Update the GuardDuty schema to reflect upstream changes (#1641)

mozilla · Jun 3, 2020 · 0b10f83 · 0b10f83
1 parent e96abc8
commit 0b10f83
Showing 1 changed file with 37 additions and 36 deletions.
diff --git a/mq/plugins/guardduty_mapping.yml b/mq/plugins/guardduty_mapping.yml
@@ -93,8 +93,8 @@
     proto: details.finding.action.networkConnectionAction.protocol
     evidence: details.finding.evidence
     miscinfo: details.finding.additionalInfo
-    query: details.finding.action.dnsrequestaction.domain
-    details.platform: details.resource.instanceDetails.platform
+    query: details.finding.action.dnsRequestAction.domain
+    platform: details.resource.instanceDetails.platform
     gdeventcreatedts: details.createdAt
     gdeventupdatedts: details.updatedAt
     gdeventfirstseents: details.finding.eventFirstSeen
@@ -133,7 +133,7 @@
     proto: details.finding.action.networkConnectionAction.protocol
     evidence: details.finding.evidence
     miscinfo: details.finding.additionalInfo
-    details.platform: details.resource.instanceDetails.platform
+    platform: details.resource.instanceDetails.platform
     gdeventcreatedts: details.createdAt
     gdeventupdatedts: details.updatedAt
     gdeventfirstseents: details.finding.eventFirstSeen
@@ -172,7 +172,7 @@
     proto: details.finding.action.networkConnectionAction.protocol
     evidence: details.finding.evidence
     miscinfo: details.finding.additionalInfo
-    details.platform: details.resource.instanceDetails.platform
+    platform: details.resource.instanceDetails.platform
     gdeventcreatedts: details.createdAt
     gdeventupdatedts: details.updatedAt
     gdeventfirstseents: details.finding.eventFirstSeen
@@ -211,7 +211,7 @@
     proto: details.finding.action.networkConnectionAction.protocol
     evidence: details.finding.evidence
     miscinfo: details.finding.additionalInfo
-    details.platform: details.resource.instanceDetails.platform
+    platform: details.resource.instanceDetails.platform
     gdeventcreatedts: details.createdAt
     gdeventupdatedts: details.updatedAt
     gdeventfirstseents: details.finding.eventFirstSeen
@@ -250,7 +250,7 @@
     proto: details.finding.action.networkConnectionAction.protocol
     evidence: details.finding.evidence
     miscinfo: details.finding.additionalInfo
-    details.platform: details.resource.instanceDetails.platform
+    platform: details.resource.instanceDetails.platform
     gdeventcreatedts: details.createdAt
     gdeventupdatedts: details.updatedAt
     gdeventfirstseents: details.finding.eventFirstSeen
@@ -289,7 +289,7 @@
     proto: details.finding.action.networkConnectionAction.protocol
     evidence: details.finding.evidence
     miscinfo: details.finding.additionalInfo
-    details.platform: details.resource.instanceDetails.platform
+    platform: details.resource.instanceDetails.platform
     gdeventcreatedts: details.createdAt
     gdeventupdatedts: details.updatedAt
     gdeventfirstseents: details.finding.eventFirstSeen
@@ -328,8 +328,8 @@
     proto: details.finding.action.networkConnectionAction.protocol
     evidence: details.finding.evidence
     miscinfo: details.finding.additionalInfo
-    details.query: details.finding.additionalInfo.domain
-    details.platform: details.resource.instanceDetails.platform
+    query: details.finding.action.dnsRequestAction.domain
+    platform: details.resource.instanceDetails.platform
     gdeventcreatedts: details.createdAt
     gdeventupdatedts: details.updatedAt
     gdeventfirstseents: details.finding.eventFirstSeen
@@ -368,7 +368,7 @@
     proto: details.finding.action.networkConnectionAction.protocol
     evidence: details.finding.evidence
     miscinfo: details.finding.additionalInfo
-    details.platform: details.resource.instanceDetails.platform
+    platform: details.resource.instanceDetails.platform
     gdeventcreatedts: details.createdAt
     gdeventupdatedts: details.updatedAt
     gdeventfirstseents: details.finding.eventFirstSeen
@@ -407,7 +407,7 @@
     proto: details.finding.action.networkConnectionAction.protocol
     evidence: details.finding.evidence
     miscinfo: details.finding.additionalInfo
-    details.platform: details.resource.instanceDetails.platform
+    platform: details.resource.instanceDetails.platform
     gdeventcreatedts: details.createdAt
     gdeventupdatedts: details.updatedAt
     gdeventfirstseents: details.finding.eventFirstSeen
@@ -446,8 +446,8 @@
     proto: details.finding.action.networkConnectionAction.protocol
     evidence: details.finding.evidence
     miscinfo: details.finding.additionalInfo
-    details.query: details.finding.additionalInfo.domain
-    details.platform: details.resource.instanceDetails.platform
+    query: details.finding.action.dnsRequestAction.domain
+    platform: details.resource.instanceDetails.platform
     gdeventcreatedts: details.createdAt
     gdeventupdatedts: details.updatedAt
     gdeventfirstseents: details.finding.eventFirstSeen
@@ -486,7 +486,7 @@
     proto: details.finding.action.networkConnectionAction.protocol
     evidence: details.finding.evidence
     miscinfo: details.finding.additionalInfo
-    details.platform: details.resource.instanceDetails.platform
+    platform: details.resource.instanceDetails.platform
     gdeventcreatedts: details.createdAt
     gdeventupdatedts: details.updatedAt
     gdeventfirstseents: details.finding.eventFirstSeen
@@ -525,7 +525,7 @@
     proto: details.finding.action.networkConnectionAction.protocol
     evidence: details.finding.evidence
     miscinfo: details.finding.additionalInfo
-    details.platform: details.resource.instanceDetails.platform
+    platform: details.resource.instanceDetails.platform
     gdeventcreatedts: details.createdAt
     gdeventupdatedts: details.updatedAt
     gdeventfirstseents: details.finding.eventFirstSeen
@@ -564,7 +564,7 @@
     proto: details.finding.action.networkConnectionAction.protocol
     evidence: details.finding.evidence
     miscinfo: details.finding.additionalInfo
-    details.platform: details.resource.instanceDetails.platform
+    platform: details.resource.instanceDetails.platform
     gdeventcreatedts: details.createdAt
     gdeventupdatedts: details.updatedAt
     gdeventfirstseents: details.finding.eventFirstSeen
@@ -603,7 +603,7 @@
     proto: details.finding.action.networkConnectionAction.protocol
     evidence: details.finding.evidence
     miscinfo: details.finding.additionalInfo
-    details.platform: details.resource.instanceDetails.platform
+    platform: details.resource.instanceDetails.platform
     gdeventcreatedts: details.createdAt
     gdeventupdatedts: details.updatedAt
     gdeventfirstseents: details.finding.eventFirstSeen
@@ -641,7 +641,7 @@
     proto: details.finding.action.networkConnectionAction.protocol
     evidence: details.finding.evidence
     miscinfo: details.finding.additionalInfo
-    details.platform: details.resource.instanceDetails.platform
+    platform: details.resource.instanceDetails.platform
     gdeventcreatedts: details.createdAt
     gdeventupdatedts: details.updatedAt
     gdeventfirstseents: details.finding.eventFirstSeen
@@ -679,7 +679,8 @@
     proto: details.finding.action.networkConnectionAction.protocol
     evidence: details.finding.evidence
     miscinfo: details.finding.additionalInfo
-    details.platform: details.resource.instanceDetails.platform
+    query: details.finding.action.dnsRequestAction.domain
+    platform: details.resource.instanceDetails.platform
     gdeventcreatedts: details.createdAt
     gdeventupdatedts: details.updatedAt
     gdeventfirstseents: details.finding.eventFirstSeen
@@ -717,8 +718,8 @@
     proto: details.finding.action.networkConnectionAction.protocol
     evidence: details.finding.evidence
     miscinfo: details.finding.additionalInfo
-    details.query: details.finding.additionalInfo.domain
-    details.platform: details.resource.instanceDetails.platform
+    query: details.finding.action.dnsRequestAction.domain
+    platform: details.resource.instanceDetails.platform
     gdeventcreatedts: details.createdAt
     gdeventupdatedts: details.updatedAt
     gdeventfirstseents: details.finding.eventFirstSeen
@@ -756,8 +757,8 @@
     proto: details.finding.action.networkConnectionAction.protocol
     evidence: details.finding.evidence
     miscinfo: details.finding.additionalInfo
-    details.query: details.finding.additionalInfo.domain
-    details.platform: details.resource.instanceDetails.platform
+    query: details.finding.action.dnsRequestAction.domain
+    platform: details.resource.instanceDetails.platform
     gdeventcreatedts: details.createdAt
     gdeventupdatedts: details.updatedAt
     gdeventfirstseents: details.finding.eventFirstSeen
@@ -795,8 +796,8 @@
     proto: details.finding.action.networkConnectionAction.protocol
     evidence: details.finding.evidence
     miscinfo: details.finding.additionalInfo
-    details.query: details.finding.additionalInfo.domain
-    details.platform: details.resource.instanceDetails.platform
+    query: details.finding.action.dnsRequestAction.domain
+    platform: details.resource.instanceDetails.platform
     gdeventcreatedts: details.createdAt
     gdeventupdatedts: details.updatedAt
     gdeventfirstseents: details.finding.eventFirstSeen
@@ -834,8 +835,8 @@
     proto: details.finding.action.networkConnectionAction.protocol
     evidence: details.finding.evidence
     miscinfo: details.finding.additionalInfo
-    details.query: details.service.action.dnsRequestAction.domain
-    details.platform: details.resource.instanceDetails.platform
+    query: details.finding.action.dnsRequestAction.domain
+    platform: details.resource.instanceDetails.platform
     gdeventcreatedts: details.createdAt
     gdeventupdatedts: details.updatedAt
     gdeventfirstseents: details.finding.eventFirstSeen
@@ -873,8 +874,8 @@
     proto: details.finding.action.networkConnectionAction.protocol
     evidence: details.finding.evidence
     miscinfo: details.finding.additionalInfo
-    details.query: details.service.action.dnsRequestAction.domain
-    details.platform: details.resource.instanceDetails.platform
+    query: details.finding.action.dnsRequestAction.domain
+    platform: details.resource.instanceDetails.platform
     gdeventcreatedts: details.createdAt
     gdeventupdatedts: details.updatedAt
     gdeventfirstseents: details.finding.eventFirstSeen
@@ -912,8 +913,8 @@
     proto: details.finding.action.networkConnectionAction.protocol
     evidence: details.finding.evidence
     miscinfo: details.finding.additionalInfo
-    details.query: details.finding.additionalInfo.domain
-    details.platform: details.resource.instanceDetails.platform
+    query: details.finding.action.dnsRequestAction.domain
+    platform: details.resource.instanceDetails.platform
     gdeventcreatedts: details.createdAt
     gdeventupdatedts: details.updatedAt
     gdeventfirstseents: details.finding.eventFirstSeen
@@ -951,8 +952,8 @@
     proto: details.finding.action.networkConnectionAction.protocol
     evidence: details.finding.evidence
     miscinfo: details.finding.additionalInfo
-    details.query: details.finding.additionalInfo.domain
-    details.platform: details.resource.instanceDetails.platform
+    query: details.finding.action.dnsRequestAction.domain
+    platform: details.resource.instanceDetails.platform
     gdeventcreatedts: details.createdAt
     gdeventupdatedts: details.updatedAt
     gdeventfirstseents: details.finding.eventFirstSeen
@@ -990,7 +991,7 @@
     proto: details.finding.action.networkConnectionAction.protocol
     evidence: details.finding.evidence
     miscinfo: details.finding.additionalInfo
-    details.platform: details.resource.instanceDetails.platform
+    platform: details.resource.instanceDetails.platform
     gdeventcreatedts: details.createdAt
     gdeventupdatedts: details.updatedAt
     gdeventfirstseents: details.finding.eventFirstSeen
@@ -1028,7 +1029,7 @@
     proto: details.finding.action.networkConnectionAction.protocol
     evidence: details.finding.evidence
     miscinfo: details.finding.additionalInfo
-    details.platform: details.resource.instanceDetails.platform
+    platform: details.resource.instanceDetails.platform
     gdeventcreatedts: details.createdAt
     gdeventupdatedts: details.updatedAt
     gdeventfirstseents: details.finding.eventFirstSeen
@@ -1333,7 +1334,7 @@
     proto: details.finding.action.networkConnectionAction.protocol
     evidence: details.finding.evidence
     miscinfo: details.finding.additionalInfo
-    details.platform: details.resource.instanceDetails.platform
+    platform: details.resource.instanceDetails.platform
     gdeventcreatedts: details.createdAt
     gdeventupdatedts: details.updatedAt
     gdeventfirstseents: details.finding.eventFirstSeen