Amazon Detective

接入教程

1. 登录AWS控制台并启用Detective服务
2. 选择要监控的AWS账户或工作负载区域
3. 配置数据源以自动收集安全事件日志
4. 使用可视化仪表板分析异常活动模式
5. 根据调查结果采取相应的安全补救措施
6. 定期审查Detective报告以优化安全策略

使用Python获取调查摘要

python

import requests
import json

base_url = 'https://api.detective.us-east-1.amazonaws.com'
headers = {
    'Content-Type': 'application/json',
    'X-Amz-Date': '20240101T120000Z',
    'Authorization': 'AWS4-HMAC-SHA256 Credential=YOUR_API_KEY/20240101/us-east-1/detective/aws4_request'
}

payload = {
    'GraphArn': 'arn:aws:detective:us-east-1:123456789012:graph/0123456789abcdef'
}

response = requests.post(f'{base_url}/investigations/summary', headers=headers, data=json.dumps(payload))
print(response.json())

使用PHP列出安全图表

php

<?php
$baseUrl = 'https://api.detective.us-east-1.amazonaws.com';
$headers = [
    'Content-Type: application/json',
    'X-Amz-Date: 20240101T120000Z',
    'Authorization: AWS4-HMAC-SHA256 Credential=YOUR_API_KEY/20240101/us-east-1/detective/aws4_request'
];

$data = [
    'NextToken' => '',
    'MaxResults' => 10
];

$ch = curl_init($baseUrl . '/graphs/list');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($data));

$response = curl_exec($ch);
curl_close($ch);

echo $response;
?>

使用JavaScript创建成员账户

javascript

const axios = require('axios');

const baseUrl = 'https://api.detective.us-east-1.amazonaws.com';
const headers = {
    'Content-Type': 'application/json',
    'X-Amz-Date': '20240101T120000Z',
    'Authorization': 'AWS4-HMAC-SHA256 Credential=YOUR_API_KEY/20240101/us-east-1/detective/aws4_request'
};

const data = {
    GraphArn: 'arn:aws:detective:us-east-1:123456789012:graph/0123456789abcdef',
    AccountId: '123456789013',
    EmailAddress: 'security@example.com'
};

axios.post(`${baseUrl}/members/create`, data, { headers })
    .then(response => {
        console.log(response.data);
    })
    .catch(error => {
        console.error(error);
    });

常见问题

Amazon Detective API需要什么认证方式？

Amazon Detective API使用AWS签名版本4（SigV4）进行认证。您需要使用有效的AWS访问密钥（包括访问密钥ID和秘密访问密钥）来签署API请求，并在Authorization头中提供签名凭证。

如何获取GraphArn以调用API？

GraphArn（图表ARN）是Amazon Detective中安全图表的唯一标识符。您可以通过AWS控制台创建安全图表后获取ARN，或通过ListGraphs API操作列出已有的图表ARN。GraphArn格式通常为：arn:aws:detective:region:account-id:graph/graph-id。

API请求频率是否有限制？

是的，Amazon Detective API有节流限制以防止滥用。具体的请求速率限制取决于AWS账户类型和区域。如果超过限制，API将返回429 Too Many Requests错误。建议在代码中实现适当的重试逻辑和退避策略。