patternMinor
CloudWatch trigger for a range of GuardDuty severities
Viewed 0 times
cloudwatchtriggerguarddutyrangeseveritiesfor
Problem
I want to edit my CloudWatch rule so that it only triggers an SNS topic for "GuardDuty findings" that fall in the High severy range, defined by AWS as
The sample Event Pattern in the documentation only shows how to create a trigger for severities 5 and 8 as follows:
How do I change this
the value of the severity parameter in the GetFindings response falls within the 7.0 to 8.9 range.The sample Event Pattern in the documentation only shows how to create a trigger for severities 5 and 8 as follows:
{
"source": [ "aws.guardduty" ],
"detail-type": [ "GuardDuty Finding" ],
"detail": { "severity": [ 5, 8 ] }
}How do I change this
{ "severity": [ 5, 8 ] } to be a range between 7.0 to 8.9?Solution
I used this post to get our Guard Duty alerts working, thanks! But a recent change at AWS caused us to stop getting any alerts. Turns out we needed to add the integer values along with floating point numbers. We used a CLI command like the following to do that:
Note the "
aws events put-rule --name Test --event-pattern "{\"source\":[\"aws.guardduty\"],\"detail-type\":[\"GuardDuty Finding\"],\"detail\":{\"severity\":[7.0,7.1,7.2,7.3,7.4,7.5,7.6,7.7,7.8,7.9,8.0,8.1,8.2,8.3,8.4,8.5,8.6,8.7,8.8,8.9,7,8]}}"Note the "
7" and "8" at the end. Alerts are working again.Context
StackExchange DevOps Q#3622, answer score: 3
Revisions (0)
No revisions yet.