Struct FindingProviderFields

#[non_exhaustive]
pub struct FindingProviderFields {
    pub confidence: Option<i32>,
    pub criticality: Option<i32>,
    pub related_findings: Option<Vec<RelatedFinding>>,
    pub severity: Option<FindingProviderSeverity>,
    pub types: Option<Vec<String>>,
}

In a BatchImportFindings request, finding providers use FindingProviderFields to provide and update values for the following fields:

• Confidence

• Criticality

• RelatedFindings

• Severity

• Types

The preceding fields are nested under the FindingProviderFields object, but also have analogues of the same name as top-level ASFF fields. When a new finding is sent to Security Hub by a finding provider, Security Hub populates the FindingProviderFields object automatically, if it is empty, based on the corresponding top-level fields.

Finding providers can update FindingProviderFields only by using the BatchImportFindings operation. Finding providers can't update this object with the BatchUpdateFindings operation. Customers can update the top-level fields by using the BatchUpdateFindings operation. Customers can't update FindingProviderFields.

For information about how Security Hub handles updates from BatchImportFindings to FindingProviderFields and to the corresponding top-level attributes, see Using FindingProviderFields in the Security Hub User Guide.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

confidence: Option<i32>

A finding's confidence. Confidence is defined as the likelihood that a finding accurately identifies the behavior or issue that it was intended to identify.

Confidence is scored on a 0-100 basis using a ratio scale, where 0 means zero percent confidence and 100 means 100 percent confidence.

criticality: Option<i32>

The level of importance assigned to the resources associated with the finding.

A score of 0 means that the underlying resources have no criticality, and a score of 100 is reserved for the most critical resources.

related_findings: Option<Vec<RelatedFinding>>

A list of findings that are related to the current finding.

severity: Option<FindingProviderSeverity>

The severity of a finding.

types: Option<Vec<String>>

One or more finding types in the format of namespace/category/classifier that classify a finding.

Valid namespace values are: Software and Configuration Checks | TTPs | Effects | Unusual Behaviors | Sensitive Data Identifications

Implementations

impl FindingProviderFields

pub fn confidence(&self) -> Option<i32>

A finding's confidence. Confidence is defined as the likelihood that a finding accurately identifies the behavior or issue that it was intended to identify.

Confidence is scored on a 0-100 basis using a ratio scale, where 0 means zero percent confidence and 100 means 100 percent confidence.

pub fn criticality(&self) -> Option<i32>

The level of importance assigned to the resources associated with the finding.

A score of 0 means that the underlying resources have no criticality, and a score of 100 is reserved for the most critical resources.

pub fn related_findings(&self) -> &[RelatedFinding]

A list of findings that are related to the current finding.

If no value was sent for this field, a default will be set. If you want to determine if no value was sent, use .related_findings.is_none().

pub fn severity(&self) -> Option<&FindingProviderSeverity>

The severity of a finding.

pub fn types(&self) -> &[String]

One or more finding types in the format of namespace/category/classifier that classify a finding.

Valid namespace values are: Software and Configuration Checks | TTPs | Effects | Unusual Behaviors | Sensitive Data Identifications

If no value was sent for this field, a default will be set. If you want to determine if no value was sent, use .types.is_none().

impl FindingProviderFields

pub fn builder() -> FindingProviderFieldsBuilder

Creates a new builder-style object to manufacture FindingProviderFields.

Trait Implementations

impl Clone for FindingProviderFields

fn clone(&self) -> FindingProviderFields

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for FindingProviderFields

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for FindingProviderFields

fn eq(&self, other: &FindingProviderFields) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for FindingProviderFields