finding_histories
Creates, updates, deletes, gets or lists a finding_histories resource.
Overview
| Name | finding_histories |
| Type | Resource |
| Id | aws.securityhub.finding_histories |
Fields
The following fields are returned by SELECT queries:
- get_finding_history
| Name | Datatype | Description |
|---|---|---|
finding_created | boolean | Identifies whether the event marks the creation of a new finding. A value of True means that the finding is newly created. A value of False means that the finding isn’t newly created. |
finding_identifier | object | Identifies which finding to get the finding history for. |
next_token | string | A token for pagination purposes. Provide this token in the subsequent request to GetFindingsHistory to get up to an additional 100 results of history for the same finding that you specified in your initial request. |
update_source | object | Identifies the source of the event that changed the finding. For example, an integrated Amazon Web Services service or third-party partner integration may call BatchImportFindings , or an Security Hub CSPM customer may call BatchUpdateFindings . |
update_time | string (date-time) | A timestamp that indicates when Security Hub CSPM processed the updated finding record. For more information about the validation and formatting of timestamp fields in Security Hub CSPM, see Timestamps. |
updates | array | An array of objects that provides details about the finding change event, including the Amazon Web Services Security Finding Format (ASFF) field that changed, the value of the field before the change, and the value of the field after the change. |
Methods
The following methods are available for this resource:
| Name | Accessible by | Required Params | Optional Params | Description |
|---|---|---|---|---|
get_finding_history | select | region | Returns the history of a Security Hub CSPM finding. The history includes changes made to any fields in the Amazon Web Services Security Finding Format (ASFF) except top-level timestamp fields, such as the CreatedAt and UpdatedAt fields. This operation might return fewer results than the maximum number of results (MaxResults) specified in a request, even when more results are available. If this occurs, the response includes a NextToken value, which you should use to retrieve the next set of results in the response. The presence of a NextToken value in a response doesn't necessarily indicate that the results are incomplete. However, you should continue to specify a NextToken value until you receive a response that doesn't include this value. |
Parameters
Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.
| Name | Datatype | Description |
|---|---|---|
region | string | AWS region (default: us-east-1) |
SELECT examples
- get_finding_history
Returns the history of a Security Hub CSPM finding. The history includes changes made to any fields in the Amazon Web Services Security Finding Format (ASFF) except top-level timestamp fields, such as the CreatedAt and UpdatedAt fields. This operation might return fewer results than the maximum number of results (MaxResults) specified in a request, even when more results are available. If this occurs, the response includes a NextToken value, which you should use to retrieve the next set of results in the response. The presence of a NextToken value in a response doesn't necessarily indicate that the results are incomplete. However, you should continue to specify a NextToken value until you receive a response that doesn't include this value.
SELECT
finding_created,
finding_identifier,
next_token,
update_source,
update_time,
updates
FROM aws.securityhub.finding_histories
WHERE region = '{{ region }}' -- required
;