订阅 GuardDuty 告 SNS 主题 - Amazon GuardDuty
Amazon Web Services 文档中描述的 Amazon Web Services 服务或功能可能因区域而异。要查看适用于中国区域的差异,请参阅中国的 Amazon Web Services 服务入门

本文属于机器翻译版本。若本译文内容与英语原文存在差异,则一律以英文原文为准。

订阅 GuardDuty 告 SNS 主题

本节提供有关订阅 GuardDuty 公告 SNS 主题以接收有关新发布的调查结果类型、现有调查结果类型的更新以及其他功能更改的通知的信息。通知以 Amazon SNS 支持的所有格式提供。

GuardDuty SNS 主题提供有关卫安服务的更新信息Amazon添加到任何已订阅的帐户。要接收有关账户内发现结果的通知,请参阅使用 Amazon CloudWatch Events 创建自定义响应 GuardDuty 调查结果

注意

您的用户账户必须拥有 sns::subscribe IAM 权限才能订阅 SNS 主题。

您可以为 Amazon SQS 队列订阅此通知主题,但您必须使用位于同一区域内的主题 ARN。有关更多信息,请参阅 。教程:为 Amazon SNS 主题订阅 Amazon SNS 主题(在《Amazon Simple Service 开发人员指南》中。)

您还可以使用Amazon Lambda函数在收到通知时触发事件。有关更多信息,请参阅 Amazon Simple Notification Service 开发人员指南中的使用 Amazon SNS 通知调用 Lambda 函数

每个区域的 Amazon SNS 主题 ARN 如下所示。

Amazon区域 Amazon SNS 主题 ARN
us-east-1 arn:aws:sns:us-east-1:242987662583:GuardDutyAnnouncements
us-east-2 arn:aws:sns:us-east-2:118283430703:GuardDutyAnnouncements
us-west-1 arn:aws:sns:us-west-1:144182107116:GuardDutyAnnouncements
us-west-2 arn:aws:sns:us-west-2:934957504740:GuardDutyAnnouncements
ca-central-1 arn:aws:sns:ca-central-1:107430051933:GuardDutyAnnouncements
eu-north-1 arn:aws:sns:eu-north-1:973841112453:GuardDutyAnnouncements
eu-west-1 arn:aws:sns:eu-west-1:965013871422:GuardDutyAnnouncements
eu-west-2 arn:aws:sns:eu-west-2:506403581195:GuardDutyAnnouncements
eu-west-3 arn:aws:sns:eu-west-3:436163563069:GuardDutyAnnouncements
eu-central-1 arn:aws:sns:eu-central-1:378365507264:GuardDutyAnnouncements
ap-east-1 arn:aws:sns:ap-east-1:646602203151:GuardDutyAnnouncements
ap-northeast-1 arn:aws:sns:ap-northeast-1:741172661024:GuardDutyAnnouncements
ap-northeast-2 arn:aws:sns:ap-northeast-2:464168911255:GuardDutyAnnouncements
ap-southeast-1 arn:aws:sns:ap-southeast-1:476419727788:GuardDutyAnnouncements
ap-southeast-2 arn:aws:sns:ap-southeast-2:457615622431:GuardDutyAnnouncements
ap-south-1 arn:aws:sns:ap-south-1:926826061926:GuardDutyAnnouncements
sa-east-1 arn:aws:sns:sa-east-1:955633302743:GuardDutyAnnouncements
us-gov-west-1 arn:aws-us-gov:sns:us-gov-west-1:430639793359:GuardDutyAnnouncements
cn-north-1 arn:aws-cn:sns:cn-north-1:002991280229:GuardDutyAnnouncements
cn-northwest-1 arn:aws-cn:sns:cn-northwest-1:003033775354:GuardDutyAnnouncements

在中订阅 GuardDuty 更新通知电子邮件Amazon Web Services Management Console

  1. 通过以下网址打开 Amazon SNS 控制台:https://console.aws.amazon.com/sns/v3/home

  2. 在区域列表中,选择与要订阅的主题 ARN 相同的区域。此示例使用us-west-2区域。

  3. 在左侧导航窗格中,依次选择订阅创建订阅

  4. Create Subscription (创建订阅) 对话框中,对于 Topic ARN (主题 ARN),粘贴主题 ARN:arn:aws:sns:us-west-2:934957504740:GuardDutyAnnouncements

  5. 对于协议,选择电子邮件。对于终端节点,请键入您可用于接收通知的电子邮件地址。

  6. 选择 Create subscription

  7. 在您的电子邮件应用程序中,打开来自Amazon通知并打开链接以确认订阅。

    您的 Web 浏览器将显示来自 Amazon SNS 的确认响应。

使用订阅 GuardDuty 更新通知电子邮件Amazon CLI

  1. 使用 Amazon CLI 运行以下命令:

    Amazon sns --region us-west-2 subscribe --topic-arn arn:aws:sns:us-west-2:934957504740:GuardDutyAnnouncements --protocol email --notification-endpoint your_email@your_domain.com
  2. 在您的电子邮件应用程序中,打开来自Amazon通知并打开链接以确认订阅。

    您的 Web 浏览器将显示来自 Amazon SNS 的确认响应。

Amazon SNS 格式

有关新调查结果的示例 GuardDuty 更新通知消息如下所示:

{ "Type" : "Notification", "MessageId" : "9101dc6b-726f-4df0-8646-ec2f94e674bc", "TopicArn" : "arn:aws:sns:us-west-2:934957504740:GuardDutyAnnouncements", "Message" : "{\"version\":\"1\",\"type\":\"NEW_FINDINGS\",\"findingDetails\":[{\"link\":\"https://docs.aws.amazon.com//guardduty/latest/ug/guardduty_unauthorized.html\",\"findingType\":\"UnauthorizedAccess:EC2/TorClient\",\"findingDescription\":\"This finding informs you that an EC2 instance in your Amazon environment is making connections to a Tor Guard or an Authority node. Tor is software for enabling anonymous communication. Tor Guards and Authority nodes act as initial gateways into a Tor network. This traffic can indicate that this EC2 instance is acting as a client on a Tor network. A common use for a Tor client is to circumvent network monitoring and filter for access to unauthorized or illicit content. Tor clients can also generate nefarious Internet traffic, including attacking SSH servers. This activity can indicate that your EC2 instance is compromised.\"}]}", "Timestamp" : "2018-03-09T00:25:43.483Z", "SignatureVersion" : "1", "Signature" : "XWox8GDGLRiCgDOXlo/fG9Lu/88P8S0FL6M6oQYOmUFzkucuhoblsdea3BjqdCHcWR7qdhMPQnLpN7y9iBrWVUqdAGJrukAI8athvAS+4AQD/V/QjrhsEnlj+GaiW+ozAu006X6GopOzFGnCtPMROjCMrMonjz7Hpv/8KRuMZR3pyQYm5d4wWB7xBPYhUMuLoZ1V8YFs55FMtgQV/YLhSYuEu0BP1GMtLQauxDkscOtPP/vjhGQLFx1Q9LTadcQiRHtNIBxWL87PSI+BVvkin6AL7PhksvdQ7FAgHfXsit+6p8GyOvKCqaeBG7HZhR1AbpyVka7JSNRO/6ssyrlj1g==", "SigningCertURL" : "https://sns.us-west-2.amazonaws.com/SimpleNotificationService-433026a4050d206028891664da859041.pem", "UnsubscribeURL" : "https://sns.us-west-2.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:us-west-2:934957504740:GuardDutyAnnouncements:9225ed2b-7228-4665-8a01-c8a5db6859f4" }

解析的消息值 (删除了转义引号) 如下所示:

{ "version": "1", "type": "NEW_FINDINGS", "findingDetails": [{ "link": "https://docs.aws.amazon.com//guardduty/latest/ug/guardduty_unauthorized.html", "findingType": "UnauthorizedAccess:EC2/TorClient", "findingDescription": "This finding informs you that an EC2 instance in your Amazon environment is making connections to a Tor Guard or an Authority node. Tor is software for enabling anonymous communication. Tor Guards and Authority nodes act as initial gateways into a Tor network. This traffic can indicate that this EC2 instance is acting as a client on a Tor network. A common use for a Tor client is to circumvent network monitoring and filter for access to unauthorized or illicit content. Tor clients can also generate nefarious Internet traffic, including attacking SSH servers. This activity can indicate that your EC2 instance is compromised." }] }

有关 GuardDuty 功能更新的示例 GuardDuty 更新通知消息如下所示:

{ "Type" : "Notification", "MessageId" : "9101dc6b-726f-4df0-8646-ec2f94e674bc", "TopicArn" : "arn:aws:sns:us-west-2:934957504740:GuardDutyAnnouncements", "Message" : "{\"version\":\"1\",\"type\":\"NEW_FEATURES\",\"featureDetails\":[{\"featureDescription\":\"Customers with high-volumes of global CloudTrail events should see a net positive impact on their GuardDuty costs.\",\"featureLink\":\"https://docs.aws.amazon.com//guardduty/latest/ug/guardduty_data-sources.html#guardduty_cloudtrail\"}]}", "Timestamp" : "2018-03-09T00:25:43.483Z", "SignatureVersion" : "1", "Signature" : "XWox8GDGLRiCgDOXlo/fG9Lu/88P8S0FL6M6oQYOmUFzkucuhoblsdea3BjqdCHcWR7qdhMPQnLpN7y9iBrWVUqdAGJrukAI8athvAS+4AQD/V/QjrhsEnlj+GaiW+ozAu006X6GopOzFGnCtPMROjCMrMonjz7Hpv/8KRuMZR3pyQYm5d4wWB7xBPYhUMuLoZ1V8YFs55FMtgQV/YLhSYuEu0BP1GMtLQauxDkscOtPP/vjhGQLFx1Q9LTadcQiRHtNIBxWL87PSI+BVvkin6AL7PhksvdQ7FAgHfXsit+6p8GyOvKCqaeBG7HZhR1AbpyVka7JSNRO/6ssyrlj1g==", "SigningCertURL" : "https://sns.us-west-2.amazonaws.com/SimpleNotificationService-433026a4050d206028891664da859041.pem", "UnsubscribeURL" : "https://sns.us-west-2.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:us-west-2:934957504740:GuardDutyAnnouncements:9225ed2b-7228-4665-8a01-c8a5db6859f4" }

解析的消息值 (删除了转义引号) 如下所示:

{ "version": "1", "type": "NEW_FEATURES", "featureDetails": [{ "featureDescription": "Customers with high-volumes of global CloudTrail events should see a net positive impact on their GuardDuty costs.", "featureLink": "https://docs.aws.amazon.com//guardduty/latest/ug/guardduty_data-sources.html#guardduty_cloudtrail" }] }

有关更新的调查结果的示例 GuardDuty 更新通知消息如下所示:

{ "Type": "Notification", "MessageId": "9101dc6b-726f-4df0-8646-ec2f94e674bc", "TopicArn": "arn:aws:sns:us-west-2:934957504740:GuardDutyAnnouncements", "Message": "{\"version\":\"1\",\"type\":\"UPDATED_FINDINGS\",\"findingDetails\":[{\"link\":\"https://docs.aws.amazon.com//guardduty/latest/ug/guardduty_unauthorized.html\",\"findingType\":\"UnauthorizedAccess:EC2/TorClient\",\"description\":\"Increased severity value from 5 to 8.\"}]}", "Timestamp": "2018-03-09T00:25:43.483Z", "SignatureVersion": "1", "Signature": "XWox8GDGLRiCgDOXlo/fG9Lu/88P8S0FL6M6oQYOmUFzkucuhoblsdea3BjqdCHcWR7qdhMPQnLpN7y9iBrWVUqdAGJrukAI8athvAS+4AQD/V/QjrhsEnlj+GaiW+ozAu006X6GopOzFGnCtPMROjCMrMonjz7Hpv/8KRuMZR3pyQYm5d4wWB7xBPYhUMuLoZ1V8YFs55FMtgQV/YLhSYuEu0BP1GMtLQauxDkscOtPP/vjhGQLFx1Q9LTadcQiRHtNIBxWL87PSI+BVvkin6AL7PhksvdQ7FAgHfXsit+6p8GyOvKCqaeBG7HZhR1AbpyVka7JSNRO/6ssyrlj1g==", "SigningCertURL": "https://sns.us-west-2.amazonaws.com/SimpleNotificationService-433026a4050d206028891664da859041.pem", "UnsubscribeURL": "https://sns.us-west-2.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:us-west-2:934957504740:GuardDutyAnnouncements:9225ed2b-7228-4665-8a01-c8a5db6859f4" }

解析的消息值 (删除了转义引号) 如下所示:

{ "version": "1", "type": "UPDATED_FINDINGS", "findingDetails": [{ "link": "https://docs.aws.amazon.com//guardduty/latest/ug/guardduty_unauthorized.html", "findingType": "UnauthorizedAccess:EC2/TorClient", "description": "Increased severity value from 5 to 8." }] }