AWS GuardDuty High Severity Threat Finding Sentinel

id: aws-guardduty-threat-finding-severity-sentinel
namespace: company.ops

inputs:
  - id: aws_region
    type: STRING
    defaults: us-east-1
    description: AWS region where GuardDuty is enabled.
  - id: severity_threshold
    type: FLOAT
    defaults: 7.0
    description: Minimum GuardDuty finding severity to alert on (0-10 scale).

tasks:
  - id: query_guardduty_findings
    type: io.kestra.plugin.aws.cli.AwsCLI
    accessKeyId: "{{ secret('AWS_ACCESS_KEY_ID') }}"
    secretKeyId: "{{ secret('AWS_SECRET_ACCESS_KEY') }}"
    region: "{{ inputs.aws_region }}"
    commands:
      - |
        DETECTOR_IDS=$(aws guardduty list-detectors --output json | jq -r '.DetectorIds[]')
        FINDINGS_SUMMARY=""
        HIGH_COUNT=0
        for DETECTOR_ID in $DETECTOR_IDS; do
          FINDING_IDS=$(aws guardduty list-findings \
            --detector-id "$DETECTOR_ID" \
            --finding-criteria "{\"Criterion\":{\"severity\":{\"Gte\":{{ inputs.severity_threshold | int }}}}}" \
            --output json | jq -r '.FindingIds[]' 2>/dev/null || true)
          if [ -n "$FINDING_IDS" ]; then
            IDS_JSON=$(echo $FINDING_IDS | tr ' ' '\n' | head -5 | jq -R . | jq -s .)
            FINDINGS=$(aws guardduty get-findings \
              --detector-id "$DETECTOR_ID" \
              --finding-ids $FINDING_IDS \
              --output json 2>/dev/null || echo '{"Findings":[]}')
            COUNT=$(echo "$FINDINGS" | jq '.Findings | length')
            HIGH_COUNT=$((HIGH_COUNT + COUNT))
            TYPES=$(echo "$FINDINGS" | jq -r '[.Findings[].Type] | unique | join(", ")')
            FINDINGS_SUMMARY="$FINDINGS_SUMMARY DetectorId=$DETECTOR_ID Count=$COUNT Types=$TYPES;"
          fi
        done
        if [ $HIGH_COUNT -gt 0 ]; then
          echo "{\"high_severity_found\": true, \"high_count\": $HIGH_COUNT, \"summary\": \"$FINDINGS_SUMMARY\"}"
        else
          echo "{\"high_severity_found\": false, \"high_count\": 0, \"summary\": \"No high severity findings\"}"
        fi

  - id: evaluate_findings
    type: io.kestra.plugin.core.flow.If
    condition: "{{ outputs.query_guardduty_findings.vars.high_severity_found |
      default(false) }}"
    then:
      - id: alert_slack
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        url: "{{ secret('SLACK_WEBHOOK') }}"
        payload: |
          {
            "text": ":rotating_light: *AWS GuardDuty High Severity Findings Detected*\n• Total high-severity findings: `{{ outputs.query_guardduty_findings.vars.high_count }}`\n• Summary: `{{ outputs.query_guardduty_findings.vars.summary }}`\n• Severity threshold: `{{ inputs.severity_threshold }}`\n• Region: `{{ inputs.aws_region }}`"
          }
    else:
      - id: log_ok
        type: io.kestra.plugin.core.log.Log
        message: "No high-severity GuardDuty findings detected. Region: {{
          inputs.aws_region }}"

errors:
  - id: error_alert
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK') }}"
    payload: |
      {
        "text": ":x: *AWS GuardDuty Sentinel failed*\nExecution `{{ execution.id }}` encountered an error: `{{ error.message }}`"
      }

triggers:
  - id: scheduled_sentinel_check
    type: io.kestra.plugin.core.trigger.Schedule
    cron: "*/15 * * * *"
    disabled: true