Security Hub

compliance-finding

Auto-generated mapping for AWS Security Hub Compliance Finding

Vendor: AWS

Type: Compliance Finding

OCSF Version: 1.1.0

Created by: Rajas Panat

Templates provide pre-built configurations for transforming common log formats into OCSF. They save you time by handling the complex mapping logic for popular security tools and services. Learn more about using templates →

Mapping Configuration

The mapping configuration transforms parsed log fields into OCSF format. This step is required to convert your specific log structure into OCSF's standardized schema. To define these field mappings, the configuration below uses the Fleak Eval Expression Language (FEEL). This language lets you specify how to transform data from AWS Compliance Finding logs into OCSF fields - converting timestamps to standard formats, restructuring nested data, and applying conditional logic to determine field values.

dict(
  time=ts_str_to_epoch($.UpdatedAt, 'yyyy-MM-dd\'T\'HH:mm:ss.SSS\'Z\''),
  cloud=dict(
    region=$.Region,
    account=dict(
      uid=$.AwsAccountId
    ),
    provider='AWS'
  ),
  status=$.Workflow.Status,
  time_dt=$.UpdatedAt,
  metadata=dict(
    product=dict(
      uid=$.ProductArn,
      name=$.ProductName,
      feature=dict(
        uid=$.GeneratorId
      ),
      vendor_name=$.CompanyName
    ),
    version='1.1.0',
    profiles=array('cloud', 'datetime'),
    log_version=$.SchemaVersion,
    processed_time_dt=$.ProcessedAt
  ),
  resource=dict(
    uid=$.Resources[0].Id,
    type=$.Resources[0].Type,
    region=$.Resources[0].Region,
    cloud_partition=$.Resources[0].Partition
  ),
  severity='Medium',
  type_uid=200302,
  class_uid=2003,
  type_name='Compliance Finding: Update',
  class_name='Compliance Finding',
  compliance=dict(
    status=$.Compliance.Status,
    control=$.Compliance.SecurityControlId,
    requirements=$.Compliance.RelatedRequirements
  ),
  activity_id=2,
  remediation=dict(
    desc=$.Remediation.Recommendation.Text,
    references=array(
      $.Remediation.Recommendation.Url
    )
  ),
  severity_id=3,
  category_uid=2,
  finding_info=dict(
    uid=$.Id,
    desc=$.Description,
    title=$.Title,
    types=$.Types,
    created_time_dt=$.CreatedAt,
    modified_time_dt=$.UpdatedAt,
    last_seen_time_dt=$.LastObservedAt,
    first_seen_time_dt=$.FirstObservedAt
  ),
  activity_name='Update',
  category_name='Findings'
)

Template ID: beeb1b13-8cd2-4654-93b5-c89eb6112909

Text Mapping: No

Ready to use this template?