Cloud One File Storage Securityで検出した不正ファイルをAWS Security Hub経由でメール通知する

$ git clone https://github.com/trendmicro/cloudone-filestorage-plugins.git

$ cd cloudone-filestorage-plugins/post-scan-actions/aws-nodejs-securityhub-integration
$ npm --version
10.5.0
$ npm run package

$ aws s3 mb s3://cm-hirai-cloudone-securityhub
$ aws s3 cp bundle.zip s3://cm-hirai-cloudone-securityhub/

$ aws cloudformation create-stack \
  --stack-name fss-security-hub-integration \
  --template-body file://template.yaml \
  --parameters \
    ParameterKey=snsScanResultTopicArn,ParameterValue=arn:aws:sns:ap-northeast-1:012345678901:Storage-TM-FileStorageSecurity-ScanResultTopic-6iKvNvXcr05o \
    ParameterKey=LambdaZipBucket,ParameterValue=cm-hirai-cloudone-securityhub \
    ParameterKey=LambdaZipKey,ParameterValue=bundle.zip \
  --capabilities CAPABILITY_IAM

$ curl -O https://secure.eicar.org/eicar.com
$ aws s3 cp eicar.com s3://cm-hirai-c1fss

{
	"version": "0",
	"id": "9f05b441-114a-fb53-09e5-1992a4358043",
	"detail-type": "Security Hub Findings - Imported",
	"source": "aws.securityhub",
	"account": "012345678901",
	"time": "2024-09-11T23:33:40Z",
	"region": "ap-northeast-1",
	"resources": [
		"arn:aws:securityhub:ap-northeast-1:012345678901:product/012345678901/default/012345678901/2398e98a-c4bf-4f0b-91c5-1a786263b723"
	],
	"detail": {
		"findings": [
			{
				"ProductArn": "arn:aws:securityhub:ap-northeast-1:012345678901:product/012345678901/default",
				"Types": [
					"Unusual Behaviors/Data"
				],
				"Description": "Malware found!",
				"SchemaVersion": "2018-10-08",
				"ProductName": "Default",
				"GeneratorId": "FSS",
				"CreatedAt": "2024-09-11T23:33:28.594Z",
				"RecordState": "ACTIVE",
				"Title": "S3 Object had malware detected by FSS.",
				"Workflow": {
					"Status": "NEW"
				},
				"Severity": {
					"Normalized": 70,
					"Label": "HIGH"
				},
				"UpdatedAt": "2024-09-11T23:33:28.594Z",
				"CompanyName": "Personal",
				"FindingProviderFields": {
					"Types": [
						"Unusual Behaviors/Data"
					],
					"Severity": {
						"Normalized": 70,
						"Label": "HIGH"
					}
				},
				"WorkflowState": "NEW",
				"ProductFields": {
					"aws/securityhub/FindingId": "arn:aws:securityhub:ap-northeast-1:012345678901:product/012345678901/default/012345678901/2398e98a-c4bf-4f0b-91c5-1a786263b723",
					"aws/securityhub/ProductName": "Default",
					"aws/securityhub/CompanyName": "Personal"
				},
				"AwsAccountId": "012345678901",
				"Region": "ap-northeast-1",
				"Malware": [
					{
						"Path": "eicar.com",
						"Type": "POTENTIALLY_UNWANTED",
						"State": "OBSERVED",
						"Name": "Eicar_test_file"
					}
				],
				"Id": "012345678901/2398e98a-c4bf-4f0b-91c5-1a786263b723",
				"Resources": [
					{
						"Type": "AwsS3Object",
						"Id": "eicar.com"
					},
					{
						"Type": "AwsS3Bucket",
						"Id": "cm-hirai-c1fss"
					}
				],
				"ProcessedAt": "2024-09-11T23:33:31.200Z"
			}
		]
	}
}

~中略~
const publishToSecurityHub = async (securityhub, securityHubArn, accountId, malwareName, bucket, key) => {
  const date = new Date().toISOString()
  const params = {
    Findings: [
      {
        AwsAccountId: accountId,
        CreatedAt: date,
        Description: "Malware found!",
        GeneratorId: "FSS",
        Id: `${accountId}/${uuidV4()}`,
        ProductArn: securityHubArn,
        SchemaVersion: "2018-10-08",
        Resources: [
          {
            Id: key,
            Type: "AwsS3Object"
          },
          {
            Id: bucket,
            Type: "AwsS3Bucket"
          },
        ],
        Malware: [
          {
            Name: malwareName,
            Path: key,
            State: "OBSERVED",
            Type: "POTENTIALLY_UNWANTED"
          }
        ],
        Severity: {
          Label: "HIGH"
        },
        Title: "S3 Object had malware detected by FSS.",
        Types: [
          "Unusual Behaviors/Data"
        ],
        UpdatedAt: date
      }
    ]
  }

{
  "source": ["aws.securityhub"],
  "detail-type": ["Security Hub Findings - Imported"],
  "detail": {
    "findings": {
      "Severity": {
        "Label": ["HIGH"]
      },
      "RecordState": ["ACTIVE"],
      "GeneratorId": ["FSS"],
      "Workflow": {
        "Status": ["NEW"]
      }
    }
  }
}

{
  "TITLE": "$.detail.findings[0].Title"
  "PROCESSED_AT": "$.detail.findings[0].ProcessedAt",
  "AWS_ACCOUNT_ID": "$.detail.findings[0].AwsAccountId",
  "REGION": "$.detail.findings[0].Region",
  "S3_BUCKET": "$.detail.findings[0].Resources[1].Id",
  "S3_KEY": "$.detail.findings[0].Resources[0].Id",
}

{
  "タイトル": <TITLE>,
  "検出結果時間": <PROCESSED_AT>,
  "アカウントID": <AWS_ACCOUNT_ID>,
  "リージョン名": <REGION>,
  "S3バケット名": <S3_BUCKET>,
  "キー名": <S3_KEY>
}

$ curl -O https://secure.eicar.org/eicar.com
$ aws s3 cp eicar.com s3://cm-hirai-c1fss