HiveBrain v1.2.0
Get Started
← Back to all entries
patternMinor

CloudWatch trigger for a range of GuardDuty severities

Submitted by: @import:stackexchange-devops··
0
Viewed 0 times
cloudwatchtriggerguarddutyrangeseveritiesfor

Problem

I want to edit my CloudWatch rule so that it only triggers an SNS topic for "GuardDuty findings" that fall in the High severy range, defined by AWS as the value of the severity parameter in the GetFindings response falls within the 7.0 to 8.9 range.

The sample Event Pattern in the documentation only shows how to create a trigger for severities 5 and 8 as follows:

{
  "source": [ "aws.guardduty" ],
  "detail-type": [ "GuardDuty Finding" ],
  "detail": {  "severity": [ 5, 8 ]  }
}


How do I change this { "severity": [ 5, 8 ] } to be a range between 7.0 to 8.9?

Solution

I used this post to get our Guard Duty alerts working, thanks! But a recent change at AWS caused us to stop getting any alerts. Turns out we needed to add the integer values along with floating point numbers. We used a CLI command like the following to do that:

aws events put-rule --name Test --event-pattern "{\"source\":[\"aws.guardduty\"],\"detail-type\":[\"GuardDuty Finding\"],\"detail\":{\"severity\":[7.0,7.1,7.2,7.3,7.4,7.5,7.6,7.7,7.8,7.9,8.0,8.1,8.2,8.3,8.4,8.5,8.6,8.7,8.8,8.9,7,8]}}"

Note the "7" and "8" at the end. Alerts are working again.

Context

StackExchange DevOps Q#3622, answer score: 3

Revisions (0)

No revisions yet.