This integration will do three things:
@umbrellabot check out xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx
You'll need a free Transposit account and a free ipstack account for determining the physical location of an IP address. You'll also need the ability to install an application on Slack.
You'll need an AWS account.
AmazonS3FullAccess
AmazonAthenaFullAccess
enrich_cloudtrail_object
function at the top of the get_log_files
operation. This is where you mark interesting events with a priority.cloudtrail_bucket_name
: the name of your cloudtrail bucket.cloudtrail_initial_prefix
: the prefix to your CloudTrail log files. If you accept the default setup, it is: AWSLogs/xxxxxxx/CloudTrail/
where xxxxxxx
is your AWS account number.cloudtrail_processed_prefix
: by default the system stores the enriched log files in the same bucket and key as the unprocessed CloudTrail logs, except the key has this prefix added to it.athena_results_prefix
: the location (under cloudtrail_bucket_name
) where we store Athena results.slack_channel
: the name of the Slack channel you created above.scheduled_job
operation on whatever schedule you'd like notifications to occur. Running every 10 minutes: 0 /10 * ? * *
To interact with your bot, you need to create a Slack App. Here's the entire guide, but the cliff notes are:
webhook
url (something like https://athena-cloudtrail-slack-xxx.transposit.io/api/v1/execute-http/webhook?api_key=xxxx
).bot
, chat:write:bot
. Use https://accounts.transposit.com/oauth/v2/handle-redirect for the redirect URL.app_mention
event. Use the webhook
url from above for the 'Request URL'.CREATE EXTERNAL TABLE default.cloudtrail_enriched (
xpriority string,
eventTime string,
eventName string,
awsRegion string,
eventSource string,
eventID string
)
ROW FORMAT SERDE 'org.openx.data.jsonserde.JsonSerDe'
WITH SERDEPROPERTIES ('ignore.malformed.json' = 'true')
LOCATION 's3://[bucketname]/[cloudtrail_processed_prefixe]/[cloudtrail_initial_prefix]';