Naemon/Nagios plugin for AWS GaurdDuty (outputs status and full table with resolve of instance id to Name tag)

check_aws_guardduty.sh

#!/bin/bash
awscmd='aws guardduty --output json'
frmt='%-6s %-9s %-6s %-20s %-20s %-11s %-11s %-10s %s\n'
# damn aws stupid reports with utf8
export LC_ALL='en_US.UTF-8'

map_id(){
        res_sed=`aws ec2 describe-instances --output json |\
                jq -r '.Reservations[].Instances[] | "\(.InstanceId) \(if .Tags and ([.Tags[] | select ( .Key == "Name" )] != []) then .Tags[] | select ( .Key == "Name" ) | .Value else  "%" end)"' |\
                grep -v % | sed 1d | sort -r |\
                awk '$2!="None"{printf "s#\\\b"$1"\\\b#"$2"#g;"};'`
        cat | sed "$res_sed"
}

time2age(){
        local s=$((`date +%s`-`date +%s -d "${1/T/ }"`))
        printf "%02d:%02d:%02d" $(($s/3600)) $(($s%3600/60)) $(($s%60))
}

times2age(){
        local s=$((`date +%s -d "${2/T/ }"`-`date +%s -d "${1/T/ }"`));
        printf "%02d:%02d:%02d" $(($s/3600)) $(($s%3600/60)) $(($s%60))

}

det=`$awscmd list-detectors | jq -r '"\(.DetectorIds[0])"'`
fin=`$awscmd list-findings --page-size 50 --detector-id $det | jq -r '"\(.FindingIds[])"'`
[ -z "$fin" ] && fin_cnt=0 || fin_cnt=`echo "$fin" | wc -l`
table=$(echo "$fin" | while read f; do
                if ! ((++c%50)); then
                        $awscmd get-findings --detector-id $det --finding-ids $fs |\
                                jq -r '.Findings[] | "\(.Severity) \(.Service.Count) \(.Service.EventFirstSeen) \(.Service.EventLastSeen) \(.UpdatedAt) \(.Service.Archived) \(.Title)"' |\
                                map_id | while read s c ss se t a m; do
                                        S='high'
                                        [ $s -lt 7 ] && S='med'
                                        [ $s -lt 4 ] && S='low'
                                        T=`time2age $se`
                                        D=`times2age $ss $se`
                                        printf "$frmt" $S $s $c ${ss/Z*/} ${se/Z*/} $D $T $a "$m"
                                done
                        unset fs
                fi
                fs="$fs $f"
        done | awk '$8!="true"')
if [ "$fin_cnt" -gt 0 ] && [ -z "$table" ]; then
        echo "Can't get findings details (found $fin_cnt)"
        #echo $awscmd get-findings --detector-id $det --finding-ids $fin
        #$awscmd get-findings --detector-id $det --finding-ids $fin 2>&1 |\
        #       jq -r '.Findings[] | "\(.Severity) \(.Service.Count) \(.Service.EventFirstSeen) \(.Service.EventLastSeen) \(.UpdatedAt) \(.Title)"' 2>&1
        exit 2
fi

eval `echo "$table" | awk '{print $1}' | sort | uniq -c | awk '{print $2"="$1}'`

counts="LOW:${low:=0} MED:${med:=0} HIGH:${high:=0}"

details="<pre>
`printf \"$frmt\" Level Severity Count SeenFirst SeenLast Duration AgeLast Archived Msg
echo "$table"`
</pre>"

if [ $high -gt 0 ]; then
        ec=2
        msg='High severity alerts found'
elif [ $med -gt 0 ]; then
        ec=1
        msg='Medium severity alerts found'
elif [ $low -gt 0 ]; then
        ec=1
        msg='Low severity alerts found'
else
        ec=0
        msg='No findings'
fi

echo "$msg ($counts)"
[ $ec -gt 0 ] && echo "$details"
exit $ec