Detection and alert that uses cloudtrail, run in native aws using lambda.
Lambda send sns if there is a match for certain cloudtrail API call.
The goal is to detect CloudTrail API calls that are both high-impact and indicative of malicious activity by having a lambda that load from sigma signature.
I write about CTDE in my blog
Care must be use to choose the sigma rule that is very high-impact but not noisy. Some sigma examples are included and sigma-stash repository. I also included ConsoleLogin as a test sigma.
you can deploy using the provided terraform or by uploading the zipped lambda directory
- prerequisite:
- aws CLI is setup with the credentials
- copy lambda directory to deploy/terraform/lambda -> this will be zipped and uploaded by the terraform
- terraform init
- terraform plan -> please recheck
- terraform apply
- zip the lambda directory
- upload zip package
- set up variables:
- correct role and permission
- snsarn
- bucket name for cloudtrail
- bucket name for sigma
create IAC to deploy- add more sigma examples
- expand on sigma selection
- format email alert
- add threeshold feature to lambda
- add correlation feature to lambda
- Sigma rules from sigmaHQ