AWS GuardDuty Low Severity Finding

Description

A low-severity GuardDuty finding has been identified.

Query · python

from panther_aws_helpers import aws_guardduty_context


def rule(event):
    if event.deep_get("service", "additionalInfo", "sample"):
        # in case of sample data
        # https://docs.aws.amazon.com/guardduty/latest/ug/sample_findings.html
        return False
    return 0.1 <= float(event.get("severity", 0)) <= 3.9


def title(event):
    return event.get("title")


def alert_context(event):
    return aws_guardduty_context(event)

Analyst notes

Search related logs to understand the root cause of the activity. Search the Panther Summary Attribute type value in https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-active.html for additional details.

Raw source AWS GuardDuty Low Severity Finding · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
Filename: aws_guardduty_low_sev_findings.py
RuleID: "AWS.GuardDuty.LowSeverityFinding"
DisplayName: "AWS GuardDuty Low Severity Finding"
Enabled: true
LogTypes:
  - AWS.GuardDuty
Tags:
  - AWS
Severity: Low
DedupPeriodMinutes: 1440 # 24 hours
Description: >
  A low-severity GuardDuty finding has been identified.
Runbook: >
  Search related logs to understand the root cause of the activity.
  Search the Panther Summary Attribute type value in https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-active.html for additional details.
Reference: https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_findings.html#guardduty_findings-severity
SummaryAttributes:
  - severity
  - type
  - title
  - p_any_domain_names
  - p_any_aws_arns
  - p_any_aws_account_ids
Tests:
  - Name: Low Sev Finding
    ExpectedResult: true
    Log:
      {
        "schemaVersion": "2.0",
        "accountId": "123456789012",
        "region": "us-east-1",
        "partition": "aws",
        "arn": "arn:aws:guardduty:us-west-2:123456789012:detector/111111bbbbbbbbbb5555555551111111/finding/90b82273685661b9318f078d0851fe9a",
        "type": "PrivilegeEscalation:IAMUser/AdministrativePermissions",
        "service":
          {
            "serviceName": "guardduty",
            "detectorId": "111111bbbbbbbbbb5555555551111111",
            "action":
              {
                "actionType": "AWS_API_CALL",
                "awsApiCallAction":
                  {
                    "api": "PutRolePolicy",
                    "serviceName": "iam.amazonaws.com",
                    "callerType": "Domain",
                    "domainDetails":
                      { "domain": "cloudformation.amazonaws.com" },
                    "affectedResources":
                      {
                        "AWS::IAM::Role": "arn:aws:iam::123456789012:role/IAMRole",
                      },
                  },
              },
            "resourceRole": "TARGET",
            "additionalInfo": {},
            "evidence": null,
            "eventFirstSeen": "2020-02-14T17:59:17Z",
            "eventLastSeen": "2020-02-14T17:59:17Z",
            "archived": false,
            "count": 1,
          },
        "severity": 1,
        "id": "eeb88ab56556eb7771b266670dddee5a",
        "createdAt": "2020-02-14T18:12:22.316Z",
        "updatedAt": "2020-02-14T18:12:22.316Z",
        "title": "Principal AssumedRole:IAMRole attempted to add a policy to themselves that is highly permissive.",
        "description": "Principal AssumedRole:IAMRole attempted to add a highly permissive policy to themselves.",
      }
  - Name: Low Sev Finding As Sample Data
    ExpectedResult: false
    Log:
      {
        "schemaVersion": "2.0",
        "accountId": "123456789012",
        "region": "us-east-1",
        "partition": "aws",
        "arn": "arn:aws:guardduty:us-west-2:123456789012:detector/111111bbbbbbbbbb5555555551111111/finding/90b82273685661b9318f078d0851fe9a",
        "type": "PrivilegeEscalation:IAMUser/AdministrativePermissions",
        "service":
          {
            "serviceName": "guardduty",
            "detectorId": "111111bbbbbbbbbb5555555551111111",
            "action":
              {
                "actionType": "AWS_API_CALL",
                "awsApiCallAction":
                  {
                    "api": "PutRolePolicy",
                    "serviceName": "iam.amazonaws.com",
                    "callerType": "Domain",
                    "domainDetails":
                      { "domain": "cloudformation.amazonaws.com" },
                    "affectedResources":
                      {
                        "AWS::IAM::Role": "arn:aws:iam::123456789012:role/IAMRole",
                      },
                  },
              },
            "resourceRole": "TARGET",
            "additionalInfo": { "sample": true },
            "evidence": null,
            "eventFirstSeen": "2020-02-14T17:59:17Z",
            "eventLastSeen": "2020-02-14T17:59:17Z",
            "archived": false,
            "count": 1,
          },
        "severity": 1,
        "id": "eeb88ab56556eb7771b266670dddee5a",
        "createdAt": "2020-02-14T18:12:22.316Z",
        "updatedAt": "2020-02-14T18:12:22.316Z",
        "title": "Principal AssumedRole:IAMRole attempted to add a policy to themselves that is highly permissive.",
        "description": "Principal AssumedRole:IAMRole attempted to add a highly permissive policy to themselves.",
      }


# ------ paired body: aws_guardduty_low_sev_findings.py ------

from panther_aws_helpers import aws_guardduty_context


def rule(event):
    if event.deep_get("service", "additionalInfo", "sample"):
        # in case of sample data
        # https://docs.aws.amazon.com/guardduty/latest/ug/sample_findings.html
        return False
    return 0.1 <= float(event.get("severity", 0)) <= 3.9


def title(event):
    return event.get("title")


def alert_context(event):
    return aws_guardduty_context(event)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.