GistPin/infrastructure/monitoring/guardduty-alerts.yml at main · ghzhost/GistPin · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
groups:
  - name: guardduty-findings
    rules:
      # ───────────────────────────────────────────────────────────────────────────
      # CRITICAL severity (>= 7.0) — page on-call engineer immediately
      # Finding types: UnauthorizedAccess, PrivilegeEscalation, CredentialAccess
      # ───────────────────────────────────────────────────────────────────────────
      - alert: GuardDutyCritical
        expr: guardduty_finding_severity{severity=~"7\\.[0-9]+|8\\.[0-9]+|9\\.[0-9]+|10\\.[0-9]+"} > 0
        for: 1m
        labels:
          severity: critical
          team: security
          routing: pagerduty
        annotations:
          summary: "Critical GuardDuty finding — immediate response required"
          description: "GuardDuty detected {{ $labels.finding_type }} in {{ $labels.region }} for resource {{ $labels.resource_id }} (severity: {{ $value }})"
          runbook: "infrastructure/docs/threat-detection.md"

      - alert: GuardDutyCryptoCurrency
        expr: guardduty_finding{type=~".*CryptoCurrency.*"}
        for: 1m
        labels:
          severity: critical
          team: security
          routing: pagerduty
        annotations:
          summary: "Cryptocurrency mining activity detected"
          description: "Possible cryptocurrency mining activity on resource {{ $labels.resource_id }} (type: {{ $labels.finding_type }})"
          runbook: "infrastructure/docs/threat-detection.md"

      # ───────────────────────────────────────────────────────────────────────────
      # HIGH severity (>= 4.0, < 7.0) — notify security team via Slack
      # Finding types: Recon, Backdoor, Behavior, Stealth
      # ───────────────────────────────────────────────────────────────────────────
      - alert: GuardDutyHigh
        expr: guardduty_finding_severity{severity=~"4\\.[0-9]+|5\\.[0-9]+|6\\.[0-9]+"} > 0
        for: 5m
        labels:
          severity: high
          team: security
          routing: slack
        annotations:
          summary: "High severity GuardDuty finding — investigate"
          description: "GuardDuty detected {{ $labels.finding_type }} in {{ $labels.region }} for resource {{ $labels.resource_id }} (severity: {{ $value }})"
          runbook: "infrastructure/docs/threat-detection.md"

      - alert: GuardDutyRecon
        expr: guardduty_finding{type=~".*Recon.*"}
        for: 5m
        labels:
          severity: high
          team: security
          routing: slack
        annotations:
          summary: "Reconnaissance activity detected"
          description: "Reconnaissance activity {{ $labels.finding_type }} targeting {{ $labels.resource_id }}"
          runbook: "infrastructure/docs/threat-detection.md"

      # ───────────────────────────────────────────────────────────────────────────
      # MEDIUM severity (>= 1.0, < 4.0) — create ticket for follow-up
      # Finding types: Discovery, PolicyViolation, NetworkConnection
      # ───────────────────────────────────────────────────────────────────────────
      - alert: GuardDutyMedium
        expr: guardduty_finding_severity{severity=~"1\\.[0-9]+|2\\.[0-9]+|3\\.[0-9]+"} > 0
        for: 10m
        labels:
          severity: medium
          team: security
          routing: jira
        annotations:
          summary: "Medium severity GuardDuty finding — create ticket"
          description: "GuardDuty detected {{ $labels.finding_type }} in {{ $labels.region }} for resource {{ $labels.resource_id }} (severity: {{ $value }})"
          runbook: "infrastructure/docs/threat-detection.md"

      - alert: GuardDutyPolicyViolation
        expr: guardduty_finding{type=~".*PolicyViolation.*"}
        for: 10m
        labels:
          severity: medium
          team: security
          routing: jira
        annotations:
          summary: "Policy violation detected"
          description: "Policy violation {{ $labels.finding_type }} on resource {{ $labels.resource_id }}"
          runbook: "infrastructure/docs/threat-detection.md"

      # ───────────────────────────────────────────────────────────────────────────
      # Aggregated alerting rules
      # ───────────────────────────────────────────────────────────────────────────
      - alert: GuardDutyFindingBurst
        expr: sum(rate(guardduty_finding[5m])) > 10
        for: 5m
        labels:
          severity: high
          team: security
          routing: slack
        annotations:
          summary: "Burst of GuardDuty findings detected"
          description: "More than 10 findings per minute over 5 minutes (current: {{ $value }}/min)"
          runbook: "infrastructure/docs/threat-detection.md"

      - alert: GuardDutyS3PublicAccess
        expr: guardduty_finding{type="Policy:S3/BucketPublicAccessGranted"}
        for: 1m
        labels:
          severity: critical
          team: security
          routing: pagerduty
        annotations:
          summary: "S3 bucket publicly accessible"
          description: "S3 bucket {{ $labels.resource_id }} has been granted public access"
          runbook: "infrastructure/docs/threat-detection.md"

      - alert: GuardDutyEKSCluster
        expr: guardduty_finding{type=~".*EKS.*"}
        for: 2m
        labels:
          severity: high
          team: security
          routing: slack
        annotations:
          summary: "EKS cluster security finding"
          description: "GuardDuty detected {{ $labels.finding_type }} on EKS cluster {{ $labels.resource_id }}"
          runbook: "infrastructure/docs/threat-detection.md"