FindingProviderFields
In a BatchImportFindings request, finding providers use FindingProviderFields to provide
and update values for the following fields:
-
Confidence -
Criticality -
RelatedFindings -
Severity -
Types
The preceding fields are nested under the FindingProviderFields object, but also have analogues of the same name
as top-level ASFF fields. When a new finding is sent to AWS Security Hub by a finding provider, Security Hub populates the
FindingProviderFields object automatically, if it is empty, based on the corresponding top-level fields.
Finding providers can update FindingProviderFields only by using the BatchImportFindings
operation. Finding providers can't update
this object with the BatchUpdateFindings operation. Customers can update the top-level fields by using the BatchUpdateFindings operation. Customers can't
update FindingProviderFields.
For information about how Security Hub handles updates from BatchImportFindings to
FindingProviderFields and to the corresponding top-level
attributes, see Using FindingProviderFields in the
AWS Security Hub User Guide.
Contents
- Confidence
-
A finding's confidence. Confidence is defined as the likelihood that a finding accurately identifies the behavior or issue that it was intended to identify.
Confidence is scored on a 0-100 basis using a ratio scale, where 0 means zero percent confidence and 100 means 100 percent confidence.
Type: Integer
Valid Range: Minimum value of 0. Maximum value of 100.
Required: No
- Criticality
-
The level of importance assigned to the resources associated with the finding.
A score of 0 means that the underlying resources have no criticality, and a score of 100 is reserved for the most critical resources.
Type: Integer
Valid Range: Minimum value of 0. Maximum value of 100.
Required: No
- RelatedFindings
-
A list of findings that are related to the current finding.
Type: Array of RelatedFinding objects
Required: No
- Severity
-
The severity of a finding.
Type: FindingProviderSeverity object
Required: No
- Types
-
One or more finding types in the format of
namespace/category/classifierthat classify a finding.Valid namespace values are: Software and Configuration Checks | TTPs | Effects | Unusual Behaviors | Sensitive Data Identifications
Type: Array of strings
Pattern:
.*\S.*Required: No
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following:
