Create EventBridge Rule

In this step we will create a EventBridge Rule for create a snapshot for the BasicLinuxTarget.

Create EventBridge Rule

• Search for the EventBridge. This will take you to the EventBridge homepage, click on Create Rule.

• Name the rule is : gd-compromised-instance-remediation, the description is optional, then foward to the creation.

• Under Event pattern, Creation method click the Custom pattern(JSON editor) and paste the Json below into the editor.

{
    "source": ["aws.guardduty"],
    "detail": {
        "type": ["UnauthorizedAccess:EC2/TorClient", "Backdoor:EC2/C&CActivity.B!DNS", "Trojan:EC2/DNSDataExfiltration", "CryptoCurrency:EC2/BitcoinTool.B", "CryptoCurrency:EC2/BitcoinTool.B!DNS"]
    }
}

• The result should be like this then click Next.

1. Select Lambda function as the target.
2. Select the ec2instance-containment-with-forensics as the Function. (The result should be like this)

3. Leave every unchanged and create the Rule.

When you are done with all the steps, head to the next part of the Workshop which is Configure Automated Response or you can do the Step Function response