
from lib.alerttask import AlertTask
from query_models import SearchQuery, TermMatch


class AlertCloudtrailLoggingDisabled(AlertTask):
    def main(self):
        search_query = SearchQuery(minutes=30)

        search_query.add_must([
            TermMatch('_type', 'cloudtrail'),
            TermMatch('eventName', 'StopLogging'),
        ])

        search_query.add_must_not(TermMatch('errorCode', 'AccessDenied'))

        self.filtersManual(search_query)
        self.searchEventsSimple()
        self.walkEvents()

    def onEvent(self, event):
        category = 'AWSCloudtrail'
        tags = ['cloudtrail', 'aws']
        severity = 'CRITICAL'

        summary = 'Cloudtrail Logging Disabled: ' + event['_source']['requestParameters']['name']

        return self.createAlertDict(summary, category, tags, [event], severity)


from lib.alerttask import AlertTask
from query_models import SearchQuery, TermMatch


class AlertCloudtrailLoggingDisabled(AlertTask):
    def main(self):
        search_query = SearchQuery(minutes=30)

        search_query.add_must([
            TermMatch('_type', 'cloudtrail'),
            TermMatch('eventName', 'StopLogging'),
        ])

        search_query.add_must_not(TermMatch('errorCode', 'AccessDenied'))

        self.filtersManual(search_query)
        self.searchEventsSimple()
        self.walkEvents()

    def onEvent(self, event):
        category = 'AWSCloudtrail'
        tags = ['cloudtrail', 'aws', 'cloudtrailpagerduty']
        severity = 'CRITICAL'

        summary = 'Cloudtrail Logging Disabled: ' + event['_source']['requestParameters']['name']

        return self.createAlertDict(summary, category, tags, [event], severity)

Send Cloudtrail logging disabled alert to MOC
Send Cloudtrail logging disabled alert to MOC

  
  from lib.alerttask import AlertTask
  from query_models import SearchQuery, TermMatch
  
  
  class AlertCloudtrailLoggingDisabled(AlertTask):
      def main(self):
          search_query = SearchQuery(minutes=30)
  
          search_query.add_must([
              TermMatch('_type', 'cloudtrail'),
              TermMatch('eventName', 'StopLogging'),
          ])
  
          search_query.add_must_not(TermMatch('errorCode', 'AccessDenied'))
  
          self.filtersManual(search_query)
          self.searchEventsSimple()
          self.walkEvents()
  
      def onEvent(self, event):
          category = 'AWSCloudtrail'
-         tags = ['cloudtrail', 'aws']
+         tags = ['cloudtrail', 'aws', 'cloudtrailpagerduty']
          severity = 'CRITICAL'
  
          summary = 'Cloudtrail Logging Disabled: ' + event['_source']['requestParameters']['name']
  
          return self.createAlertDict(summary, category, tags, [event], severity)
  
Send Cloudtrail logging disabled alert to MOC
## Code Before:

from lib.alerttask import AlertTask
from query_models import SearchQuery, TermMatch


class AlertCloudtrailLoggingDisabled(AlertTask):
    def main(self):
        search_query = SearchQuery(minutes=30)

        search_query.add_must([
            TermMatch('_type', 'cloudtrail'),
            TermMatch('eventName', 'StopLogging'),
        ])

        search_query.add_must_not(TermMatch('errorCode', 'AccessDenied'))

        self.filtersManual(search_query)
        self.searchEventsSimple()
        self.walkEvents()

    def onEvent(self, event):
        category = 'AWSCloudtrail'
        tags = ['cloudtrail', 'aws']
        severity = 'CRITICAL'

        summary = 'Cloudtrail Logging Disabled: ' + event['_source']['requestParameters']['name']

        return self.createAlertDict(summary, category, tags, [event], severity)

## Instruction:
Send Cloudtrail logging disabled alert to MOC
## Code After:

from lib.alerttask import AlertTask
from query_models import SearchQuery, TermMatch


class AlertCloudtrailLoggingDisabled(AlertTask):
    def main(self):
        search_query = SearchQuery(minutes=30)

        search_query.add_must([
            TermMatch('_type', 'cloudtrail'),
            TermMatch('eventName', 'StopLogging'),
        ])

        search_query.add_must_not(TermMatch('errorCode', 'AccessDenied'))

        self.filtersManual(search_query)
        self.searchEventsSimple()
        self.walkEvents()

    def onEvent(self, event):
        category = 'AWSCloudtrail'
        tags = ['cloudtrail', 'aws', 'cloudtrailpagerduty']
        severity = 'CRITICAL'

        summary = 'Cloudtrail Logging Disabled: ' + event['_source']['requestParameters']['name']

        return self.createAlertDict(summary, category, tags, [event], severity)
