You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardexpand all lines: README.md
+49-27
Original file line number
Diff line number
Diff line change
@@ -1,21 +1,33 @@
1
1
# Amazon SNS Utilities for Deep Security
2
2
3
-
## Support
3
+
Most versions of Deep Security Manager 9.6+ can output events to an Amazon SNS topic. Events are sent as a JSON document to the specified SNS topic. The end result is a standard SNS notification wrapper with the Deep Security event stored in the ```Sns > Message``` key of each Record in the notification.
4
+
5
+
The goal of the scripts in this repository is to help you manage and process these events.
4
6
5
-
This is a community project and while you will see contributions from the Deep Security team, there is no official Trend Micro support for this project. The official documentation for the Deep Security APIs is available from the [Trend Micro Online Help Centre](http://docs.trendmicro.com/en-us/enterprise/deep-security.aspx).
6
7
7
-
Tutorials, feature-specific help, and other information about Deep Security is available from the [Deep Security Help Center](https://help.deepsecurity.trendmicro.com/Welcome.html).
8
+
## Table of Contents
8
9
9
-
For Deep Security specific issues, please use the regular Trend Micro support channels. For issues with the code in this repository, please [open an issue here on GitHub](https://github.com/deep-security/amazon-sns/issues).
10
+
*[Usage](#usage)
11
+
*[Support](#support)
12
+
*[Contribute](#contribute)
10
13
11
-
## Purpose
12
14
13
-
Most versions of Deep Security 9.6+ have the ability to output events to an Amazon SNS topic. Events are sent as a JSON document to the specified SNS topic. The end result is a standard SNS notification wrapper with the Deep Security event stored in the ```Sns > Message``` key of each Record in the notification.
15
+
## Usage
16
+
### lambda-save-ds-event-to-s3.py
14
17
15
-
The goal of the scripts in this repository is to help you manage and process these events.
18
+
This script is funs as an AWS Lambda function and processes each notification as it arrives. It extracts the Deep Security event from the notification and saves it in the specified S3 bucket.
19
+
20
+
To use:
21
+
22
+
1. Create a new S3 bucket
23
+
1. Create a [new AWS Lambda function](https://docs.aws.amazon.com/lambda/latest/dg/get-started-create-function.html)
24
+
1. Ensure the function executes in a role that has **write** permissions to the target S3 bucket (from step #1)
25
+
1. Edit [line 13](https://github.com/deep-security/amazon-sns/blob/master/lambda-save-ds-event-to-s3.py#L13) by changing the value to your own S3 bucket name. The bucket should already exist
26
+
1. Add the code to the function and save.
16
27
17
-
## Sample Event
28
+
If you'd like to test the function, you can use a sample event and run the test from the AWS Lambda Management Console.
18
29
30
+
#### Sample Event
19
31
```
20
32
{
21
33
"Records": [
@@ -41,23 +53,9 @@ The goal of the scripts in this repository is to help you manage and process the
41
53
}
42
54
```
43
55
44
-
## lambda-save-ds-event-to-s3.py
45
-
46
-
This script is funs as an AWS Lambda function and processes each notification as it arrives. It extracts the Deep Security event from the notification and saves it in the specified S3 bucket.
47
-
48
-
To use;
49
-
50
-
1. Create a new S3 bucket
51
-
1. Create a [new AWS Lambda function](https://docs.aws.amazon.com/lambda/latest/dg/get-started-create-function.html)
52
-
1. Ensure the function executes in a role that has **write** permissions to the target S3 bucket (from step #1)
53
-
1. Edit [line 13](https://github.com/deep-security/amazon-sns/blob/master/lambda-save-ds-event-to-s3.py#L13) by changing the value to your own S3 bucket name. The bucket should already exist
54
-
1. Add the code to the function and save.
55
-
56
-
If you'd like to test the function, you can use the sample event above and run the test from the AWS Lambda Management Console.
56
+
#### Results from lambda-save-ds-event-to-s3.py
57
57
58
-
### Results from lambda-save-ds-event-to-s3.py
59
-
60
-
The script will create a new key for each event received via the SNS topic. This results is a key naming structure similar to;
58
+
The script will create a new key for each event received via the SNS topic. This results is a key naming structure like:
61
59
62
60
```
63
61
bucket root
@@ -76,7 +74,7 @@ bucket root
76
74
77
75
**Warning:** This method can generate a *lot* of individual keys in the bucket. Querying via the S3 API or the AWS CLI isn't an issue but the browser-based Amazon S3 Management Console might have some performance issues when displaying the "folder" containing the *.txt files.
78
76
79
-
## lambda-save-ds-event-to-s3-by-hostname.py
77
+
###lambda-save-ds-event-to-s3-by-hostname.py
80
78
81
79
The same script as ```lambda-save-ds-event-to-s3.py``` but saves log files in a structure that starts with the full hostname of the computer that generated the event. System events remain in the year-root structure.
82
80
@@ -103,8 +101,32 @@ bucket root
103
101
- 2016-08-04-11-06-33-316000-SD9XNWTY.txt
104
102
```
105
103
106
-
## lambda-save-ds-events-to-s3.js
104
+
###lambda-save-ds-events-to-s3.js
107
105
108
106
Similar script as ```lambda-save-ds-events-to-s3.py``` but in Node.js.
109
107
Edit [line 7](https://github.com/deep-security/amazon-sns/blob/master/lambda-save-ds-event-to-s3.js#L7) by changing the value to your own S3 bucket name.
110
-
If desired, the s3 folder name and file extension can also be modified on lines 9 and 10.
108
+
If desired, the s3 folder name and file extension can also be modified on lines 9 and 10.
109
+
110
+
## Support
111
+
112
+
This is an Open Source community project. Project contributors may be able to help,
113
+
depending on their time and availability. Please be specific about what you're
114
+
trying to do, your system, and steps to reproduce the problem.
115
+
116
+
For bug reports or feature requests, please
117
+
[open an issue](../issues).
118
+
You are welcome to [contribute](#contribute).
119
+
120
+
Official support from Trend Micro is not available. Individual contributors may be
121
+
Trend Micro employees, but are not official support.
122
+
123
+
## Contribute
124
+
125
+
We accept contributions from the community. To submit changes:
126
+
127
+
1. Fork this repository.
128
+
1. Create a new feature branch.
129
+
1. Make your changes.
130
+
1. Submit a pull request with an explanation of your changes or additions.
131
+
132
+
We will review and work with you to release the code.
0 commit comments