зеркало из https://github.com/mozilla/MozDef.git
Remove cloudtrail deadman in favor of generic deadman alert
This commit is contained in:
Родитель
5289a9fbed
Коммит
aab3debc07
|
@ -1,35 +0,0 @@
|
|||
#!/usr/bin/env python
|
||||
|
||||
# This Source Code Form is subject to the terms of the Mozilla Public
|
||||
# License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
# file, You can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
# Copyright (c) 2017 Mozilla Corporation
|
||||
|
||||
|
||||
from lib.deadman_alerttask import DeadmanAlertTask
|
||||
from mozdef_util.query_models import SearchQuery, TermMatch
|
||||
|
||||
|
||||
class AlertCloudtrailDeadman(DeadmanAlertTask):
|
||||
def main(self):
|
||||
search_query = SearchQuery(hours=1)
|
||||
|
||||
search_query.add_must([
|
||||
TermMatch('source', 'cloudtrail')
|
||||
])
|
||||
|
||||
self.filtersManual(search_query)
|
||||
self.searchEventsSimple()
|
||||
self.walkEvents()
|
||||
|
||||
# Set alert properties
|
||||
# if no events found
|
||||
def onNoEvent(self):
|
||||
category = 'deadman'
|
||||
tags = ['cloudtrail', 'aws']
|
||||
severity = 'ERROR'
|
||||
|
||||
summary = 'No cloudtrail events found the last hour'
|
||||
|
||||
# Create the alert object based on these properties
|
||||
return self.createAlertDict(summary, category, tags, [], severity=severity)
|
Загрузка…
Ссылка в новой задаче