automation_rule_v2s

Creates, updates, deletes, gets or lists an automation_rule_v2s resource.

Overview

Name	automation_rule_v2s
Type	Resource
Id	aws.securityhub.automation_rule_v2s

Fields

The following fields are returned by SELECT queries:

get_automation_rule_v2

Name	Datatype	Description
actions	array	A list of actions performed when the rule criteria is met.
created_at	string (date-time)	The timestamp when the V2 automation rule was created.
criteria	object	The filtering type and configuration of the V2 automation rule.
description	string	A description of the automation rule. (pattern: <code>.\S.</code>)
rule_arn	string	The ARN of the V2 automation rule. (pattern: <code>.\S.</code>)
rule_id	string	The ID of the V2 automation rule. (pattern: <code>.\S.</code>)
rule_name	string	The name of the V2 automation rule. (pattern: <code>.\S.</code>)
rule_order	number (float)	The value for the rule priority.
rule_status	string	The status of the V2 automation automation rule. (ENABLED, DISABLED)
updated_at	string (date-time)	The timestamp when the V2 automation rule was updated.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_automation_rule_v2	select	identifier, region		Returns an automation rule for the V2 service.
create_automation_rule_v2	insert	region, RuleName, RuleOrder		Creates a V2 automation rule.
update_automation_rule_v2	update	identifier, region		Updates a V2 automation rule.
delete_automation_rule_v2	delete	identifier, region		Deletes a V2 automation rule.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
identifier	string	The ARN of the V2 automation rule.
region	string	AWS region (default: us-east-1)

SELECT examples

get_automation_rule_v2

Returns an automation rule for the V2 service.

SELECT
actions,
created_at,
criteria,
description,
rule_arn,
rule_id,
rule_name,
rule_order,
rule_status,
updated_at
FROM aws.securityhub.automation_rule_v2s
WHERE identifier = '{{ identifier }}' -- required
AND region = '{{ region }}' -- required
;

INSERT examples

create_automation_rule_v2

Creates a V2 automation rule.

INSERT INTO aws.securityhub.automation_rule_v2s (
RuleName,
RuleStatus,
Description,
RuleOrder,
Criteria,
Actions,
Tags,
ClientToken,
region
)
SELECT 
'{{ RuleName }}' /* required */,
'{{ RuleStatus }}',
'{{ Description }}',
{{ RuleOrder }} /* required */,
'{{ Criteria }}',
'{{ Actions }}',
'{{ Tags }}',
'{{ ClientToken }}',
'{{ region }}'
RETURNING
rule_arn,
rule_id
;

Manifest

# Description fields are for documentation purposes
- name: automation_rule_v2s
props:
  - name: region
    value: "{{ region }}"
    description: Required parameter for the automation_rule_v2s resource.
  - name: RuleName
    value: "{{ RuleName }}"
  - name: RuleStatus
    value: "{{ RuleStatus }}"
    valid_values: ['ENABLED', 'DISABLED']
  - name: Description
    value: "{{ Description }}"
  - name: RuleOrder
    value: {{ RuleOrder }}
  - name: Criteria
    description: |
      Defines the parameters and conditions used to evaluate and filter security findings.
    value:
      OcsfFindingCriteria:
        CompositeFilters:
          - StringFilters: "{{ StringFilters }}"
            DateFilters: "{{ DateFilters }}"
            BooleanFilters: "{{ BooleanFilters }}"
            NumberFilters: "{{ NumberFilters }}"
            MapFilters: "{{ MapFilters }}"
            IpFilters: "{{ IpFilters }}"
            NestedCompositeFilters: "{{ NestedCompositeFilters }}"
            Operator: "{{ Operator }}"
        CompositeOperator: "{{ CompositeOperator }}"
  - name: Actions
    value:
      - Type: "{{ Type }}"
        FindingFieldsUpdate:
          SeverityId: {{ SeverityId }}
          Comment: "{{ Comment }}"
          StatusId: {{ StatusId }}
        ExternalIntegrationConfiguration:
          ConnectorArn: "{{ ConnectorArn }}"
  - name: Tags
    value: "{{ Tags }}"
  - name: ClientToken
    value: "{{ ClientToken }}"

UPDATE examples

update_automation_rule_v2

Updates a V2 automation rule.

UPDATE aws.securityhub.automation_rule_v2s
SET 
RuleStatus = '{{ RuleStatus }}',
RuleOrder = {{ RuleOrder }},
Description = '{{ Description }}',
RuleName = '{{ RuleName }}',
Criteria = '{{ Criteria }}',
Actions = '{{ Actions }}'
WHERE 
identifier = '{{ identifier }}' --required
AND region = '{{ region }}' --required;

DELETE examples

delete_automation_rule_v2

Deletes a V2 automation rule.

DELETE FROM aws.securityhub.automation_rule_v2s
WHERE identifier = '{{ identifier }}' --required
AND region = '{{ region }}' --required
;