Remove cloudtrail deadman in favor of generic deadman alert

This commit is contained in:
Brandon Myers 2020-04-01 13:46:23 -05:00
Родитель 5289a9fbed
Коммит aab3debc07
Не найден ключ, соответствующий данной подписи
Идентификатор ключа GPG: 8AA79AD83045BBC7
1 изменённых файлов: 0 добавлений и 35 удалений

Просмотреть файл

@ -1,35 +0,0 @@
#!/usr/bin/env python
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at https://mozilla.org/MPL/2.0/.
# Copyright (c) 2017 Mozilla Corporation
from lib.deadman_alerttask import DeadmanAlertTask
from mozdef_util.query_models import SearchQuery, TermMatch
class AlertCloudtrailDeadman(DeadmanAlertTask):
def main(self):
search_query = SearchQuery(hours=1)
search_query.add_must([
TermMatch('source', 'cloudtrail')
])
self.filtersManual(search_query)
self.searchEventsSimple()
self.walkEvents()
# Set alert properties
# if no events found
def onNoEvent(self):
category = 'deadman'
tags = ['cloudtrail', 'aws']
severity = 'ERROR'
summary = 'No cloudtrail events found the last hour'
# Create the alert object based on these properties
return self.createAlertDict(summary, category, tags, [], severity=severity)