Interface CfnInsight.AwsSecurityFindingFiltersProperty
- All Superinterfaces:
software.amazon.jsii.JsiiSerializable
- All Known Implementing Classes:
CfnInsight.AwsSecurityFindingFiltersProperty.Jsii$Proxy
- Enclosing class:
CfnInsight
You can filter by up to ten finding attributes. For each attribute, you can provide up to 20 filter values.
Example:
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import software.amazon.awscdk.services.securityhub.*;
AwsSecurityFindingFiltersProperty awsSecurityFindingFiltersProperty = AwsSecurityFindingFiltersProperty.builder()
.awsAccountId(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.awsAccountName(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.companyName(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.complianceAssociatedStandardsId(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.complianceSecurityControlId(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.complianceSecurityControlParametersName(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.complianceSecurityControlParametersValue(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.complianceStatus(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.confidence(List.of(NumberFilterProperty.builder()
.eq(123)
.gte(123)
.lte(123)
.build()))
.createdAt(List.of(DateFilterProperty.builder()
.dateRange(DateRangeProperty.builder()
.unit("unit")
.value(123)
.build())
.end("end")
.start("start")
.build()))
.criticality(List.of(NumberFilterProperty.builder()
.eq(123)
.gte(123)
.lte(123)
.build()))
.description(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.findingProviderFieldsConfidence(List.of(NumberFilterProperty.builder()
.eq(123)
.gte(123)
.lte(123)
.build()))
.findingProviderFieldsCriticality(List.of(NumberFilterProperty.builder()
.eq(123)
.gte(123)
.lte(123)
.build()))
.findingProviderFieldsRelatedFindingsId(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.findingProviderFieldsRelatedFindingsProductArn(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.findingProviderFieldsSeverityLabel(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.findingProviderFieldsSeverityOriginal(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.findingProviderFieldsTypes(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.firstObservedAt(List.of(DateFilterProperty.builder()
.dateRange(DateRangeProperty.builder()
.unit("unit")
.value(123)
.build())
.end("end")
.start("start")
.build()))
.generatorId(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.id(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.keyword(List.of(KeywordFilterProperty.builder()
.value("value")
.build()))
.lastObservedAt(List.of(DateFilterProperty.builder()
.dateRange(DateRangeProperty.builder()
.unit("unit")
.value(123)
.build())
.end("end")
.start("start")
.build()))
.malwareName(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.malwarePath(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.malwareState(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.malwareType(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.networkDestinationDomain(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.networkDestinationIpV4(List.of(IpFilterProperty.builder()
.cidr("cidr")
.build()))
.networkDestinationIpV6(List.of(IpFilterProperty.builder()
.cidr("cidr")
.build()))
.networkDestinationPort(List.of(NumberFilterProperty.builder()
.eq(123)
.gte(123)
.lte(123)
.build()))
.networkDirection(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.networkProtocol(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.networkSourceDomain(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.networkSourceIpV4(List.of(IpFilterProperty.builder()
.cidr("cidr")
.build()))
.networkSourceIpV6(List.of(IpFilterProperty.builder()
.cidr("cidr")
.build()))
.networkSourceMac(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.networkSourcePort(List.of(NumberFilterProperty.builder()
.eq(123)
.gte(123)
.lte(123)
.build()))
.noteText(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.noteUpdatedAt(List.of(DateFilterProperty.builder()
.dateRange(DateRangeProperty.builder()
.unit("unit")
.value(123)
.build())
.end("end")
.start("start")
.build()))
.noteUpdatedBy(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.processLaunchedAt(List.of(DateFilterProperty.builder()
.dateRange(DateRangeProperty.builder()
.unit("unit")
.value(123)
.build())
.end("end")
.start("start")
.build()))
.processName(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.processParentPid(List.of(NumberFilterProperty.builder()
.eq(123)
.gte(123)
.lte(123)
.build()))
.processPath(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.processPid(List.of(NumberFilterProperty.builder()
.eq(123)
.gte(123)
.lte(123)
.build()))
.processTerminatedAt(List.of(DateFilterProperty.builder()
.dateRange(DateRangeProperty.builder()
.unit("unit")
.value(123)
.build())
.end("end")
.start("start")
.build()))
.productArn(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.productFields(List.of(MapFilterProperty.builder()
.comparison("comparison")
.key("key")
.value("value")
.build()))
.productName(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.recommendationText(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.recordState(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.region(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.relatedFindingsId(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.relatedFindingsProductArn(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.resourceApplicationArn(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.resourceApplicationName(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.resourceAwsEc2InstanceIamInstanceProfileArn(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.resourceAwsEc2InstanceImageId(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.resourceAwsEc2InstanceIpV4Addresses(List.of(IpFilterProperty.builder()
.cidr("cidr")
.build()))
.resourceAwsEc2InstanceIpV6Addresses(List.of(IpFilterProperty.builder()
.cidr("cidr")
.build()))
.resourceAwsEc2InstanceKeyName(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.resourceAwsEc2InstanceLaunchedAt(List.of(DateFilterProperty.builder()
.dateRange(DateRangeProperty.builder()
.unit("unit")
.value(123)
.build())
.end("end")
.start("start")
.build()))
.resourceAwsEc2InstanceSubnetId(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.resourceAwsEc2InstanceType(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.resourceAwsEc2InstanceVpcId(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.resourceAwsIamAccessKeyCreatedAt(List.of(DateFilterProperty.builder()
.dateRange(DateRangeProperty.builder()
.unit("unit")
.value(123)
.build())
.end("end")
.start("start")
.build()))
.resourceAwsIamAccessKeyPrincipalName(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.resourceAwsIamAccessKeyStatus(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.resourceAwsIamAccessKeyUserName(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.resourceAwsIamUserUserName(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.resourceAwsS3BucketOwnerId(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.resourceAwsS3BucketOwnerName(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.resourceContainerImageId(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.resourceContainerImageName(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.resourceContainerLaunchedAt(List.of(DateFilterProperty.builder()
.dateRange(DateRangeProperty.builder()
.unit("unit")
.value(123)
.build())
.end("end")
.start("start")
.build()))
.resourceContainerName(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.resourceDetailsOther(List.of(MapFilterProperty.builder()
.comparison("comparison")
.key("key")
.value("value")
.build()))
.resourceId(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.resourcePartition(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.resourceRegion(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.resourceTags(List.of(MapFilterProperty.builder()
.comparison("comparison")
.key("key")
.value("value")
.build()))
.resourceType(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.sample(List.of(BooleanFilterProperty.builder()
.value(false)
.build()))
.severityLabel(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.severityNormalized(List.of(NumberFilterProperty.builder()
.eq(123)
.gte(123)
.lte(123)
.build()))
.severityProduct(List.of(NumberFilterProperty.builder()
.eq(123)
.gte(123)
.lte(123)
.build()))
.sourceUrl(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.threatIntelIndicatorCategory(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.threatIntelIndicatorLastObservedAt(List.of(DateFilterProperty.builder()
.dateRange(DateRangeProperty.builder()
.unit("unit")
.value(123)
.build())
.end("end")
.start("start")
.build()))
.threatIntelIndicatorSource(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.threatIntelIndicatorSourceUrl(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.threatIntelIndicatorType(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.threatIntelIndicatorValue(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.title(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.type(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.updatedAt(List.of(DateFilterProperty.builder()
.dateRange(DateRangeProperty.builder()
.unit("unit")
.value(123)
.build())
.end("end")
.start("start")
.build()))
.userDefinedFields(List.of(MapFilterProperty.builder()
.comparison("comparison")
.key("key")
.value("value")
.build()))
.verificationState(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.vulnerabilitiesExploitAvailable(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.vulnerabilitiesFixAvailable(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.workflowState(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.workflowStatus(List.of(StringFilterProperty.builder()
.comparison("comparison")
.value("value")
.build()))
.build();
- See Also:
-
Nested Class Summary
Nested ClassesModifier and TypeInterfaceDescriptionstatic final classA builder forCfnInsight.AwsSecurityFindingFiltersPropertystatic final classAn implementation forCfnInsight.AwsSecurityFindingFiltersProperty -
Method Summary
Modifier and TypeMethodDescriptionbuilder()default ObjectThe AWS account ID in which a finding is generated.default ObjectThe name of the AWS account in which a finding is generated.default ObjectThe name of the findings provider (company) that owns the solution (product) that generates findings.default ObjectThe unique identifier of a standard in which a control is enabled.default ObjectThe unique identifier of a control across standards.default ObjectThe name of a security control parameter.default ObjectThe current value of a security control parameter.default ObjectExclusive to findings that are generated as the result of a check run against a specific rule in a supported standard, such as CIS AWS Foundations.default ObjectA finding's confidence.default ObjectA timestamp that indicates when the security findings provider created the potential security issue that a finding reflects.default ObjectThe level of importance assigned to the resources associated with the finding.default ObjectA finding's description.default ObjectThe finding provider value for the finding confidence.default ObjectThe finding provider value for the level of importance assigned to the resources associated with the findings.default ObjectThe finding identifier of a related finding that is identified by the finding provider.default ObjectThe ARN of the solution that generated a related finding that is identified by the finding provider.default ObjectThe finding provider value for the severity label.default ObjectThe finding provider's original value for the severity.default ObjectOne or more finding types that the finding provider assigned to the finding.default ObjectA timestamp that indicates when the security findings provider first observed the potential security issue that a finding captured.default ObjectThe identifier for the solution-specific component (a discrete unit of logic) that generated a finding.default ObjectgetId()The security findings provider-specific identifier for a finding.default ObjectThis field is deprecated.default ObjectA timestamp that indicates when the security findings provider most recently observed a change in the resource that is involved in the finding.default ObjectThe name of the malware that was observed.default ObjectThe filesystem path of the malware that was observed.default ObjectThe state of the malware that was observed.default ObjectThe type of the malware that was observed.default ObjectThe destination domain of network-related information about a finding.default ObjectThe destination IPv4 address of network-related information about a finding.default ObjectThe destination IPv6 address of network-related information about a finding.default ObjectThe destination port of network-related information about a finding.default ObjectIndicates the direction of network traffic associated with a finding.default ObjectThe protocol of network-related information about a finding.default ObjectThe source domain of network-related information about a finding.default ObjectThe source IPv4 address of network-related information about a finding.default ObjectThe source IPv6 address of network-related information about a finding.default ObjectThe source media access control (MAC) address of network-related information about a finding.default ObjectThe source port of network-related information about a finding.default ObjectThe text of a note.default ObjectThe timestamp of when the note was updated.default ObjectThe principal that created a note.default ObjectA timestamp that identifies when the process was launched.default ObjectThe name of the process.default ObjectThe parent process ID.default ObjectThe path to the process executable.default ObjectThe process ID.default ObjectA timestamp that identifies when the process was terminated.default ObjectThe ARN generated by Security Hub CSPM that uniquely identifies a third-party company (security findings provider) after this provider's product (solution that generates findings) is registered with Security Hub CSPM.default ObjectA data type where security findings providers can include additional solution-specific details that aren't part of the definedAwsSecurityFindingformat.default ObjectThe name of the solution (product) that generates findings.default ObjectThe recommendation of what to do about the issue described in a finding.default ObjectThe updated record state for the finding.default ObjectThe Region from which the finding was generated.default ObjectThe solution-generated identifier for a related finding.default ObjectThe ARN of the solution that generated a related finding.default ObjectThe ARN of the application that is related to a finding.default ObjectThe name of the application that is related to a finding.default ObjectThe IAM profile ARN of the instance.default ObjectThe Amazon Machine Image (AMI) ID of the instance.default ObjectThe IPv4 addresses associated with the instance.default ObjectThe IPv6 addresses associated with the instance.default ObjectThe key name associated with the instance.default ObjectThe date and time the instance was launched.default ObjectThe identifier of the subnet that the instance was launched in.default ObjectThe instance type of the instance.default ObjectThe identifier of the VPC that the instance was launched in.default ObjectThe creation date/time of the IAM access key related to a finding.default ObjectThe name of the principal that is associated with an IAM access key.default ObjectThe status of the IAM access key related to a finding.default ObjectThis field is deprecated.default ObjectThe name of an IAM user.default ObjectThe canonical user ID of the owner of the S3 bucket.default ObjectThe display name of the owner of the S3 bucket.default ObjectThe identifier of the image related to a finding.default ObjectThe name of the image related to a finding.default ObjectA timestamp that identifies when the container was started.default ObjectThe name of the container related to a finding.default ObjectThe details of a resource that doesn't have a specific subfield for the resource type defined.default ObjectThe canonical identifier for the given resource type.default ObjectThe canonical AWS partition name that the Region is assigned to.default ObjectThe canonical AWS external Region name where this resource is located.default ObjectA list of AWS tags associated with a resource at the time the finding was processed.default ObjectSpecifies the type of the resource that details are provided for.default ObjectIndicates whether or not sample findings are included in the filter results.default ObjectThe label of a finding's severity.default ObjectDeprecated.default ObjectDeprecated.default ObjectA URL that links to a page about the current finding in the security findings provider's solution.default ObjectThe category of a threat intelligence indicator.default ObjectA timestamp that identifies the last observation of a threat intelligence indicator.default ObjectThe source of the threat intelligence.default ObjectThe URL for more details from the source of the threat intelligence.default ObjectThe type of a threat intelligence indicator.default ObjectThe value of a threat intelligence indicator.default ObjectgetTitle()A finding's title.default ObjectgetType()A finding type in the format ofnamespace/category/classifierthat classifies a finding.default ObjectA timestamp that indicates when the security findings provider last updated the finding record.default ObjectA list of name/value string pairs associated with the finding.default ObjectThe veracity of a finding.default ObjectIndicates whether a software vulnerability in your environment has a known exploit.default ObjectIndicates whether a vulnerability is fixed in a newer version of the affected software packages.default ObjectThe workflow state of a finding.default ObjectThe status of the investigation into a finding.Methods inherited from interface software.amazon.jsii.JsiiSerializable
$jsii$toJson
-
Method Details
-
getAwsAccountId
The AWS account ID in which a finding is generated.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getAwsAccountName
The name of the AWS account in which a finding is generated.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getCompanyName
The name of the findings provider (company) that owns the solution (product) that generates findings.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getComplianceAssociatedStandardsId
The unique identifier of a standard in which a control is enabled.This field consists of the resource portion of the Amazon Resource Name (ARN) returned for a standard in the DescribeStandards API response.
Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getComplianceSecurityControlId
The unique identifier of a control across standards.Values for this field typically consist of an AWS service and a number, such as APIGateway.5.
Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getComplianceSecurityControlParametersName
The name of a security control parameter.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getComplianceSecurityControlParametersValue
The current value of a security control parameter.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getComplianceStatus
Exclusive to findings that are generated as the result of a check run against a specific rule in a supported standard, such as CIS AWS Foundations.Contains security standard-related finding details.
Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getConfidence
A finding's confidence.Confidence is defined as the likelihood that a finding accurately identifies the behavior or issue that it was intended to identify.
Confidence is scored on a 0-100 basis using a ratio scale, where 0 means zero percent confidence and 100 means 100 percent confidence.
Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.NumberFilterProperty>- See Also:
-
getCreatedAt
A timestamp that indicates when the security findings provider created the potential security issue that a finding reflects.For more information about the validation and formatting of timestamp fields in AWS Security Hub CSPM , see Timestamps .
Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.DateFilterProperty>- See Also:
-
getCriticality
The level of importance assigned to the resources associated with the finding.A score of 0 means that the underlying resources have no criticality, and a score of 100 is reserved for the most critical resources.
Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.NumberFilterProperty>- See Also:
-
getDescription
A finding's description.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getFindingProviderFieldsConfidence
The finding provider value for the finding confidence.Confidence is defined as the likelihood that a finding accurately identifies the behavior or issue that it was intended to identify.
Confidence is scored on a 0-100 basis using a ratio scale, where 0 means zero percent confidence and 100 means 100 percent confidence.
Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.NumberFilterProperty>- See Also:
-
getFindingProviderFieldsCriticality
The finding provider value for the level of importance assigned to the resources associated with the findings.A score of 0 means that the underlying resources have no criticality, and a score of 100 is reserved for the most critical resources.
Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.NumberFilterProperty>- See Also:
-
getFindingProviderFieldsRelatedFindingsId
The finding identifier of a related finding that is identified by the finding provider.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getFindingProviderFieldsRelatedFindingsProductArn
The ARN of the solution that generated a related finding that is identified by the finding provider.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getFindingProviderFieldsSeverityLabel
The finding provider value for the severity label.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getFindingProviderFieldsSeverityOriginal
The finding provider's original value for the severity.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getFindingProviderFieldsTypes
One or more finding types that the finding provider assigned to the finding.Uses the format of
namespace/category/classifierthat classify a finding.Valid namespace values are: Software and Configuration Checks | TTPs | Effects | Unusual Behaviors | Sensitive Data Identifications
Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getFirstObservedAt
A timestamp that indicates when the security findings provider first observed the potential security issue that a finding captured.For more information about the validation and formatting of timestamp fields in AWS Security Hub CSPM , see Timestamps .
Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.DateFilterProperty>- See Also:
-
getGeneratorId
The identifier for the solution-specific component (a discrete unit of logic) that generated a finding.In various security findings providers' solutions, this generator can be called a rule, a check, a detector, a plugin, etc.
Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getId
The security findings provider-specific identifier for a finding.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getKeyword
This field is deprecated.A keyword for a finding.
Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.KeywordFilterProperty>- See Also:
-
getLastObservedAt
A timestamp that indicates when the security findings provider most recently observed a change in the resource that is involved in the finding.For more information about the validation and formatting of timestamp fields in AWS Security Hub CSPM , see Timestamps .
Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.DateFilterProperty>- See Also:
-
getMalwareName
The name of the malware that was observed.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getMalwarePath
The filesystem path of the malware that was observed.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getMalwareState
The state of the malware that was observed.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getMalwareType
The type of the malware that was observed.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getNetworkDestinationDomain
The destination domain of network-related information about a finding.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getNetworkDestinationIpV4
The destination IPv4 address of network-related information about a finding.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.IpFilterProperty>- See Also:
-
getNetworkDestinationIpV6
The destination IPv6 address of network-related information about a finding.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.IpFilterProperty>- See Also:
-
getNetworkDestinationPort
The destination port of network-related information about a finding.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.NumberFilterProperty>- See Also:
-
getNetworkDirection
Indicates the direction of network traffic associated with a finding.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getNetworkProtocol
The protocol of network-related information about a finding.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getNetworkSourceDomain
The source domain of network-related information about a finding.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getNetworkSourceIpV4
The source IPv4 address of network-related information about a finding.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.IpFilterProperty>- See Also:
-
getNetworkSourceIpV6
The source IPv6 address of network-related information about a finding.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.IpFilterProperty>- See Also:
-
getNetworkSourceMac
The source media access control (MAC) address of network-related information about a finding.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getNetworkSourcePort
The source port of network-related information about a finding.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.NumberFilterProperty>- See Also:
-
getNoteText
The text of a note.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getNoteUpdatedAt
The timestamp of when the note was updated.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.DateFilterProperty>- See Also:
-
getNoteUpdatedBy
The principal that created a note.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getProcessLaunchedAt
A timestamp that identifies when the process was launched.For more information about the validation and formatting of timestamp fields in AWS Security Hub CSPM , see Timestamps .
Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.DateFilterProperty>- See Also:
-
getProcessName
The name of the process.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getProcessParentPid
The parent process ID.This field accepts positive integers between
Oand2147483647.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.NumberFilterProperty>- See Also:
-
getProcessPath
The path to the process executable.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getProcessPid
The process ID.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.NumberFilterProperty>- See Also:
-
getProcessTerminatedAt
A timestamp that identifies when the process was terminated.For more information about the validation and formatting of timestamp fields in AWS Security Hub CSPM , see Timestamps .
Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.DateFilterProperty>- See Also:
-
getProductArn
The ARN generated by Security Hub CSPM that uniquely identifies a third-party company (security findings provider) after this provider's product (solution that generates findings) is registered with Security Hub CSPM.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getProductFields
A data type where security findings providers can include additional solution-specific details that aren't part of the definedAwsSecurityFindingformat.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.MapFilterProperty>- See Also:
-
getProductName
The name of the solution (product) that generates findings.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getRecommendationText
The recommendation of what to do about the issue described in a finding.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getRecordState
The updated record state for the finding.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getRegion
The Region from which the finding was generated.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getRelatedFindingsId
The solution-generated identifier for a related finding.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getRelatedFindingsProductArn
The ARN of the solution that generated a related finding.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getResourceApplicationArn
The ARN of the application that is related to a finding.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getResourceApplicationName
The name of the application that is related to a finding.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getResourceAwsEc2InstanceIamInstanceProfileArn
The IAM profile ARN of the instance.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getResourceAwsEc2InstanceImageId
The Amazon Machine Image (AMI) ID of the instance.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getResourceAwsEc2InstanceIpV4Addresses
The IPv4 addresses associated with the instance.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.IpFilterProperty>- See Also:
-
getResourceAwsEc2InstanceIpV6Addresses
The IPv6 addresses associated with the instance.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.IpFilterProperty>- See Also:
-
getResourceAwsEc2InstanceKeyName
The key name associated with the instance.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getResourceAwsEc2InstanceLaunchedAt
The date and time the instance was launched.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.DateFilterProperty>- See Also:
-
getResourceAwsEc2InstanceSubnetId
The identifier of the subnet that the instance was launched in.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getResourceAwsEc2InstanceType
The instance type of the instance.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getResourceAwsEc2InstanceVpcId
The identifier of the VPC that the instance was launched in.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getResourceAwsIamAccessKeyCreatedAt
The creation date/time of the IAM access key related to a finding.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.DateFilterProperty>- See Also:
-
getResourceAwsIamAccessKeyPrincipalName
The name of the principal that is associated with an IAM access key.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getResourceAwsIamAccessKeyStatus
The status of the IAM access key related to a finding.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getResourceAwsIamAccessKeyUserName
This field is deprecated.The username associated with the IAM access key related to a finding.
Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getResourceAwsIamUserUserName
The name of an IAM user.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getResourceAwsS3BucketOwnerId
The canonical user ID of the owner of the S3 bucket.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getResourceAwsS3BucketOwnerName
The display name of the owner of the S3 bucket.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getResourceContainerImageId
The identifier of the image related to a finding.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getResourceContainerImageName
The name of the image related to a finding.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getResourceContainerLaunchedAt
A timestamp that identifies when the container was started.For more information about the validation and formatting of timestamp fields in AWS Security Hub CSPM , see Timestamps .
Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.DateFilterProperty>- See Also:
-
getResourceContainerName
The name of the container related to a finding.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getResourceDetailsOther
The details of a resource that doesn't have a specific subfield for the resource type defined.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.MapFilterProperty>- See Also:
-
getResourceId
The canonical identifier for the given resource type.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getResourcePartition
The canonical AWS partition name that the Region is assigned to.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getResourceRegion
The canonical AWS external Region name where this resource is located.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getResourceTags
A list of AWS tags associated with a resource at the time the finding was processed.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.MapFilterProperty>- See Also:
-
getResourceType
Specifies the type of the resource that details are provided for.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getSample
Indicates whether or not sample findings are included in the filter results.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.BooleanFilterProperty>- See Also:
-
getSeverityLabel
The label of a finding's severity.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getSeverityNormalized
Deprecated. The normalized severity of a finding. Instead of providingNormalized, provideLabel.The value of
Normalizedcan be an integer between0and100.If you provide
Labeland don't provideNormalized, thenNormalizedis set automatically as follows.INFORMATIONAL- 0LOW- 1MEDIUM- 40HIGH- 70CRITICAL- 90
Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.NumberFilterProperty>- See Also:
-
getSeverityProduct
Deprecated. This attribute isn't included in findings. Instead of providingProduct, provideOriginal.The native severity as defined by the AWS service or integrated partner product that generated the finding.
Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.NumberFilterProperty>- See Also:
-
getSourceUrl
A URL that links to a page about the current finding in the security findings provider's solution.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getThreatIntelIndicatorCategory
The category of a threat intelligence indicator.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getThreatIntelIndicatorLastObservedAt
A timestamp that identifies the last observation of a threat intelligence indicator.For more information about the validation and formatting of timestamp fields in AWS Security Hub CSPM , see Timestamps .
Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.DateFilterProperty>- See Also:
-
getThreatIntelIndicatorSource
The source of the threat intelligence.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getThreatIntelIndicatorSourceUrl
The URL for more details from the source of the threat intelligence.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getThreatIntelIndicatorType
The type of a threat intelligence indicator.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getThreatIntelIndicatorValue
The value of a threat intelligence indicator.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getTitle
A finding's title.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getType
A finding type in the format ofnamespace/category/classifierthat classifies a finding.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getUpdatedAt
A timestamp that indicates when the security findings provider last updated the finding record.For more information about the validation and formatting of timestamp fields in AWS Security Hub CSPM , see Timestamps .
Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.DateFilterProperty>- See Also:
-
getUserDefinedFields
A list of name/value string pairs associated with the finding.These are custom, user-defined fields added to a finding.
Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.MapFilterProperty>- See Also:
-
getVerificationState
The veracity of a finding.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getVulnerabilitiesExploitAvailable
Indicates whether a software vulnerability in your environment has a known exploit.You can filter findings by this field only if you use Security Hub CSPM and Amazon Inspector.
Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getVulnerabilitiesFixAvailable
Indicates whether a vulnerability is fixed in a newer version of the affected software packages.You can filter findings by this field only if you use Security Hub CSPM and Amazon Inspector.
Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getWorkflowState
The workflow state of a finding.Note that this field is deprecated. To search for a finding based on its workflow status, use
WorkflowStatus.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
getWorkflowStatus
The status of the investigation into a finding. Allowed values are the following.NEW- The initial state of a finding, before it is reviewed.
Security Hub CSPM also resets the workflow status from
NOTIFIEDorRESOLVEDtoNEWin the following cases:RecordStatechanges fromARCHIVEDtoACTIVE.Compliance.Statuschanges fromPASSEDto eitherWARNING,FAILED, orNOT_AVAILABLE.NOTIFIED- Indicates that the resource owner has been notified about the security issue. Used when the initial reviewer is not the resource owner, and needs intervention from the resource owner.
If one of the following occurs, the workflow status is changed automatically from
NOTIFIEDtoNEW:RecordStatechanges fromARCHIVEDtoACTIVE.Compliance.Statuschanges fromPASSEDtoFAILED,WARNING, orNOT_AVAILABLE.SUPPRESSED- Indicates that you reviewed the finding and don't believe that any action is needed.
The workflow status of a
SUPPRESSEDfinding does not change ifRecordStatechanges fromARCHIVEDtoACTIVE.RESOLVED- The finding was reviewed and remediated and is now considered resolved.
The finding remains
RESOLVEDunless one of the following occurs:RecordStatechanges fromARCHIVEDtoACTIVE.Compliance.Statuschanges fromPASSEDtoFAILED,WARNING, orNOT_AVAILABLE.
In those cases, the workflow status is automatically reset to
NEW.For findings from controls, if
Compliance.StatusisPASSED, then Security Hub CSPM automatically sets the workflow status toRESOLVED.Returns union: either
IResolvableor Listinvalid input: '<'eitherIResolvableorCfnInsight.StringFilterProperty>- See Also:
-
builder
-