This integration will do three things:
@umbrellabot check out xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx
You'll need a free Transposit account and a free ipstack account for determining the physical location of an IP address. You'll also need the ability to install an application on Slack.
You'll need an AWS account.
enrich_cloudtrail_objectfunction at the top of the
get_log_filesoperation. This is where you mark interesting events with a priority.
cloudtrail_bucket_name: the name of your cloudtrail bucket.
cloudtrail_initial_prefix: the prefix to your CloudTrail log files. If you accept the default setup, it is:
xxxxxxxis your AWS account number.
cloudtrail_processed_prefix: by default the system stores the enriched log files in the same bucket and key as the unprocessed CloudTrail logs, except the key has this prefix added to it.
athena_results_prefix: the location (under
cloudtrail_bucket_name) where we store Athena results.
slack_channel: the name of the Slack channel you created above.
scheduled_joboperation on whatever schedule you'd like notifications to occur. Running every 10 minutes:
0 /10 * ? * *
To interact with your bot, you need to create a Slack App. Here's the entire guide, but the cliff notes are:
webhookurl (something like
chat:write:bot. Use https://accounts.transposit.com/oauth/v2/handle-redirect for the redirect URL.
app_mentionevent. Use the
webhookurl from above for the 'Request URL'.
CREATE EXTERNAL TABLE default.cloudtrail_enriched ( xpriority string, eventTime string, eventName string, awsRegion string, eventSource string, eventID string ) ROW FORMAT SERDE 'org.openx.data.jsonserde.JsonSerDe' WITH SERDEPROPERTIES ('ignore.malformed.json' = 'true') LOCATION 's3://[bucketname]/[cloudtrail_processed_prefixe]/[cloudtrail_initial_prefix]';