SecurityHubのGuardDutyサンプル検出結果をAWS CLI（シェルスクリプト）でまとめて解決/抑制してみた

chmod +x update_guardduty_samples.sh
./update_guardduty_samples.sh [RESOLVED|SUPPRESSED] [dry-run]

$ ./update_guardduty_samples.sh RESOLVED dry-run
[DRY RUN] Would update 100 findings to RESOLVED.
[DRY RUN] Would update 100 findings to RESOLVED.
[DRY RUN] Would update 100 findings to RESOLVED.
[DRY RUN] Would update 63 findings to RESOLVED.
総更新件数: 0 (未処理: 0)

$ ./update_guardduty_samples.sh RESOLVED
Updated 100 findings (Unprocessed: 0).
Updated 100 findings (Unprocessed: 0).
Updated 100 findings (Unprocessed: 0).
Updated 63 findings (Unprocessed: 0).
総更新件数: 363 (未処理: 0)

#!/bin/bash

# スクリプトの使用方法: ./update_guardduty_samples.sh [RESOLVED|SUPPRESSED] [dry-run]
# 例: ./update_guardduty_samples.sh RESOLVED dry-run
# dry-runを指定すると、更新せずに対象件数を確認。
# 前提: AWS CLIがインストールされ、適切な権限が設定済み。jqが必要。

STATUS="${1:-RESOLVED}"  # デフォルトはRESOLVED
DRY_RUN="$2"
REGION="ap-northeast-1"       # リージョン（変更してください）
MAX_RESULTS=100          # ページサイズ
SLEEP_INTERVAL=1         # APIレート制限対策の遅延（秒）
NOTE_TEXT="サンプル検出結果のため${STATUS}"
NOTE_UPDATED_BY="update-guardduty-samples-script"

if [ "$STATUS" != "RESOLVED" ] && [ "$STATUS" != "SUPPRESSED" ]; then
  echo "Usage: $0 [RESOLVED|SUPPRESSED] [dry-run]"
  exit 1
fi

if [ "$DRY_RUN" != "dry-run" ] && [ ! -z "$DRY_RUN" ]; then
  echo "Usage: $0 [RESOLVED|SUPPRESSED] [dry-run]"
  exit 1
fi

if ! command -v jq >/dev/null 2>&1; then
  echo "Error: jq is required but not installed. Install jq (e.g., apt install jq or brew install jq)."
  exit 1
fi

# 変数初期化
NEXT_TOKEN=""
TOTAL_UPDATED=0
TOTAL_UNPROCESSED=0

while true; do
  # get-findings実行
  if [ -z "$NEXT_TOKEN" ]; then
    RESPONSE=$(aws securityhub get-findings \
      --filters '{"ProductName":[{"Value":"GuardDuty","Comparison":"EQUALS"}],"Sample":[{"Value":true}],"RecordState":[{"Value":"ACTIVE","Comparison":"EQUALS"}],"WorkflowStatus":[{"Value":"NEW","Comparison":"EQUALS"},{"Value":"NOTIFIED","Comparison":"EQUALS"}]}' \
      --max-results $MAX_RESULTS \
      --region $REGION \
      --output json 2>&1)
  else
    RESPONSE=$(aws securityhub get-findings \
      --filters '{"ProductName":[{"Value":"GuardDuty","Comparison":"EQUALS"}],"Sample":[{"Value":true}],"RecordState":[{"Value":"ACTIVE","Comparison":"EQUALS"}],"WorkflowStatus":[{"Value":"NEW","Comparison":"EQUALS"},{"Value":"NOTIFIED","Comparison":"EQUALS"}]}' \
      --max-results $MAX_RESULTS \
      --next-token "$NEXT_TOKEN" \
      --region $REGION \
      --output json 2>&1)
  fi

  if [[ $RESPONSE == *"An error occurred"* ]]; then
    echo "Error in get-findings: $RESPONSE"
    exit 1
  fi

  FINDINGS=$(echo "$RESPONSE" | jq '.Findings')
  NUM_FINDINGS=$(echo "$FINDINGS" | jq 'length')

  if [ "$NUM_FINDINGS" -eq 0 ]; then
    echo "No more findings found."
    break
  fi

  IDENTIFIERS=$(echo "$FINDINGS" | jq '[.[] | {"Id": .Id, "ProductArn": .ProductArn}]')

  if [ "$DRY_RUN" = "dry-run" ]; then
    echo "[DRY RUN] Would update $NUM_FINDINGS findings to $STATUS."
  else
    UPDATE_RESPONSE=$(aws securityhub batch-update-findings \
      --finding-identifiers "$IDENTIFIERS" \
      --workflow '{"Status": "'"$STATUS"'"}' \
      --note '{"Text": "'"$NOTE_TEXT"'", "UpdatedBy": "'"$NOTE_UPDATED_BY"'"}' \
      --region $REGION \
      --output json 2>&1)

    if [[ $UPDATE_RESPONSE == *"An error occurred"* ]]; then
      echo "Error in batch-update-findings: $UPDATE_RESPONSE"
      sleep $SLEEP_INTERVAL
      continue
    fi

    PROCESSED=$(echo "$UPDATE_RESPONSE" | jq '.ProcessedFindings | length')
    UNPROCESSED=$(echo "$UPDATE_RESPONSE" | jq '.UnprocessedFindings | length')
    TOTAL_UPDATED=$((TOTAL_UPDATED + PROCESSED))
    TOTAL_UNPROCESSED=$((TOTAL_UNPROCESSED + UNPROCESSED))
    echo "Updated $PROCESSED findings (Unprocessed: $UNPROCESSED)."
  fi

  NEXT_TOKEN=$(echo "$RESPONSE" | jq -r '.NextToken // empty')
  if [ -z "$NEXT_TOKEN" ]; then
    break
  fi

  sleep $SLEEP_INTERVAL
done

echo "総更新件数: $TOTAL_UPDATED (未処理: $TOTAL_UNPROCESSED)"

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyGuardDutySampleFindings",
      "Effect": "Deny",
      "Action": ["guardduty:CreateSampleFindings"],
      "Resource": ["*"]
    }
  ]
}