Package com.mozilla.secops.gatekeeper

Pipeline for AWS Guardduty and GCP ETD analysis

See: Description

Interface Summary

Interface	Description
ETDTransforms.Options	Runtime options for ETD Transforms
GatekeeperPipeline.GatekeeperOptions	Runtime options for GatekeeperPipeline .
GuardDutyTransforms.Options	Runtime options for GuardDuty Transforms

Class Summary

Class	Description
ETDTransforms	Implements various transforms on GCP's EventThreatDetectionFinding Events
ETDTransforms.ExtractFindings	Extract ETD Findings
ETDTransforms.GenerateETDAlerts	Generate Alerts for relevant ETD Finding Events
ETDTransforms.SuppressAlerts	Suppress Alerts for repeated Event Threat Detection Findings.
GatekeeperParser	Implements a parser which handles both AWS GuardDuty Finding and GCP ETD Findings EventThreatDetectionFinding
GatekeeperParser.Parse	Composite transform to parse a PCollection containing events as strings and emit a PCollection of Event objects.
GatekeeperPipeline	GatekeeperPipeline describes and implements a Beam pipeline for analysis of AWS GuardDuty and GCP Event Threat Detection Findings
GuardDutyConfig	GuardDutyConfig is used for configuring our use of Guardduty, i.e.
GuardDutyFindingMatcher	GuardDutyFindingMatcher is used for matching against Guardduty findings, used by GatekeeperPipeline to bucket findings into different categories
GuardDutyTransforms	Implements various transforms on AWS GuardDuty Finding Events
GuardDutyTransforms.ExtractFindings	Extract GuardDuty Findings
GuardDutyTransforms.GenerateGDAlerts	Generate Alerts for relevant Findings
GuardDutyTransforms.SuppressAlerts	Suppress Alerts for repeated GuardDuty Findings.

Package com.mozilla.secops.gatekeeper Description

Pipeline for AWS Guardduty and GCP ETD analysis