Security Hub

dict(
  time=ts_str_to_epoch($.LastObservedAt, "yyyy-MM-dd'T'HH:mm:ss.SSS'Z'"),
  cloud=dict(
    region=$.Region,
    account=dict(
      uid=$.AwsAccountId
    ),
    provider='AWS'
  ),
  status=$.Workflow.Status,
  message=$.Description,
  time_dt=$.LastObservedAt,
  metadata=dict(
    product=dict(
      uid=$.ProductArn,
      name=$.ProductName,
      feature=dict(
        uid=$.GeneratorId,
        name=$.ProductFields['aws/guardduty/service/featureName']
      ),
      vendor_name=$.CompanyName
    ),
    version='1.1.0',
    profiles=array('cloud', 'datetime', 'linux'),
    extensions=array(
      dict(
        uid=1,
        name='linux',
        version='1.1.0'
      )
    ),
    log_version=$.SchemaVersion,
    processed_time_dt=$.ProcessedAt
  ),
  severity=$.Severity.Label,
  type_uid=case(
    $.CreatedAt == $.UpdatedAt => 200401,
    _ => 200402
  ),
  class_uid=2004,
  evidences=array(
    dict(
      api=dict(
        service=dict(
          name=$.ProductFields['aws/guardduty/service/action/awsApiCallAction/serviceName']
        ),
        operation=$.ProductFields['aws/guardduty/service/action/awsApiCallAction/api']
      ),
      src_endpoint=dict(
        ip=$.ProductFields['aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/ipAddressV4'],
        location=dict(
          city=$.ProductFields['aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/city/cityName'],
          country=$.ProductFields['aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/country/countryName'],
          coordinates=array(
            $.ProductFields['aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/geoLocation/lon'],
            $.ProductFields['aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/geoLocation/lat']
          )
        )
      )
    )
  ),
  resources=arr_foreach($.Resources, resource, dict(
      uid=resource.Id,
      data=resource.Details,
      type=resource.Type,
      owner=dict(
        account=dict(
          uid=$.ProductFields.ResourceOwnerAccount
        )
      ),
      labels=resource.Tags,
      region=resource.Region,
      criticality=$.Criticality,
      cloud_partition=resource.Partition
    )
  ),
  type_name=case(
    $.CreatedAt == $.UpdatedAt => 'Detection Finding: Create',
    _ => 'Detection Finding: Update'
  ),
  class_name='Detection Finding',
  activity_id=case(
    $.CreatedAt == $.UpdatedAt => 1,
    _ => 2
  ),
  severity_id=case(
    upper($.Severity.Label) == 'LOW' => 1,
    upper($.Severity.Label) == 'MEDIUM' => 2,
    upper($.Severity.Label) == 'HIGH' => 3,
    upper($.Severity.Label) == 'CRITICAL' => 4,
    _ => 0
  ),
  category_uid=2,
  finding_info=dict(
    uid=$.Id,
    desc=$.Description,
    title=$.Title,
    types=$.Types,
    src_url=$.SourceUrl,
    created_time_dt=$.CreatedAt,
    modified_time_dt=$.UpdatedAt,
    last_seen_time_dt=$.LastObservedAt,
    first_seen_time_dt=$.FirstObservedAt
  ),
  activity_name=case(
    $.CreatedAt == $.UpdatedAt => 'Create',
    _ => 'Update'
  ),
  category_name='Findings',
  confidence_score=$.Confidence
)