automation_rules

Creates, updates, deletes, gets or lists an automation_rules resource.

Overview

Name	automation_rules
Type	Resource
Id	aws.securityhub.automation_rules

Fields

The following fields are returned by SELECT queries:

batch_get_automation_rules

Name	Datatype	Description
rules	array	A list of rule details for the provided rule ARNs.
unprocessed_automation_rules	array	A list of objects containing RuleArn, ErrorCode, and ErrorMessage. This parameter tells you which automation rules the request didn't retrieve and why.

list_automation_rules

Name	Datatype	Description
automation_rules_metadata	array	Metadata for rules in the calling account. The response includes rules with a RuleStatus of ENABLED and DISABLED.
next_token	string	A pagination token for the response.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
batch_get_automation_rules	select	region		Retrieves a list of details for automation rules based on rule Amazon Resource Names (ARNs).
list_automation_rules	select	region	NextToken, MaxResults	A list of automation rules and their metadata for the calling account.
create_automation_rule	insert	region, RuleOrder, RuleName, Description, Criteria, Actions		Creates an automation rule based on input parameters.
batch_delete_automation_rules	exec	region, AutomationRulesArns		Deletes one or more automation rules.
batch_update_automation_rules	exec	region, UpdateAutomationRulesRequestItems		Updates one or more automation rules based on rule Amazon Resource Names (ARNs) and input parameters.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)
MaxResults	integer	The maximum number of rules to return in the response. This currently ranges from 1 to 100.
NextToken	string	A token to specify where to start paginating the response. This is the NextToken from a previously truncated response. On your first call to the ListAutomationRules API, set the value of this parameter to NULL.

SELECT examples

batch_get_automation_rules

Retrieves a list of details for automation rules based on rule Amazon Resource Names (ARNs).

SELECT
rules,
unprocessed_automation_rules
FROM aws.securityhub.automation_rules
WHERE region = '{{ region }}' -- required
;

list_automation_rules

A list of automation rules and their metadata for the calling account.

SELECT
automation_rules_metadata,
next_token
FROM aws.securityhub.automation_rules
WHERE region = '{{ region }}' -- required
AND NextToken = '{{ NextToken }}'
AND MaxResults = '{{ MaxResults }}'
;

INSERT examples

create_automation_rule

Creates an automation rule based on input parameters.

INSERT INTO aws.securityhub.automation_rules (
Tags,
RuleStatus,
RuleOrder,
RuleName,
Description,
IsTerminal,
Criteria,
Actions,
region
)
SELECT 
'{{ Tags }}',
'{{ RuleStatus }}',
{{ RuleOrder }} /* required */,
'{{ RuleName }}' /* required */,
'{{ Description }}' /* required */,
{{ IsTerminal }},
'{{ Criteria }}' /* required */,
'{{ Actions }}' /* required */,
'{{ region }}'
RETURNING
rule_arn
;

Manifest

# Description fields are for documentation purposes
- name: automation_rules
props:
  - name: region
    value: "{{ region }}"
    description: Required parameter for the automation_rules resource.
  - name: Tags
    value: "{{ Tags }}"
  - name: RuleStatus
    value: "{{ RuleStatus }}"
    valid_values: ['ENABLED', 'DISABLED']
  - name: RuleOrder
    value: {{ RuleOrder }}
  - name: RuleName
    value: "{{ RuleName }}"
  - name: Description
    value: "{{ Description }}"
  - name: IsTerminal
    value: {{ IsTerminal }}
  - name: Criteria
    description: |
      The criteria that determine which findings a rule applies to.
    value:
      ProductArn:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      AwsAccountId:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      Id:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      GeneratorId:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      Type:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      FirstObservedAt:
        - Start: "{{ Start }}"
          End: "{{ End }}"
          DateRange:
            Value: {{ Value }}
            Unit: "{{ Unit }}"
            Comparison: "{{ Comparison }}"
      LastObservedAt:
        - Start: "{{ Start }}"
          End: "{{ End }}"
          DateRange:
            Value: {{ Value }}
            Unit: "{{ Unit }}"
            Comparison: "{{ Comparison }}"
      CreatedAt:
        - Start: "{{ Start }}"
          End: "{{ End }}"
          DateRange:
            Value: {{ Value }}
            Unit: "{{ Unit }}"
            Comparison: "{{ Comparison }}"
      UpdatedAt:
        - Start: "{{ Start }}"
          End: "{{ End }}"
          DateRange:
            Value: {{ Value }}
            Unit: "{{ Unit }}"
            Comparison: "{{ Comparison }}"
      Confidence:
        - Gte: {{ Gte }}
          Lte: {{ Lte }}
          Eq: {{ Eq }}
          Gt: {{ Gt }}
          Lt: {{ Lt }}
      Criticality:
        - Gte: {{ Gte }}
          Lte: {{ Lte }}
          Eq: {{ Eq }}
          Gt: {{ Gt }}
          Lt: {{ Lt }}
      Title:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      Description:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      SourceUrl:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ProductName:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      CompanyName:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      SeverityLabel:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ResourceType:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ResourceId:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ResourcePartition:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ResourceRegion:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ResourceTags:
        - Key: "{{ Key }}"
          Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ResourceDetailsOther:
        - Key: "{{ Key }}"
          Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ComplianceStatus:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ComplianceSecurityControlId:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ComplianceAssociatedStandardsId:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      VerificationState:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      WorkflowStatus:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      RecordState:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      RelatedFindingsProductArn:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      RelatedFindingsId:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      NoteText:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      NoteUpdatedAt:
        - Start: "{{ Start }}"
          End: "{{ End }}"
          DateRange:
            Value: {{ Value }}
            Unit: "{{ Unit }}"
            Comparison: "{{ Comparison }}"
      NoteUpdatedBy:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      UserDefinedFields:
        - Key: "{{ Key }}"
          Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ResourceApplicationArn:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ResourceApplicationName:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      AwsAccountName:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ResourceProvider:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ResourceOwnerAccountId:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ResourceOwnerOrgId:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
  - name: Actions
    value:
      - Type: "{{ Type }}"
        FindingFieldsUpdate:
          Note:
            Text: "{{ Text }}"
            UpdatedBy: "{{ UpdatedBy }}"
          Severity:
            Normalized: {{ Normalized }}
            Product: {{ Product }}
            Label: "{{ Label }}"
          VerificationState: "{{ VerificationState }}"
          Confidence: {{ Confidence }}
          Criticality: {{ Criticality }}
          Types:
            - "{{ Types }}"
          UserDefinedFields: "{{ UserDefinedFields }}"
          Workflow:
            Status: "{{ Status }}"
          RelatedFindings:
            - ProductArn: "{{ ProductArn }}"
              Id: "{{ Id }}"

Lifecycle Methods

batch_delete_automation_rules

Deletes one or more automation rules.

EXEC aws.securityhub.automation_rules.batch_delete_automation_rules 
@region='{{ region }}' --required 
@@json=
'{
"AutomationRulesArns": "{{ AutomationRulesArns }}"
}'
;

batch_update_automation_rules

Updates one or more automation rules based on rule Amazon Resource Names (ARNs) and input parameters.

EXEC aws.securityhub.automation_rules.batch_update_automation_rules 
@region='{{ region }}' --required 
@@json=
'{
"UpdateAutomationRulesRequestItems": "{{ UpdateAutomationRulesRequestItems }}"
}'
;