flatterning BodyJson to match splunk TA for aws guardduty

[jonxilinx]

We have successfully  ingested from an AWS SQS queue guardduty logs
Its structured JSON , but the extracted records are all predicated with a 'BodyJson' .
A workaround for field aliases and extractions is to use that as a predicate on the local/props.conf

eg
EVAL-dest_name = if('BodyJson.detail.service.resourceRole'="TARGET" AND 'BodyJson.detail.resource.resourceType'="AccessKey", 'BodyJson.detail.resource.accessKeyDetails.userName', null())

But thats Pretty messy and will need maintaining
I tried to flatten out using a props.conf
FIELDALIAS-BodyJsonremove = BodyJson.* as *
But that didnt work

Has anyone another soln, other than local/props.conf .
Is there something in the aws_sqs_tasks.conf (inputs) that can flatten the json to the format the TA for Amazon expects ?
Thanks

[tscroggins]

Hi @jonxilinx,

The aws:cloudwatch:guardduty source type was intended to be used with a CloudWatch Logs input after a transform from the aws:cloudwatchlogs source type.

To use an SQS input, you can transform the data on your heavy forwarder. The configuration below works on the following event schema:

{
  "BodyJson": {
    "version": "0",
    "id": "cd2d702e-ab31-411b-9344-793ce56b1bc7",
    "detail-type": "GuardDuty Finding",
    "source": "aws.guardduty",
    "account": "111122223333",
    "time": "1970-01-01T00:00:00Z",
    "region": "us-east-1",
    "resources": [],
    "detail": {
      ...
    }
  }  
}

You may need to adjust the configuration to match your specific input and event format.

# local/inputs.conf

[my_sqs_input]
aws_account = xxx
aws_region = xxx
sqs_queues = xxx
index = xxx
sourcetype = aws:sqs
interval = xxx

# local/props.conf

[aws:sqs]
TRANSFORMS-aws_sqs_guardduty = aws_sqs_guardduty_remove_bodyjson, aws_sqs_guardduty_to_cloudwatchlogs_sourcetype

# local/transforms.conf

[aws_sqs_guardduty_remove_bodyjson]
REGEX = "source"\s*\:\s*"aws\.guardduty"
INGEST_EVAL = _raw:=json_extract(_raw, "BodyJson")

[aws_sqs_guardduty_to_cloudwatchlogs_sourcetype]
REGEX = "source"\s*\:\s*"aws\.guardduty"
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::aws:cloudwatchlogs:guardduty