Merge pull request #8 from lacework-alliances/7-update-mfa-struct-from-int-to-bool

fixes (#7)

Author: jbonner7

amazon-security-lake-integration.yml

@@ -99,7 +99,7 @@ Resources:
       ServiceToken: !GetAtt "CopyZipsFunction.Arn"
       DestBucket: !Ref "LambdaZipsBucket"
       SourceBucket: "lacework-alliances"
-      Prefix: "lacework-amazon-security-lake-dev"
+      Prefix: "lacework-amazon-security-lake"
       Objects:
         - "/lambda/amazon-security-lake.zip"
 
@@ -206,7 +206,7 @@ Resources:
     Properties:
       Code:
         S3Bucket: !Ref LambdaZipsBucket
-        S3Key: !Join ["", ["lacework-amazon-security-lake-dev", "/lambda/amazon-security-lake.zip"]]
+        S3Key: !Join ["", ["lacework-amazon-security-lake", "/lambda/amazon-security-lake.zip"]]
       Handler: bootstrap
       Runtime: provided.al2023
       Environment:
@@ -217,7 +217,7 @@ Resources:
           lacework_access_key_id: !Ref LaceworkAccessKeyID
           lacework_secret_key: !Ref LaceworkSecretKey
           event_bus_arn: !GetAtt LaceworkAmazonSecurityLakeEventBus.Arn
-          alert_channel_name: !Join [ "-", ["Lacework-Amazon-Security-Lake-dev", !Select [2, !Split [ "/", !Ref "AWS::StackId"]]]]
+          alert_channel_name: !Join [ "-", ["Lacework-Amazon-Security-Lake", !Select [2, !Split [ "/", !Ref "AWS::StackId"]]]]
           amazon_security_lake_cache_s3_bucket_name: !Ref AmazonSecurityLakeCacheS3Bucket
       Role: !GetAtt LaceworkAmazonSecurityLakeSetupFunctionRole.Arn
 
@@ -301,7 +301,7 @@ Resources:
     Properties:
       Code:
         S3Bucket: !Ref LambdaZipsBucket
-        S3Key: !Join ["", ["lacework-amazon-security-lake-dev", "/lambda/amazon-security-lake.zip"]]
+        S3Key: !Join ["", ["lacework-amazon-security-lake", "/lambda/amazon-security-lake.zip"]]
       Handler: bootstrap
       MemorySize: 256
       Timeout: 30

internal/findings/mappings.go

@@ -86,7 +86,7 @@ func InitMap() map[string][]int {
 	eventMap["CustomerMasterKeyScheduledForDeletion"] = []int{ocsf.CategoryUIDAuditActivity, ocsf.ClassUIDAccountChange}
 	eventMap["SuccessfulConsoleLoginWithoutMFA"] = []int{ocsf.CategoryUIDAuditActivity, ocsf.ClassUIDAuthentication}
 	eventMap["FailedConsoleLogin"] = []int{ocsf.CategoryUIDAuditActivity, ocsf.ClassUIDAuthentication}
-	eventMap["UsageOfRootAccount"] = []int{ocsf.CategoryUIDAuditActivity, ocsf.ClassUIDAuthorization}
+	eventMap["Usage of Root Account"] = []int{ocsf.CategoryUIDAuditActivity, ocsf.ClassUIDAuthorization}
 	eventMap["UnauthorizedAPICall"] = []int{ocsf.CategoryUIDCloudActivity, ocsf.ClassUIDCloudApi}
 	eventMap["ConfigServiceChange"] = []int{ocsf.CategoryUIDCloudActivity, ocsf.ClassUIDCloudApi}
 	eventMap["CloudTrailDefaultAlert"] = []int{ocsf.CategoryUIDCloudActivity, ocsf.ClassUIDCloudApi}

pkg/lacework/lacework.go

@@ -58,7 +58,7 @@ type CtUser struct {
 	AccountID   string   `json:"ACCOUNT_ID"`
 	RegionList  []string `json:"REGION_LIST"`
 	Username    string   `json:"USERNAME"`
-	Mfa         int      `json:"MFA"`
+	Mfa         bool     `json:"MFA"`
 	APIList     []string `json:"API_LIST"`
 	PrincipalID string   `json:"PRINCIPAL_ID"`
 }