Panther high experimental python

AWS GuardDuty Enabled

GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior.

View Source

Detection Logic

# Add/remove regions as desired
REGIONS_REQUIRED = {
    "us-west-2",
}


def policy(resource):
    # Detector IDs are in the following format:
    # [AccountId]:[Region]:AWS.GuardDuty.Detector
    # so we grab the middle part to determine what regions have GuardDuty enabled
    regions_enabled = [detector.split(":")[1] for detector in resource["Detectors"]]
    for region in REGIONS_REQUIRED:
        if region not in regions_enabled:
            return False

    return True

Field Validations

Loading…

Comments (0)

Loading comments...