From 448f8152017b4f2ec23b2a680392fc6c1aae1854 Mon Sep 17 00:00:00 2001
From: Duc Ha <duchatran@gmail.com>
Date: Wed, 29 Nov 2017 17:12:32 -0800
Subject: [PATCH] SUMO-0: explicitly remove outerfield for guardduty events

---
 cloudwatchevents/cloudwatchevents.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cloudwatchevents/cloudwatchevents.js b/cloudwatchevents/cloudwatchevents.js
index 4fe347e..6b589cc 100644
--- a/cloudwatchevents/cloudwatchevents.js
+++ b/cloudwatchevents/cloudwatchevents.js
@@ -96,7 +96,7 @@ exports.handler = function (event, context) {
     }
     
     //console.log(event);
-    if ((event.source==="aws.guardduty") && (removeOuterFields)) {
+    if ((event.source==="aws.guardduty") || (removeOuterFields)) {
         final_event =event.detail;
     } else {
         final_event = event;