Struct aws_sdk_securityhub::model::AwsSecurityFindingFilters [−][src]
#[non_exhaustive]pub struct AwsSecurityFindingFilters {Show 94 fields
pub product_arn: Option<Vec<StringFilter>>,
pub aws_account_id: Option<Vec<StringFilter>>,
pub id: Option<Vec<StringFilter>>,
pub generator_id: Option<Vec<StringFilter>>,
pub region: Option<Vec<StringFilter>>,
pub type: Option<Vec<StringFilter>>,
pub first_observed_at: Option<Vec<DateFilter>>,
pub last_observed_at: Option<Vec<DateFilter>>,
pub created_at: Option<Vec<DateFilter>>,
pub updated_at: Option<Vec<DateFilter>>,
pub severity_product: Option<Vec<NumberFilter>>,
pub severity_normalized: Option<Vec<NumberFilter>>,
pub severity_label: Option<Vec<StringFilter>>,
pub confidence: Option<Vec<NumberFilter>>,
pub criticality: Option<Vec<NumberFilter>>,
pub title: Option<Vec<StringFilter>>,
pub description: Option<Vec<StringFilter>>,
pub recommendation_text: Option<Vec<StringFilter>>,
pub source_url: Option<Vec<StringFilter>>,
pub product_fields: Option<Vec<MapFilter>>,
pub product_name: Option<Vec<StringFilter>>,
pub company_name: Option<Vec<StringFilter>>,
pub user_defined_fields: Option<Vec<MapFilter>>,
pub malware_name: Option<Vec<StringFilter>>,
pub malware_type: Option<Vec<StringFilter>>,
pub malware_path: Option<Vec<StringFilter>>,
pub malware_state: Option<Vec<StringFilter>>,
pub network_direction: Option<Vec<StringFilter>>,
pub network_protocol: Option<Vec<StringFilter>>,
pub network_source_ip_v4: Option<Vec<IpFilter>>,
pub network_source_ip_v6: Option<Vec<IpFilter>>,
pub network_source_port: Option<Vec<NumberFilter>>,
pub network_source_domain: Option<Vec<StringFilter>>,
pub network_source_mac: Option<Vec<StringFilter>>,
pub network_destination_ip_v4: Option<Vec<IpFilter>>,
pub network_destination_ip_v6: Option<Vec<IpFilter>>,
pub network_destination_port: Option<Vec<NumberFilter>>,
pub network_destination_domain: Option<Vec<StringFilter>>,
pub process_name: Option<Vec<StringFilter>>,
pub process_path: Option<Vec<StringFilter>>,
pub process_pid: Option<Vec<NumberFilter>>,
pub process_parent_pid: Option<Vec<NumberFilter>>,
pub process_launched_at: Option<Vec<DateFilter>>,
pub process_terminated_at: Option<Vec<DateFilter>>,
pub threat_intel_indicator_type: Option<Vec<StringFilter>>,
pub threat_intel_indicator_value: Option<Vec<StringFilter>>,
pub threat_intel_indicator_category: Option<Vec<StringFilter>>,
pub threat_intel_indicator_last_observed_at: Option<Vec<DateFilter>>,
pub threat_intel_indicator_source: Option<Vec<StringFilter>>,
pub threat_intel_indicator_source_url: Option<Vec<StringFilter>>,
pub resource_type: Option<Vec<StringFilter>>,
pub resource_id: Option<Vec<StringFilter>>,
pub resource_partition: Option<Vec<StringFilter>>,
pub resource_region: Option<Vec<StringFilter>>,
pub resource_tags: Option<Vec<MapFilter>>,
pub resource_aws_ec2_instance_type: Option<Vec<StringFilter>>,
pub resource_aws_ec2_instance_image_id: Option<Vec<StringFilter>>,
pub resource_aws_ec2_instance_ip_v4_addresses: Option<Vec<IpFilter>>,
pub resource_aws_ec2_instance_ip_v6_addresses: Option<Vec<IpFilter>>,
pub resource_aws_ec2_instance_key_name: Option<Vec<StringFilter>>,
pub resource_aws_ec2_instance_iam_instance_profile_arn: Option<Vec<StringFilter>>,
pub resource_aws_ec2_instance_vpc_id: Option<Vec<StringFilter>>,
pub resource_aws_ec2_instance_subnet_id: Option<Vec<StringFilter>>,
pub resource_aws_ec2_instance_launched_at: Option<Vec<DateFilter>>,
pub resource_aws_s3_bucket_owner_id: Option<Vec<StringFilter>>,
pub resource_aws_s3_bucket_owner_name: Option<Vec<StringFilter>>,
pub resource_aws_iam_access_key_user_name: Option<Vec<StringFilter>>,
pub resource_aws_iam_access_key_principal_name: Option<Vec<StringFilter>>,
pub resource_aws_iam_access_key_status: Option<Vec<StringFilter>>,
pub resource_aws_iam_access_key_created_at: Option<Vec<DateFilter>>,
pub resource_aws_iam_user_user_name: Option<Vec<StringFilter>>,
pub resource_container_name: Option<Vec<StringFilter>>,
pub resource_container_image_id: Option<Vec<StringFilter>>,
pub resource_container_image_name: Option<Vec<StringFilter>>,
pub resource_container_launched_at: Option<Vec<DateFilter>>,
pub resource_details_other: Option<Vec<MapFilter>>,
pub compliance_status: Option<Vec<StringFilter>>,
pub verification_state: Option<Vec<StringFilter>>,
pub workflow_state: Option<Vec<StringFilter>>,
pub workflow_status: Option<Vec<StringFilter>>,
pub record_state: Option<Vec<StringFilter>>,
pub related_findings_product_arn: Option<Vec<StringFilter>>,
pub related_findings_id: Option<Vec<StringFilter>>,
pub note_text: Option<Vec<StringFilter>>,
pub note_updated_at: Option<Vec<DateFilter>>,
pub note_updated_by: Option<Vec<StringFilter>>,
pub keyword: Option<Vec<KeywordFilter>>,
pub finding_provider_fields_confidence: Option<Vec<NumberFilter>>,
pub finding_provider_fields_criticality: Option<Vec<NumberFilter>>,
pub finding_provider_fields_related_findings_id: Option<Vec<StringFilter>>,
pub finding_provider_fields_related_findings_product_arn: Option<Vec<StringFilter>>,
pub finding_provider_fields_severity_label: Option<Vec<StringFilter>>,
pub finding_provider_fields_severity_original: Option<Vec<StringFilter>>,
pub finding_provider_fields_types: Option<Vec<StringFilter>>,
}Expand description
A collection of attributes that are applied to all active Security Hub-aggregated findings and that result in a subset of findings that are included in this insight.
You can filter by up to 10 finding attributes. For each attribute, you can provide up to 20 filter values.
Fields (Non-exhaustive)
This struct is marked as non-exhaustive
Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.product_arn: Option<Vec<StringFilter>>The ARN generated by Security Hub that uniquely identifies a third-party company (security findings provider) after this provider's product (solution that generates findings) is registered with Security Hub.
aws_account_id: Option<Vec<StringFilter>>The Amazon Web Services account ID that a finding is generated in.
id: Option<Vec<StringFilter>>The security findings provider-specific identifier for a finding.
generator_id: Option<Vec<StringFilter>>The identifier for the solution-specific component (a discrete unit of logic) that generated a finding. In various security-findings providers' solutions, this generator can be called a rule, a check, a detector, a plugin, etc.
region: Option<Vec<StringFilter>>The Region from which the finding was generated.
type: Option<Vec<StringFilter>>A finding type in the format of namespace/category/classifier that
classifies a finding.
first_observed_at: Option<Vec<DateFilter>>An ISO8601-formatted timestamp that indicates when the security-findings provider first observed the potential security issue that a finding captured.
last_observed_at: Option<Vec<DateFilter>>An ISO8601-formatted timestamp that indicates when the security-findings provider most recently observed the potential security issue that a finding captured.
created_at: Option<Vec<DateFilter>>An ISO8601-formatted timestamp that indicates when the security-findings provider captured the potential security issue that a finding captured.
updated_at: Option<Vec<DateFilter>>An ISO8601-formatted timestamp that indicates when the security-findings provider last updated the finding record.
severity_product: Option<Vec<NumberFilter>>The native severity as defined by the security-findings provider's solution that generated the finding.
severity_normalized: Option<Vec<NumberFilter>>The normalized severity of a finding.
severity_label: Option<Vec<StringFilter>>The label of a finding's severity.
confidence: Option<Vec<NumberFilter>>A finding's confidence. Confidence is defined as the likelihood that a finding accurately identifies the behavior or issue that it was intended to identify.
Confidence is scored on a 0-100 basis using a ratio scale, where 0 means zero percent confidence and 100 means 100 percent confidence.
criticality: Option<Vec<NumberFilter>>The level of importance assigned to the resources associated with the finding.
A score of 0 means that the underlying resources have no criticality, and a score of 100 is reserved for the most critical resources.
title: Option<Vec<StringFilter>>A finding's title.
description: Option<Vec<StringFilter>>A finding's description.
recommendation_text: Option<Vec<StringFilter>>The recommendation of what to do about the issue described in a finding.
source_url: Option<Vec<StringFilter>>A URL that links to a page about the current finding in the security-findings provider's solution.
product_fields: Option<Vec<MapFilter>>A data type where security-findings providers can include additional solution-specific
details that aren't part of the defined AwsSecurityFinding format.
product_name: Option<Vec<StringFilter>>The name of the solution (product) that generates findings.
Note that this is a filter against the aws/securityhub/ProductName field in ProductFields. It is not a filter for the top-level ProductName field.
company_name: Option<Vec<StringFilter>>The name of the findings provider (company) that owns the solution (product) that generates findings.
Note that this is a filter against the aws/securityhub/CompanyName field in ProductFields. It is not a filter for the top-level CompanyName field.
user_defined_fields: Option<Vec<MapFilter>>A list of name/value string pairs associated with the finding. These are custom, user-defined fields added to a finding.
malware_name: Option<Vec<StringFilter>>The name of the malware that was observed.
malware_type: Option<Vec<StringFilter>>The type of the malware that was observed.
malware_path: Option<Vec<StringFilter>>The filesystem path of the malware that was observed.
malware_state: Option<Vec<StringFilter>>The state of the malware that was observed.
network_direction: Option<Vec<StringFilter>>Indicates the direction of network traffic associated with a finding.
network_protocol: Option<Vec<StringFilter>>The protocol of network-related information about a finding.
network_source_ip_v4: Option<Vec<IpFilter>>The source IPv4 address of network-related information about a finding.
network_source_ip_v6: Option<Vec<IpFilter>>The source IPv6 address of network-related information about a finding.
network_source_port: Option<Vec<NumberFilter>>The source port of network-related information about a finding.
network_source_domain: Option<Vec<StringFilter>>The source domain of network-related information about a finding.
network_source_mac: Option<Vec<StringFilter>>The source media access control (MAC) address of network-related information about a finding.
network_destination_ip_v4: Option<Vec<IpFilter>>The destination IPv4 address of network-related information about a finding.
network_destination_ip_v6: Option<Vec<IpFilter>>The destination IPv6 address of network-related information about a finding.
network_destination_port: Option<Vec<NumberFilter>>The destination port of network-related information about a finding.
network_destination_domain: Option<Vec<StringFilter>>The destination domain of network-related information about a finding.
process_name: Option<Vec<StringFilter>>The name of the process.
process_path: Option<Vec<StringFilter>>The path to the process executable.
process_pid: Option<Vec<NumberFilter>>The process ID.
process_parent_pid: Option<Vec<NumberFilter>>The parent process ID.
process_launched_at: Option<Vec<DateFilter>>The date/time that the process was launched.
process_terminated_at: Option<Vec<DateFilter>>The date/time that the process was terminated.
threat_intel_indicator_type: Option<Vec<StringFilter>>The type of a threat intelligence indicator.
threat_intel_indicator_value: Option<Vec<StringFilter>>The value of a threat intelligence indicator.
threat_intel_indicator_category: Option<Vec<StringFilter>>The category of a threat intelligence indicator.
threat_intel_indicator_last_observed_at: Option<Vec<DateFilter>>The date/time of the last observation of a threat intelligence indicator.
threat_intel_indicator_source: Option<Vec<StringFilter>>The source of the threat intelligence.
threat_intel_indicator_source_url: Option<Vec<StringFilter>>The URL for more details from the source of the threat intelligence.
resource_type: Option<Vec<StringFilter>>Specifies the type of the resource that details are provided for.
resource_id: Option<Vec<StringFilter>>The canonical identifier for the given resource type.
resource_partition: Option<Vec<StringFilter>>The canonical Amazon Web Services partition name that the Region is assigned to.
resource_region: Option<Vec<StringFilter>>The canonical Amazon Web Services external Region name where this resource is located.
A list of Amazon Web Services tags associated with a resource at the time the finding was processed.
resource_aws_ec2_instance_type: Option<Vec<StringFilter>>The instance type of the instance.
resource_aws_ec2_instance_image_id: Option<Vec<StringFilter>>The Amazon Machine Image (AMI) ID of the instance.
resource_aws_ec2_instance_ip_v4_addresses: Option<Vec<IpFilter>>The IPv4 addresses associated with the instance.
resource_aws_ec2_instance_ip_v6_addresses: Option<Vec<IpFilter>>The IPv6 addresses associated with the instance.
resource_aws_ec2_instance_key_name: Option<Vec<StringFilter>>The key name associated with the instance.
resource_aws_ec2_instance_iam_instance_profile_arn: Option<Vec<StringFilter>>The IAM profile ARN of the instance.
resource_aws_ec2_instance_vpc_id: Option<Vec<StringFilter>>The identifier of the VPC that the instance was launched in.
resource_aws_ec2_instance_subnet_id: Option<Vec<StringFilter>>The identifier of the subnet that the instance was launched in.
resource_aws_ec2_instance_launched_at: Option<Vec<DateFilter>>The date and time the instance was launched.
resource_aws_s3_bucket_owner_id: Option<Vec<StringFilter>>The canonical user ID of the owner of the S3 bucket.
resource_aws_s3_bucket_owner_name: Option<Vec<StringFilter>>The display name of the owner of the S3 bucket.
resource_aws_iam_access_key_user_name: Option<Vec<StringFilter>>The user associated with the IAM access key related to a finding.
resource_aws_iam_access_key_principal_name: Option<Vec<StringFilter>>The name of the principal that is associated with an IAM access key.
resource_aws_iam_access_key_status: Option<Vec<StringFilter>>The status of the IAM access key related to a finding.
resource_aws_iam_access_key_created_at: Option<Vec<DateFilter>>The creation date/time of the IAM access key related to a finding.
resource_aws_iam_user_user_name: Option<Vec<StringFilter>>The name of an IAM user.
resource_container_name: Option<Vec<StringFilter>>The name of the container related to a finding.
resource_container_image_id: Option<Vec<StringFilter>>The identifier of the image related to a finding.
resource_container_image_name: Option<Vec<StringFilter>>The name of the image related to a finding.
resource_container_launched_at: Option<Vec<DateFilter>>The date/time that the container was started.
resource_details_other: Option<Vec<MapFilter>>The details of a resource that doesn't have a specific subfield for the resource type defined.
compliance_status: Option<Vec<StringFilter>>Exclusive to findings that are generated as the result of a check run against a specific rule in a supported standard, such as CIS Amazon Web Services Foundations. Contains security standard-related finding details.
verification_state: Option<Vec<StringFilter>>The veracity of a finding.
workflow_state: Option<Vec<StringFilter>>The workflow state of a finding.
Note that this field is deprecated. To search for a finding based on its workflow
status, use WorkflowStatus.
workflow_status: Option<Vec<StringFilter>>The status of the investigation into a finding. Allowed values are the following.
-
NEW- The initial state of a finding, before it is reviewed.Security Hub also resets the workflow status from
NOTIFIEDorRESOLVEDtoNEWin the following cases:-
The record state changes from
ARCHIVEDtoACTIVE. -
The compliance status changes from
PASSEDto eitherWARNING,FAILED, orNOT_AVAILABLE.
-
-
NOTIFIED- Indicates that the resource owner has been notified about the security issue. Used when the initial reviewer is not the resource owner, and needs intervention from the resource owner. -
SUPPRESSED- The finding will not be reviewed again and will not be acted upon. -
RESOLVED- The finding was reviewed and remediated and is now considered resolved.
record_state: Option<Vec<StringFilter>>The updated record state for the finding.
The ARN of the solution that generated a related finding.
The solution-generated identifier for a related finding.
note_text: Option<Vec<StringFilter>>The text of a note.
note_updated_at: Option<Vec<DateFilter>>The timestamp of when the note was updated.
note_updated_by: Option<Vec<StringFilter>>The principal that created a note.
keyword: Option<Vec<KeywordFilter>>A keyword for a finding.
finding_provider_fields_confidence: Option<Vec<NumberFilter>>The finding provider value for the finding confidence. Confidence is defined as the likelihood that a finding accurately identifies the behavior or issue that it was intended to identify.
Confidence is scored on a 0-100 basis using a ratio scale, where 0 means zero percent confidence and 100 means 100 percent confidence.
finding_provider_fields_criticality: Option<Vec<NumberFilter>>The finding provider value for the level of importance assigned to the resources associated with the findings.
A score of 0 means that the underlying resources have no criticality, and a score of 100 is reserved for the most critical resources.
The finding identifier of a related finding that is identified by the finding provider.
The ARN of the solution that generated a related finding that is identified by the finding provider.
finding_provider_fields_severity_label: Option<Vec<StringFilter>>The finding provider value for the severity label.
finding_provider_fields_severity_original: Option<Vec<StringFilter>>The finding provider's original value for the severity.
finding_provider_fields_types: Option<Vec<StringFilter>>One or more finding types that the finding provider assigned to the finding. Uses the format of namespace/category/classifier
that classify a finding.
Valid namespace values are: Software and Configuration Checks | TTPs | Effects | Unusual Behaviors | Sensitive Data Identifications
Implementations
The ARN generated by Security Hub that uniquely identifies a third-party company (security findings provider) after this provider's product (solution that generates findings) is registered with Security Hub.
The Amazon Web Services account ID that a finding is generated in.
The security findings provider-specific identifier for a finding.
The identifier for the solution-specific component (a discrete unit of logic) that generated a finding. In various security-findings providers' solutions, this generator can be called a rule, a check, a detector, a plugin, etc.
The Region from which the finding was generated.
A finding type in the format of namespace/category/classifier that
classifies a finding.
An ISO8601-formatted timestamp that indicates when the security-findings provider first observed the potential security issue that a finding captured.
An ISO8601-formatted timestamp that indicates when the security-findings provider most recently observed the potential security issue that a finding captured.
An ISO8601-formatted timestamp that indicates when the security-findings provider captured the potential security issue that a finding captured.
An ISO8601-formatted timestamp that indicates when the security-findings provider last updated the finding record.
The native severity as defined by the security-findings provider's solution that generated the finding.
The normalized severity of a finding.
The label of a finding's severity.
A finding's confidence. Confidence is defined as the likelihood that a finding accurately identifies the behavior or issue that it was intended to identify.
Confidence is scored on a 0-100 basis using a ratio scale, where 0 means zero percent confidence and 100 means 100 percent confidence.
The level of importance assigned to the resources associated with the finding.
A score of 0 means that the underlying resources have no criticality, and a score of 100 is reserved for the most critical resources.
A finding's description.
The recommendation of what to do about the issue described in a finding.
A URL that links to a page about the current finding in the security-findings provider's solution.
A data type where security-findings providers can include additional solution-specific
details that aren't part of the defined AwsSecurityFinding format.
The name of the solution (product) that generates findings.
Note that this is a filter against the aws/securityhub/ProductName field in ProductFields. It is not a filter for the top-level ProductName field.
The name of the findings provider (company) that owns the solution (product) that generates findings.
Note that this is a filter against the aws/securityhub/CompanyName field in ProductFields. It is not a filter for the top-level CompanyName field.
A list of name/value string pairs associated with the finding. These are custom, user-defined fields added to a finding.
The name of the malware that was observed.
The type of the malware that was observed.
The filesystem path of the malware that was observed.
The state of the malware that was observed.
Indicates the direction of network traffic associated with a finding.
The protocol of network-related information about a finding.
The source IPv4 address of network-related information about a finding.
The source IPv6 address of network-related information about a finding.
The source port of network-related information about a finding.
The source domain of network-related information about a finding.
The source media access control (MAC) address of network-related information about a finding.
The destination IPv4 address of network-related information about a finding.
The destination IPv6 address of network-related information about a finding.
The destination port of network-related information about a finding.
The destination domain of network-related information about a finding.
The name of the process.
The path to the process executable.
The process ID.
The parent process ID.
The date/time that the process was launched.
The date/time that the process was terminated.
The type of a threat intelligence indicator.
The value of a threat intelligence indicator.
The category of a threat intelligence indicator.
The date/time of the last observation of a threat intelligence indicator.
The source of the threat intelligence.
The URL for more details from the source of the threat intelligence.
Specifies the type of the resource that details are provided for.
The canonical identifier for the given resource type.
The canonical Amazon Web Services partition name that the Region is assigned to.
The canonical Amazon Web Services external Region name where this resource is located.
A list of Amazon Web Services tags associated with a resource at the time the finding was processed.
The instance type of the instance.
The Amazon Machine Image (AMI) ID of the instance.
The IPv4 addresses associated with the instance.
The IPv6 addresses associated with the instance.
The key name associated with the instance.
The IAM profile ARN of the instance.
The identifier of the VPC that the instance was launched in.
The identifier of the subnet that the instance was launched in.
The date and time the instance was launched.
The canonical user ID of the owner of the S3 bucket.
The display name of the owner of the S3 bucket.
The user associated with the IAM access key related to a finding.
The name of the principal that is associated with an IAM access key.
The status of the IAM access key related to a finding.
The creation date/time of the IAM access key related to a finding.
The name of an IAM user.
The name of the container related to a finding.
The identifier of the image related to a finding.
The name of the image related to a finding.
The date/time that the container was started.
The details of a resource that doesn't have a specific subfield for the resource type defined.
Exclusive to findings that are generated as the result of a check run against a specific rule in a supported standard, such as CIS Amazon Web Services Foundations. Contains security standard-related finding details.
The veracity of a finding.
The workflow state of a finding.
Note that this field is deprecated. To search for a finding based on its workflow
status, use WorkflowStatus.
The status of the investigation into a finding. Allowed values are the following.
-
NEW- The initial state of a finding, before it is reviewed.Security Hub also resets the workflow status from
NOTIFIEDorRESOLVEDtoNEWin the following cases:-
The record state changes from
ARCHIVEDtoACTIVE. -
The compliance status changes from
PASSEDto eitherWARNING,FAILED, orNOT_AVAILABLE.
-
-
NOTIFIED- Indicates that the resource owner has been notified about the security issue. Used when the initial reviewer is not the resource owner, and needs intervention from the resource owner. -
SUPPRESSED- The finding will not be reviewed again and will not be acted upon. -
RESOLVED- The finding was reviewed and remediated and is now considered resolved.
The updated record state for the finding.
The ARN of the solution that generated a related finding.
The solution-generated identifier for a related finding.
The timestamp of when the note was updated.
The principal that created a note.
The finding provider value for the finding confidence. Confidence is defined as the likelihood that a finding accurately identifies the behavior or issue that it was intended to identify.
Confidence is scored on a 0-100 basis using a ratio scale, where 0 means zero percent confidence and 100 means 100 percent confidence.
The finding provider value for the level of importance assigned to the resources associated with the findings.
A score of 0 means that the underlying resources have no criticality, and a score of 100 is reserved for the most critical resources.
The finding identifier of a related finding that is identified by the finding provider.
The ARN of the solution that generated a related finding that is identified by the finding provider.
The finding provider value for the severity label.
The finding provider's original value for the severity.
One or more finding types that the finding provider assigned to the finding. Uses the format of namespace/category/classifier
that classify a finding.
Valid namespace values are: Software and Configuration Checks | TTPs | Effects | Unusual Behaviors | Sensitive Data Identifications
Creates a new builder-style object to manufacture AwsSecurityFindingFilters
Trait Implementations
This method tests for self and other values to be equal, and is used
by ==. Read more
This method tests for !=.
Auto Trait Implementations
impl RefUnwindSafe for AwsSecurityFindingFilters
impl Send for AwsSecurityFindingFilters
impl Sync for AwsSecurityFindingFilters
impl Unpin for AwsSecurityFindingFilters
impl UnwindSafe for AwsSecurityFindingFilters
Blanket Implementations
Mutably borrows from an owned value. Read more
Attaches the provided Subscriber to this type, returning a
WithDispatch wrapper. Read more
Attaches the current default Subscriber to this type, returning a
WithDispatch wrapper. Read more