Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions cloudwatchevents/guardduty/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -17,10 +17,10 @@ Made with ❤️ by Sumo Logic AppDev Team. Available on the [AWS Serverless App
## Lambda Environment Variables
The following AWS Lambda environment variables are supported

SUMO_ENDPOINT (REQUIRED) - SumoLogic HTTP Collector endpoint URL.
SOURCE_CATEGORY_OVERRIDE (OPTIONAL) - Override _sourceCategory metadata field within SumoLogic. If none will not be overridden
SOURCE_HOST_OVERRIDE (OPTIONAL) - Override _sourceHost metadata field within SumoLogic. If none will not be overridden
SOURCE_NAME_OVERRIDE (OPTIONAL) - Override _sourceName metadata field within SumoLogic. If none will not be overridden
- SUMO_ENDPOINT (REQUIRED) - SumoLogic HTTP Collector endpoint URL.
- SOURCE_CATEGORY_OVERRIDE (OPTIONAL) - Override _sourceCategory metadata field within SumoLogic. If none will not be overridden
- SOURCE_HOST_OVERRIDE (OPTIONAL) - Override _sourceHost metadata field within SumoLogic. If none will not be overridden
- SOURCE_NAME_OVERRIDE (OPTIONAL) - Override _sourceName metadata field within SumoLogic. If none will not be overridden

## Excluding Outer Event Fields

Expand Down
24 changes: 22 additions & 2 deletions cloudwatchevents/guardduty/packaged.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -8,16 +8,36 @@ Description: 'This function is invoked by AWS CloudWatch events in response to s
Globals:
Function:
Timeout: 300
Metadata:
AWS::ServerlessRepo::Application:
Author: Sumo Logic
Description: This function is invoked by AWS CloudWatch events in response to
state change in your AWS resources which matches a event target definition.
The event payload received is then forwarded to Sumo Logic HTTP source endpoint.
HomePageUrl: https://github.com/SumoLogic/sumologic-aws-lambda
Labels:
- sumologic
- serverless
- guardduty
- security
- cloudwatchevents
- guardduty
Name: sumologic-guardduty-events-processor
LicenseUrl: s3://appdevstore/GuardDuty/v1.0.3/6092dd6c323e33634657102f570628e0
ReadmeUrl: s3://appdevstore/GuardDuty/v1.0.3/9d217c45b3ababadef584aee27d4d607
SemanticVersion: 1.0.3
SourceCodeUrl: https://github.com/SumoLogic/sumologic-aws-lambda/tree/master/cloudwatchevents/guardduty
SpdxLicenseId: Apache-2.0
Parameters:
SumoEndpointUrl:
Type: String
Resources:
CloudWatchEventFunction:
Type: AWS::Serverless::Function
Properties:
CodeUri: s3://appdevstore/GuardDuty/v1.0.2/0d13904d1fbd69ecd879992058f1aa41
CodeUri: s3://appdevstore/GuardDuty/v1.0.3/58c7f17decc811a6e8904a19a9f844a1
Handler: cloudwatchevents.handler
Runtime: nodejs10.x
Runtime: nodejs14.x
Environment:
Variables:
SUMO_ENDPOINT:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -53,10 +53,11 @@ Metadata:
- benchmark
- guardduty
Name: sumologic-guardduty-benchmark
LicenseUrl: s3://appdevstore/guarddutybenchmark/v1.0.10/cac1a6df52c685e0f6ebe4ae72078c80
ReadmeUrl: s3://appdevstore/guarddutybenchmark/v1.0.10/cab012d7fb7887671b751e6f5c0d2062
SemanticVersion: 1.0.10
LicenseUrl: s3://appdevstore/guarddutybenchmark/v1.0.11/6092dd6c323e33634657102f570628e0
ReadmeUrl: s3://appdevstore/guarddutybenchmark/v1.0.11/cab012d7fb7887671b751e6f5c0d2062
SemanticVersion: 1.0.11
SourceCodeUrl: https://github.com/SumoLogic/sumologic-aws-lambda/tree/master/cloudwatchevents/guarddutybenchmark
SpdxLicenseId: Apache-2.0
Parameters:
CollectorName:
Type: String
Expand All @@ -83,7 +84,7 @@ Parameters:
- us1
- in
- fed
Description: Enter au, ca, de, eu, jp, us2, or us1
Description: Enter in, fed, au, ca, de, eu, jp, us2, or us1
RemoveSumoResourcesOnDeleteStack:
AllowedValues:
- true
Expand All @@ -95,7 +96,7 @@ Parameters:
Resources:
CloudWatchEventFunction:
Properties:
CodeUri: s3://appdevstore/guarddutybenchmark/v1.0.10/0d13904d1fbd69ecd879992058f1aa41
CodeUri: s3://appdevstore/guarddutybenchmark/v1.0.11/58c7f17decc811a6e8904a19a9f844a1
Environment:
Variables:
SUMO_ENDPOINT:
Expand All @@ -110,14 +111,14 @@ Resources:
- aws.guardduty
Type: CloudWatchEvent
Handler: cloudwatchevents.handler
Runtime: nodejs10.x
Runtime: nodejs14.x
Type: AWS::Serverless::Function
SumoAppUtils:
Type: AWS::Serverless::Application
Properties:
Location:
ApplicationId: arn:aws:serverlessrepo:us-east-1:956882708938:applications/sumologic-app-utils
SemanticVersion: 1.0.24
SemanticVersion: 2.0.6
SumoHostedCollector:
Type: Custom::Collector
Properties:
Expand Down Expand Up @@ -174,7 +175,7 @@ Resources:
- Outputs.SumoAppUtilsFunction
Region:
Ref: AWS::Region
AppName: Amazon GuardDuty Benchmark
AppName: Global Intelligence for Amazon GuardDuty
AppId: 8e7efcb3-040a-4a92-9f8d-922fafb24afb
RemoveOnDeleteStack:
Ref: RemoveSumoResourcesOnDeleteStack
Expand Down
6 changes: 3 additions & 3 deletions cloudwatchevents/test/testdeploy.sh
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
#!/bin/bash

export AWS_REGION="us-east-1"
export AWS_PROFILE="personal"
export AWS_PROFILE="default"

if [[ "${AWS_PROFILE}" == "personal" ]]
then
Expand All @@ -18,7 +18,7 @@ app_names=(

sam --version
# Regex to deploy only expected templates.
match_case=""
match_case="guarddutybenchmark"

for app_name in "${app_names[@]}"
do
Expand All @@ -35,7 +35,7 @@ do
sam package --profile ${AWS_PROFILE} --template-file ../"${KEY}/${VALUE}" --s3-bucket ${SAM_S3_BUCKET} --output-template-file ../"${KEY}"/packaged.yaml \
--s3-prefix "${KEY}/v${version}"

sam publish --template ../"${KEY}"/packaged.yaml --region ${AWS_REGION} --semantic-version "${version}"
sam publish --profile ${AWS_PROFILE} --template ../"${KEY}"/packaged.yaml --region ${AWS_REGION} --semantic-version "${version}"
echo "Publish done"
fi
done