Skip to content

Commit 3160ee9

Browse files
author
Tejas Ganesh Naik
committed
guardduty basics implementation done by cl4b
1 parent 32d0a18 commit 3160ee9

File tree

12 files changed

+1592
-0
lines changed

12 files changed

+1592
-0
lines changed

‎.doc_gen/metadata/guardduty_metadata.yaml‎

Lines changed: 158 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,158 @@
1+
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
# GuardDuty code examples for the SDK for Python.
5+
guardduty_Hello:
6+
title: Hello &GD;
7+
title_abbrev: Hello &GD;
8+
synopsis: get started using &GD;.
9+
category: Hello
10+
languages:
11+
Python:
12+
versions:
13+
- sdk_version: 3
14+
github: python/example_code/guardduty
15+
excerpts:
16+
- description:
17+
snippet_tags:
18+
- python.example_code.guardduty.Hello
19+
services:
20+
guardduty: {ListDetectors}
21+
guardduty_CreateDetector:
22+
title: Create a &GD; detector using an &AWS; SDK
23+
title_abbrev: Create a detector
24+
synopsis: create a &GD; detector.
25+
category: Actions
26+
languages:
27+
Python:
28+
versions:
29+
- sdk_version: 3
30+
github: python/example_code/guardduty
31+
excerpts:
32+
- description:
33+
snippet_tags:
34+
- python.example_code.guardduty.GuardDutyWrapper.decl
35+
- python.example_code.guardduty.CreateDetector
36+
services:
37+
guardduty: {CreateDetector}
38+
guardduty_GetDetector:
39+
title: Get a &GD; detector using an &AWS; SDK
40+
title_abbrev: Get a detector
41+
synopsis: get a &GD; detector.
42+
category: Actions
43+
languages:
44+
Python:
45+
versions:
46+
- sdk_version: 3
47+
github: python/example_code/guardduty
48+
excerpts:
49+
- description:
50+
snippet_tags:
51+
- python.example_code.guardduty.GuardDutyWrapper.decl
52+
- python.example_code.guardduty.GetDetector
53+
services:
54+
guardduty: {GetDetector}
55+
guardduty_ListDetectors:
56+
title: List &GD; detectors using an &AWS; SDK
57+
title_abbrev: List detectors
58+
synopsis: list &GD; detectors.
59+
category: Actions
60+
languages:
61+
Python:
62+
versions:
63+
- sdk_version: 3
64+
github: python/example_code/guardduty
65+
excerpts:
66+
- description:
67+
snippet_tags:
68+
- python.example_code.guardduty.GuardDutyWrapper.decl
69+
- python.example_code.guardduty.ListDetectors
70+
services:
71+
guardduty: {ListDetectors}
72+
guardduty_CreateSampleFindings:
73+
title: Create &GD; sample findings using an &AWS; SDK
74+
title_abbrev: Create sample findings
75+
synopsis: create &GD; sample findings.
76+
category: Actions
77+
languages:
78+
Python:
79+
versions:
80+
- sdk_version: 3
81+
github: python/example_code/guardduty
82+
excerpts:
83+
- description:
84+
snippet_tags:
85+
- python.example_code.guardduty.GuardDutyWrapper.decl
86+
- python.example_code.guardduty.CreateSampleFindings
87+
services:
88+
guardduty: {CreateSampleFindings}
89+
guardduty_ListFindings:
90+
title: List &GD; findings using an &AWS; SDK
91+
title_abbrev: List findings
92+
synopsis: list &GD; findings.
93+
category: Actions
94+
languages:
95+
Python:
96+
versions:
97+
- sdk_version: 3
98+
github: python/example_code/guardduty
99+
excerpts:
100+
- description:
101+
snippet_tags:
102+
- python.example_code.guardduty.GuardDutyWrapper.decl
103+
- python.example_code.guardduty.ListFindings
104+
services:
105+
guardduty: {ListFindings}
106+
guardduty_GetFindings:
107+
title: Get &GD; findings using an &AWS; SDK
108+
title_abbrev: Get findings
109+
synopsis: get &GD; findings.
110+
category: Actions
111+
languages:
112+
Python:
113+
versions:
114+
- sdk_version: 3
115+
github: python/example_code/guardduty
116+
excerpts:
117+
- description:
118+
snippet_tags:
119+
- python.example_code.guardduty.GuardDutyWrapper.decl
120+
- python.example_code.guardduty.GetFindings
121+
services:
122+
guardduty: {GetFindings}
123+
guardduty_DeleteDetector:
124+
title: Delete a &GD; detector using an &AWS; SDK
125+
title_abbrev: Delete a detector
126+
synopsis: delete a &GD; detector.
127+
category: Actions
128+
languages:
129+
Python:
130+
versions:
131+
- sdk_version: 3
132+
github: python/example_code/guardduty
133+
excerpts:
134+
- description:
135+
snippet_tags:
136+
- python.example_code.guardduty.GuardDutyWrapper.decl
137+
- python.example_code.guardduty.DeleteDetector
138+
services:
139+
guardduty: {DeleteDetector}
140+
guardduty_Scenario:
141+
title: Learn the basics of &GD; using an &AWS; SDK
142+
title_abbrev: Learn the basics
143+
synopsis: learn the basics of &GD;.
144+
category: Scenarios
145+
languages:
146+
Python:
147+
versions:
148+
- sdk_version: 3
149+
github: python/example_code/guardduty
150+
excerpts:
151+
- description: Create a wrapper class that encapsulates &GD; functions.
152+
snippet_tags:
153+
- python.example_code.guardduty.GuardDutyWrapper.class
154+
- description: Use the wrapper class to run an interactive scenario at a command prompt.
155+
snippet_tags:
156+
- python.example_code.guardduty.GuardDutyScenario
157+
services:
158+
guardduty: {CreateDetector, GetDetector, ListDetectors, CreateSampleFindings, ListFindings, GetFindings, DeleteDetector}

‎python/example_code/guardduty/README.md‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
# Amazon GuardDuty code examples for the SDK for Python
2+
3+
## Overview
4+
5+
Shows how to use the AWS SDK for Python (Boto3) to work with Amazon GuardDuty.
6+
7+
<!--custom.overview.start-->
8+
<!--custom.overview.end-->
9+
10+
_Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts and workloads._
11+
12+
## ⚠ Important
13+
14+
* Running this code might result in charges to your AWS account. For more details, see [AWS Pricing](https://aws.amazon.com/pricing/) and [Free Tier](https://aws.amazon.com/free/).
15+
* Running the tests might result in charges to your AWS account.
16+
* We recommend that you grant your code least privilege. At most, grant only the minimum permissions required to perform the task. For more information, see [Grant least privilege](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#grant-least-privilege).
17+
* This code is not tested in every AWS Region. For more information, see [AWS Regional Services](https://aws.amazon.com/about-aws/global-infrastructure/regional-product-services).
18+
19+
<!--custom.important.start-->
20+
<!--custom.important.end-->
21+
22+
## Code examples
23+
24+
### Prerequisites
25+
26+
For prerequisites, see the [README](../../README.md#Prerequisites) in the `python` folder.
27+
28+
Install the packages required by these examples by running the following in a virtual environment:
29+
30+
```
31+
python -m pip install -r requirements.txt
32+
```
33+
34+
<!--custom.prerequisites.start-->
35+
<!--custom.prerequisites.end-->
36+
37+
### Get started
38+
39+
- [Hello GuardDuty](guardduty_hello.py#L15) (`ListDetectors`)
40+
41+
### Single actions
42+
43+
Code excerpts that show you how to call individual service functions.
44+
45+
- [CreateDetector](guardduty_wrapper.py#L35)
46+
- [CreateSampleFindings](guardduty_wrapper.py#L108)
47+
- [DeleteDetector](guardduty_wrapper.py#L189)
48+
- [GetDetector](guardduty_wrapper.py#L78)
49+
- [GetFindings](guardduty_wrapper.py#L162)
50+
- [ListDetectors](guardduty_wrapper.py#L56)
51+
- [ListFindings](guardduty_wrapper.py#L135)
52+
53+
### Scenarios
54+
55+
Code examples that show you how to accomplish a specific task by calling multiple functions within the same service.
56+
57+
- [Learn the basics of GuardDuty](scenario_guardduty_basics.py)
58+
59+
## Run the examples
60+
61+
### Instructions
62+
63+
64+
<!--custom.instructions.start-->
65+
<!--custom.instructions.end-->
66+
67+
#### Hello GuardDuty
68+
69+
This example shows you how to get started using GuardDuty.
70+
71+
```
72+
python guardduty_hello.py
73+
```
74+
75+
76+
#### Learn the basics of GuardDuty
77+
78+
This example shows you how to do the following:
79+
80+
* Create a GuardDuty detector to enable threat detection.
81+
* Generate sample findings for demonstration purposes.
82+
* List and examine findings by severity.
83+
* Delete the detector to clean up resources.
84+
85+
```
86+
python scenario_guardduty_basics.py
87+
```
88+
89+
### Tests
90+
91+
⚠ Running tests might result in charges to your AWS account.
92+
93+
94+
To find instructions for running these tests, see the [README](../../README.md#Tests)
95+
in the `python` folder.
96+
97+
98+
99+
<!--custom.tests.start-->
100+
<!--custom.tests.end-->
101+
102+
## Additional resources
103+
104+
- [Amazon GuardDuty User Guide](https://docs.aws.amazon.com/guardduty/latest/ug/what-is-guardduty.html)
105+
- [Amazon GuardDuty API Reference](https://docs.aws.amazon.com/guardduty/latest/APIReference/Welcome.html)
106+
- [AWS SDK for Python (Boto3) GuardDuty reference](https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/guardduty.html)
107+
108+
<!--custom.resources.start-->
109+
<!--custom.resources.end-->
110+
111+
---
112+
113+
Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
114+
115+
SPDX-License-Identifier: Apache-2.0

‎python/example_code/guardduty/guardduty_hello.py‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
"""
5+
Purpose
6+
7+
Shows how to use the AWS SDK for Python (Boto3) to get started with Amazon GuardDuty.
8+
This example demonstrates the most basic GuardDuty operation: listing existing detectors
9+
in the current region.
10+
"""
11+
12+
import logging
13+
import boto3
14+
from botocore.exceptions import ClientError
15+
16+
from guardduty_wrapper import GuardDutyWrapper
17+
18+
19+
# snippet-start:[python.example_code.guardduty.Hello]
20+
def hello_guardduty():
21+
"""
22+
Use the AWS SDK for Python (Boto3) to check if GuardDuty is available
23+
in the current region and list any existing detectors.
24+
This function is typically used to verify GuardDuty service connectivity.
25+
"""
26+
print("Hello, Amazon GuardDuty!")
27+
28+
try:
29+
# Create GuardDuty wrapper
30+
guardduty_wrapper = GuardDutyWrapper.from_client()
31+
32+
# List existing detectors
33+
detector_ids = guardduty_wrapper.list_detectors()
34+
35+
if detector_ids:
36+
print(f"Found {len(detector_ids)} GuardDuty detector(s) in this region:")
37+
for detector_id in detector_ids:
38+
print(f" - {detector_id}")
39+
else:
40+
print("No GuardDuty detectors found in this region.")
41+
print(
42+
"You can create a detector to start using GuardDuty threat detection."
43+
)
44+
45+
except ClientError as e:
46+
error_code = e.response["Error"]["Code"]
47+
if error_code == "AccessDeniedException":
48+
print("Access denied. Please check your AWS credentials and permissions.")
49+
elif error_code == "UnauthorizedOperation":
50+
print(
51+
"Unauthorized operation. Please ensure you have GuardDuty permissions."
52+
)
53+
else:
54+
print(f"Error accessing GuardDuty: {e}")
55+
except Exception as e:
56+
print(f"Unexpected error: {e}")
57+
58+
59+
# snippet-end:[python.example_code.guardduty.Hello]
60+
61+
if __name__ == "__main__":
62+
logging.basicConfig(level=logging.WARNING, format="%(levelname)s: %(message)s")
63+
hello_guardduty()

0 commit comments

Comments
 (0)