Amazon GuardDuty is a threat-detection service that continuously monitors your AWS accounts and workloads for malicious activity and delivers detailed security findings for visibility and remediation.
Use Amazon GuardDuty to Trigger Workflows in Torq
Step One: Create an Amazon GuardDuty Trigger Integration in Torq
Add the Integration: Navigate to Build > Integrations > Triggers > Amazon GuardDuty and click Add Instance.
Configure the Integration: Enter a unique and meaningful name.
Finalize: Click Add and Copy the generated endpoint. You will need the URL to create the subscription in AWS.
Step Two: Create an SNS Topic
Open AWS SNS: Sign in to the AWS Management Console and go to Simple Notification Service.
Create a Topic: Select Topics > Create topic.
Select the Standard type.
Enter a unique and meaningful name.
Finalize: Click Create topic.
Step Three: Subscribe Torq to an SNS Topic
Open AWS SNS: Go to Simple Notification Service in the AWS Management Console.
Create a Subscription: Select Subscriptions > Create subscription.
Select a Topic ARN: This ARN should either be for the topic you created earlier or for a previously created topic containing relevant messages.
Select a Protocol: Select the HTTPS endpoint.
Enter the Endpoint: Paste the URL that you generated earlier in Torq.
Enable raw message delivery: Click enable raw message delivery.
Finalize: Click Create subscription.
Step Four: Create an EventBridge Rule
Open AWS SNS: Go to Amazon EventBridge in the AWS Management Console.
Create a Rule: Select Buses > Rules and click Create rule.
Define the Rule:
Enter a unique and meaningful name.
(Optional) Enter a description of the rule.
Click Next.
Build the Event Pattern:
AWS service: Select GuardDuty.
Event type: Select All Events.
Click Next.
Select a Target:
Select a target: Choose SNS topic.
Topic: Select the topic you created earlier.
Click Next.
(Optional) Configure Tags: Click Add new tag to specify a key and then click Next.
Finalize: Review the rule and click Create rule.
Step Five: Confirm the Subscription
Open the Activity Log in Torq: Navigate to Monitor > Activity Log.
Filter for the Integration: Click Source and select the GuardDuty integration you created earlier in Torq.
Locate the Subscription Confirmation Event: If there is more than one event, locate the one with
"Type": "SubscriptionConfirmation"in the Event JSON.Retrieve the Event's Subscribe URL: Search for the
SubscribeURLin the Event JSON and copy it.
Send the HTTP Request: Paste the subscribe URL in your browser. An XML file will be rendered.
Check the Subscription's Status: Open the AWS Management Console and navigate to Amazon SNS > Subscriptions. Search for the subscription and verify the status is Confirmed.
(Optional) Generate Sample GuardDuty Findings: In the AWS Management Console, navigate to GuardDuty > Settings.
In the Sample Findings section, click Generate sample findings.
Return to Monitor > Activity Log in Torq and refresh the page until the new event appears.
Click the event and review the sample GuardDuty findings in the Event JSON.
Now that you've successfully created an Amazon GuardDuty trigger, you can build your first GuardDuty–initiated workflow!
In Torq, go to Build > Workflows > Create a Workflow > New Blank Workflow, and select the trigger type: Integrations > Amazon GuardDuty. Find your new trigger, and automate away!