Las traducciones son generadas a través de traducción automática. En caso de conflicto entre la traducción y la version original de inglés, prevalecerá la version en inglés.

# Ejemplos de reglas de automatización
<a name="examples-automation-rules"></a>

En esta sección se proporcionan ejemplos de reglas de automatización para casos de uso comunes del CSPM de Security Hub. Estos ejemplos corresponden a plantillas de reglas que están disponibles en la consola del CSPM de Security Hub.

## Elevar la gravedad a Crítica cuando un recurso específico como un bucket S3 esté en riesgo
<a name="example-automation-rule-severity-resource"></a>

En este ejemplo, los criterios de la regla coinciden cuando el `ResourceId` de un resultado es un bucket específico de Amazon Simple Storage Service (Amazon S3). La acción de la regla es cambiar la gravedad de los resultados coincidentes a `CRITICAL`. Puede modificar esta plantilla para aplicarla a otros recursos.

**Ejemplo de solicitud de API:**

```
{
    "IsTerminal": {{true}},
    "RuleName": "{{Elevate severity of findings that relate to important resources}}",
    "RuleOrder": {{1}},
    "RuleStatus": "{{ENABLED}}",
    "Description": "{{Elevate finding severity to CRITICAL when specific resource such as an S3 bucket is at risk}}",
    "Criteria": {
        "ProductName": [{
            "Value": "{{Security Hub CSPM}}",
            "Comparison": "{{EQUALS}}"
        }],
        "ComplianceStatus": [{
            "Value": "{{FAILED}}",
            "Comparison": "{{EQUALS}}"
        }],
        "RecordState": [{
            "Value": "{{ACTIVE}}",
            "Comparison": "{{EQUALS}}"
        }],
        "WorkflowStatus": [{
            "Value": "{{NEW}}",
            "Comparison": "{{EQUALS}}"
        }],
        "ResourceId": [{
            "Value": "arn:aws:{{s3:::amzn-s3-demo-bucket/developers/design_info.doc}}",
            "Comparison": "{{EQUALS}}"
        }]
    },
    "Actions": [{
        "Type": "FINDING_FIELDS_UPDATE",
        "FindingFieldsUpdate": {
            "Severity": {
                "Label": "{{CRITICAL}}"
            },
            "Note": {
                "Text": "{{This is a critical resource. Please review ASAP.}}",
                "UpdatedBy": "{{sechub-automation}}"
            }
        }
    }]
}
```

**Ejemplo de comando de la CLI:**

```
$ 
aws securityhub create-automation-rule \
--is-terminal \
--rule-name "{{Elevate severity of findings that relate to important resources}}" \
--rule-order {{1}} \
--rule-status "{{ENABLED}}" \

--description "{{Elevate finding severity to CRITICAL when specific resource such as an S3 bucket is at risk}}" \
--criteria '{
"ProductName": [{
"Value": "{{Security Hub CSPM}}",
"Comparison": "{{EQUALS}}"
}],
"ComplianceStatus": [{
"Value": "{{FAILED}}",
"Comparison": "{{EQUALS}}"
}],
"RecordState": [{
"Value": "{{ACTIVE}}",
"Comparison": "{{EQUALS}}"
}],
"WorkflowStatus": [{
"Value": "{{NEW}}",
"Comparison": "{{EQUALS}}"
}],
"ResourceId": [{
"Value": "{{arn:aws:s3:::amzn-s3-demo-bucket/developers/design_info.doc"}},
"Comparison": "{{EQUALS}}"
}]
}' \
--actions '[{
"Type": "FINDING_FIELDS_UPDATE",
"FindingFieldsUpdate": {
"Severity": {
"Label": "{{CRITICAL}}"
},
"Note": {
"Text": "{{This is a critical resource. Please review ASAP.}}",
"UpdatedBy": "{{sechub-automation}}"
}
}
}]' \
--region {{us-east-1}}
```

## Cómo elevar la gravedad de los resultados relacionados con los recursos en cuentas de producción
<a name="example-automation-rule-severity-change"></a>

En este ejemplo, los criterios de la regla coinciden cuando se genera un resultado de gravedad `HIGH` en cuentas de producción específicas. La acción de la regla es cambiar la gravedad de los resultados coincidentes a `CRITICAL`.

**Ejemplo de solicitud de API:**

```
{
    "IsTerminal": {{false}},
    "RuleName": "{{Elevate severity for production accounts}}",
    "RuleOrder": {{1}},
    "RuleStatus": "{{ENABLED}}",
    "Description": "{{Elevate finding severity from HIGH to CRITICAL for findings that relate to resources in specific production accounts}}",
    "Criteria": {
        "ProductName": [{
            "Value": "{{Security Hub CSPM}}",
            "Comparison": "{{EQUALS}}"
        }],
        "ComplianceStatus": [{
            "Value": "{{FAILED}}",
            "Comparison": "{{EQUALS}}"
        }],
        "RecordState": [{
            "Value": "{{ACTIVE}}",
            "Comparison": "{{EQUALS}}"
        }],
        "WorkflowStatus": [{
            "Value": "{{NEW}}",
            "Comparison": "{{EQUALS}}"
        }],
        "SeverityLabel": [{
            "Value": "{{HIGH}}",
            "Comparison": "{{EQUALS}}"
        }],
        "AwsAccountId": [
        {
            "Value": "{{111122223333}}",
            "Comparison": "{{EQUALS}}"
        },
        {
            "Value": "{{123456789012}}",
            "Comparison": "{{EQUALS}}"
        }]
    },
    "Actions": [{
        "Type": "FINDING_FIELDS_UPDATE",
        "FindingFieldsUpdate": {
            "Severity": {
                "Label": "{{CRITICAL}}"
            },
            "Note": {
                "Text": "{{A resource in production accounts is at risk. Please review ASAP.}}",
                "UpdatedBy": "{{sechub-automation}}"
            }
        }
    }]
}
```

**Ejemplo de comando de la CLI**:

```
aws securityhub create-automation-rule \
--no-is-terminal \
--rule-name "{{Elevate severity of findings that relate to resources in production accounts}}" \
--rule-order {{1}} \
--rule-status "{{ENABLED}}" \
--description "{{Elevate finding severity from HIGH to CRITICAL for findings that relate to resources in specific production accounts}}" \
--criteria '{
"ProductName": [{
"Value": "{{Security Hub CSPM}}",
"Comparison": "{{EQUALS}}"
}],
"ComplianceStatus": [{
"Value": "{{FAILED}}",
"Comparison": "{{EQUALS}}"
}],
"RecordState": [{
"Value": "{{ACTIVE}}",
"Comparison": "{{EQUALS}}"
}],
"SeverityLabel": [{
"Value": "{{HIGH}}",
"Comparison": "{{EQUALS}}"
}],
"AwsAccountId": [
{
"Value": "{{111122223333}}",
"Comparison": "{{EQUALS}}"
},
{
"Value": "{{123456789012}}",
"Comparison": "{{EQUALS}}"
}]
}' \
--actions '[{
"Type": "FINDING_FIELDS_UPDATE",
"FindingFieldsUpdate": {
"Severity": {
"Label": "{{CRITICAL}}"
},
"Note": {
"Text": "{{A resource in production accounts is at risk. Please review ASAP.}}",
"UpdatedBy": "{{sechub-automation}}"
}
}
}]' \
--region {{us-east-1}}
```

## Cómo suprimir resultados informativos
<a name="example-automation-rule-change-workflow"></a>

En este ejemplo, los criterios de la regla coinciden con los hallazgos de `INFORMATIONAL` gravedad enviados a Security Hub CSPM desde Amazon. GuardDuty La acción de la regla es cambiar el estado del flujo de trabajo de los resultados coincidentes a `SUPPRESSED`.

**Ejemplo de solicitud de API:**

```
{
    "IsTerminal": {{false}},
    "RuleName": "{{Suppress informational findings}}",
    "RuleOrder": {{1}},
    "RuleStatus": "{{ENABLED}}",
    "Description": "{{Suppress GuardDuty findings with INFORMATIONAL severity}}",
    "Criteria": {
        "ProductName": [{
            "Value": "{{GuardDuty}}",
            "Comparison": "{{EQUALS}}"
        }],
        "RecordState": [{
            "Value": "{{ACTIVE}}",
            "Comparison": "{{EQUALS}}"
        }],
        "WorkflowStatus": [{
            "Value": "{{NEW}}",
            "Comparison": "{{EQUALS}}"
        }],
        "SeverityLabel": [{
            "Value": "{{INFORMATIONAL}}",
            "Comparison": "{{EQUALS}}"
        }]
    },
    "Actions": [{
        "Type": "FINDING_FIELDS_UPDATE",
        "FindingFieldsUpdate": {
            "Workflow": {
                "Status": "{{SUPPRESSED}}"
            },
            "Note": {
                "Text": "{{Automatically suppress GuardDuty findings with INFORMATIONAL severity}}",
                "UpdatedBy": "{{sechub-automation}}"
            }
        }
    }]
}
```

**Ejemplo de comando de la CLI**:

```
aws securityhub create-automation-rule \
--no-is-terminal \
--rule-name "{{Suppress informational findings}}" \
--rule-order {{1}} \
--rule-status "{{ENABLED}}" \
--description "{{Suppress GuardDuty findings with INFORMATIONAL severity}}" \
--criteria '{
"ProductName": [{
"Value": "{{GuardDuty}}",
"Comparison": "{{EQUALS}}"
}],
"ComplianceStatus": [{
"Value": "{{FAILED}}",
"Comparison": "{{EQUALS}}"
}],
"RecordState": [{
"Value": "{{ACTIVE}}",
"Comparison": "{{EQUALS}}"
}],
"WorkflowStatus": [{
"Value": "{{NEW}}",
"Comparison": "{{EQUALS}}"
}],
"SeverityLabel": [{
"Value": "{{INFORMATIONAL}}",
"Comparison": "{{EQUALS}}"
}]
}' \
--actions '[{
"Type": "FINDING_FIELDS_UPDATE",
"FindingFieldsUpdate": {
"Workflow": {
"Status": "{{SUPPRESSED}}"
},
"Note": {
"Text": "{{Automatically suppress GuardDuty findings with INFORMATIONAL severity}}",
"UpdatedBy": "{{sechub-automation}}"
}
}
}]' \
--region {{us-east-1}}
```