AWS Security Hub Modeling Rule

Details

Rules (XIF)

[MODEL: dataset="aws_security_hub_raw"]
alter
        outcome = json_extract_scalar(Compliance, "$.Status"),
        severity_label = json_extract_scalar(Severity, "$.Label")
| alter
        xdm.alert.name = Title,
        xdm.alert.description = Description,
        xdm.alert.original_alert_id = Id,
        xdm.alert.subcategory = Types,
        xdm.source.zone = Region,
        xdm.alert.severity = severity_label,
        xdm.event.log_level = if(severity_label = "CRITICAL", XDM_CONST.LOG_LEVEL_CRITICAL, severity_label = "HIGH", XDM_CONST.LOG_LEVEL_ERROR, severity_label = "MEDIUM", XDM_CONST.LOG_LEVEL_WARNING, severity_label = "LOW", XDM_CONST.LOG_LEVEL_INFORMATIONAL, severity_label = "INFORMATIONAL", XDM_CONST.LOG_LEVEL_INFORMATIONAL, to_string(severity_label)),
        xdm.target.resource.id = arraystring(arraymap(Resources -> [], json_extract_scalar("@element","$.Id")), ", "),
        xdm.target.resource.type = arraystring(arraymap(Resources -> [], json_extract_scalar("@element","$.Type")), ", "),
        xdm.event.outcome = if(outcome="PASSED", XDM_CONST.OUTCOME_SUCCESS, outcome="FAILED", XDM_CONST.OUTCOME_FAILED, outcome="WARNING", XDM_CONST.OUTCOME_PARTIAL , outcome="NOT_AVAILABLE", XDM_CONST.OUTCOME_UNKNOWN, to_string(outcome)),
        xdm.observer.product = ProductName,
        xdm.source.cloud.project = AwsAccountId,
        xdm.source.cloud.provider = XDM_CONST.CLOUD_PROVIDER_AWS;

Schema

aws_security_hub_raw

{
    "aws_security_hub_raw": {
      "Id": {
        "type": "string",
        "is_array": false
      },
      "ProductName": {
        "type": "string",
        "is_array": false
      },
      "Region": {
        "type": "string",
        "is_array": false
      },
      "AwsAccountId": {
        "type": "string",
        "is_array": false
      },
      "Types": {
        "type": "string",
        "is_array": false
      },
      "Severity": {
        "type": "string",
        "is_array": false
      },
      "Title": {
        "type": "string",
        "is_array": false
      },
      "Description": {
        "type": "string",
        "is_array": false
      },
      "Resources": {
        "type": "string",
        "is_array": false
      },
      "Compliance": {
        "type": "string",
        "is_array": false
      }
    }
  }