code: def cloudtrail_root_account_usage(rec):
      """
      author:           airbnb_csirt
      description:      Root AWS credentials are being used;
                        This is against best practice and may be an attacker
      reference_1:      https://aws.amazon.com/premiumsupport/knowledge-center/
                            cloudtrail-root-action-logs/
      reference_2:      http://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html
      playbook:         (a) identify who is using the Root account
                        (b) ping the individual to determine if intentional and/or legitimate
      """
      # reference_1 contains details on logic below
      return (
          rec["detail"]["userIdentity"]["type"] == "Root"
          and rec["detail"]["userIdentity"].get("invokedBy") is None
          and rec["detail"]["eventType"] != "AwsServiceEvent"
      )
  
label_desc: Use image node_id 1 for calling a global function with example usage: cloudtrail_root_account_usage(rec) and returns: unknown