Poll SWC for new alerts and observations

swc_lambda_poll.py

"""
swc_lambda_poll.py

Use this AWS Lambda function with a Cloudwatch Logs Event to poll
for and react to Stealthwatch Cloud alerts.
The Cloudwatch Logs Event should trigger every 10 minutes.
"""
from datetime import datetime, timedelta, timezone
from os import environ
from botocore.vendored import requests


def lambda_handler(event, context):
    customer_name = environ['CUSTOMER_NAME']
    api_user = environ['API_USER']
    api_key = environ['API_KEY']
    
    now = datetime.strptime(event['time'], '%Y-%m-%dT%H:%M:%SZ')
    start_time = (now - timedelta(minutes=10)).replace(tzinfo=timezone.utc)
    
    url = f'https://{customer_name}.obsrvbl.com/api/v3/alerts/notifications/'
    headers = {
        'Authorization': 'ApiKey {}:{}'.format(api_user, api_key),
        'Accept': 'application/json'
    }
    params = {'time__gt': start_time.strftime('%Y-%m-%dT%H:%M:%SZ')}
    resp = requests.get(url=url, headers=headers, params=params)
    resp.raise_for_status()
    
    # Do something with the result
    for alert in resp.json().get('objects', []):
        print(alert)