Struct aws_sdk_securityhub::types::AwsSecurityFinding

#[non_exhaustive]
pub struct AwsSecurityFinding {

    pub schema_version: Option<String>,
    pub id: Option<String>,
    pub product_arn: Option<String>,
    pub product_name: Option<String>,
    pub company_name: Option<String>,
    pub region: Option<String>,
    pub generator_id: Option<String>,
    pub aws_account_id: Option<String>,
    pub types: Option<Vec<String>>,
    pub first_observed_at: Option<String>,
    pub last_observed_at: Option<String>,
    pub created_at: Option<String>,
    pub updated_at: Option<String>,
    pub severity: Option<Severity>,
    pub confidence: Option<i32>,
    pub criticality: Option<i32>,
    pub title: Option<String>,
    pub description: Option<String>,
    pub remediation: Option<Remediation>,
    pub source_url: Option<String>,
    pub product_fields: Option<HashMap<String, String>>,
    pub user_defined_fields: Option<HashMap<String, String>>,
    pub malware: Option<Vec<Malware>>,
    pub network: Option<Network>,
    pub network_path: Option<Vec<NetworkPathComponent>>,
    pub process: Option<ProcessDetails>,
    pub threats: Option<Vec<Threat>>,
    pub threat_intel_indicators: Option<Vec<ThreatIntelIndicator>>,
    pub resources: Option<Vec<Resource>>,
    pub compliance: Option<Compliance>,
    pub verification_state: Option<VerificationState>,
    pub workflow_state: Option<WorkflowState>,
    pub workflow: Option<Workflow>,
    pub record_state: Option<RecordState>,
    pub related_findings: Option<Vec<RelatedFinding>>,
    pub note: Option<Note>,
    pub vulnerabilities: Option<Vec<Vulnerability>>,
    pub patch_summary: Option<PatchSummary>,
    pub action: Option<Action>,
    pub finding_provider_fields: Option<FindingProviderFields>,
    pub sample: Option<bool>,
    pub generator_details: Option<GeneratorDetails>,
    pub processed_at: Option<String>,
    pub aws_account_name: Option<String>,
}

Provides a consistent format for Security Hub findings. AwsSecurityFinding format allows you to share findings between Amazon Web Services security services and third-party solutions.

A finding is a potential security issue generated either by Amazon Web Services services or by the integrated third-party solutions and standards checks.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

schema_version: Option<String>

The schema version that a finding is formatted for.

id: Option<String>

The security findings provider-specific identifier for a finding.

product_arn: Option<String>

The ARN generated by Security Hub that uniquely identifies a product that generates findings. This can be the ARN for a third-party product that is integrated with Security Hub, or the ARN for a custom integration.

product_name: Option<String>

The name of the product that generated the finding.

Security Hub populates this attribute automatically for each finding. You cannot update this attribute with BatchImportFindings or BatchUpdateFindings. The exception to this is a custom integration.

When you use the Security Hub console or API to filter findings by product name, you use this attribute.

company_name: Option<String>

The name of the company for the product that generated the finding.

Security Hub populates this attribute automatically for each finding. You cannot update this attribute with BatchImportFindings or BatchUpdateFindings. The exception to this is a custom integration.

When you use the Security Hub console or API to filter findings by company name, you use this attribute.

region: Option<String>

The Region from which the finding was generated.

Security Hub populates this attribute automatically for each finding. You cannot update it using BatchImportFindings or BatchUpdateFindings.

generator_id: Option<String>

The identifier for the solution-specific component (a discrete unit of logic) that generated a finding. In various security findings providers' solutions, this generator can be called a rule, a check, a detector, a plugin, etc.

aws_account_id: Option<String>

The Amazon Web Services account ID that a finding is generated in.

types: Option<Vec<String>>

One or more finding types in the format of namespace/category/classifier that classify a finding.

Valid namespace values are: Software and Configuration Checks | TTPs | Effects | Unusual Behaviors | Sensitive Data Identifications

first_observed_at: Option<String>

Indicates when the security findings provider first observed the potential security issue that a finding captured.

This field accepts only the specified formats. Timestamps can end with Z or ("+" / "-") time-hour [":" time-minute]. The time-secfrac after seconds is limited to a maximum of 9 digits. The offset is bounded by +/-18:00. Here are valid timestamp formats with examples:

• YYYY-MM-DDTHH:MM:SSZ (for example, 2019-01-31T23:00:00Z)

• YYYY-MM-DDTHH:MM:SS.mmmmmmmmmZ (for example, 2019-01-31T23:00:00.123456789Z)

• YYYY-MM-DDTHH:MM:SS+HH:MM (for example, 2024-01-04T15:25:10+17:59)

• YYYY-MM-DDTHH:MM:SS-HHMM (for example, 2024-01-04T15:25:10-1759)

• YYYY-MM-DDTHH:MM:SS.mmmmmmmmm+HH:MM (for example, 2024-01-04T15:25:10.123456789+17:59)

last_observed_at: Option<String>

Indicates when the security findings provider most recently observed the potential security issue that a finding captured.

This field accepts only the specified formats. Timestamps can end with Z or ("+" / "-") time-hour [":" time-minute]. The time-secfrac after seconds is limited to a maximum of 9 digits. The offset is bounded by +/-18:00. Here are valid timestamp formats with examples:

• YYYY-MM-DDTHH:MM:SSZ (for example, 2019-01-31T23:00:00Z)

• YYYY-MM-DDTHH:MM:SS.mmmmmmmmmZ (for example, 2019-01-31T23:00:00.123456789Z)

• YYYY-MM-DDTHH:MM:SS+HH:MM (for example, 2024-01-04T15:25:10+17:59)

• YYYY-MM-DDTHH:MM:SS-HHMM (for example, 2024-01-04T15:25:10-1759)

• YYYY-MM-DDTHH:MM:SS.mmmmmmmmm+HH:MM (for example, 2024-01-04T15:25:10.123456789+17:59)

created_at: Option<String>

Indicates when the security findings provider created the potential security issue that a finding captured.

This field accepts only the specified formats. Timestamps can end with Z or ("+" / "-") time-hour [":" time-minute]. The time-secfrac after seconds is limited to a maximum of 9 digits. The offset is bounded by +/-18:00. Here are valid timestamp formats with examples:

• YYYY-MM-DDTHH:MM:SSZ (for example, 2019-01-31T23:00:00Z)

• YYYY-MM-DDTHH:MM:SS.mmmmmmmmmZ (for example, 2019-01-31T23:00:00.123456789Z)

• YYYY-MM-DDTHH:MM:SS+HH:MM (for example, 2024-01-04T15:25:10+17:59)

• YYYY-MM-DDTHH:MM:SS-HHMM (for example, 2024-01-04T15:25:10-1759)

• YYYY-MM-DDTHH:MM:SS.mmmmmmmmm+HH:MM (for example, 2024-01-04T15:25:10.123456789+17:59)

updated_at: Option<String>

Indicates when the security findings provider last updated the finding record.

This field accepts only the specified formats. Timestamps can end with Z or ("+" / "-") time-hour [":" time-minute]. The time-secfrac after seconds is limited to a maximum of 9 digits. The offset is bounded by +/-18:00. Here are valid timestamp formats with examples:

• YYYY-MM-DDTHH:MM:SSZ (for example, 2019-01-31T23:00:00Z)

• YYYY-MM-DDTHH:MM:SS.mmmmmmmmmZ (for example, 2019-01-31T23:00:00.123456789Z)

• YYYY-MM-DDTHH:MM:SS+HH:MM (for example, 2024-01-04T15:25:10+17:59)

• YYYY-MM-DDTHH:MM:SS-HHMM (for example, 2024-01-04T15:25:10-1759)

• YYYY-MM-DDTHH:MM:SS.mmmmmmmmm+HH:MM (for example, 2024-01-04T15:25:10.123456789+17:59)

severity: Option<Severity>

A finding's severity.

confidence: Option<i32>

A finding's confidence. Confidence is defined as the likelihood that a finding accurately identifies the behavior or issue that it was intended to identify.

Confidence is scored on a 0-100 basis using a ratio scale, where 0 means zero percent confidence and 100 means 100 percent confidence.

criticality: Option<i32>

The level of importance assigned to the resources associated with the finding.

A score of 0 means that the underlying resources have no criticality, and a score of 100 is reserved for the most critical resources.

title: Option<String>

A finding's title.

In this release, Title is a required property.

description: Option<String>

A finding's description.

In this release, Description is a required property.

remediation: Option<Remediation>

A data type that describes the remediation options for a finding.

source_url: Option<String>

A URL that links to a page about the current finding in the security findings provider's solution.

product_fields: Option<HashMap<String, String>>

A data type where security findings providers can include additional solution-specific details that aren't part of the defined AwsSecurityFinding format.

Can contain up to 50 key-value pairs. For each key-value pair, the key can contain up to 128 characters, and the value can contain up to 2048 characters.

user_defined_fields: Option<HashMap<String, String>>

A list of name/value string pairs associated with the finding. These are custom, user-defined fields added to a finding.

malware: Option<Vec<Malware>>

A list of malware related to a finding.

network: Option<Network>

The details of network-related information about a finding.

network_path: Option<Vec<NetworkPathComponent>>

Provides information about a network path that is relevant to a finding. Each entry under NetworkPath represents a component of that path.

process: Option<ProcessDetails>

The details of process-related information about a finding.

threats: Option<Vec<Threat>>

Details about the threat detected in a security finding and the file paths that were affected by the threat.

threat_intel_indicators: Option<Vec<ThreatIntelIndicator>>

Threat intelligence details related to a finding.

resources: Option<Vec<Resource>>

A set of resource data types that describe the resources that the finding refers to.

compliance: Option<Compliance>

This data type is exclusive to findings that are generated as the result of a check run against a specific rule in a supported security standard, such as CIS Amazon Web Services Foundations. Contains security standard-related finding details.

verification_state: Option<VerificationState>

Indicates the veracity of a finding.

workflow_state: Option<WorkflowState>

The workflow state of a finding.

workflow: Option<Workflow>

Provides information about the status of the investigation into a finding.

record_state: Option<RecordState>

The record state of a finding.

related_findings: Option<Vec<RelatedFinding>>

A list of related findings.

note: Option<Note>

A user-defined note added to a finding.

vulnerabilities: Option<Vec<Vulnerability>>

Provides a list of vulnerabilities associated with the findings.

patch_summary: Option<PatchSummary>

Provides an overview of the patch compliance status for an instance against a selected compliance standard.

action: Option<Action>

Provides details about an action that affects or that was taken on a resource.

finding_provider_fields: Option<FindingProviderFields>

In a BatchImportFindings request, finding providers use FindingProviderFields to provide and update their own values for confidence, criticality, related findings, severity, and types.

sample: Option<bool>

Indicates whether the finding is a sample finding.

generator_details: Option<GeneratorDetails>

Provides metadata for the Amazon CodeGuru detector associated with a finding. This field pertains to findings that relate to Lambda functions. Amazon Inspector identifies policy violations and vulnerabilities in Lambda function code based on internal detectors developed in collaboration with Amazon CodeGuru. Security Hub receives those findings.

processed_at: Option<String>

A imestamp that indicates when Security Hub received a finding and begins to process it.

This field accepts only the specified formats. Timestamps can end with Z or ("+" / "-") time-hour [":" time-minute]. The time-secfrac after seconds is limited to a maximum of 9 digits. The offset is bounded by +/-18:00. Here are valid timestamp formats with examples:

• YYYY-MM-DDTHH:MM:SSZ (for example, 2019-01-31T23:00:00Z)

• YYYY-MM-DDTHH:MM:SS.mmmmmmmmmZ (for example, 2019-01-31T23:00:00.123456789Z)

• YYYY-MM-DDTHH:MM:SS+HH:MM (for example, 2024-01-04T15:25:10+17:59)

• YYYY-MM-DDTHH:MM:SS-HHMM (for example, 2024-01-04T15:25:10-1759)

• YYYY-MM-DDTHH:MM:SS.mmmmmmmmm+HH:MM (for example, 2024-01-04T15:25:10.123456789+17:59)

aws_account_name: Option<String>

The name of the Amazon Web Services account from which a finding was generated.

Implementations

impl AwsSecurityFinding

pub fn schema_version(&self) -> Option<&str>

The schema version that a finding is formatted for.

pub fn id(&self) -> Option<&str>

The security findings provider-specific identifier for a finding.

pub fn product_arn(&self) -> Option<&str>

The ARN generated by Security Hub that uniquely identifies a product that generates findings. This can be the ARN for a third-party product that is integrated with Security Hub, or the ARN for a custom integration.

pub fn product_name(&self) -> Option<&str>

The name of the product that generated the finding.

Security Hub populates this attribute automatically for each finding. You cannot update this attribute with BatchImportFindings or BatchUpdateFindings. The exception to this is a custom integration.

When you use the Security Hub console or API to filter findings by product name, you use this attribute.

pub fn company_name(&self) -> Option<&str>

The name of the company for the product that generated the finding.

Security Hub populates this attribute automatically for each finding. You cannot update this attribute with BatchImportFindings or BatchUpdateFindings. The exception to this is a custom integration.

When you use the Security Hub console or API to filter findings by company name, you use this attribute.

pub fn region(&self) -> Option<&str>

The Region from which the finding was generated.

Security Hub populates this attribute automatically for each finding. You cannot update it using BatchImportFindings or BatchUpdateFindings.

pub fn generator_id(&self) -> Option<&str>

The identifier for the solution-specific component (a discrete unit of logic) that generated a finding. In various security findings providers' solutions, this generator can be called a rule, a check, a detector, a plugin, etc.

pub fn aws_account_id(&self) -> Option<&str>

The Amazon Web Services account ID that a finding is generated in.

pub fn types(&self) -> &[String]

One or more finding types in the format of namespace/category/classifier that classify a finding.

Valid namespace values are: Software and Configuration Checks | TTPs | Effects | Unusual Behaviors | Sensitive Data Identifications

If no value was sent for this field, a default will be set. If you want to determine if no value was sent, use .types.is_none().

pub fn first_observed_at(&self) -> Option<&str>

Indicates when the security findings provider first observed the potential security issue that a finding captured.

This field accepts only the specified formats. Timestamps can end with Z or ("+" / "-") time-hour [":" time-minute]. The time-secfrac after seconds is limited to a maximum of 9 digits. The offset is bounded by +/-18:00. Here are valid timestamp formats with examples:

• YYYY-MM-DDTHH:MM:SSZ (for example, 2019-01-31T23:00:00Z)

• YYYY-MM-DDTHH:MM:SS.mmmmmmmmmZ (for example, 2019-01-31T23:00:00.123456789Z)

• YYYY-MM-DDTHH:MM:SS+HH:MM (for example, 2024-01-04T15:25:10+17:59)

• YYYY-MM-DDTHH:MM:SS-HHMM (for example, 2024-01-04T15:25:10-1759)

• YYYY-MM-DDTHH:MM:SS.mmmmmmmmm+HH:MM (for example, 2024-01-04T15:25:10.123456789+17:59)

pub fn last_observed_at(&self) -> Option<&str>

Indicates when the security findings provider most recently observed the potential security issue that a finding captured.

This field accepts only the specified formats. Timestamps can end with Z or ("+" / "-") time-hour [":" time-minute]. The time-secfrac after seconds is limited to a maximum of 9 digits. The offset is bounded by +/-18:00. Here are valid timestamp formats with examples:

• YYYY-MM-DDTHH:MM:SSZ (for example, 2019-01-31T23:00:00Z)

• YYYY-MM-DDTHH:MM:SS.mmmmmmmmmZ (for example, 2019-01-31T23:00:00.123456789Z)

• YYYY-MM-DDTHH:MM:SS+HH:MM (for example, 2024-01-04T15:25:10+17:59)

• YYYY-MM-DDTHH:MM:SS-HHMM (for example, 2024-01-04T15:25:10-1759)

• YYYY-MM-DDTHH:MM:SS.mmmmmmmmm+HH:MM (for example, 2024-01-04T15:25:10.123456789+17:59)

pub fn created_at(&self) -> Option<&str>

Indicates when the security findings provider created the potential security issue that a finding captured.

This field accepts only the specified formats. Timestamps can end with Z or ("+" / "-") time-hour [":" time-minute]. The time-secfrac after seconds is limited to a maximum of 9 digits. The offset is bounded by +/-18:00. Here are valid timestamp formats with examples:

• YYYY-MM-DDTHH:MM:SSZ (for example, 2019-01-31T23:00:00Z)

• YYYY-MM-DDTHH:MM:SS.mmmmmmmmmZ (for example, 2019-01-31T23:00:00.123456789Z)

• YYYY-MM-DDTHH:MM:SS+HH:MM (for example, 2024-01-04T15:25:10+17:59)

• YYYY-MM-DDTHH:MM:SS-HHMM (for example, 2024-01-04T15:25:10-1759)

• YYYY-MM-DDTHH:MM:SS.mmmmmmmmm+HH:MM (for example, 2024-01-04T15:25:10.123456789+17:59)

pub fn updated_at(&self) -> Option<&str>

Indicates when the security findings provider last updated the finding record.

This field accepts only the specified formats. Timestamps can end with Z or ("+" / "-") time-hour [":" time-minute]. The time-secfrac after seconds is limited to a maximum of 9 digits. The offset is bounded by +/-18:00. Here are valid timestamp formats with examples:

• YYYY-MM-DDTHH:MM:SSZ (for example, 2019-01-31T23:00:00Z)

• YYYY-MM-DDTHH:MM:SS.mmmmmmmmmZ (for example, 2019-01-31T23:00:00.123456789Z)

• YYYY-MM-DDTHH:MM:SS+HH:MM (for example, 2024-01-04T15:25:10+17:59)

• YYYY-MM-DDTHH:MM:SS-HHMM (for example, 2024-01-04T15:25:10-1759)

• YYYY-MM-DDTHH:MM:SS.mmmmmmmmm+HH:MM (for example, 2024-01-04T15:25:10.123456789+17:59)

pub fn severity(&self) -> Option<&Severity>

A finding's severity.

pub fn confidence(&self) -> Option<i32>

A finding's confidence. Confidence is defined as the likelihood that a finding accurately identifies the behavior or issue that it was intended to identify.

Confidence is scored on a 0-100 basis using a ratio scale, where 0 means zero percent confidence and 100 means 100 percent confidence.

pub fn criticality(&self) -> Option<i32>

The level of importance assigned to the resources associated with the finding.

A score of 0 means that the underlying resources have no criticality, and a score of 100 is reserved for the most critical resources.

pub fn title(&self) -> Option<&str>

A finding's title.

In this release, Title is a required property.

pub fn description(&self) -> Option<&str>

A finding's description.

In this release, Description is a required property.

pub fn remediation(&self) -> Option<&Remediation>

A data type that describes the remediation options for a finding.

pub fn source_url(&self) -> Option<&str>

A URL that links to a page about the current finding in the security findings provider's solution.

pub fn product_fields(&self) -> Option<&HashMap<String, String>>

A data type where security findings providers can include additional solution-specific details that aren't part of the defined AwsSecurityFinding format.

Can contain up to 50 key-value pairs. For each key-value pair, the key can contain up to 128 characters, and the value can contain up to 2048 characters.

pub fn user_defined_fields(&self) -> Option<&HashMap<String, String>>

A list of name/value string pairs associated with the finding. These are custom, user-defined fields added to a finding.

pub fn malware(&self) -> &[Malware]

A list of malware related to a finding.

If no value was sent for this field, a default will be set. If you want to determine if no value was sent, use .malware.is_none().

pub fn network(&self) -> Option<&Network>

The details of network-related information about a finding.

pub fn network_path(&self) -> &[NetworkPathComponent]

Provides information about a network path that is relevant to a finding. Each entry under NetworkPath represents a component of that path.

If no value was sent for this field, a default will be set. If you want to determine if no value was sent, use .network_path.is_none().

pub fn process(&self) -> Option<&ProcessDetails>

The details of process-related information about a finding.

pub fn threats(&self) -> &[Threat]

Details about the threat detected in a security finding and the file paths that were affected by the threat.

If no value was sent for this field, a default will be set. If you want to determine if no value was sent, use .threats.is_none().

pub fn threat_intel_indicators(&self) -> &[ThreatIntelIndicator]

Threat intelligence details related to a finding.

If no value was sent for this field, a default will be set. If you want to determine if no value was sent, use .threat_intel_indicators.is_none().

pub fn resources(&self) -> &[Resource]

A set of resource data types that describe the resources that the finding refers to.

If no value was sent for this field, a default will be set. If you want to determine if no value was sent, use .resources.is_none().

pub fn compliance(&self) -> Option<&Compliance>

This data type is exclusive to findings that are generated as the result of a check run against a specific rule in a supported security standard, such as CIS Amazon Web Services Foundations. Contains security standard-related finding details.

pub fn verification_state(&self) -> Option<&VerificationState>

Indicates the veracity of a finding.

pub fn workflow_state(&self) -> Option<&WorkflowState>

The workflow state of a finding.

pub fn workflow(&self) -> Option<&Workflow>

Provides information about the status of the investigation into a finding.

pub fn record_state(&self) -> Option<&RecordState>

The record state of a finding.

pub fn related_findings(&self) -> &[RelatedFinding]

A list of related findings.

If no value was sent for this field, a default will be set. If you want to determine if no value was sent, use .related_findings.is_none().

pub fn note(&self) -> Option<&Note>

A user-defined note added to a finding.

pub fn vulnerabilities(&self) -> &[Vulnerability]

Provides a list of vulnerabilities associated with the findings.

If no value was sent for this field, a default will be set. If you want to determine if no value was sent, use .vulnerabilities.is_none().

pub fn patch_summary(&self) -> Option<&PatchSummary>

Provides an overview of the patch compliance status for an instance against a selected compliance standard.

pub fn action(&self) -> Option<&Action>

Provides details about an action that affects or that was taken on a resource.

pub fn finding_provider_fields(&self) -> Option<&FindingProviderFields>

In a BatchImportFindings request, finding providers use FindingProviderFields to provide and update their own values for confidence, criticality, related findings, severity, and types.

pub fn sample(&self) -> Option<bool>

Indicates whether the finding is a sample finding.

pub fn generator_details(&self) -> Option<&GeneratorDetails>

Provides metadata for the Amazon CodeGuru detector associated with a finding. This field pertains to findings that relate to Lambda functions. Amazon Inspector identifies policy violations and vulnerabilities in Lambda function code based on internal detectors developed in collaboration with Amazon CodeGuru. Security Hub receives those findings.

pub fn processed_at(&self) -> Option<&str>

A imestamp that indicates when Security Hub received a finding and begins to process it.

This field accepts only the specified formats. Timestamps can end with Z or ("+" / "-") time-hour [":" time-minute]. The time-secfrac after seconds is limited to a maximum of 9 digits. The offset is bounded by +/-18:00. Here are valid timestamp formats with examples:

• YYYY-MM-DDTHH:MM:SSZ (for example, 2019-01-31T23:00:00Z)

• YYYY-MM-DDTHH:MM:SS.mmmmmmmmmZ (for example, 2019-01-31T23:00:00.123456789Z)

• YYYY-MM-DDTHH:MM:SS+HH:MM (for example, 2024-01-04T15:25:10+17:59)

• YYYY-MM-DDTHH:MM:SS-HHMM (for example, 2024-01-04T15:25:10-1759)

• YYYY-MM-DDTHH:MM:SS.mmmmmmmmm+HH:MM (for example, 2024-01-04T15:25:10.123456789+17:59)

pub fn aws_account_name(&self) -> Option<&str>

The name of the Amazon Web Services account from which a finding was generated.

impl AwsSecurityFinding

pub fn builder() -> AwsSecurityFindingBuilder

Creates a new builder-style object to manufacture AwsSecurityFinding.

Trait Implementations

impl Clone for AwsSecurityFinding

fn clone(&self) -> AwsSecurityFinding

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AwsSecurityFinding

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for AwsSecurityFinding

fn eq(&self, other: &AwsSecurityFinding) -> bool

This method tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

This method tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for AwsSecurityFinding