Struct aws_sdk_securityhub::model::AwsSecurityFindingFilters

#[non_exhaustive]
pub struct AwsSecurityFindingFilters { /* private fields */ }

A collection of attributes that are applied to all active Security Hub-aggregated findings and that result in a subset of findings that are included in this insight.

You can filter by up to 10 finding attributes. For each attribute, you can provide up to 20 filter values.

Implementations

impl AwsSecurityFindingFilters

pub fn product_arn(&self) -> Option<&[StringFilter]>

The ARN generated by Security Hub that uniquely identifies a third-party company (security findings provider) after this provider's product (solution that generates findings) is registered with Security Hub.

pub fn aws_account_id(&self) -> Option<&[StringFilter]>

The Amazon Web Services account ID that a finding is generated in.

pub fn id(&self) -> Option<&[StringFilter]>

The security findings provider-specific identifier for a finding.

pub fn generator_id(&self) -> Option<&[StringFilter]>

The identifier for the solution-specific component (a discrete unit of logic) that generated a finding. In various security-findings providers' solutions, this generator can be called a rule, a check, a detector, a plugin, etc.

pub fn region(&self) -> Option<&[StringFilter]>

The Region from which the finding was generated.

pub fn type(&self) -> Option<&[StringFilter]>

A finding type in the format of namespace/category/classifier that classifies a finding.

pub fn first_observed_at(&self) -> Option<&[DateFilter]>

An ISO8601-formatted timestamp that indicates when the security-findings provider first observed the potential security issue that a finding captured.

pub fn last_observed_at(&self) -> Option<&[DateFilter]>

An ISO8601-formatted timestamp that indicates when the security-findings provider most recently observed the potential security issue that a finding captured.

pub fn created_at(&self) -> Option<&[DateFilter]>

An ISO8601-formatted timestamp that indicates when the security-findings provider captured the potential security issue that a finding captured.

pub fn updated_at(&self) -> Option<&[DateFilter]>

An ISO8601-formatted timestamp that indicates when the security-findings provider last updated the finding record.

pub fn severity_product(&self) -> Option<&[NumberFilter]>

👎Deprecated: This filter is deprecated. Instead, use FindingProviderSeverityOriginal.

The native severity as defined by the security-findings provider's solution that generated the finding.

pub fn severity_normalized(&self) -> Option<&[NumberFilter]>

👎Deprecated: This filter is deprecated. Instead, use SeverityLabel or FindingProviderFieldsSeverityLabel.

The normalized severity of a finding.

pub fn severity_label(&self) -> Option<&[StringFilter]>

The label of a finding's severity.

pub fn confidence(&self) -> Option<&[NumberFilter]>

A finding's confidence. Confidence is defined as the likelihood that a finding accurately identifies the behavior or issue that it was intended to identify.

Confidence is scored on a 0-100 basis using a ratio scale, where 0 means zero percent confidence and 100 means 100 percent confidence.

pub fn criticality(&self) -> Option<&[NumberFilter]>

The level of importance assigned to the resources associated with the finding.

A score of 0 means that the underlying resources have no criticality, and a score of 100 is reserved for the most critical resources.

pub fn title(&self) -> Option<&[StringFilter]>

A finding's title.

pub fn description(&self) -> Option<&[StringFilter]>

A finding's description.

pub fn recommendation_text(&self) -> Option<&[StringFilter]>

The recommendation of what to do about the issue described in a finding.

pub fn source_url(&self) -> Option<&[StringFilter]>

A URL that links to a page about the current finding in the security-findings provider's solution.

pub fn product_fields(&self) -> Option<&[MapFilter]>

A data type where security-findings providers can include additional solution-specific details that aren't part of the defined AwsSecurityFinding format.

pub fn product_name(&self) -> Option<&[StringFilter]>

The name of the solution (product) that generates findings.

pub fn company_name(&self) -> Option<&[StringFilter]>

The name of the findings provider (company) that owns the solution (product) that generates findings.

pub fn user_defined_fields(&self) -> Option<&[MapFilter]>

A list of name/value string pairs associated with the finding. These are custom, user-defined fields added to a finding.

pub fn malware_name(&self) -> Option<&[StringFilter]>

The name of the malware that was observed.

pub fn malware_type(&self) -> Option<&[StringFilter]>

The type of the malware that was observed.

pub fn malware_path(&self) -> Option<&[StringFilter]>

The filesystem path of the malware that was observed.

pub fn malware_state(&self) -> Option<&[StringFilter]>

The state of the malware that was observed.

pub fn network_direction(&self) -> Option<&[StringFilter]>

Indicates the direction of network traffic associated with a finding.

pub fn network_protocol(&self) -> Option<&[StringFilter]>

The protocol of network-related information about a finding.

pub fn network_source_ip_v4(&self) -> Option<&[IpFilter]>

The source IPv4 address of network-related information about a finding.

pub fn network_source_ip_v6(&self) -> Option<&[IpFilter]>

The source IPv6 address of network-related information about a finding.

pub fn network_source_port(&self) -> Option<&[NumberFilter]>

The source port of network-related information about a finding.

pub fn network_source_domain(&self) -> Option<&[StringFilter]>

The source domain of network-related information about a finding.

pub fn network_source_mac(&self) -> Option<&[StringFilter]>

The source media access control (MAC) address of network-related information about a finding.

pub fn network_destination_ip_v4(&self) -> Option<&[IpFilter]>

The destination IPv4 address of network-related information about a finding.

pub fn network_destination_ip_v6(&self) -> Option<&[IpFilter]>

The destination IPv6 address of network-related information about a finding.

pub fn network_destination_port(&self) -> Option<&[NumberFilter]>

The destination port of network-related information about a finding.

pub fn network_destination_domain(&self) -> Option<&[StringFilter]>

The destination domain of network-related information about a finding.

pub fn process_name(&self) -> Option<&[StringFilter]>

The name of the process.

pub fn process_path(&self) -> Option<&[StringFilter]>

The path to the process executable.

pub fn process_pid(&self) -> Option<&[NumberFilter]>

The process ID.

pub fn process_parent_pid(&self) -> Option<&[NumberFilter]>

The parent process ID.

pub fn process_launched_at(&self) -> Option<&[DateFilter]>

The date/time that the process was launched.

pub fn process_terminated_at(&self) -> Option<&[DateFilter]>

The date/time that the process was terminated.

pub fn threat_intel_indicator_type(&self) -> Option<&[StringFilter]>

The type of a threat intelligence indicator.

pub fn threat_intel_indicator_value(&self) -> Option<&[StringFilter]>

The value of a threat intelligence indicator.

pub fn threat_intel_indicator_category(&self) -> Option<&[StringFilter]>

The category of a threat intelligence indicator.

pub fn threat_intel_indicator_last_observed_at(&self) -> Option<&[DateFilter]>

The date/time of the last observation of a threat intelligence indicator.

pub fn threat_intel_indicator_source(&self) -> Option<&[StringFilter]>

The source of the threat intelligence.

pub fn threat_intel_indicator_source_url(&self) -> Option<&[StringFilter]>

The URL for more details from the source of the threat intelligence.

pub fn resource_type(&self) -> Option<&[StringFilter]>

Specifies the type of the resource that details are provided for.

pub fn resource_id(&self) -> Option<&[StringFilter]>

The canonical identifier for the given resource type.

pub fn resource_partition(&self) -> Option<&[StringFilter]>

The canonical Amazon Web Services partition name that the Region is assigned to.

pub fn resource_region(&self) -> Option<&[StringFilter]>

The canonical Amazon Web Services external Region name where this resource is located.

pub fn resource_tags(&self) -> Option<&[MapFilter]>

A list of Amazon Web Services tags associated with a resource at the time the finding was processed.

pub fn resource_aws_ec2_instance_type(&self) -> Option<&[StringFilter]>

The instance type of the instance.

pub fn resource_aws_ec2_instance_image_id(&self) -> Option<&[StringFilter]>

The Amazon Machine Image (AMI) ID of the instance.

pub fn resource_aws_ec2_instance_ip_v4_addresses(&self) -> Option<&[IpFilter]>

The IPv4 addresses associated with the instance.

pub fn resource_aws_ec2_instance_ip_v6_addresses(&self) -> Option<&[IpFilter]>

The IPv6 addresses associated with the instance.

pub fn resource_aws_ec2_instance_key_name(&self) -> Option<&[StringFilter]>

The key name associated with the instance.

pub fn resource_aws_ec2_instance_iam_instance_profile_arn(
    &self
) -> Option<&[StringFilter]>

The IAM profile ARN of the instance.

pub fn resource_aws_ec2_instance_vpc_id(&self) -> Option<&[StringFilter]>

The identifier of the VPC that the instance was launched in.

pub fn resource_aws_ec2_instance_subnet_id(&self) -> Option<&[StringFilter]>

The identifier of the subnet that the instance was launched in.

pub fn resource_aws_ec2_instance_launched_at(&self) -> Option<&[DateFilter]>

The date and time the instance was launched.

pub fn resource_aws_s3_bucket_owner_id(&self) -> Option<&[StringFilter]>

The canonical user ID of the owner of the S3 bucket.

pub fn resource_aws_s3_bucket_owner_name(&self) -> Option<&[StringFilter]>

The display name of the owner of the S3 bucket.

pub fn resource_aws_iam_access_key_user_name(&self) -> Option<&[StringFilter]>

👎Deprecated: This filter is deprecated. Instead, use ResourceAwsIamAccessKeyPrincipalName.

The user associated with the IAM access key related to a finding.

pub fn resource_aws_iam_access_key_principal_name(
    &self
) -> Option<&[StringFilter]>

The name of the principal that is associated with an IAM access key.

pub fn resource_aws_iam_access_key_status(&self) -> Option<&[StringFilter]>

The status of the IAM access key related to a finding.

pub fn resource_aws_iam_access_key_created_at(&self) -> Option<&[DateFilter]>

The creation date/time of the IAM access key related to a finding.

pub fn resource_aws_iam_user_user_name(&self) -> Option<&[StringFilter]>

The name of an IAM user.

pub fn resource_container_name(&self) -> Option<&[StringFilter]>

The name of the container related to a finding.

pub fn resource_container_image_id(&self) -> Option<&[StringFilter]>

The identifier of the image related to a finding.

pub fn resource_container_image_name(&self) -> Option<&[StringFilter]>

The name of the image related to a finding.

pub fn resource_container_launched_at(&self) -> Option<&[DateFilter]>

The date/time that the container was started.

pub fn resource_details_other(&self) -> Option<&[MapFilter]>

The details of a resource that doesn't have a specific subfield for the resource type defined.

pub fn compliance_status(&self) -> Option<&[StringFilter]>

Exclusive to findings that are generated as the result of a check run against a specific rule in a supported standard, such as CIS Amazon Web Services Foundations. Contains security standard-related finding details.

pub fn verification_state(&self) -> Option<&[StringFilter]>

The veracity of a finding.

pub fn workflow_state(&self) -> Option<&[StringFilter]>

The workflow state of a finding.

Note that this field is deprecated. To search for a finding based on its workflow status, use WorkflowStatus.

pub fn workflow_status(&self) -> Option<&[StringFilter]>

The status of the investigation into a finding. Allowed values are the following.

• NEW - The initial state of a finding, before it is reviewed.

  Security Hub also resets the workflow status from NOTIFIED or RESOLVED to NEW in the following cases:

  • RecordState changes from ARCHIVED to ACTIVE.

  • Compliance.Status changes from PASSED to either WARNING, FAILED, or NOT_AVAILABLE.

• NOTIFIED - Indicates that the resource owner has been notified about the security issue. Used when the initial reviewer is not the resource owner, and needs intervention from the resource owner.

  If one of the following occurs, the workflow status is changed automatically from NOTIFIED to NEW:

  • RecordState changes from ARCHIVED to ACTIVE.

  • Compliance.Status changes from PASSED to FAILED, WARNING, or NOT_AVAILABLE.

• SUPPRESSED - Indicates that you reviewed the finding and do not believe that any action is needed.

  The workflow status of a SUPPRESSED finding does not change if RecordState changes from ARCHIVED to ACTIVE.

• RESOLVED - The finding was reviewed and remediated and is now considered resolved.

  The finding remains RESOLVED unless one of the following occurs:

  • RecordState changes from ARCHIVED to ACTIVE.

  • Compliance.Status changes from PASSED to FAILED, WARNING, or NOT_AVAILABLE.

  In those cases, the workflow status is automatically reset to NEW.

  For findings from controls, if Compliance.Status is PASSED, then Security Hub automatically sets the workflow status to RESOLVED.

pub fn record_state(&self) -> Option<&[StringFilter]>

The updated record state for the finding.

pub fn related_findings_product_arn(&self) -> Option<&[StringFilter]>

The ARN of the solution that generated a related finding.

pub fn related_findings_id(&self) -> Option<&[StringFilter]>

The solution-generated identifier for a related finding.

pub fn note_text(&self) -> Option<&[StringFilter]>

The text of a note.

pub fn note_updated_at(&self) -> Option<&[DateFilter]>

The timestamp of when the note was updated.

pub fn note_updated_by(&self) -> Option<&[StringFilter]>

The principal that created a note.

pub fn keyword(&self) -> Option<&[KeywordFilter]>

👎Deprecated: The Keyword property is deprecated.

A keyword for a finding.

pub fn finding_provider_fields_confidence(&self) -> Option<&[NumberFilter]>

The finding provider value for the finding confidence. Confidence is defined as the likelihood that a finding accurately identifies the behavior or issue that it was intended to identify.

Confidence is scored on a 0-100 basis using a ratio scale, where 0 means zero percent confidence and 100 means 100 percent confidence.

pub fn finding_provider_fields_criticality(&self) -> Option<&[NumberFilter]>

The finding provider value for the level of importance assigned to the resources associated with the findings.

A score of 0 means that the underlying resources have no criticality, and a score of 100 is reserved for the most critical resources.

pub fn finding_provider_fields_related_findings_id(
    &self
) -> Option<&[StringFilter]>

The finding identifier of a related finding that is identified by the finding provider.

pub fn finding_provider_fields_related_findings_product_arn(
    &self
) -> Option<&[StringFilter]>

The ARN of the solution that generated a related finding that is identified by the finding provider.

pub fn finding_provider_fields_severity_label(&self) -> Option<&[StringFilter]>

The finding provider value for the severity label.

pub fn finding_provider_fields_severity_original(
    &self
) -> Option<&[StringFilter]>

The finding provider's original value for the severity.

pub fn finding_provider_fields_types(&self) -> Option<&[StringFilter]>

One or more finding types that the finding provider assigned to the finding. Uses the format of namespace/category/classifier that classify a finding.

Valid namespace values are: Software and Configuration Checks | TTPs | Effects | Unusual Behaviors | Sensitive Data Identifications

pub fn sample(&self) -> Option<&[BooleanFilter]>

Indicates whether or not sample findings are included in the filter results.

impl AwsSecurityFindingFilters

pub fn builder() -> Builder

Creates a new builder-style object to manufacture AwsSecurityFindingFilters.

Trait Implementations

impl Clone for AwsSecurityFindingFilters

fn clone(&self) -> AwsSecurityFindingFilters

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AwsSecurityFindingFilters

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq<AwsSecurityFindingFilters> for AwsSecurityFindingFilters

fn eq(&self, other: &AwsSecurityFindingFilters) -> bool

This method tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

This method tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for AwsSecurityFindingFilters