aws-samples / siem-on-amazon-opensearch-service

A solution for collecting, correlating and visualizing multiple types of logs to help investigate security incidents.
MIT No Attribution
558 stars 185 forks source link

CloudTrail load: Error on requestParameters.overrides.containerOverrides.environment due to varied type #430

Open kkumler opened 7 months ago

kkumler commented 7 months ago

We are seeing some errors for CloudTrail on es-loader with object mapping for [requestParameters.overrides.containerOverrides.environment] tried to parse field [environment] as object, but found a concrete value. This error seems to come from CloudTrail entries where there is "environment": "HIDDEN_DUE_TO_SECURITY_REASONS" instead of an object/hash. This is happening with a deployment of this sample at v2.10.2a, on AWS-managed OpenSearch 2.11.

I see this key for a couple actions, snippets from examples below.

From Batch / Step Functions SubmitJob (no error):

            "requestParameters": {
                "jobName": "Utility",
                "containerOverrides": {
                    "command": [
                        "bin/echo"
                    ],
                    "environment": [
                        {
                            "name": "MANAGED_BY_AWS",
                            "value": "STARTED_BY_STEP_FUNCTIONS"
                        },
                        {
                            "name": "JOB_DATA",
                            "value": ""
                        }
                    ]
                },

From ECS RunTask (error):

            "requestParameters": {
                "platformVersion": "LATEST",
                "overrides": {
                    "containerOverrides": [
                        {
                            "name": "default",
                            "command": [
                                "bin/echo"
                            ],
                            "environment": "HIDDEN_DUE_TO_SECURITY_REASONS"
                        }
                    ],
                    "cpu": "2048",
                    "memory": "4096"
                },
tmat-s commented 7 months ago

+1 Experiencing the same issue.