Cyber security

GuardDuty Runbook Automator – Streamlined Security Responses

Create a runbook for all available GuardDuty finding types found on the GuardDuty docs website using the information documented for each finding.

This project is a kick-start to generate a base set of runbooks when GuardDuty is enabled in an organization.

Runbooks will need to be customized to fit organizational incident response procedures and add contextual information.

Generating Runbooks

This tool can be installed from PyPI

pip install guardduty-runbooks

It can also be installed locally. After cloning the directory, run in the folder:

pip install .

The tool can then be run with optional flags:

guardduty-runbooks [--outdir outdir] [--overwrite]

If outdir is not specified, it will write all runbooks to the local directory.

guardduty-runbooks --outdir ./my-runbook-directory

This tool can be run multiple times to create runbooks for new finding types. Run the tool again over the directory where runbooks are stored and it will write new runbooks only, unless --overwrite is specified.

Overwrite is a destructive command and will erase any customization made to the runbook.

guardduty-runbooks --outdir ./my-runbook-directory --overwrite

Runbook filenames are written using the “finding type” specified by GuardDuty.

Because finding types include non alphanumeric characters like :, /, !, and ., those characters are replaced with dashes - and all other characters are made lowercase.

This is for ease of programatically locating runbooks for tools like Panther and Matano.

For example: CryptoCurrency:EC2/BitcoinTool.B!DNS becomes cryptocurrency-ec2-bitcointool-b-dns

Varshini

Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.

Recent Posts

The Code Behind Lyric Video Makers: Rendering and Timing

Lyric videos have become one of the most popular tools for artists to share music…

2 hours ago

cp Command: Copy Files and Directories in Linux

The cp command, short for "copy," is the main Linux utility for duplicating files and directories. Whether…

2 weeks ago

Image OSINT

Introduction In digital investigations, images often hold more information than meets the eye. With the…

2 weeks ago

cat Command: Read and Combine File Contents in Linux

The cat command short for concatenate, It is a fast and versatile tool for viewing and merging…

2 weeks ago

Port In Networking

What is a Port? A port in networking acts like a gateway that directs data…

2 weeks ago

ls Command: List Directory Contents in Linux

The ls command is fundamental for anyone working with Linux. It’s used to display the files and…

2 weeks ago