code: def cloudtrail_critical_api_calls(rec):
      """
      author:           airbnb_csirt
      description:      Alert on AWS API calls that stop or delete security/infrastructure logs.
                        Additionally, alert on AWS API calls that delete critical resources
                        (VPCs, Subnets, DB's, ...)
      reference:        https://medium.com/@robwitoff/
                            proactive-cloud-security-w-aws-organizations-d58695bcae16#.tx2e6iju0
      playbook:         (a) identify the AWS account in the log
                        (b) identify what resource(s) are impacted by the API call
                        (c) determine if the intent is valid, malicious or accidental
      """
      if rec["eventName"] in _CRITICAL_EVENTS:
          return True
  
      if rec["eventName"] == "UpdateDetector":
          # Check if GuardDuty is being disabled, where enable is set to False
          if not rec.get("requestParameters", {}).get("enable", True):
              return True
  
      if rec["eventName"] in {
          "PutBucketPublicAccessBlock",
          "PutAccountPublicAccessBlock",
      }:
          # These calls set the policy for what to block for a bucket.
          # We need to get the configuration and see if any
          # of the items are set to False.
          config = rec.get("requestParameters", {}).get(
              "PublicAccessBlockConfiguration", {}
          )
          for action in PUBLIC_ACCESS_BLOCK_CONFIG_ACTIONS:
              if config.get(action, True) is False:
                  return True
  
      # Detect important Organizations calls
      if (
          rec["eventSource"] == "organizations.amazonaws.com"
          and rec["eventName"] in AWS_ORG_EVENTS
      ):
          return True
  
      return False
  
label_desc: Use image node_id 1 for calling a global function with example usage: cloudtrail_critical_api_calls(rec) and returns: False, True, True, True, True