com.mozilla.secops.gatekeeper

Class GuardDutyFindingMatcher

java.lang.Object

com.mozilla.secops.gatekeeper.GuardDutyFindingMatcher

All Implemented Interfaces:

Serializable

public class GuardDutyFindingMatcher
extends Object
implements Serializable

GuardDutyFindingMatcher is used for matching against Guardduty findings, used by GatekeeperPipeline to bucket findings into different categories

See Also:

Serialized Form

Constructor Summary

Constructors

Constructor and Description
GuardDutyFindingMatcher()

Method Summary

Modifier and Type	Method and Description
boolean	matches(com.amazonaws.services.guardduty.model.Finding f) Checks if a Finding matches this matcher.
void	setAccountId(String accountId) Set the account id to match against
void	setAwsTags(Map<String,String> awsTags) Set the aws tags to match against
void	setDomainName(String domainName) Set the domain name to match against within the finding
void	setFindingType(String findingType) Set the finding type to match against

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

GuardDutyFindingMatcher

public GuardDutyFindingMatcher()

Method Detail

setFindingType

public void setFindingType(String findingType)

Set the finding type to match against

Parameters:

findingType - finding type string (regex supported)

setAwsTags

public void setAwsTags(Map<String,String> awsTags)

Set the aws tags to match against

Parameters:

awsTags - map of tags to match against, values support regex.

setAccountId

public void setAccountId(String accountId)

Set the account id to match against

Parameters:

accountId - aws account id string

setDomainName

public void setDomainName(String domainName)

Set the domain name to match against within the finding

Parameters:

domainName - domain string

matches

public boolean matches(com.amazonaws.services.guardduty.model.Finding f)

Checks if a Finding matches this matcher. This is done by comparing the finding type, account id, tags, and domain name (from Finding). If one (or more) of these are unset, it is ignored.

Parameters:

f - Guardduty Finding

Returns:

boolean