DevOps Agent の スキルとカスタムエージェントを使って、GuardDuty 検出結果を重要度別に振り分けて Slack 通知してみる

export AWS_REGION=ap-northeast-1
ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)

aws guardduty list-custom-detection-rules --output json > rules.json
for r in ec2-termination-protection-enabled s3-lifecycle-rapid-expiration lambda-function-url-public-access; do
  aws guardduty get-custom-detection-rule --rule-id "$r" --query 'Rule.[Name,Severity]' --output text
done

EC2TerminationProtectionEnabled LOW
S3LifecycleRapidExpiration      MEDIUM
LambdaFunctionUrlPublicAccess   HIGH

for r in ec2-termination-protection-enabled s3-lifecycle-rapid-expiration lambda-function-url-public-access; do
  aws guardduty create-custom-detection-rule-association --rule-id "$r" --mode LIVE >/dev/null && echo "$r LIVE ok"
done
aws guardduty list-custom-detection-rule-associations --query 'RuleAssociations[].[RuleId,Mode]' --output text

lambda-function-url-public-access       LIVE
s3-lifecycle-rapid-expiration   LIVE
ec2-termination-protection-enabled      LIVE

read -s -p 'Webhook URL: ' DA_URL; echo

read -s -p 'API key: ' DA_TOKEN; echo

case "$DA_URL" in https://event-ai.*) echo "DA_URL: ok" ;; "") echo "DA_URL: 入っていない" ;; *) echo "DA_URL: 形式が違う" ;; esac
[ -n "$DA_TOKEN" ] && echo "DA_TOKEN: ok" || echo "DA_TOKEN: 入っていない"

/invite @AWS DevOps Agent - AP (Tokyo)

case "$DA_URL" in https://event-ai.*) echo "DA_URL: ok" ;; "") echo "DA_URL: 入っていない" ;; *) echo "DA_URL: 形式が違う" ;; esac
[ -n "$DA_TOKEN" ] && echo "DA_TOKEN: ok" || echo "DA_TOKEN: 入っていない"

CONN_ARN=$(aws events create-connection --name demo-devops-agent-webhook \
  --authorization-type API_KEY \
  --auth-parameters "$(jq -cn --arg v "Bearer $DA_TOKEN" '{ApiKeyAuthParameters:{ApiKeyName:"Authorization",ApiKeyValue:$v}}')" \
  --query ConnectionArn --output text)
sleep 5
aws events describe-connection --name demo-devops-agent-webhook --query ConnectionState --output text

DEST_ARN=$(aws events create-api-destination --name demo-devops-agent-webhook \
  --connection-arn $CONN_ARN --invocation-endpoint "$DA_URL" --http-method POST \
  --invocation-rate-limit-per-second 1 --query ApiDestinationArn --output text)
unset DA_TOKEN DA_URL

aws iam create-role --role-name demo-eventbridge-devops-agent \
  --assume-role-policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"events.amazonaws.com"},"Action":"sts:AssumeRole"}]}' >/dev/null
aws iam put-role-policy --role-name demo-eventbridge-devops-agent --policy-name invoke-api-destination \
  --policy-document "$(jq -cn --arg d "$DEST_ARN" '{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:"events:InvokeApiDestination",Resource:$d}]}')"
EB_ROLE_ARN=$(aws iam get-role --role-name demo-eventbridge-devops-agent --query Role.Arn --output text)

DLQ_URL=$(aws sqs create-queue --queue-name demo-devops-agent-dlq --query QueueUrl --output text)
DLQ_ARN=$(aws sqs get-queue-attributes --queue-url $DLQ_URL --attribute-names QueueArn --query Attributes.QueueArn --output text)
aws sqs set-queue-attributes --queue-url $DLQ_URL --attributes "$(jq -cn \
  --arg q "$DLQ_ARN" --arg a "arn:aws:events:$AWS_REGION:$ACCOUNT_ID:rule/demo-gd-*" '{
  Policy: ({Version:"2012-10-17",
    Statement:[{Sid:"AllowEventBridge",Effect:"Allow",Principal:{Service:"events.amazonaws.com"},
      Action:"sqs:SendMessage",Resource:$q,Condition:{ArnLike:{"aws:SourceArn":$a}}}]} | tojson)}')"

for LG in /aws/events/demo-gd /aws/events/demo-gd-low; do
  aws logs create-log-group --log-group-name $LG && aws logs put-retention-policy --log-group-name $LG --retention-in-days 60 && echo "$LG ok"
done
aws logs put-resource-policy --policy-name demo-gd-events --policy-document "$(jq -cn \
  --arg r "arn:aws:logs:$AWS_REGION:$ACCOUNT_ID:log-group:/aws/events/demo-gd*:*" '{Version:"2012-10-17",Statement:[{
  Effect:"Allow",Principal:{Service:["events.amazonaws.com","delivery.logs.amazonaws.com"]},
  Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:$r}]}')" >/dev/null && echo "policy ok"

aws events put-rule --name demo-gd-capture \
  --event-pattern '{"source":["aws.guardduty"],"detail-type":["GuardDuty Finding"]}' >/dev/null && echo "capture ok"
aws events put-targets --rule demo-gd-capture --targets "$(jq -cn \
  --arg arn "arn:aws:logs:$AWS_REGION:$ACCOUNT_ID:log-group:/aws/events/demo-gd" '[{Id:"logs",Arn:$arn}]')" \
  --query FailedEntryCount --output text

GD_TYPES='["DefenseImpairment:EC2/DisableOrModifyTools","Impact:S3/DataDestruction","Persistence:Lambda/ModifyAuthenticationProcess"]'
gd_pattern() {  # usage: gd_pattern <下限> <上限>（下限以上、上限未満）
  jq -cn --argjson lo $1 --argjson hi $2 --argjson types "$GD_TYPES" '{
    source:["aws.guardduty"], "detail-type":["GuardDuty Finding"],
    detail:{type:$types, severity:[{numeric:[">=",$lo,"<",$hi]}],
      service:{count:[{numeric:["=",1]}]},
      "$or":[{service:{additionalInfo:{sample:[false]}}},{service:{additionalInfo:{sample:[{exists:false}]}}}]}}'
}
gd_pattern 7 9 | jq .

{
  "source": ["aws.guardduty"],
  "detail-type": ["GuardDuty Finding"],
  "detail": {
    "type": ["DefenseImpairment:EC2/DisableOrModifyTools", "Impact:S3/DataDestruction", "Persistence:Lambda/ModifyAuthenticationProcess"],
    "severity": [{ "numeric": [">=", 7, "<", 9] }],
    "service": { "count": [{ "numeric": ["=", 1] }] },
    "$or": [
      { "service": { "additionalInfo": { "sample": [false] } } },
      { "service": { "additionalInfo": { "sample": [{ "exists": false }] } } }
    ]
  }
}

aws events put-rule --name demo-gd-low --event-pattern "$(gd_pattern 0 4)" >/dev/null && echo "demo-gd-low ok"
aws events put-targets --rule demo-gd-low --targets "$(jq -cn \
  --arg arn "arn:aws:logs:$AWS_REGION:$ACCOUNT_ID:log-group:/aws/events/demo-gd-low" '[{Id:"ledger",Arn:$arn}]')" \
  --query FailedEntryCount --output text

make_gd_rule() {  # usage: make_gd_rule <名前> <PRIORITY> <下限> <上限>
  local name=demo-gd-$1 pri=$2 template
  aws events put-rule --name $name --event-pattern "$(gd_pattern $3 $4)" >/dev/null && echo "$name ok"
  template=$(printf '{"eventType":"incident","incidentId":"<id>","action":"created","priority":"%s","title":"[%s] GuardDuty finding <type>","description":"A GuardDuty Custom Detection Rules finding <type> (severity <sev>) was created in ap-northeast-1. Finding ID: <fid>. Find who made the change and whether it was expected.","timestamp":"<time>","service":"demo","data":{"source":"guardduty","findingId":"<fid>","type":"<type>","severity":<sev>,"resource":<res>,"service":<svc>}}' "$pri" "$pri")
  aws events put-targets --rule $name --targets "$(jq -cn --arg arn "$DEST_ARN" --arg role "$EB_ROLE_ARN" --arg t "$template" --arg dlq "$DLQ_ARN" '[{
    Id:"devops-agent", Arn:$arn, RoleArn:$role,
    InputTransformer:{
      InputPathsMap:{id:"$.id", time:"$.time", type:"$.detail.type", sev:"$.detail.severity",
        fid:"$.detail.id", res:"$.detail.resource", svc:"$.detail.service"},
      InputTemplate:$t},
    RetryPolicy:{MaximumRetryAttempts:3, MaximumEventAgeInSeconds:600},
    DeadLetterConfig:{Arn:$dlq}}]')" \
    --query FailedEntryCount --output text
}
make_gd_rule medium MEDIUM 4 7
make_gd_rule high HIGH 7 9

{
  "eventType": "incident",
  "incidentId": "<EventBridge のイベント ID>",
  "action": "created",
  "priority": "HIGH",
  "title": "[HIGH] GuardDuty finding Persistence:Lambda/ModifyAuthenticationProcess",
  "description": "A GuardDuty Custom Detection Rules finding Persistence:Lambda/ModifyAuthenticationProcess (severity 8) was created in ap-northeast-1. Finding ID: xxxx. Find who made the change and whether it was expected.",
  "timestamp": "2026-10-29T00:32:51Z",
  "service": "demo",
  "data": {
    "source": "guardduty",
    "findingId": "xxxx",
    "type": "Persistence:Lambda/ModifyAuthenticationProcess",
    "severity": 8,
    "resource": { "...": "GuardDuty の detail.resource がそのまま入る" },
    "service": { "...": "GuardDuty の detail.service がそのまま入る" }
  }
}

# GuardDuty の Medium のデモ検出をスキップする
以下の2点が両方とも当てはまるインシデントのみスキップする。

- priority が MEDIUM
- タイトルが "[MEDIUM] GuardDuty finding" で始まる

スキップの理由には「GuardDuty の Medium の検出は、カスタムエージェント gd-medium-checker が一次確認するため」と書く。

HIGH と CRITICAL のインシデントはスキップしない。
タイトルがほかの形のインシデントもスキップしない。

次の内容でカスタムエージェントを1つ作ってください。名前は gd-medium-checkerで、システムプロンプトは書き換えず、下の文面をそのまま使ってください。ツールは use_aws のみ、スキルとメモリストアは付けない。作ったあとに実行はしないでください。

あなたは GuardDuty の MEDIUM の検出を一次確認する担当です。本調査（Inverstigation）に上げるべきかを決めるのが仕事です。リソースの変更は実施しません。

## 入力
- 受け取ったペイロードの data に検出の内容がある。data.type が検出の種類、data.severity が重要度、data.resource と data.service に対象と、操作した人の情報がある

## やること
1. data から、操作した人（ロール）、操作した API、時刻、対象のリソースを確認する
2. 対象が S3 バケットの場合、今のライフサイクル設定を読み、何日で消える設定になっているかを確かめる
3. CloudTrail のイベント履歴から、その人の操作を前後1時間確認する。他に気になる操作（IAMの変更、ログや監視の停止、鍵の作成、データの削除等）がないかを見る。IAM と STS の操作は us-east-1 のイベント履歴に記録されるので、ap-northeast-1 と us-east-1 の両方を確認すること。
4. 判定する
   - 様子見：操作した人が分かっていて、対象のバケットが空か、該当アクティビティの前後で気になる操作がない場合など
   - 要調査：操作した人が分からない、中身のあるバケットが短い日数で消える設定になった、該当アクティビティ前後に気になる操作がある、AWSの外から操作されている等
5. ツールの呼び出しは 15 回までとする（コスト削減のため）

## Slack への通知
- 処理が終わった時に1回だけ通知する。タイトルは「一次確認の結果：様子見」または「一次確認の結果：要調査」。本文の 1文目に検出の種類を書き、続けて理由を3文以内で書く
- 始めたときや途中では通知しない

## 書いてはいけないもの
- 通知にも出力にも、アカウント ID、ARN、IPアドレス、IAMユーザ名、セッション名、バケット名を書かない
- 操作した人はロール名だけを書く（例：demo-gd-actor-1）。操作した場所は「AWSの中から」「外から」のように書く。バケットは「デモ用のバケット」のように書く

SPACE_ID='<Agent SpaceのID>'  # IDに置き換えてください
TOPIC_ARN=$(aws sns create-topic --name demo-devops-agent-alert --query TopicArn --output text)
aws sns set-topic-attributes --topic-arn $TOPIC_ARN --attribute-name Policy --attribute-value "$(jq -cn \
  --arg t "$TOPIC_ARN" --arg a "arn:aws:events:$AWS_REGION:$ACCOUNT_ID:rule/demo-*" '{
  Version:"2012-10-17",
  Statement:[{Sid:"AllowEventBridge",Effect:"Allow",Principal:{Service:"events.amazonaws.com"},
    Action:"sns:Publish",Resource:$t,Condition:{ArnLike:{"aws:SourceArn":$a}}}]}')"

read -p 'メールアドレス： ' MY_EMAIL

aws sns subscribe --topic-arn $TOPIC_ARN --protocol email --notification-endpoint "$MY_EMAIL" >/dev/null
unset MY_EMAIL

aws events put-rule --name demo-guard-skipped --event-pattern "$(jq -cn --arg s "$SPACE_ID" '{
  source:["aws.aidevops"], "detail-type":["Investigation Skipped"],
  detail:{metadata:{agent_space_id:[$s]}, data:{priority:["HIGH"]}}}')" >/dev/null && echo "guard ok"
aws events put-targets --rule demo-guard-skipped --targets "$(jq -cn --arg arn "$TOPIC_ARN" '[{
  Id:"email", Arn:$arn,
  InputTransformer:{
    InputPathsMap:{pri:"$.detail.data.priority", task:"$.detail.metadata.task_id", time:"$.time"},
    InputTemplate:"\"[要確認] priority <pri> の検出で、DevOps Agent の本調査がスキップされました（<time>）。タスク ID: <task>。Web アプリでスキップの理由を確かめてください。\""}}]')" \
  --query FailedEntryCount --output text

aws devops-agent get-agent-space --agent-space-id $SPACE_ID --output json | jq '[..|.preferences? // empty]'
aws devops-agent list-associations --agent-space-id $SPACE_ID --output json | grep -o '"agentElevatedRoleArnStatus": *"[a-z-]*"'
aws iam get-role --role-name DevOpsAgentActionsRole-AgentSpace-xxxx \
  --query 'Role.AssumeRolePolicyDocument.Statement[].Action' --output json

[
  {
    "elevatedActionsEnabled": true
  }
]
"agentElevatedRoleArnStatus": "valid"
[
    [
        "sts:AssumeRole",
        "sts:SetSourceIdentity",
        "sts:TagSession"
    ]
]

AMI=$(aws ssm get-parameter --name /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-arm64 \
  --query Parameter.Value --output text)
INSTANCE_ID=$(aws ec2 run-instances --image-id $AMI --instance-type t4g.nano \
  --metadata-options HttpTokens=required \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=demo-gd-target}]' \
  --query 'Instances[0].InstanceId' --output text)
aws ec2 wait instance-running --instance-ids $INSTANCE_ID
aws ec2 stop-instances --instance-ids $INSTANCE_ID --query 'StoppingInstances[0].CurrentState.Name' --output text

BUCKET=demo-gd-lc-$(openssl rand -hex 4)
aws s3api create-bucket --bucket $BUCKET --create-bucket-configuration LocationConstraint=$AWS_REGION

aws iam create-role --role-name demo-gd-url-fn-role \
  --assume-role-policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"lambda.amazonaws.com"},"Action":"sts:AssumeRole"}]}'
mkdir -p fn && cat > fn/app.py <<'EOF'
def handler(event, context):
    return {"statusCode": 200, "body": "demo"}
EOF
python3 -c "import zipfile; z=zipfile.ZipFile('fn.zip','w'); z.write('fn/app.py','app.py'); z.close()"
sleep 15
FN=demo-gd-url-fn
aws lambda create-function --function-name $FN --runtime python3.12 --architectures arm64 \
  --handler app.handler --zip-file fileb://fn.zip \
  --role arn:aws:iam::$ACCOUNT_ID:role/demo-gd-url-fn-role --query State --output text

make_actor() {  # 使い方: make_actor <番号>
  local r=demo-gd-actor-$1
  aws iam create-role --role-name $r --assume-role-policy-document "$(jq -cn --arg a "arn:aws:iam::$ACCOUNT_ID:root" \
    '{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{AWS:$a},Action:"sts:AssumeRole"}]}')" >/dev/null &&
  aws iam put-role-policy --role-name $r --policy-name demo-actions --policy-document "$(jq -cn \
    --arg i "arn:aws:ec2:$AWS_REGION:$ACCOUNT_ID:instance/$INSTANCE_ID" \
    --arg b "arn:aws:s3:::$BUCKET" \
    --arg f "arn:aws:lambda:$AWS_REGION:$ACCOUNT_ID:function:$FN" '{Version:"2012-10-17",Statement:[
      {Effect:"Allow",Action:"ec2:ModifyInstanceAttribute",Resource:$i},
      {Effect:"Allow",Action:"s3:PutLifecycleConfiguration",Resource:$b},
      {Effect:"Allow",Action:["lambda:CreateFunctionUrlConfig","lambda:UpdateFunctionUrlConfig"],Resource:$f}]}')" && echo "$r ok"
}
make_actor 1
make_actor 2

as_actor() {  # 使い方: as_actor <番号> <aws のサブコマンド>
  local n=$1; shift
  local c
  c=$(aws sts assume-role --role-arn arn:aws:iam::$ACCOUNT_ID:role/demo-gd-actor-$n \
    --role-session-name demo-run-$n --query Credentials --output json) || return 1
  AWS_ACCESS_KEY_ID=$(jq -r .AccessKeyId <<<"$c") AWS_SECRET_ACCESS_KEY=$(jq -r .SecretAccessKey <<<"$c") \
    AWS_SESSION_TOKEN=$(jq -r .SessionToken <<<"$c") aws "$@"
}

export AWS_REGION=ap-northeast-1
ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
DEST_ARN=$(aws events describe-api-destination --name demo-devops-agent-webhook --query ApiDestinationArn --output text)
EB_ROLE_ARN=$(aws iam get-role --role-name demo-eventbridge-devops-agent --query Role.Arn --output text)
DLQ_ARN=$(aws sqs get-queue-attributes --attribute-names QueueArn --query Attributes.QueueArn --output text \
  --queue-url $(aws sqs get-queue-url --queue-name demo-devops-agent-dlq --query QueueUrl --output text))
TOPIC_ARN=arn:aws:sns:$AWS_REGION:$ACCOUNT_ID:demo-devops-agent-alert
INSTANCE_ID=$(aws ec2 describe-instances --filters Name=tag:Name,Values=demo-gd-target \
  Name=instance-state-name,Values=running,stopped --query 'Reservations[0].Instances[0].InstanceId' --output text)
BUCKET=$(aws s3api list-buckets --prefix demo-gd-lc- --query 'Buckets[0].Name' --output text)
FN=demo-gd-url-fn
SPACE_NAME='<Agent Space の名前>'  # 自分の Agent Space の名前に置き換える
SPACE_ID=$(aws devops-agent list-agent-spaces --query "agentSpaces[?name=='$SPACE_NAME'].agentSpaceId | [0]" --output text)
for v in DEST_ARN EB_ROLE_ARN DLQ_ARN INSTANCE_ID BUCKET SPACE_ID; do
  case "${!v}" in ""|None) echo "$v: 見つからない" ;; *) echo "$v: ok" ;; esac
done
aws sns get-topic-attributes --topic-arn "$TOPIC_ARN" >/dev/null 2>&1 && echo "TOPIC_ARN: ok" || echo "TOPIC_ARN: 見つからない"

DEST_ARN: ok
EB_ROLE_ARN: ok
DLQ_ARN: ok
INSTANCE_ID: ok
BUCKET: ok
SPACE_ID: ok
TOPIC_ARN: ok

as_actor 1 ec2 modify-instance-attribute --instance-id $INSTANCE_ID --disable-api-termination

aws logs filter-log-events --log-group-name /aws/events/demo-gd-low \
  --start-time $(( ($(date +%s) - 120*60) * 1000 )) --query 'events[].message' --output text |
  jq -r '[.time, .detail.type, (.detail.severity|tostring), "count=" + (.detail.service.count|tostring)] | @tsv'

# 出力結果例
2026-10-28T06:27:00Z    DefenseImpairment:EC2/DisableOrModifyTools      2       count=1

2026-10-28T06:27:00Z    DefenseImpairment:EC2/DisableOrModifyTools      2       count=1
2026-10-28T06:36:05Z    DefenseImpairment:EC2/DisableOrModifyTools      2       count=1
2026-10-28T06:36:10Z    DefenseImpairment:EC2/DisableOrModifyTools      2       count=1

as_actor 1 s3api put-bucket-lifecycle-configuration --bucket $BUCKET --lifecycle-configuration \
  '{"Rules":[{"ID":"demo-rapid-expire","Status":"Enabled","Filter":{"Prefix":""},"Expiration":{"Days":1}}]}'

make_actor 5
sleep 15  # ロール作成待ちのため念のため15秒だけ待機
as_actor 5 lambda create-function-url-config --function-name $FN --auth-type NONE --query AuthType --output text

Lambda 関数 demo-gd-url-fn の関数 URL の認証を、NONE から AWS_IAM に変えてください。関数 URL もロールも削除しないでください。ほかの変更もしないでください。

aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=UpdateApprovalAction \
  --start-time $(date -u -d '-60 min' +%FT%TZ) --query 'Events[].[EventTime,EventName]' --output text

export AWS_REGION=ap-northeast-1
ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
for r in demo-gd-low demo-gd-medium demo-gd-high demo-gd-capture demo-guard-skipped; do
  ids=$(aws events list-targets-by-rule --rule $r --query 'Targets[].Id' --output text)
  [ -n "$ids" ] && aws events remove-targets --rule $r --ids $ids >/dev/null
  aws events delete-rule --name $r && echo "$r deleted"
done
aws events delete-api-destination --name demo-devops-agent-webhook
aws events delete-connection --name demo-devops-agent-webhook
aws iam delete-role-policy --role-name demo-eventbridge-devops-agent --policy-name invoke-api-destination
aws iam delete-role --role-name demo-eventbridge-devops-agent
aws sqs delete-queue --queue-url $(aws sqs get-queue-url --queue-name demo-devops-agent-dlq --query QueueUrl --output text)
aws sns delete-topic --topic-arn arn:aws:sns:$AWS_REGION:$ACCOUNT_ID:demo-devops-agent-alert && echo "topic deleted"
for LG in /aws/events/demo-gd /aws/events/demo-gd-low; do aws logs delete-log-group --log-group-name $LG; done
aws logs delete-resource-policy --policy-name demo-gd-events
for r in ec2-termination-protection-enabled s3-lifecycle-rapid-expiration lambda-function-url-public-access; do
  A=$(aws guardduty list-custom-detection-rule-associations --rule-id "$r" --query 'RuleAssociations[0].AssociationId' --output text)
  aws guardduty delete-custom-detection-rule-association --rule-id "$r" --association-id "$A"
done

aws ec2 modify-instance-attribute --instance-id $INSTANCE_ID --no-disable-api-termination
aws ec2 terminate-instances --instance-ids $INSTANCE_ID --query 'TerminatingInstances[0].CurrentState.Name' --output text
aws s3api delete-bucket --bucket $BUCKET
aws lambda delete-function --function-name $FN
aws iam delete-role --role-name demo-gd-url-fn-role
for n in 1 2 3 4 5; do  # 作った番号に合わせる
  aws iam delete-role-policy --role-name demo-gd-actor-$n --policy-name demo-actions &&
  aws iam delete-role --role-name demo-gd-actor-$n && echo "demo-gd-actor-$n deleted"
done