feat(eb): add guardduty finding to event bridge rule (SSPROD-41990) (#…

…123) * add guardduty finding to event bridge rule * add variable for event pattern rule * remove new line * new line
sysdiglabs · Jun 25, 2024 · cbd331e · cbd331e
1 parent d5baab4
commit cbd331e
Show file tree

Hide file tree

Showing 4 changed files with 191 additions and 87 deletions.
diff --git a/templates_cspm_eventbridge/FullInstall.yaml b/templates_cspm_eventbridge/FullInstall.yaml
@@ -13,6 +13,7 @@ Metadata:
           - EventBusARN
           - EventBridgeRoleName
           - EventBridgeState
+          - EventBridgeEventPattern
 
     ParameterLabels:
       RoleName:
@@ -27,8 +28,9 @@ Metadata:
         default: "Integration Name (Sysdig use only)"
       EventBridgeState:
         default: "State of the EventBridge Rule (Sysdig use only)"
-
-
+      EventBridgeEventPattern:
+        default: "Event Pattern (Sysdig use only)"
+
 Parameters:
   RoleName:
     Type: String
@@ -53,6 +55,28 @@ Parameters:
       - ENABLED_WITH_ALL_CLOUDTRAIL_MANAGEMENT_EVENTS
       - ENABLED
       - DISABLED
+  EventBridgeEventPattern:
+    Type: String
+    Description: JSON pattern for the EventBridge rule's event pattern
+    Default: |
+      {
+        "detail-type": [
+          "AWS API Call via CloudTrail",
+          "AWS Console Sign In via CloudTrail",
+          "AWS Service Event via CloudTrail",
+          "Object Access Tier Changed",
+          "Object ACL Updated",
+          "Object Created",
+          "Object Deleted",
+          "Object Restore Completed",
+          "Object Restore Expired",
+          "Object Restore Initiated",
+          "Object Storage Class Changed",
+          "Object Tags Added",
+          "Object Tags Deleted",
+          "GuardDuty Finding"
+        ]
+      }
 
 Resources:
   CloudAgentlessRole:
@@ -133,27 +157,12 @@ Resources:
     Type: AWS::Events::Rule
     Properties:
       Name: !Ref EventBridgeRoleName
-      Description: Capture all CloudTrail events
-      EventPattern:
-        detail-type:
-          - 'AWS API Call via CloudTrail'
-          - 'AWS Console Sign In via CloudTrail'
-          - 'AWS Service Event via CloudTrail'
-          - 'Object Access Tier Changed'
-          - 'Object ACL Updated'
-          - 'Object Created'
-          - 'Object Deleted'
-          - 'Object Restore Completed'
-          - 'Object Restore Expired'
-          - 'Object Restore Initiated'
-          - 'Object Storage Class Changed'
-          - 'Object Tags Added'
-          - 'Object Tags Deleted'
+      Description: Capture events based on the provided event pattern
+      EventPattern: !Ref EventBridgeEventPattern
       State: !Ref EventBridgeState
       Targets:
         - Id: !Ref EventBridgeRoleName
           Arn: !Ref EventBusARN
           RoleArn: !GetAtt
             - EventBridgeRole
             - Arn
-
diff --git a/templates_cspm_eventbridge/OrgFullInstall.yaml b/templates_cspm_eventbridge/OrgFullInstall.yaml
@@ -1,5 +1,6 @@
 AWSTemplateFormatVersion: "2010-09-09"
 Description: IAM Role and EventBridge resources used by Sysdig Secure
+
 Metadata:
   AWS::CloudFormation::Interface:
     ParameterGroups:
@@ -14,6 +15,7 @@ Metadata:
           - Regions
           - OrganizationUnitIDs
           - EventBridgeState
+          - EventBridgeEventPattern
     ParameterLabels:
       CSPMRoleName:
         default: "CSPM Role Name (Sysdig use only)"
@@ -30,7 +32,10 @@ Metadata:
       OrganizationUnitIDs:
         default: "Organization Unit IDs (Sysdig use only)"
       EventBridgeState:
-        default: "State of the EventBridge Rule (Sysdig use only)"  
+        default: "State of the EventBridge Rule (Sysdig use only)"
+      EventBridgeEventPattern:
+        default: "Event Pattern (Sysdig use only)"  
+
 Parameters:
   CSPMRoleName:
     Type: String
@@ -61,7 +66,29 @@ Parameters:
       - ENABLED_WITH_ALL_CLOUDTRAIL_MANAGEMENT_EVENTS
       - ENABLED
       - DISABLED
-
+  EventBridgeEventPattern:
+    Type: String
+    Description: JSON pattern for the EventBridge rule's event pattern
+    Default: |
+      {
+        "detail-type": [
+          "AWS API Call via CloudTrail",
+          "AWS Console Sign In via CloudTrail",
+          "AWS Service Event via CloudTrail",
+          "Object Access Tier Changed",
+          "Object ACL Updated",
+          "Object Created",
+          "Object Deleted",
+          "Object Restore Completed",
+          "Object Restore Expired",
+          "Object Restore Initiated",
+          "Object Storage Class Changed",
+          "Object Tags Added",
+          "Object Tags Deleted",
+          "GuardDuty Finding"
+        ]
+      }
+
 Resources:
   AdministrationRole:
     Type: AWS::IAM::Role
@@ -357,6 +384,7 @@ Resources:
                   - 'Object Storage Class Changed'
                   - 'Object Tags Added'
                   - 'Object Tags Deleted'
+                  - 'GuardDuty Finding'
               State: !Sub ${EventBridgeState}
               Targets:
                 - Id: !Sub ${EventBridgeRoleName}
@@ -388,6 +416,8 @@ Resources:
           ParameterValue: !Ref EventBusARN
         - ParameterKey: EventBridgeState
           ParameterValue: !Ref EventBridgeState
+        - ParameterKey: EventBridgeEventPattern
+          ParameterValue: !Ref EventBridgeEventPattern
       StackInstancesGroup:
         - DeploymentTargets:
             Accounts:
@@ -410,28 +440,36 @@ Resources:
             AllowedValues:
               - ENABLED_WITH_ALL_CLOUDTRAIL_MANAGEMENT_EVENTS
               - ENABLED
-              - DISABLED                     
+              - DISABLED
+          EventBridgeEventPattern:
+            Type: String
+            Description: JSON pattern for the EventBridge rule's event pattern
+            Default: |
+              {
+                "detail-type": [
+                  "AWS API Call via CloudTrail",
+                  "AWS Console Sign In via CloudTrail",
+                  "AWS Service Event via CloudTrail",
+                  "Object Access Tier Changed",
+                  "Object ACL Updated",
+                  "Object Created",
+                  "Object Deleted",
+                  "Object Restore Completed",
+                  "Object Restore Expired",
+                  "Object Restore Initiated",
+                  "Object Storage Class Changed",
+                  "Object Tags Added",
+                  "Object Tags Deleted",
+                  "GuardDuty Finding"
+                ]
+              }
         Resources:           
           EventBridgeRule:
             Type: "AWS::Events::Rule"
             Properties:
               Name: !Sub ${EventBridgeRoleName}
               Description: Capture all CloudTrail events
-              EventPattern:
-                detail-type:
-                  - 'AWS API Call via CloudTrail'
-                  - 'AWS Console Sign In via CloudTrail'
-                  - 'AWS Service Event via CloudTrail'
-                  - 'Object Access Tier Changed'
-                  - 'Object ACL Updated'
-                  - 'Object Created'
-                  - 'Object Deleted'
-                  - 'Object Restore Completed'
-                  - 'Object Restore Expired'
-                  - 'Object Restore Initiated'
-                  - 'Object Storage Class Changed'
-                  - 'Object Tags Added'
-                  - 'Object Tags Deleted'
+              EventPattern: !Ref EventBridgeEventPattern
               State: !Sub ${EventBridgeState}
               Targets:
                 - Id: !Sub ${EventBridgeRoleName}

diff --git a/templates_eventbridge/EventBridge.yaml b/templates_eventbridge/EventBridge.yaml
@@ -11,6 +11,8 @@ Metadata:
           - ExternalID
           - TrustedIdentity
           - EventBusARN
+          - EventBridgeState
+          - EventBridgeEventPattern
 
     ParameterLabels:
       ExternalID:
@@ -23,6 +25,8 @@ Metadata:
         default: "Integration Name (Sysdig use only)"
       EventBridgeState:
         default: "State of the EventBridge Rule (Sysdig use only)"
+      EventBridgeEventPattern:
+        default: "Event Pattern (Sysdig use only)"
 
 Parameters:
   EventBridgeRoleName:
@@ -45,6 +49,28 @@ Parameters:
       - ENABLED_WITH_ALL_CLOUDTRAIL_MANAGEMENT_EVENTS
       - ENABLED
       - DISABLED
+  EventBridgeEventPattern:
+    Type: String
+    Description: JSON pattern for the EventBridge rule's event pattern
+    Default: |
+      {
+        "detail-type": [
+          "AWS API Call via CloudTrail",
+          "AWS Console Sign In via CloudTrail",
+          "AWS Service Event via CloudTrail",
+          "Object Access Tier Changed",
+          "Object ACL Updated",
+          "Object Created",
+          "Object Deleted",
+          "Object Restore Completed",
+          "Object Restore Expired",
+          "Object Restore Initiated",
+          "Object Storage Class Changed",
+          "Object Tags Added",
+          "Object Tags Deleted",
+          "GuardDuty Finding"
+        ]
+      }
 
 Resources:
   EventBridgeRole:
@@ -83,25 +109,11 @@ Resources:
     Properties:
       Name: !Ref EventBridgeRoleName
       Description: Capture all CloudTrail events
-      EventPattern:
-        detail-type:
-          - 'AWS API Call via CloudTrail'
-          - 'AWS Console Sign In via CloudTrail'
-          - 'AWS Service Event via CloudTrail'
-          - 'Object Access Tier Changed'
-          - 'Object ACL Updated'
-          - 'Object Created'
-          - 'Object Deleted'
-          - 'Object Restore Completed'
-          - 'Object Restore Expired'
-          - 'Object Restore Initiated'
-          - 'Object Storage Class Changed'
-          - 'Object Tags Added'
-          - 'Object Tags Deleted'
+      EventPattern: !Ref EventBridgeEventPattern
       State: !Ref EventBridgeState
       Targets:
         - Id: !Ref EventBridgeRoleName
           Arn: !Ref EventBusARN
           RoleArn: !GetAtt
             - EventBridgeRole
-            - Arn    
+            - Arn