sns.html
https://aws.amazon.com/premiumsupport/knowledge-center/guardduty-cloudwatch-sns-rule/
https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-ug.pdf (For CLI Automation of Cloud Watch, SNS, and Lambda)