threats

Creates, updates, deletes, gets or lists a threats resource.

Overview

Name	threats
Type	Resource
Id	aws.securityagent.threats

Fields

The following fields are returned by SELECT queries:

batch_get_threats

Name	Datatype	Description
not_found	array	List of threat IDs.
threats	array	The list of threats that were found.

list_threats

Name	Datatype	Description
created_at	string (date-time)	The date and time the threat was created, in UTC format.
created_by	string	Who created this threat. (CUSTOMER, AGENT)
severity	string	Severity level for a threat. (CRITICAL, HIGH, MEDIUM, LOW, INFO)
statement	string	The natural-language threat statement.
status	string	The current status of the threat. (OPEN, RESOLVED, DISMISSED)
stride	array	List of STRIDE categories.
threat_id	string	The unique identifier of the threat.
threat_job_id	string	The unique identifier of the threat model job that produced the threat.
title_	string	A short title summarizing the threat.
updated_at	string (date-time)	The date and time the threat was last updated, in UTC format.
updated_by	string	Who last updated this threat. (CUSTOMER, AGENT)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
batch_get_threats	select	region		Retrieves information about one or more threats.
list_threats	select	region		Returns a paginated list of threats for a threat model job.
create_threat	insert	region, agentSpaceId, threatJobId		Creates a new threat under a threat model job.
update_threat	update	region, threatId, agentSpaceId		Updates a threat.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

SELECT examples

batch_get_threats

Retrieves information about one or more threats.

SELECT
not_found,
threats
FROM aws.securityagent.threats
WHERE region = '{{ region }}' -- required
;

list_threats

Returns a paginated list of threats for a threat model job.

SELECT
created_at,
created_by,
severity,
statement,
status,
stride,
threat_id,
threat_job_id,
title_,
updated_at,
updated_by
FROM aws.securityagent.threats
WHERE region = '{{ region }}' -- required
;

INSERT examples

create_threat

Creates a new threat under a threat model job.

INSERT INTO aws.securityagent.threats (
agentSpaceId,
threatJobId,
title,
statement,
severity,
comments,
stride,
threatSource,
prerequisites,
threatAction,
threatImpact,
impactedGoal,
impactedAssets,
anchor,
evidence,
recommendation,
region
)
SELECT 
'{{ agentSpaceId }}' /* required */,
'{{ threatJobId }}' /* required */,
'{{ title }}',
'{{ statement }}',
'{{ severity }}',
'{{ comments }}',
'{{ stride }}',
'{{ threatSource }}',
'{{ prerequisites }}',
'{{ threatAction }}',
'{{ threatImpact }}',
'{{ impactedGoal }}',
'{{ impactedAssets }}',
'{{ anchor }}',
'{{ evidence }}',
'{{ recommendation }}',
'{{ region }}'
RETURNING
anchor,
comments,
created_at,
created_by,
evidence,
impacted_assets,
impacted_goal,
prerequisites,
recommendation,
severity,
statement,
status,
stride,
threat_action,
threat_id,
threat_impact,
threat_job_id,
threat_source,
title_,
updated_at,
updated_by
;

Manifest

# Description fields are for documentation purposes
- name: threats
props:
  - name: region
    value: "{{ region }}"
    description: Required parameter for the threats resource.
  - name: agentSpaceId
    value: "{{ agentSpaceId }}"
  - name: threatJobId
    value: "{{ threatJobId }}"
  - name: title
    value: "{{ title }}"
  - name: statement
    value: "{{ statement }}"
  - name: severity
    value: "{{ severity }}"
    description: |
      Severity level for a threat.
    valid_values: ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW', 'INFO']
  - name: comments
    value: "{{ comments }}"
  - name: stride
    value:
      - "{{ stride }}"
    description: |
      List of STRIDE categories.
  - name: threatSource
    value: "{{ threatSource }}"
  - name: prerequisites
    value: "{{ prerequisites }}"
  - name: threatAction
    value: "{{ threatAction }}"
  - name: threatImpact
    value: "{{ threatImpact }}"
  - name: impactedGoal
    value:
      - "{{ impactedGoal }}"
  - name: impactedAssets
    value:
      - "{{ impactedAssets }}"
  - name: anchor
    description: |
      DFD element that a threat is anchored to.
    value:
      kind: "{{ kind }}"
      id: "{{ id }}"
      packageId: "{{ packageId }}"
  - name: evidence
    description: |
      List of threat evidence.
    value:
      - packageId: "{{ packageId }}"
        path: "{{ path }}"
  - name: recommendation
    value: "{{ recommendation }}"

UPDATE examples

update_threat

Updates a threat.

UPDATE aws.securityagent.threats
SET 
threatId = '{{ threatId }}',
agentSpaceId = '{{ agentSpaceId }}',
title = '{{ title }}',
status = '{{ status }}',
comments = '{{ comments }}',
statement = '{{ statement }}',
severity = '{{ severity }}',
threatSource = '{{ threatSource }}',
prerequisites = '{{ prerequisites }}',
threatAction = '{{ threatAction }}',
threatImpact = '{{ threatImpact }}',
impactedGoal = '{{ impactedGoal }}',
impactedAssets = '{{ impactedAssets }}',
anchor = '{{ anchor }}',
evidence = '{{ evidence }}',
recommendation = '{{ recommendation }}'
WHERE 
region = '{{ region }}' --required
AND threatId = '{{ threatId }}' --required
AND agentSpaceId = '{{ agentSpaceId }}' --required
RETURNING
anchor,
comments,
created_at,
created_by,
evidence,
impacted_assets,
impacted_goal,
prerequisites,
recommendation,
severity,
statement,
status,
stride,
threat_action,
threat_id,
threat_impact,
threat_job_id,
threat_source,
title_,
updated_at,
updated_by;