Closed pbnj-dragon closed 2 weeks ago
aws_guardduty_context helper function does not include accountId in the alert context
aws_guardduty_context
accountId
Improve the built-in aws_guardduty_context helper function to include the accountId
Clone the managed detection to extend the aws_guardduty_context in the alert_context() function, like:
alert_context()
def alert_context(event): return aws_guardduty_context(event) | {"accountId": event.get("accountId", "<MISSING ACCOUNT ID>")}
Downsides:
Problem
aws_guardduty_context
helper function does not includeaccountId
in the alert contextProposed Solution
Improve the built-in
aws_guardduty_context
helper function to include theaccountId
Workaround
Clone the managed detection to extend the
aws_guardduty_context
in thealert_context()
function, like:Downsides: