Amazon GuardDuty サンプル・イベント・メッセージ

{"schemaVersion":"2.0","accountId":"111111111111","region":"region","partition":"aws","id":"6ab971cccd774293fcb8a9eaff944711","arn":"arn:aws:guardduty:region:111111111111:detector/42b0d9e4fcad1600d444fc52278999c2/finding/6ab971cccd774293fcb8a9eaff944711","type":"Policy:S3/BucketBlockPublicAccessDisabled","resource":{"resourceType":"AccessKey","accessKeyDetails":{"accessKeyId":"GeneratedFindingAccessKeyId","principalId":"GeneratedFindingPrincipalId","userType":"IAMUser","userName":"GeneratedFindingUserName"},"s3BucketDetails":[{"arn":"arn:aws:s3:::bucketName","name":"bucketName","type":"Destination","createdAt":"1513612692","owner":{"id":"CanonicalId of Owner"},"tags":[{"key":"foo","value":"bar"}],"defaultServerSideEncryption":{"encryptionType":"SSEAlgorithm","kmsMasterKeyArn":"arn:aws:kms:region:123456789012:key/key-id"},"publicAccess":{"permissionConfiguration":{"bucketLevelPermissions":{"accessControlList":{"allowsPublicReadAccess":false,"allowsPublicWriteAccess":false},"bucketPolicy":{"allowsPublicReadAccess":false,"allowsPublicWriteAccess":false},"blockPublicAccess":{"ignorePublicAcls":false,"restrictPublicBuckets":false,"blockPublicAcls":false,"blockPublicPolicy":false}},"accountLevelPermissions":{"blockPublicAccess":{"ignorePublicAcls":false,"restrictPublicBuckets":false,"blockPublicAcls":false,"blockPublicPolicy":false}}},"effectivePermission":"NOT_PUBLIC"}}],"instanceDetails":{"instanceId":"i-99999999","instanceType":"m3.xlarge","outpostArn":"arn:aws:outposts:region-name:123456789000:outpost/op-0fbc006e9abbc73c3","launchTime":"2016-08-02T02:05:06Z","platform":null,"productCodes":[{"productCodeId":"GeneratedFindingProductCodeId","productCodeType":"GeneratedFindingProductCodeType"}],"iamInstanceProfile":{"arn":"GeneratedFindingInstanceProfileArn","id":"GeneratedFindingInstanceProfileId"},"networkInterfaces":[{"ipv6Addresses":[],"networkInterfaceId":"test","privateDnsName":"GeneratedFindingPrivateDnsName","privateIpAddress":"10.0.0.1","privateIpAddresses":[{"privateDnsName":"GeneratedFindingPrivateName","privateIpAddress":"10.0.0.1"}],"subnetId":"GeneratedFindingSubnetId","vpcId":"GeneratedFindingVPCId","securityGroups":[{"groupName":"GeneratedFindingSecurityGroupName","groupId":"GeneratedFindingSecurityId"}],"publicDnsName":"GeneratedFindingPublicDNSName","publicIp":"10.51.100.0"}],"tags":[{"key":"GeneratedFindingInstaceTag1","value":"GeneratedFindingInstaceValue1"},{"key":"GeneratedFindingInstaceTag2","value":"GeneratedFindingInstaceTagValue2"},{"key":"GeneratedFindingInstaceTag3","value":"GeneratedFindingInstaceTagValue3"},{"key":"GeneratedFindingInstaceTag4","value":"GeneratedFindingInstaceTagValue4"},{"key":"GeneratedFindingInstaceTag5","value":"GeneratedFindingInstaceTagValue5"},{"key":"GeneratedFindingInstaceTag6","value":"GeneratedFindingInstaceTagValue6"},{"key":"GeneratedFindingInstaceTag7","value":"GeneratedFindingInstaceTagValue7"},{"key":"GeneratedFindingInstaceTag8","value":"GeneratedFindingInstaceTagValue8"},{"key":"GeneratedFindingInstaceTag9","value":"GeneratedFindingInstaceTagValue9"}],"instanceState":"running","availabilityZone":"GeneratedFindingInstaceAvailabilityZone","imageId":"ami-99999999","imageDescription":"GeneratedFindingInstaceImageDescription"}},"service":{"serviceName":"guardduty","detectorId":"11a1a1a1aaaa1111a111aa11111111a1","action":{"actionType":"AWS_API_CALL","awsApiCallAction":{"api":"GeneratedFindingAPIName","serviceName":"GeneratedFindingAPIServiceName","callerType":"Remote IP","remoteIpDetails":{"ipAddressV4":"10.51.100.0","organization":{"asn":"-1","asnOrg":"GeneratedFindingASNOrg","isp":"GeneratedFindingISP","org":"GeneratedFindingORG"},"country":{"countryName":"GeneratedFindingCountryName"},"city":{"cityName":"GeneratedFindingCityName"},"geoLocation":{"lat":44.972686,"lon":-65.860879}},"affectedResources":{"AWS::S3::Bucket":"GeneratedFindingS3Bucket"}}},"resourceRole":"TARGET","additionalInfo":{"unusual":{"hoursOfDay":[1513609200000],"userNames":["GeneratedFindingUserName"]},"sample":true},"eventFirstSeen":"2020-06-23T23:53:14.222Z","eventLastSeen":"2020-06-24T00:26:33.501Z","archived":false,"count":2},"severity":2,"createdAt":"2020-06-23T23:53:14.222Z","updatedAt":"2020-06-24T00:26:33.501Z","title":"Amazon S3 Block Public Access was disabled for S3 bucket GeneratedFindingS3Bucket.","description":"Amazon S3 Block Public Access was disabled for S3 bucket GeneratedFindingS3Bucket by GeneratedFindingUserName calling GeneratedFindingAPIName. If this behavior is not expected, it may indicate a configuration mistake or that your credentials are compromised."}

{"schemaVersion":"2.0","accountId":"111111111111","region":"region","partition":"aws","id":"90b971cccd774ee2570756fda343dd2a","arn":"arn:aws:guardduty:region:111111111111:detector/42b0d9e4fcad1600d444fc52278999c2/finding/90b971cccd774ee2570756fda343dd2a","type":"Stealth:S3/ServerAccessLoggingDisabled","resource":{"resourceType":"AccessKey","accessKeyDetails":{"accessKeyId":"GeneratedFindingAccessKeyId","principalId":"GeneratedFindingPrincipalId","userType":"IAMUser","userName":"GeneratedFindingUserName"},"s3BucketDetails":[{"arn":"arn:aws:s3:::bucketName","name":"bucketName","type":"Destination","createdAt":"1513612692","owner":{"id":"CanonicalId of Owner"},"tags":[{"key":"foo","value":"bar"}],"defaultServerSideEncryption":{"encryptionType":"SSEAlgorithm","kmsMasterKeyArn":"arn:aws:kms:region:123456789012:key/key-id"},"publicAccess":{"permissionConfiguration":{"bucketLevelPermissions":{"accessControlList":{"allowsPublicReadAccess":false,"allowsPublicWriteAccess":false},"bucketPolicy":{"allowsPublicReadAccess":false,"allowsPublicWriteAccess":false},"blockPublicAccess":{"ignorePublicAcls":false,"restrictPublicBuckets":false,"blockPublicAcls":false,"blockPublicPolicy":false}},"accountLevelPermissions":{"blockPublicAccess":{"ignorePublicAcls":false,"restrictPublicBuckets":false,"blockPublicAcls":false,"blockPublicPolicy":false}}},"effectivePermission":"NOT_PUBLIC"}}],"instanceDetails":{"instanceId":"i-99999999","instanceType":"m3.xlarge","outpostArn":"arn:aws:outposts:region-name:123456789000:outpost/op-0fbc006e9abbc73c3","launchTime":"2016-08-02T02:05:06Z","platform":null,"productCodes":[{"productCodeId":"GeneratedFindingProductCodeId","productCodeType":"GeneratedFindingProductCodeType"}],"iamInstanceProfile":{"arn":"GeneratedFindingInstanceProfileArn","id":"GeneratedFindingInstanceProfileId"},"networkInterfaces":[{"ipv6Addresses":[],"networkInterfaceId":"test","privateDnsName":"GeneratedFindingPrivateDnsName","privateIpAddress":"10.0.0.1","privateIpAddresses":[{"privateDnsName":"GeneratedFindingPrivateName","privateIpAddress":"10.0.0.1"}],"subnetId":"GeneratedFindingSubnetId","vpcId":"GeneratedFindingVPCId","securityGroups":[{"groupName":"GeneratedFindingSecurityGroupName","groupId":"GeneratedFindingSecurityId"}],"publicDnsName":"GeneratedFindingPublicDNSName","publicIp":"10.51.100.0"}],"tags":[{"key":"GeneratedFindingInstaceTag1","value":"GeneratedFindingInstaceValue1"},{"key":"GeneratedFindingInstaceTag2","value":"GeneratedFindingInstaceTagValue2"},{"key":"GeneratedFindingInstaceTag3","value":"GeneratedFindingInstaceTagValue3"},{"key":"GeneratedFindingInstaceTag4","value":"GeneratedFindingInstaceTagValue4"},{"key":"GeneratedFindingInstaceTag5","value":"GeneratedFindingInstaceTagValue5"},{"key":"GeneratedFindingInstaceTag6","value":"GeneratedFindingInstaceTagValue6"},{"key":"GeneratedFindingInstaceTag7","value":"GeneratedFindingInstaceTagValue7"},{"key":"GeneratedFindingInstaceTag8","value":"GeneratedFindingInstaceTagValue8"},{"key":"GeneratedFindingInstaceTag9","value":"GeneratedFindingInstaceTagValue9"}],"instanceState":"running","availabilityZone":"GeneratedFindingInstaceAvailabilityZone","imageId":"ami-99999999","imageDescription":"GeneratedFindingInstaceImageDescription"}},"service":{"serviceName":"guardduty","detectorId":"11a1a1a1aaaa1111a111aa11111111a1","action":{"actionType":"AWS_API_CALL","awsApiCallAction":{"api":"GeneratedFindingAPIName","serviceName":"GeneratedFindingAPIServiceName","callerType":"Remote IP","remoteIpDetails":{"ipAddressV4":"10.51.100.0","organization":{"asn":"-1","asnOrg":"GeneratedFindingASNOrg","isp":"GeneratedFindingISP","org":"GeneratedFindingORG"},"country":{"countryName":"GeneratedFindingCountryName"},"city":{"cityName":"GeneratedFindingCityName"},"geoLocation":{"lat":44.972686,"lon":-65.860879}},"affectedResources":{"AWS::S3::Bucket":"GeneratedFindingS3Bucket"}}},"resourceRole":"TARGET","additionalInfo":{"unusual":{"hoursOfDay":[1513609200000],"userNames":["GeneratedFindingUserName"]},"sample":true},"eventFirstSeen":"2020-06-23T23:53:14.222Z","eventLastSeen":"2020-06-24T00:26:33.501Z","archived":false,"count":2},"severity":2,"createdAt":"2020-06-23T23:53:14.222Z","updatedAt":"2020-06-24T00:26:33.501Z","title":"Amazon S3 Server Access Logging was disabled for S3 bucket GeneratedFindingS3Bucket.","description":"Amazon S3 Server Access Logging was disabled for S3 bucket GeneratedFindingS3Bucket by GeneratedFindingUserName calling PutBucketLogging. This can lead to lack of visibility into actions taken on the affected S3 bucket and its objects if an event occurs."}