Amazon Security Lake using OCSF's Detection Finding event class

The issue you're facing with the missing "Detection Finding" event class in the Amazon Security Lake custom source creation process is likely due to a discrepancy between the OCSF specification version supported by Amazon Security Lake and the version you're referencing.

Here are a few things you can consider:

1. Verify the OCSF version supported by Amazon Security Lake: The Amazon Security Lake documentation states that it supports OCSF v1.1.0, but it's possible that the event class list in the custom source creation process lags behind the latest OCSF specification. You can try reaching out to AWS Support to confirm the exact OCSF version and event class support in the current implementation of Amazon Security Lake.

2. Review the latest OCSF specification: Check the latest OCSF specification (version 1.1.0 or higher) and see if the "Detection Finding" event class is indeed available. If it is, you may need to work with AWS to get the event class support added to the Amazon Security Lake custom source creation process.

3. Consider using a different event class: If the "Detection Finding" class is not available, you may need to explore alternative event classes that better fit the events generated by Wazuh. The "Security Finding" class, although deprecated, may still be a viable option, or you could use a more generic event class like "Observation" or "Information".

4. Implement a custom mapping: As a workaround, you could consider building a custom integration that maps the Wazuh events to the available OCSF event classes supported by Amazon Security Lake. This would require more development effort on your side, but it could provide a solution that fits your specific needs.

5. Provide feedback to AWS: You can reach out to AWS Support or the OCSF community to provide feedback about the missing "Detection Finding" event class in the Amazon Security Lake custom source creation process. This could help drive improvements and updates to the service's OCSF support.

In summary, the key steps are to:

1. Confirm the exact OCSF version and event class support in Amazon Security Lake.
2. Explore alternative OCSF event classes that may fit your use case.
3. Consider implementing a custom mapping if necessary.
4. Provide feedback to AWS to help improve the service's OCSF support.

By working through these steps, you should be able to find a viable solution for integrating Wazuh with Amazon Security Lake using the appropriate OCSF event class.