Create EventBridge Rule

In this step we will create a EventBridge Rule for create a snapshot for the BasicLinuxTarget.

Create EventBridge Rule

• Search for the EventBridge. This will take you to the EventBridge home, click on Create Rule.

• Name the rule is : gd-compromised-instance-remediation (if you still kept the old one then add this rule with -sf), the description is optional, then foward to the creation.

• Under Event pattern, Creation method click the Custom pattern(JSON editor) and paste the Json below into the editor.

{
    "source": ["aws.guardduty"],
    "detail": {
        "type": ["UnauthorizedAccess:EC2/TorClient", "Backdoor:EC2/C&CActivity.B!DNS", "Trojan:EC2/DNSDataExfiltration", "CryptoCurrency:EC2/BitcoinTool.B", "CryptoCurrency:EC2/BitcoinTool.B!DNS"]
    }
}

• The result should be like this then click Next.

1. Select Step Functions state machine as the target.
2. Select the the State Machine that we tested before PREFIX_StateMachine as the Target. (The result should be like this)

3. Leave every unchanged and create the Rule.

When you are done with all the steps, head to the next part of the Workshop which is Configure Automated Response