archive findings generated with the "generate findings" button in aws guardduty

archive-guardduty-sample-findings.sh

#!/usr/bin/env bash
set -e

PROFILE="${1:?Usage: $0 <profile> [region]}"
REGION="${2:-us-east-2}"

AWS="aws --profile $PROFILE --region $REGION"

DETECTOR_ID=$($AWS guardduty list-detectors \
    --query 'DetectorIds[0]' \
    --output text)

if [ "$DETECTOR_ID" == "None" ] || [ -z "$DETECTOR_ID" ]; then
    echo "No GuardDuty detector found in $REGION"
    exit 1
fi

echo "Profile: $PROFILE | Region: $REGION | Detector: $DETECTOR_ID"

ALL_FINDING_IDS=$($AWS guardduty list-findings \
    --detector-id "$DETECTOR_ID" \
    --finding-criteria '{"Criterion":{"service.archived":{"Eq":["false"]}}}' \
    --query 'FindingIds' \
    --output json)

TOTAL=$(echo "$ALL_FINDING_IDS" | jq 'length')

if [ "$TOTAL" -eq 0 ]; then
    echo "No unarchived findings"
    exit 0
fi

echo "Scanning $TOTAL unarchived findings for samples..."

SAMPLE_IDS="[]"
while IFS= read -r batch; do
    BATCH_FINDINGS=$($AWS guardduty get-findings \
        --detector-id "$DETECTOR_ID" \
        --finding-ids "$batch" \
        --output json)

    BATCH_SAMPLES=$(echo "$BATCH_FINDINGS" | jq '
        [
          .Findings[]
          | select(
              (.Service.AdditionalInfo.Sample == true)
              or
              ((.Service.AdditionalInfo.Value | type == "object") and (.Service.AdditionalInfo.Value.sample == true or .Service.AdditionalInfo.Value.sample == "true"))
              or
              ((.Service.AdditionalInfo.Value | type == "string") and (try (.Service.AdditionalInfo.Value | fromjson | .sample) catch null) == true)
            )
          | .Id
        ]
    ')
    SAMPLE_IDS=$(jq -n --argjson a "$SAMPLE_IDS" --argjson b "$BATCH_SAMPLES" '$a + $b')
done < <(echo "$ALL_FINDING_IDS" | jq -c '[.[]] | _nwise(50)')

COUNT=$(echo "$SAMPLE_IDS" | jq 'length')

if [ "$COUNT" -eq 0 ]; then
    echo "No sample findings to archive"
    exit 0
fi

echo "Found $COUNT sample findings"

echo "$SAMPLE_IDS" | jq -c '[.[]] | _nwise(50)' | while read -r batch; do
    $AWS guardduty archive-findings \
        --detector-id "$DETECTOR_ID" \
        --finding-ids "$batch"
    BATCH_COUNT=$(echo "$batch" | jq 'length')
    echo "Archived $BATCH_COUNT findings"
done

echo "Done"