Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update_310124_3 #4777

Merged
merged 1 commit into from
Jan 31, 2024
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
115 changes: 6 additions & 109 deletions terraform/environments/ppud/cloudwatch_windows.tf
Original file line number Diff line number Diff line change
Expand Up @@ -307,13 +307,14 @@ resource "aws_cloudwatch_log_metric_filter" "MalwareScan-Started" {
count = local.is-production == true ? 1 : 0
name = "MalwareScan-Started"
log_group_name = aws_cloudwatch_log_group.Windows-Defender-Logs[count.index].name
pattern = "Microsoft Defender Antivirus scan has started."
pattern = "[date, time, Instance, MalwareScan-Started, status=1000]"
metric_transformation {
name = "MalwareScan-Started"
namespace = "WindowsDefender"
value = "1"
dimensions = {
dimensions = {
Instance = "$Instance"
MalwareScan-Started = "$MalwareScan-Started"
}
}
}
Expand All @@ -322,118 +323,14 @@ resource "aws_cloudwatch_log_metric_filter" "MalwareScan-Finished" {
count = local.is-production == true ? 1 : 0
name = "MalwareScan-Finished"
log_group_name = aws_cloudwatch_log_group.Windows-Defender-Logs[count.index].name
pattern = "Microsoft Defender Antivirus scan has finished."
pattern = "[date, time, Instance, MalwareScan-Finished, status=1001]"
metric_transformation {
name = "MalwareScan-Finished"
namespace = "WindowsDefender"
value = "1"
dimensions = {
Instance = "$Instance"
}
}
}

resource "aws_cloudwatch_log_metric_filter" "MalwareScan-Stopped" {
count = local.is-production == true ? 1 : 0
name = "MalwareScan-Stopped"
log_group_name = aws_cloudwatch_log_group.Windows-Defender-Logs[count.index].name
pattern = "Microsoft Defender Antivirus scan has been stopped before completion."
metric_transformation {
name = "MalwareScan-Stopped"
namespace = "WindowsDefender"
value = "1"
dimensions = {
Instance = "$Instance"
}
}
}

resource "aws_cloudwatch_log_metric_filter" "MalwareScan-Failed" {
count = local.is-production == true ? 1 : 0
name = "MalwareScan-Failed"
log_group_name = aws_cloudwatch_log_group.Windows-Defender-Logs[count.index].name
pattern = "Microsoft Defender Antivirus scan has failed."
metric_transformation {
name = "MalwareScan-Failed"
namespace = "WindowsDefender"
value = "1"
dimensions = {
Instance = "$Instance"
}
}
}

resource "aws_cloudwatch_log_metric_filter" "MalwareBehavior-Detected" {
count = local.is-production == true ? 1 : 0
name = "MalwareBehavior-Detected"
log_group_name = aws_cloudwatch_log_group.Windows-Defender-Logs[count.index].name
pattern = "Microsoft Defender Antivirus detected a suspicious behavior."
metric_transformation {
name = "MalwareBehavior-Detected"
namespace = "WindowsDefender"
value = "1"
dimensions = {
Instance = "$Instance"
}
}
}

resource "aws_cloudwatch_log_metric_filter" "MalwareState-Detected" {
count = local.is-production == true ? 1 : 0
name = "MalwareState-Detected"
log_group_name = aws_cloudwatch_log_group.Windows-Defender-Logs[count.index].name
pattern = "Microsoft Defender Antivirus has detected malware or other potentially unwanted software."
metric_transformation {
name = "MalwareState-Detected"
namespace = "WindowsDefender"
value = "1"
dimensions = {
Instance = "$Instance"
}
}
}

resource "aws_cloudwatch_log_metric_filter" "MalwareSignatureUpdate-Failed" {
count = local.is-production == true ? 1 : 0
name = "MalwareSignatureUpdate-Failed"
log_group_name = aws_cloudwatch_log_group.Windows-Defender-Logs[count.index].name
pattern = "Microsoft Defender Antivirus has encountered an error trying to update security intelligence."
metric_transformation {
name = "MalwareSignatureUpdate-Failed"
namespace = "WindowsDefender"
value = "1"
dimensions = {
Instance = "$Instance"
}
}
}

resource "aws_cloudwatch_log_metric_filter" "MalwareEngineUpdate-Failed" {
count = local.is-production == true ? 1 : 0
name = "MalwareEngineUpdate-Failed"
log_group_name = aws_cloudwatch_log_group.Windows-Defender-Logs[count.index].name
pattern = "Microsoft Defender Antivirus has encountered an error trying to update the engine."
metric_transformation {
name = "MalwareEngineUpdate-Failed"
namespace = "WindowsDefender"
value = "1"
dimensions = {
Instance = "$Instance"
}
}
}

resource "aws_cloudwatch_log_metric_filter" "MalwareEngineUpdate-OutofDate" {
count = local.is-production == true ? 1 : 0
name = "MalwareEngineUpdate-OutofDate"
log_group_name = aws_cloudwatch_log_group.Windows-Defender-Logs[count.index].name
pattern = "Microsoft Defender Antivirus could not load antimalware engine because current platform version is not supported."
metric_transformation {
name = "MalwareEngineUpdate-OutofDate"
namespace = "WindowsDefender"
value = "1"
dimensions = {
dimensions = {
Instance = "$Instance"
MalwareScan-Finished = "$MalwareScan-Finished"
}
}
}