SecurityHub / Client / list_export_jobs_v2

list_export_jobs_v2¶

SecurityHub.Client.list_export_jobs_v2(**kwargs)¶

Returns the findings export jobs in your account as a paginated list of ExportSummary objects. You can filter the results by job Status or DataType.

To page through the results, use the MaxResults and NextToken parameters. If the response includes a NextToken value, pass it in a subsequent request to retrieve the next page of results.

Each ExportSummary reports the output Format of the job but not its full OutputConfiguration. To retrieve the filters and selected fields that a job was started with, call GetExportJobV2.

Request Syntax

response = client.list_export_jobs_v2(
    Status='RUNNING'|'SUCCEEDED'|'FAILED'|'CANCELLED',
    DataType='FINDINGS',
    MaxResults=123,
    NextToken='string'
)

Parameters:

Status (string) – Filters the results to export jobs that have the specified status.
DataType (string) – Filters the results to export jobs that produce the specified data type.
MaxResults (integer) – The maximum number of results to return in a single call. Valid range is 1–20.
NextToken (string) – The token required for pagination. On your first call, set the value of this parameter to NULL. For subsequent calls, to continue listing data, set the value of this parameter to the value returned in the previous response.

Return type:

dict

Returns:

Response Syntax

{
    'Items': [
        {
            'ExportJobId': 'string',
            'Name': 'string',
            'Status': 'RUNNING'|'SUCCEEDED'|'FAILED'|'CANCELLED',
            'DataType': 'FINDINGS',
            'OutputConfiguration': {
                'Findings': {
                    'Format': 'CSV'|'OCSF_JSON'
                }
            },
            'Scopes': {
                'AwsOrganizations': [
                    {
                        'OrganizationId': 'string',
                        'OrganizationalUnitId': 'string'
                    },
                ]
            },
            'Destination': {
                'S3': {
                    'BucketArn': 'string',
                    'KmsKeyArn': 'string',
                    'ObjectPrefix': 'string'
                }
            },
            'FailureCode': 'ACCESS_DENIED'|'RESOURCE_NOT_FOUND'|'INTERNAL_ERROR',
            'FailureMessage': 'string',
            'StartedAt': datetime(2015, 1, 1),
            'EndedAt': datetime(2015, 1, 1)
        },
    ],
    'NextToken': 'string'
}

Response Structure

(dict) –
- Items (list) –
  
  The export jobs that match the request, as ExportSummary objects.
  - (dict) –
    
    A summary of an export job, as returned by ListExportJobsV2.
    - ExportJobId (string) –
      
      The unique identifier of the export job.
    - Name (string) –
      
      The user-provided name of the export job, if one was specified.
    - Status (string) –
      
      The current state of the export job.
    - DataType (string) –
      
      The category of data that the export job produces.
    - OutputConfiguration (dict) –
      
      The output configuration of the export job. For findings exports, this reports the output format. Present only for findings exports; absent for other data types.
      Note
      This is a Tagged Union structure. Only one of the following top level keys will be set: Findings. If a client receives an unknown member it will set SDK_UNKNOWN_MEMBER as the top level key, which maps to the name or tag of the unknown member. The structure of SDK_UNKNOWN_MEMBER is as follows:
      
      'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'}
      - Findings (dict) –
        
        The output configuration summary for a findings export.
        
        Format (string) –
        
        The output format of the export. CSV produces comma-separated rows that are suitable for spreadsheets and analysis tools. OCSF_JSON produces newline-delimited JSON records in the Open Cybersecurity Schema Framework (OCSF) format used elsewhere in Security Hub.
    - Scopes (dict) –
      
      The organization scopes that the export job was started with, echoed verbatim. Absent if the caller didn’t supply Scopes.
      - AwsOrganizations (list) –
        
        A list of Organizations scopes to include in the export. Each entry in the list specifies an organization or organizational unit to include for the delegated administrator’s account. If the list specifies multiple entries, the entries are combined using OR logic.
        
        (dict) –
        
        Specifies an Organizations scope. Data from the specified organization or organizational unit is included in the response.
        
        To scope to a specific organizational unit, provide OrganizationalUnitId. You can optionally include OrganizationId. If you omit OrganizationId, Security Hub uses the caller’s organization ID. To scope to the delegated administrator’s entire organization, provide only OrganizationId.
        
        The organization ID and organizational unit must belong to the delegated administrator’s own organization. Each request must use one scoping approach: either scope to the entire organization by providing an AwsOrganizationScope entry with only OrganizationId, or scope to specific organizational units by providing AwsOrganizationScope entries with OrganizationalUnitId. You can’t combine both approaches in the same request.
        
        OrganizationId (string) –
        
        The unique identifier (ID) of the organization (for example, o-abcd1234567890). The organization must be the delegated administrator’s own organization. If you omit this value and provide OrganizationalUnitId, Security Hub uses the caller’s organization ID.
        
        OrganizationalUnitId (string) –
        
        The unique identifier (ID) of the organizational unit (OU) (for example, ou-ab12-cd345678). The OU must exist within the delegated administrator’s own organization. When specified, the results include only data from accounts in this OU.
    - Destination (dict) –
      
      The destination that the export job writes to.
      Note
      This is a Tagged Union structure. Only one of the following top level keys will be set: S3. If a client receives an unknown member it will set SDK_UNKNOWN_MEMBER as the top level key, which maps to the name or tag of the unknown member. The structure of SDK_UNKNOWN_MEMBER is as follows:
      
      'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'}
      - S3 (dict) –
        
        The Amazon Simple Storage Service (Amazon S3) bucket and Amazon Web Services Key Management Service (Amazon Web Services KMS) key that Security Hub uses to write the export.
        
        BucketArn (string) –
        
        The Amazon Resource Name (ARN) of the Amazon S3 bucket that Security Hub writes the export to. You must own the bucket, and its bucket policy must grant the Security Hub service principal ( exportv2.securityhub.amazonaws.com) permission to write objects. For the required bucket policy, see the Examples section of StartExportJobV2.
        
        KmsKeyArn (string) –
        
        The ARN of the Amazon Web Services KMS key that Security Hub uses to encrypt the export objects with server-side encryption. The key policy must allow the Security Hub service principal ( exportv2.securityhub.amazonaws.com) to use the key through Amazon S3. For the required key policy, see the Examples section of StartExportJobV2.
        
        The key must meet all of the following requirements:
        
        It must be a symmetric key with a key usage of ENCRYPT_DECRYPT.
        
        It must be a single-Region key. Multi-Region keys, whose key IDs begin with mrk-, are rejected.
        
        You must specify the full key ARN. Key IDs and aliases are rejected.
        
        The key must be in the same Amazon Web Services account as the export job.
        
        The key must be in the same Amazon Web Services Region as the export job.
        
        The key must be in the aws, aws-cn, or aws-us-gov partition.
        
        ObjectPrefix (string) –
        
        An optional key prefix that Security Hub prepends to the Amazon S3 object keys of the export output. Use a prefix to organize exports within the bucket. The value can be up to 512 characters.
    - FailureCode (string) –
      
      A code that classifies why the export job failed. Present only when Status is FAILED.
    - FailureMessage (string) –
      
      A human-readable message about why the export job failed. Present only when Status is FAILED.
    - StartedAt (datetime) –
      
      The time when the export job was created.
      
      For more information about the validation and formatting of timestamp fields in Security Hub, see Timestamps.
    - EndedAt (datetime) –
      
      The time when the export job reached a terminal state. Absent while the job is RUNNING.
      
      For more information about the validation and formatting of timestamp fields in Security Hub, see Timestamps.
- NextToken (string) –
  
  The pagination token to use to request the next page of results. Otherwise, this parameter is null.

Exceptions

SecurityHub.Client.exceptions.AccessDeniedException
SecurityHub.Client.exceptions.InternalServerException
SecurityHub.Client.exceptions.ThrottlingException
SecurityHub.Client.exceptions.ValidationException