订阅Amazon SNS GuardDuty 公告 - 亚马逊 GuardDuty
Amazon SNS 消息格式
Amazon Web Services 文档中描述的 Amazon Web Services 服务或功能可能因区域而异。要查看适用于中国区域的差异，请参阅 中国的 Amazon Web Services 服务入门 (PDF)。

本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

订阅Amazon SNS GuardDuty 公告

本部分提供有关订阅 Amazon SNS 消息的信息。 GuardDuty 通知以 Amazon SNS 支持的所有格式提供。

GuardDuty SNS 会向任何订阅的账户发送有关该 GuardDuty Amazon服务更新的公告。要接收有关账户内发现结果的通知，请参阅使用 Amazon Ev CloudWatch ents 创建针对 GuardDuty 调查结果的自定义响应。

注意

您的 IS 用户必须具有订阅 SNS 的sns::subscribe权限。

您可以为 Amazon SQS 队列订阅此通知主题，但必须使用位于同一区域的主题 ARN。有关更多信息，请参阅 AAmazon SQS Amazon S NS 队列。

您还可以使用Amazon Lambda函数在收到通知时触发事件。有关更多信息，请参阅 Amazon SNS 通知调用 Lambda 函数。

每个地区的Amazon SNS 主题 ARN 如下所示。

Amazon 区域 Amazon SNS ARN
us-east-1 arn:aws:sns:us-east-1:242987662583:GuardDutyAnnouncements
us-east-2 arn:aws:sns:us-east-2:118283430703:GuardDutyAnnouncements
us-west-1 arn:aws:sns:us-west-1:144182107116:GuardDutyAnnouncements
us-west-2 arn:aws:sns:us-west-2:934957504740:GuardDutyAnnouncements
ca-central-1 arn:aws:sns:ca-central-1:107430051933:GuardDutyAnnouncements
eu-north-1 arn:aws:sns:eu-north-1:973841112453:GuardDutyAnnouncements
eu-west-1 arn:aws:sns:eu-west-1:965013871422:GuardDutyAnnouncements
eu-west-2 arn:aws:sns:eu-west-2:506403581195:GuardDutyAnnouncements
eu-west-3 arn:aws:sns:eu-west-3:436163563069:GuardDutyAnnouncements
eu-central-1 arn:aws:sns:eu-central-1:378365507264:GuardDutyAnnouncements
eu-central-2 arn:aws:sns:eu-central-2:383009515534:GuardDutyAnnouncements
ap-east-1 arn:aws:sns:ap-east-1:646602203151:GuardDutyAnnouncements
ap-northeast-1 arn:aws:sns:ap-northeast-1:741172661024:GuardDutyAnnouncements
ap-northeast-2 arn:aws:sns:ap-northeast-2:464168911255:GuardDutyAnnouncements
ap-southeast-1 arn:aws:sns:ap-southeast-1:476419727788:GuardDutyAnnouncements
ap-southeast-2 arn:aws:sns:ap-southeast-2:457615622431:GuardDutyAnnouncements
ap-south-1 arn:aws:sns:ap-south-1:926826061926:GuardDutyAnnouncements
sa-east-1 arn:aws:sns:sa-east-1:955633302743:GuardDutyAnnouncements
us-gov-west-1 arn:aws-us-gov:sns:us-gov-west-1:430639793359:GuardDutyAnnouncements
cn-north-1 arn:aws-cn:sns:cn-north-1:002991280229:GuardDutyAnnouncements
cn-northwest-1 arn:aws-cn:sns:cn-northwest-1:003033775354:GuardDutyAnnouncements
me-south-1 arn:aws:sns:me-south-1:552740612889:GuardDutyAnnouncements
me-central-1 arn:aws:sns:me-central-1:030935290150:GuardDutyAnnouncements
eu-south-1 arn:aws:sns:eu-south-1:188461706213:GuardDutyAnnouncements
us-gov-east-1 arn:aws:sns:us-gov-east-1:143972945659:GuardDutyAnnouncements
ap-northeast-3 arn:aws:sns:ap-northeast-3:129086577509:GuardDutyAnnouncements
ap-southeast-3 arn:aws:sns:ap-southeast-3:225965583551:GuardDutyAnnouncements
ap-south-2 arn:aws:sns:ap-south-2:595653072700:GuardDutyAnnouncements
要订阅 GuardDuty 更新通知电子邮件，请访问Amazon Web Services Management Console

  1. 通过以下网址打开 Amazon SNS 控制台：https://console.aws.amazon.com/sns/v3/home。

  2. 在区域列表中，选择与要订阅的主题 ARN 相同的区域。此示例使用us-west-2区域。

  3. 在左侧导航窗格中，依次选择订阅和创建订阅。

  4. 在 Create Subscription (创建订阅) 对话框中，对于 Topic ARN (主题 ARN)，粘贴主题 ARN：arn:aws:sns:us-west-2:934957504740:GuardDutyAnnouncements。

  5. 对于协议，选择电子邮件。对于终端节点，请键入您可用于接收通知的电子邮件地址。

  6. 选择 Create subscription（创建订阅）。

  7. 在您的电子邮件应用程序中，打开Amazon通知中的消息并打开链接以确认您的订阅。

    您的 Web 浏览器将显示来自 Amazon SNS 的确认响应。

要订阅 GuardDuty 更新通知电子邮件，请使用Amazon CLI

  1. 使用 Amazon CLI 运行以下命令：

     aws  sns --region us-west-2 subscribe --topic-arn arn:aws:sns:us-west-2:934957504740:GuardDutyAnnouncements --protocol email --notification-endpoint your_email@your_domain.com

  2. 在您的电子邮件应用程序中，打开Amazon通知中的消息并打开链接以确认您的订阅。

    您的 Web 浏览器将显示来自 Amazon SNS 的确认响应。

Amazon SNS 消息格式

有关新发现的 GuardDuty 更新通知消息示例如下所示：

{
    "Type" : "Notification",
    "MessageId" : "9101dc6b-726f-4df0-8646-ec2f94e674bc",
    "TopicArn" : "arn:aws:sns:us-west-2:934957504740:GuardDutyAnnouncements",
    "Message" : "{\"version\":\"1\",\"type\":\"NEW_FINDINGS\",\"findingDetails\":[{\"link\":\"https://docs.aws.amazon.com//guardduty/latest/ug/guardduty_unauthorized.html\",\"findingType\":\"UnauthorizedAccess:EC2/TorClient\",\"findingDescription\":\"This finding informs you that an EC2 instance in your Amazon environment is making connections to a Tor Guard or an Authority node. Tor is software for enabling anonymous communication. Tor Guards and Authority nodes act as initial gateways into a Tor network. This traffic can indicate that this EC2 instance is acting as a client on a Tor network. A common use for a Tor client is to circumvent network monitoring and filter for access to unauthorized or illicit content. Tor clients can also generate nefarious Internet traffic, including attacking SSH servers. This activity can indicate that your EC2 instance is compromised.\"}]}",
    "Timestamp" : "2018-03-09T00:25:43.483Z",
    "SignatureVersion" : "1",
    "Signature" : "XWox8GDGLRiCgDOXlo/fG9Lu/88P8S0FL6M6oQYOmUFzkucuhoblsdea3BjqdCHcWR7qdhMPQnLpN7y9iBrWVUqdAGJrukAI8athvAS+4AQD/V/QjrhsEnlj+GaiW+ozAu006X6GopOzFGnCtPMROjCMrMonjz7Hpv/8KRuMZR3pyQYm5d4wWB7xBPYhUMuLoZ1V8YFs55FMtgQV/YLhSYuEu0BP1GMtLQauxDkscOtPP/vjhGQLFx1Q9LTadcQiRHtNIBxWL87PSI+BVvkin6AL7PhksvdQ7FAgHfXsit+6p8GyOvKCqaeBG7HZhR1AbpyVka7JSNRO/6ssyrlj1g==",
    "SigningCertURL" : "https://sns.us-west-2.amazonaws.com/SimpleNotificationService-433026a4050d206028891664da859041.pem",
    "UnsubscribeURL" : "https://sns.us-west-2.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:us-west-2:934957504740:GuardDutyAnnouncements:9225ed2b-7228-4665-8a01-c8a5db6859f4"
}

解析后的消息值（删除了转义引号）如下所示：

{
    "version": "1",
    "type": "NEW_FINDINGS",
    "findingDetails": [{
        "link": "https://docs.aws.amazon.com//guardduty/latest/ug/guardduty_unauthorized.html",
        "findingType": "UnauthorizedAccess:EC2/TorClient",
        "findingDescription": "This finding informs you that an EC2 instance in your Amazon environment is making connections to a Tor Guard or an Authority node. Tor is software for enabling anonymous communication. Tor Guards and Authority nodes act as initial gateways into a Tor network. This traffic can indicate that this EC2 instance is acting as a client on a Tor network. A common use for a Tor client is to circumvent network monitoring and filter for access to unauthorized or illicit content. Tor clients can also generate nefarious Internet traffic, including attacking SSH servers. This activity can indicate that your EC2 instance is compromised."
    }]
}

有关 GuardDuty 功能 GuardDuty 更新的示例更新通知消息如下所示：

{
    "Type" : "Notification",
    "MessageId" : "9101dc6b-726f-4df0-8646-ec2f94e674bc",
    "TopicArn" : "arn:aws:sns:us-west-2:934957504740:GuardDutyAnnouncements",
    "Message" : "{\"version\":\"1\",\"type\":\"NEW_FEATURES\",\"featureDetails\":[{\"featureDescription\":\"Customers with high-volumes of global CloudTrail events should see a net positive impact on their GuardDuty costs.\",\"featureLink\":\"https://docs.aws.amazon.com//guardduty/latest/ug/guardduty_data-sources.html#guardduty_cloudtrail\"}]}",
    "Timestamp" : "2018-03-09T00:25:43.483Z",
    "SignatureVersion" : "1",
    "Signature" : "XWox8GDGLRiCgDOXlo/fG9Lu/88P8S0FL6M6oQYOmUFzkucuhoblsdea3BjqdCHcWR7qdhMPQnLpN7y9iBrWVUqdAGJrukAI8athvAS+4AQD/V/QjrhsEnlj+GaiW+ozAu006X6GopOzFGnCtPMROjCMrMonjz7Hpv/8KRuMZR3pyQYm5d4wWB7xBPYhUMuLoZ1V8YFs55FMtgQV/YLhSYuEu0BP1GMtLQauxDkscOtPP/vjhGQLFx1Q9LTadcQiRHtNIBxWL87PSI+BVvkin6AL7PhksvdQ7FAgHfXsit+6p8GyOvKCqaeBG7HZhR1AbpyVka7JSNRO/6ssyrlj1g==",
    "SigningCertURL" : "https://sns.us-west-2.amazonaws.com/SimpleNotificationService-433026a4050d206028891664da859041.pem",
    "UnsubscribeURL" : "https://sns.us-west-2.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:us-west-2:934957504740:GuardDutyAnnouncements:9225ed2b-7228-4665-8a01-c8a5db6859f4"
}

解析后的消息值（删除了转义引号）如下所示：

{
    "version": "1",
    "type": "NEW_FEATURES",
    "featureDetails": [{
        "featureDescription": "Customers with high-volumes of global CloudTrail events should see a net positive impact on their GuardDuty costs.",
        "featureLink": "https://docs.aws.amazon.com//guardduty/latest/ug/guardduty_data-sources.html#guardduty_cloudtrail"
    }]
}

有关更新的发现的 GuardDuty 更新通知消息示例如下所示：

{
    "Type": "Notification",
    "MessageId": "9101dc6b-726f-4df0-8646-ec2f94e674bc",
    "TopicArn": "arn:aws:sns:us-west-2:934957504740:GuardDutyAnnouncements",
    "Message": "{\"version\":\"1\",\"type\":\"UPDATED_FINDINGS\",\"findingDetails\":[{\"link\":\"https://docs.aws.amazon.com//guardduty/latest/ug/guardduty_unauthorized.html\",\"findingType\":\"UnauthorizedAccess:EC2/TorClient\",\"description\":\"Increased severity value from 5 to 8.\"}]}",
    "Timestamp": "2018-03-09T00:25:43.483Z",
    "SignatureVersion": "1",
    "Signature": "XWox8GDGLRiCgDOXlo/fG9Lu/88P8S0FL6M6oQYOmUFzkucuhoblsdea3BjqdCHcWR7qdhMPQnLpN7y9iBrWVUqdAGJrukAI8athvAS+4AQD/V/QjrhsEnlj+GaiW+ozAu006X6GopOzFGnCtPMROjCMrMonjz7Hpv/8KRuMZR3pyQYm5d4wWB7xBPYhUMuLoZ1V8YFs55FMtgQV/YLhSYuEu0BP1GMtLQauxDkscOtPP/vjhGQLFx1Q9LTadcQiRHtNIBxWL87PSI+BVvkin6AL7PhksvdQ7FAgHfXsit+6p8GyOvKCqaeBG7HZhR1AbpyVka7JSNRO/6ssyrlj1g==",
    "SigningCertURL": "https://sns.us-west-2.amazonaws.com/SimpleNotificationService-433026a4050d206028891664da859041.pem",
    "UnsubscribeURL": "https://sns.us-west-2.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:us-west-2:934957504740:GuardDutyAnnouncements:9225ed2b-7228-4665-8a01-c8a5db6859f4"
}

解析后的消息值（删除了转义引号）如下所示：

{
    "version": "1",
    "type": "UPDATED_FINDINGS",
    "findingDetails": [{
        "link": "https://docs.aws.amazon.com//guardduty/latest/ug/guardduty_unauthorized.html",
        "findingType": "UnauthorizedAccess:EC2/TorClient",
        "description": "Increased severity value from 5 to 8."
    }]
}