filters

Creates, updates, deletes, gets or lists a filters resource.

Overview

Name	filters
Type	Resource
Id	aws.inspector2.filters

Fields

The following fields are returned by SELECT queries:

list_filters

Name	Datatype	Description
name	string	The name of the filter.
action	string	The action that is to be applied to the findings that match the filter. (NONE, SUPPRESS)
arn	string	The Amazon Resource Number (ARN) associated with this filter.
created_at	string (date-time)	The date and time this filter was created at.
criteria	object	Details on the criteria used to define the filter.
description	string	A description of the filter.
owner_id	string	The Amazon Web Services account ID of the account that created the filter. (pattern: <code>.(^\d{12}$)|(^o-[a-z0-9]{10,32}$).</code>)
reason	string	The reason for the filter.
tags	object	The tags attached to the filter.
updated_at	string (date-time)	The date and time the filter was last updated at.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
list_filters	select	region		Lists the filters associated with your account.
create_filter	insert	region, action, filterCriteria, name		Creates a filter resource using specified filter criteria. When the filter action is set to SUPPRESS this action creates a suppression rule.
update_filter	update	region, filterArn		Specifies the action that is to be applied to the findings that match the filter.
delete_filter	delete	region		Deletes a filter resource.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

SELECT examples

list_filters

Lists the filters associated with your account.

SELECT
name,
action,
arn,
created_at,
criteria,
description,
owner_id,
reason,
tags,
updated_at
FROM aws.inspector2.filters
WHERE region = '{{ region }}' -- required
;

INSERT examples

create_filter

Creates a filter resource using specified filter criteria. When the filter action is set to SUPPRESS this action creates a suppression rule.

INSERT INTO aws.inspector2.filters (
action,
description,
filterCriteria,
name,
tags,
reason,
region
)
SELECT 
'{{ action }}' /* required */,
'{{ description }}',
'{{ filterCriteria }}' /* required */,
'{{ name }}' /* required */,
'{{ tags }}',
'{{ reason }}',
'{{ region }}'
RETURNING
arn
;

Manifest

# Description fields are for documentation purposes
- name: filters
props:
  - name: region
    value: "{{ region }}"
    description: Required parameter for the filters resource.
  - name: action
    value: "{{ action }}"
    valid_values: ['NONE', 'SUPPRESS']
  - name: description
    value: "{{ description }}"
  - name: filterCriteria
    description: |
      Details on the criteria used to define the filter.
    value:
      findingArn:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      awsAccountId:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      findingType:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      severity:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      firstObservedAt:
        - startInclusive: "{{ startInclusive }}"
          endInclusive: "{{ endInclusive }}"
      lastObservedAt:
        - startInclusive: "{{ startInclusive }}"
          endInclusive: "{{ endInclusive }}"
      updatedAt:
        - startInclusive: "{{ startInclusive }}"
          endInclusive: "{{ endInclusive }}"
      findingStatus:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      title_:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      inspectorScore:
        - upperInclusive: {{ upperInclusive }}
          lowerInclusive: {{ lowerInclusive }}
      resourceType:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      resourceId:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      resourceTags:
        - comparison: "{{ comparison }}"
          key: "{{ key }}"
          value: "{{ value }}"
      ec2InstanceImageId:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      ec2InstanceVpcId:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      ec2InstanceSubnetId:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      ecrImagePushedAt:
        - startInclusive: "{{ startInclusive }}"
          endInclusive: "{{ endInclusive }}"
      ecrImageArchitecture:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      ecrImageRegistry:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      ecrImageRepositoryName:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      ecrImageTags:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      ecrImageHash:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      ecrImageLastInUseAt:
        - startInclusive: "{{ startInclusive }}"
          endInclusive: "{{ endInclusive }}"
      ecrImageInUseCount:
        - upperInclusive: {{ upperInclusive }}
          lowerInclusive: {{ lowerInclusive }}
      portRange:
        - beginInclusive: {{ beginInclusive }}
          endInclusive: {{ endInclusive }}
      networkProtocol:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      componentId:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      componentType:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      vulnerabilityId:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      vulnerabilitySource:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      vendorSeverity:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      vulnerablePackages:
        - name:
            comparison: "{{ comparison }}"
            value: "{{ value }}"
          version:
            comparison: "{{ comparison }}"
            value: "{{ value }}"
          epoch:
            upperInclusive: {{ upperInclusive }}
            lowerInclusive: {{ lowerInclusive }}
          release:
            comparison: "{{ comparison }}"
            value: "{{ value }}"
          architecture:
            comparison: "{{ comparison }}"
            value: "{{ value }}"
          sourceLayerHash:
            comparison: "{{ comparison }}"
            value: "{{ value }}"
          sourceLambdaLayerArn:
            comparison: "{{ comparison }}"
            value: "{{ value }}"
          filePath:
            comparison: "{{ comparison }}"
            value: "{{ value }}"
      relatedVulnerabilities:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      fixAvailable:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      lambdaFunctionName:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      lambdaFunctionLayers:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      lambdaFunctionRuntime:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      lambdaFunctionLastModifiedAt:
        - startInclusive: "{{ startInclusive }}"
          endInclusive: "{{ endInclusive }}"
      lambdaFunctionExecutionRoleArn:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      exploitAvailable:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      codeVulnerabilityDetectorName:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      codeVulnerabilityDetectorTags:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      codeVulnerabilityFilePath:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      epssScore:
        - upperInclusive: {{ upperInclusive }}
          lowerInclusive: {{ lowerInclusive }}
      codeRepositoryProjectName:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      codeRepositoryProviderType:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      cloudProvider:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      cloudProviderRegion:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      cloudProviderAccountId:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      cloudProviderOrgId:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      cloudVmImageReference:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      cloudVmNetworkId:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      cloudVmSubnetIds:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      cloudImageRepositoryName:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      cloudImageRegistry:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      cloudImageDigest:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      cloudImageTags:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      cloudImagePushedAt:
        - startInclusive: "{{ startInclusive }}"
          endInclusive: "{{ endInclusive }}"
      cloudImageArchitecture:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      cloudImageLastInUseAt:
        - startInclusive: "{{ startInclusive }}"
          endInclusive: "{{ endInclusive }}"
      cloudImageInUseCount:
        - upperInclusive: {{ upperInclusive }}
          lowerInclusive: {{ lowerInclusive }}
      cloudServerlessFunctionName:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      cloudServerlessFunctionRuntime:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      cloudServerlessFunctionLastModifiedAt:
        - startInclusive: "{{ startInclusive }}"
          endInclusive: "{{ endInclusive }}"
      cloudServerlessFunctionExecutionRole:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
  - name: name
    value: "{{ name }}"
  - name: tags
    value: "{{ tags }}"
  - name: reason
    value: "{{ reason }}"

UPDATE examples

update_filter

Specifies the action that is to be applied to the findings that match the filter.

UPDATE aws.inspector2.filters
SET 
action = '{{ action }}',
description = '{{ description }}',
filterCriteria = '{{ filterCriteria }}',
name = '{{ name }}',
filterArn = '{{ filterArn }}',
reason = '{{ reason }}'
WHERE 
region = '{{ region }}' --required
AND filterArn = '{{ filterArn }}' --required
RETURNING
arn;

DELETE examples

delete_filter

Deletes a filter resource.

DELETE FROM aws.inspector2.filters
WHERE region = '{{ region }}' --required
;