GuardDuty Runbook Generator
Project description
GuardDuty Runbook Generator
Create a runbook for all available GuardDuty finding types found on the GuardDuty docs website using the information documented for each finding.
This project is a kick-start to generate a base set of runbooks when GuardDuty is enabled in an organization. Runbooks will need to be customized to fit organizational incident response procedures and add contextual information.
Generating Runbooks
This tool can be installed from PyPI
pip install guardduty-runbooks
It can also be installed locally. After cloning the directory, run in the folder:
pip install .
The tool can then be run with optional flags:
guardduty-runbooks [--outdir outdir] [--overwrite]
If outdir
is not specified, it will write all runbooks to the local directory.
guardduty-runbooks --outdir ./my-runbook-directory
This tool can be run multiple times to create runbooks for new finding types. Run the tool again over the directory where runbooks are stored and it will write new runbooks only, unless --overwrite
is specified. Overwrite is a destructive command and will erase any customization made to the runbook.
guardduty-runbooks --outdir ./my-runbook-directory --overwrite
Runbook filenames are written using the "finding type" specified by GuardDuty. Because finding types include non alphanumeric characters like :, /, !,
and .
, those characters are replaced with dashes -
and all other characters are made lowercase. This is for ease of programatically locating runbooks for tools like Panther and Matano.
For example:
CryptoCurrency:EC2/BitcoinTool.B!DNS
becomes cryptocurrency-ec2-bitcointool-b-dns
License
Runbook content generated from docs.aws.amazon.com are licensed under CC-BY-SA-4.0 per AWS Site Terms.
Related projects/links
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Hashes for guardduty_runbooks-0.2.0-py3-none-any.whl
Algorithm | Hash digest | |
---|---|---|
SHA256 | 9fd20304b3ae35eca580f449d01abc7cf202b5221497ffc770e8ded0ce78ba89 |
|
MD5 | 12bb280a8c509817d508ddcd2214cf0a |
|
BLAKE2b-256 | a158674e819ad89be25dc3a16798feac5136e2116f78914c993c79fa096bfc0e |