insights

Creates, updates, deletes, gets or lists an insights resource.

Overview

Name	insights
Type	Resource
Id	aws.securityhub.insights

Fields

The following fields are returned by SELECT queries:

get_insights

Name	Datatype	Description
filters	object	A collection of filters that are applied to all active findings aggregated by Security Hub CSPM. You can filter by up to ten finding attributes. For each attribute, you can provide up to 20 filter values.
group_by_attribute	string	The grouping attribute for the insight's findings. Indicates how to group the matching findings, and identifies the type of item that the insight applies to. For example, if an insight is grouped by resource identifier, then the insight produces a list of resource identifiers. (pattern: <code>.\S.</code>)
insight_arn	string	The ARN of a Security Hub CSPM insight. (pattern: <code>.\S.</code>)
name	string	The name of a Security Hub CSPM insight. (pattern: <code>.\S.</code>)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_insights	select	region		Lists and describes insights for the specified insight ARNs.
create_insight	insert	region, GroupByAttribute		Creates a custom insight in Security Hub CSPM. An insight is a consolidation of findings that relate to a security issue that requires attention or remediation. To group the related findings in the insight, use the GroupByAttribute.
update_insight	update	insight_arn, region		Updates the Security Hub CSPM insight identified by the specified insight ARN.
delete_insight	delete	insight_arn, region		Deletes the insight specified by the InsightArn.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
insight_arn	string	The ARN of the insight to delete.
region	string	AWS region (default: us-east-1)

SELECT examples

get_insights

Lists and describes insights for the specified insight ARNs.

SELECT
filters,
group_by_attribute,
insight_arn,
name
FROM aws.securityhub.insights
WHERE region = '{{ region }}' -- required
;

INSERT examples

create_insight

Creates a custom insight in Security Hub CSPM. An insight is a consolidation of findings that relate to a security issue that requires attention or remediation. To group the related findings in the insight, use the GroupByAttribute.

INSERT INTO aws.securityhub.insights (
Name,
Filters,
GroupByAttribute,
region
)
SELECT 
'{{ Name }}',
'{{ Filters }}',
'{{ GroupByAttribute }}' /* required */,
'{{ region }}'
RETURNING
insight_arn
;

Manifest

# Description fields are for documentation purposes
- name: insights
props:
  - name: region
    value: "{{ region }}"
    description: Required parameter for the insights resource.
  - name: Name
    value: "{{ Name }}"
  - name: Filters
    description: |
      A collection of filters that are applied to all active findings aggregated by Security Hub CSPM. You can filter by up to ten finding attributes. For each attribute, you can provide up to 20 filter values.
    value:
      ProductArn:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      AwsAccountId:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      Id:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      GeneratorId:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      Region:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      Type:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      FirstObservedAt:
        - Start: "{{ Start }}"
          End: "{{ End }}"
          DateRange:
            Value: {{ Value }}
            Unit: "{{ Unit }}"
            Comparison: "{{ Comparison }}"
      LastObservedAt:
        - Start: "{{ Start }}"
          End: "{{ End }}"
          DateRange:
            Value: {{ Value }}
            Unit: "{{ Unit }}"
            Comparison: "{{ Comparison }}"
      CreatedAt:
        - Start: "{{ Start }}"
          End: "{{ End }}"
          DateRange:
            Value: {{ Value }}
            Unit: "{{ Unit }}"
            Comparison: "{{ Comparison }}"
      UpdatedAt:
        - Start: "{{ Start }}"
          End: "{{ End }}"
          DateRange:
            Value: {{ Value }}
            Unit: "{{ Unit }}"
            Comparison: "{{ Comparison }}"
      SeverityProduct:
        - Gte: {{ Gte }}
          Lte: {{ Lte }}
          Eq: {{ Eq }}
          Gt: {{ Gt }}
          Lt: {{ Lt }}
      SeverityNormalized:
        - Gte: {{ Gte }}
          Lte: {{ Lte }}
          Eq: {{ Eq }}
          Gt: {{ Gt }}
          Lt: {{ Lt }}
      SeverityLabel:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      Confidence:
        - Gte: {{ Gte }}
          Lte: {{ Lte }}
          Eq: {{ Eq }}
          Gt: {{ Gt }}
          Lt: {{ Lt }}
      Criticality:
        - Gte: {{ Gte }}
          Lte: {{ Lte }}
          Eq: {{ Eq }}
          Gt: {{ Gt }}
          Lt: {{ Lt }}
      Title:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      Description:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      RecommendationText:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      SourceUrl:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ProductFields:
        - Key: "{{ Key }}"
          Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ProductName:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      CompanyName:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      UserDefinedFields:
        - Key: "{{ Key }}"
          Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      MalwareName:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      MalwareType:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      MalwarePath:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      MalwareState:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      NetworkDirection:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      NetworkProtocol:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      NetworkSourceIpV4:
        - Cidr: "{{ Cidr }}"
      NetworkSourceIpV6:
        - Cidr: "{{ Cidr }}"
      NetworkSourcePort:
        - Gte: {{ Gte }}
          Lte: {{ Lte }}
          Eq: {{ Eq }}
          Gt: {{ Gt }}
          Lt: {{ Lt }}
      NetworkSourceDomain:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      NetworkSourceMac:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      NetworkDestinationIpV4:
        - Cidr: "{{ Cidr }}"
      NetworkDestinationIpV6:
        - Cidr: "{{ Cidr }}"
      NetworkDestinationPort:
        - Gte: {{ Gte }}
          Lte: {{ Lte }}
          Eq: {{ Eq }}
          Gt: {{ Gt }}
          Lt: {{ Lt }}
      NetworkDestinationDomain:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ProcessName:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ProcessPath:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ProcessPid:
        - Gte: {{ Gte }}
          Lte: {{ Lte }}
          Eq: {{ Eq }}
          Gt: {{ Gt }}
          Lt: {{ Lt }}
      ProcessParentPid:
        - Gte: {{ Gte }}
          Lte: {{ Lte }}
          Eq: {{ Eq }}
          Gt: {{ Gt }}
          Lt: {{ Lt }}
      ProcessLaunchedAt:
        - Start: "{{ Start }}"
          End: "{{ End }}"
          DateRange:
            Value: {{ Value }}
            Unit: "{{ Unit }}"
            Comparison: "{{ Comparison }}"
      ProcessTerminatedAt:
        - Start: "{{ Start }}"
          End: "{{ End }}"
          DateRange:
            Value: {{ Value }}
            Unit: "{{ Unit }}"
            Comparison: "{{ Comparison }}"
      ThreatIntelIndicatorType:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ThreatIntelIndicatorValue:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ThreatIntelIndicatorCategory:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ThreatIntelIndicatorLastObservedAt:
        - Start: "{{ Start }}"
          End: "{{ End }}"
          DateRange:
            Value: {{ Value }}
            Unit: "{{ Unit }}"
            Comparison: "{{ Comparison }}"
      ThreatIntelIndicatorSource:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ThreatIntelIndicatorSourceUrl:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ResourceType:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ResourceId:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ResourcePartition:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ResourceRegion:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ResourceTags:
        - Key: "{{ Key }}"
          Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ResourceAwsEc2InstanceType:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ResourceAwsEc2InstanceImageId:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ResourceAwsEc2InstanceIpV4Addresses:
        - Cidr: "{{ Cidr }}"
      ResourceAwsEc2InstanceIpV6Addresses:
        - Cidr: "{{ Cidr }}"
      ResourceAwsEc2InstanceKeyName:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ResourceAwsEc2InstanceIamInstanceProfileArn:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ResourceAwsEc2InstanceVpcId:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ResourceAwsEc2InstanceSubnetId:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ResourceAwsEc2InstanceLaunchedAt:
        - Start: "{{ Start }}"
          End: "{{ End }}"
          DateRange:
            Value: {{ Value }}
            Unit: "{{ Unit }}"
            Comparison: "{{ Comparison }}"
      ResourceAwsS3BucketOwnerId:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ResourceAwsS3BucketOwnerName:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ResourceAwsIamAccessKeyUserName:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ResourceAwsIamAccessKeyPrincipalName:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ResourceAwsIamAccessKeyStatus:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ResourceAwsIamAccessKeyCreatedAt:
        - Start: "{{ Start }}"
          End: "{{ End }}"
          DateRange:
            Value: {{ Value }}
            Unit: "{{ Unit }}"
            Comparison: "{{ Comparison }}"
      ResourceAwsIamUserUserName:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ResourceContainerName:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ResourceContainerImageId:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ResourceContainerImageName:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ResourceContainerLaunchedAt:
        - Start: "{{ Start }}"
          End: "{{ End }}"
          DateRange:
            Value: {{ Value }}
            Unit: "{{ Unit }}"
            Comparison: "{{ Comparison }}"
      ResourceDetailsOther:
        - Key: "{{ Key }}"
          Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ComplianceStatus:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      VerificationState:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      WorkflowState:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      WorkflowStatus:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      RecordState:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      RelatedFindingsProductArn:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      RelatedFindingsId:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      NoteText:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      NoteUpdatedAt:
        - Start: "{{ Start }}"
          End: "{{ End }}"
          DateRange:
            Value: {{ Value }}
            Unit: "{{ Unit }}"
            Comparison: "{{ Comparison }}"
      NoteUpdatedBy:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      Keyword:
        - Value: "{{ Value }}"
      FindingProviderFieldsConfidence:
        - Gte: {{ Gte }}
          Lte: {{ Lte }}
          Eq: {{ Eq }}
          Gt: {{ Gt }}
          Lt: {{ Lt }}
      FindingProviderFieldsCriticality:
        - Gte: {{ Gte }}
          Lte: {{ Lte }}
          Eq: {{ Eq }}
          Gt: {{ Gt }}
          Lt: {{ Lt }}
      FindingProviderFieldsRelatedFindingsId:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      FindingProviderFieldsRelatedFindingsProductArn:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      FindingProviderFieldsSeverityLabel:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      FindingProviderFieldsSeverityOriginal:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      FindingProviderFieldsTypes:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      Sample:
        - Value: {{ Value }}
      ComplianceSecurityControlId:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ComplianceAssociatedStandardsId:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      VulnerabilitiesExploitAvailable:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      VulnerabilitiesFixAvailable:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ComplianceSecurityControlParametersName:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ComplianceSecurityControlParametersValue:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      AwsAccountName:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ResourceApplicationName:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ResourceApplicationArn:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ResourceOwnerAccountId:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ResourceOwnerOrgId:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
      ResourceProvider:
        - Value: "{{ Value }}"
          Comparison: "{{ Comparison }}"
  - name: GroupByAttribute
    value: "{{ GroupByAttribute }}"

UPDATE examples

update_insight

Updates the Security Hub CSPM insight identified by the specified insight ARN.

UPDATE aws.securityhub.insights
SET 
Name = '{{ Name }}',
Filters = '{{ Filters }}',
GroupByAttribute = '{{ GroupByAttribute }}'
WHERE 
insight_arn = '{{ insight_arn }}' --required
AND region = '{{ region }}' --required;

DELETE examples

delete_insight

Deletes the insight specified by the InsightArn.

DELETE FROM aws.securityhub.insights
WHERE insight_arn = '{{ insight_arn }}' --required
AND region = '{{ region }}' --required
;