siem-on-amazon-opensearch-service icon indicating copy to clipboard operation
siem-on-amazon-opensearch-service copied to clipboard

fix: allow multiple events in a cwl event

Open alemairebe opened this issue 1 year ago • 1 comments

This change allow the use of 'delimiters' in addition to cloudwatch logs events split. In my case, it is useful to get SecurityHub Findings via CloudWatch Logs. https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-cwe-all-findings.html My current customer did that setup following an LAZ guideline.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

alemairebe avatar Nov 08 '23 14:11 alemairebe

Main difference versus the 2 others PRs about this is the use of value_from_nesteddict_by_dottedkey to allow to get json_delimiter = detail.findings instead of json_delimiter = findings

alemairebe avatar Nov 09 '23 07:11 alemairebe