Documentation
¶
Overview ¶
Package securityalert implements the aws.security_alert source plugin.
It emits vendor-neutral security_alert evidence records. AWS-specific detection is expressed as CloudWatch Logs metric filters (a filter pattern over CloudTrail events) wired to CloudWatch metric alarms. The vendor-specific knowledge of which filter pattern means which kind of security event lives HERE, in the plugin: each metric filter is classified into a normalized event_class enum. Policies then check "an active alert exists for event class X" without ever touching an AWS filter pattern.
Index ¶
Constants ¶
const EvidenceTypeID = "security_alert"
EvidenceTypeID is the single evidence type this plugin emits.
const SourceID = "aws.security_alert"
SourceID is the registered ID for the aws.security_alert plugin instance.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type API ¶
type API interface {
DescribeMetricFilters(ctx context.Context, params *cwl.DescribeMetricFiltersInput, optFns ...func(*cwl.Options)) (*cwl.DescribeMetricFiltersOutput, error)
DescribeAlarms(ctx context.Context, params *cw.DescribeAlarmsInput, optFns ...func(*cw.Options)) (*cw.DescribeAlarmsOutput, error)
}
API is the subset of AWS clients this plugin uses.
type Plugin ¶
type Plugin struct {
// contains filtered or unexported fields
}
Plugin is the in-process aws.security_alert source.
func NewFromAWS ¶
NewFromAWS constructs a Plugin backed by the real AWS SDK clients.
func (*Plugin) Collect ¶
func (p *Plugin) Collect(ctx context.Context, req core.SlotRequest) ([]core.EvidenceRecord, error)
Collect lists CloudWatch metric filters and alarms, classifies each metric filter into a normalized event_class, and emits one security_alert record per metric filter that maps to a recognized event class.
Source Files