Expand description
Security Hub provides you with a comprehensive view of the security state of your AWS environment and resources. It also provides you with the readiness status of your environment based on controls from supported security standards. Security Hub collects security data from AWS accounts, services, and integrated third-party products and helps you analyze security trends in your environment to identify the highest priority security issues. For more information about Security Hub, see the AWS Security Hub User Guide .
When you use operations in the Security Hub API, the requests are executed only in the AWS Region that is currently active or in the specific AWS Region that you specify in your request. Any configuration or settings change that results from the operation is applied only to that Region. To make the same change in other Regions, execute the same command for each Region to apply the change to.
For example, if your Region is set to us-west-2, when you use CreateMembers to add a member account to Security Hub, the association of the member account with the administrator account is created only in the us-west-2 Region. Security Hub must be enabled for the member account in the same Region that the invitation was sent from.
The following throttling limits apply to using Security Hub API operations.
-
BatchEnableStandards-RateLimitof 1 request per second,BurstLimitof 1 request per second. -
GetFindings-RateLimitof 3 requests per second.BurstLimitof 6 requests per second. -
UpdateFindings-RateLimitof 1 request per second.BurstLimitof 5 requests per second. -
UpdateStandardsControl-RateLimitof 1 request per second,BurstLimitof 5 requests per second. -
All other operations -
RateLimitof 10 requests per second.BurstLimitof 30 requests per second.
If you’re using the service, you’re probably looking for SecurityHubClient and SecurityHub.
Structs§
- Accept
Administrator Invitation Request - Accept
Administrator Invitation Response - Accept
Invitation Request - Accept
Invitation Response - Account
Details The details of an AWS account.
- Action
Provides details about one of the following actions that affects or that was taken on a resource:
-
A remote IP address issued an AWS API call
-
A DNS request was received
-
A remote IP address attempted to connect to an EC2 instance
-
A remote IP address attempted a port probe on an EC2 instance
-
- Action
Local IpDetails Provides information about the IP address where the scanned port is located.
- Action
Local Port Details For
NetworkConnectionActionandPortProbeDetails,LocalPortDetailsprovides information about the local port that was involved in the action.- Action
Remote IpDetails For
AwsApiAction,NetworkConnectionAction, andPortProbeAction,RemoteIpDetailsprovides information about the remote IP address that was involved in the action.- Action
Remote Port Details Provides information about the remote port that was involved in an attempted network connection.
- Action
Target An
ActionTargetobject.- Admin
Account Represents a Security Hub administrator account designated by an organization management account.
- Availability
Zone Information about an Availability Zone.
- AwsApi
Call Action Provided if
ActionTypeisAWS_API_CALL. It provides details about the API call that was detected.- AwsApi
Call Action Domain Details Provided if
CallerTypeisdomain. It provides information about the DNS domain that issued the API call.- AwsApi
Gateway Access LogSettings Contains information about settings for logging access for the stage.
- AwsApi
Gateway Canary Settings Contains information about settings for canary deployment in the stage.
- AwsApi
Gateway Endpoint Configuration Contains information about the endpoints for the API.
- AwsApi
Gateway Method Settings Defines settings for a method for the stage.
- AwsApi
Gateway Rest ApiDetails Contains information about a REST API in version 1 of Amazon API Gateway.
- AwsApi
Gateway Stage Details Provides information about a version 1 Amazon API Gateway stage.
- AwsApi
Gateway V2Api Details Contains information about a version 2 API in Amazon API Gateway.
- AwsApi
Gateway V2Route Settings Contains route settings for a stage.
- AwsApi
Gateway V2Stage Details Contains information about a version 2 stage for Amazon API Gateway.
- AwsAuto
Scaling Auto Scaling Group Details Provides details about an auto scaling group.
- AwsCertificate
Manager Certificate Details Provides details about an AWS Certificate Manager certificate.
- AwsCertificate
Manager Certificate Domain Validation Option Contains information about one of the following:
-
The initial validation of each domain name that occurs as a result of the
RequestCertificaterequest -
The validation of each domain name in the certificate, as it pertains to AWS Certificate Manager managed renewal
-
- AwsCertificate
Manager Certificate Extended KeyUsage Contains information about an extended key usage X.509 v3 extension object.
- AwsCertificate
Manager Certificate KeyUsage Contains information about a key usage X.509 v3 extension object.
- AwsCertificate
Manager Certificate Options Contains other options for the certificate.
- AwsCertificate
Manager Certificate Renewal Summary Contains information about the AWS Certificate Manager managed renewal for an
AMAZON_ISSUEDcertificate.- AwsCertificate
Manager Certificate Resource Record Provides details about the CNAME record that is added to the DNS database for domain validation.
- AwsCloud
Front Distribution Cache Behavior Information about a cache behavior for the distribution.
- AwsCloud
Front Distribution Cache Behaviors Provides information about caching for the distribution.
- AwsCloud
Front Distribution Default Cache Behavior Contains information about the default cache configuration for the distribution.
- AwsCloud
Front Distribution Details A distribution configuration.
- AwsCloud
Front Distribution Logging A complex type that controls whether access logs are written for the distribution.
- AwsCloud
Front Distribution Origin Group Information about an origin group for the distribution.
- AwsCloud
Front Distribution Origin Group Failover Provides information about when an origin group fails over.
- AwsCloud
Front Distribution Origin Group Failover Status Codes The status codes that cause an origin group to fail over.
- AwsCloud
Front Distribution Origin Groups Provides information about origin groups that are associated with the distribution.
- AwsCloud
Front Distribution Origin Item A complex type that describes the Amazon S3 bucket, HTTP server (for example, a web server), Amazon Elemental MediaStore, or other server from which CloudFront gets your files.
- AwsCloud
Front Distribution Origin S3Origin Config Information about an origin that is an S3 bucket that is not configured with static website hosting.
- AwsCloud
Front Distribution Origins A complex type that contains information about origins and origin groups for this distribution.
- AwsCloud
Trail Trail Details Provides details about a CloudTrail trail.
- AwsCode
Build Project Details Information about an AWS CodeBuild project.
- AwsCode
Build Project Environment Information about the build environment for this build project.
- AwsCode
Build Project Environment Registry Credential The credentials for access to a private registry.
- AwsCode
Build Project Source Information about the build input source code for this build project.
- AwsCode
Build Project VpcConfig Information about the VPC configuration that AWS CodeBuild accesses.
- AwsCors
Configuration Contains the cross-origin resource sharing (CORS) configuration for the API. CORS is only supported for HTTP APIs.
- AwsDynamo
DbTable Attribute Definition Contains a definition of an attribute for the table.
- AwsDynamo
DbTable Billing Mode Summary Provides information about the billing for read/write capacity on the table.
- AwsDynamo
DbTable Details Provides details about a DynamoDB table.
- AwsDynamo
DbTable Global Secondary Index Information abut a global secondary index for the table.
- AwsDynamo
DbTable KeySchema A component of the key schema for the DynamoDB table, a global secondary index, or a local secondary index.
- AwsDynamo
DbTable Local Secondary Index Information about a local secondary index for a DynamoDB table.
- AwsDynamo
DbTable Projection For global and local secondary indexes, identifies the attributes that are copied from the table into the index.
- AwsDynamo
DbTable Provisioned Throughput Information about the provisioned throughput for the table or for a global secondary index.
- AwsDynamo
DbTable Provisioned Throughput Override Replica-specific configuration for the provisioned throughput.
- AwsDynamo
DbTable Replica Information about a replica of a DynamoDB table.
- AwsDynamo
DbTable Replica Global Secondary Index Information about a global secondary index for a DynamoDB table replica.
- AwsDynamo
DbTable Restore Summary Information about the restore for the table.
- AwsDynamo
DbTable SseDescription Information about the server-side encryption for the table.
- AwsDynamo
DbTable Stream Specification The current DynamoDB Streams configuration for the table.
- AwsEc2
EipDetails Information about an Elastic IP address.
- AwsEc2
Instance Details The details of an EC2 instance.
- AwsEc2
Instance Network Interfaces Details Identifies a network interface for the EC2 instance.
- AwsEc2
Network AclAssociation An association between the network ACL and a subnet.
- AwsEc2
Network AclDetails Contains details about an EC2 network access control list (ACL).
- AwsEc2
Network AclEntry A rule for the network ACL. Each rule allows or denies access based on the IP address, traffic direction, port, and protocol.
- AwsEc2
Network Interface Attachment Information about the network interface attachment.
- AwsEc2
Network Interface Details Details about the network interface
- AwsEc2
Network Interface IpV6 Address Detail Provides information about an IPV6 address that is associated with the network interface.
- AwsEc2
Network Interface Private IpAddress Detail Provides information about a private IPv4 address that is with the network interface.
- AwsEc2
Network Interface Security Group A security group associated with the network interface.
- AwsEc2
Security Group Details Details about an EC2 security group.
- AwsEc2
Security Group IpPermission An IP permission for an EC2 security group.
- AwsEc2
Security Group IpRange A range of IPv4 addresses.
- AwsEc2
Security Group Ipv6 Range A range of IPv6 addresses.
- AwsEc2
Security Group Prefix List Id A prefix list ID.
- AwsEc2
Security Group User IdGroup Pair A relationship between a security group and a user.
- AwsEc2
Subnet Details Contains information about a subnet in EC2.
- AwsEc2
Volume Attachment An attachment to an AWS EC2 volume.
- AwsEc2
Volume Details Details about an EC2 volume.
- AwsEc2
VpcDetails Details about an EC2 VPC.
- AwsEcs
Cluster Cluster Settings Details Indicates whether to enable CloudWatch Container Insights for the ECS cluster.
- AwsEcs
Cluster Configuration Details The run command configuration for the cluster.
- AwsEcs
Cluster Configuration Execute Command Configuration Details Contains the run command configuration for the cluster.
- AwsEcs
Cluster Configuration Execute Command Configuration LogConfiguration Details The log configuration for the results of the run command actions.
- AwsEcs
Cluster Default Capacity Provider Strategy Details The default capacity provider strategy for the cluster. The default capacity provider strategy is used when services or tasks are run without a specified launch type or capacity provider strategy.
- AwsEcs
Cluster Details provides details about an ECS cluster.
- AwsEcs
Task Definition Container Definitions Depends OnDetails A dependency that is defined for container startup and shutdown.
- AwsEcs
Task Definition Container Definitions Details A container definition that describes a container in the task.
- AwsEcs
Task Definition Container Definitions Environment Details An environment variable to pass to the container.
- AwsEcs
Task Definition Container Definitions Environment Files Details A file that contain environment variables to pass to a container.
- AwsEcs
Task Definition Container Definitions Extra Hosts Details A hostname and IP address mapping to append to the /etc/hosts file on the container.
- AwsEcs
Task Definition Container Definitions Firelens Configuration Details The FireLens configuration for the container. The configuration specifies and configures a log router for container logs.
- AwsEcs
Task Definition Container Definitions Health Check Details The container health check command and associated configuration parameters for the container.
- AwsEcs
Task Definition Container Definitions Linux Parameters Capabilities Details The Linux capabilities for the container that are added to or dropped from the default configuration provided by Docker.
- AwsEcs
Task Definition Container Definitions Linux Parameters Details >Linux-specific modifications that are applied to the container, such as Linux kernel capabilities.
- AwsEcs
Task Definition Container Definitions Linux Parameters Devices Details A host device to expose to the container.
- AwsEcs
Task Definition Container Definitions Linux Parameters Tmpfs Details The container path, mount options, and size (in MiB) of a tmpfs mount.
- AwsEcs
Task Definition Container Definitions LogConfiguration Details The log configuration specification for the container.
- AwsEcs
Task Definition Container Definitions LogConfiguration Secret Options Details A secret to pass to the log configuration.
- AwsEcs
Task Definition Container Definitions Mount Points Details A mount point for the data volumes in the container.
- AwsEcs
Task Definition Container Definitions Port Mappings Details A port mapping for the container.
- AwsEcs
Task Definition Container Definitions Repository Credentials Details The private repository authentication credentials to use.
- AwsEcs
Task Definition Container Definitions Resource Requirements Details A resource to assign to a container.
- AwsEcs
Task Definition Container Definitions Secrets Details A secret to pass to the container.
- AwsEcs
Task Definition Container Definitions System Controls Details A namespaced kernel parameter to set in the container.
- AwsEcs
Task Definition Container Definitions Ulimits Details A ulimit to set in the container.
- AwsEcs
Task Definition Container Definitions Volumes From Details A data volume to mount from another container.
- AwsEcs
Task Definition Details details about a task definition. A task definition describes the container and volume definitions of an Amazon Elastic Container Service task.
- AwsEcs
Task Definition Inference Accelerators Details An Elastic Inference accelerator to use for the containers in the task.
- AwsEcs
Task Definition Placement Constraints Details A placement constraint object to use for tasks.
- AwsEcs
Task Definition Proxy Configuration Details The configuration details for the App Mesh proxy.
- AwsEcs
Task Definition Proxy Configuration Proxy Configuration Properties Details A network configuration parameter to provide to the Container Network Interface (CNI) plugin.
- AwsEcs
Task Definition Volumes Details A data volume to mount from another container.
- AwsEcs
Task Definition Volumes Docker Volume Configuration Details Information about a Docker volume.
- AwsEcs
Task Definition Volumes EfsVolume Configuration Authorization Config Details - AwsEcs
Task Definition Volumes EfsVolume Configuration Details Information about the Amazon Elastic File System file system that is used for task storage.
- AwsEcs
Task Definition Volumes Host Details Information about a bind mount host volume.
- AwsElastic
Beanstalk Environment Details Contains details about an Elastic Beanstalk environment.
- AwsElastic
Beanstalk Environment Environment Link Contains information about a link to another environment that is in the same group.
- AwsElastic
Beanstalk Environment Option Setting A configuration option setting for the environment.
- AwsElastic
Beanstalk Environment Tier Contains information about the tier of the environment.
- AwsElasticsearch
Domain Details Information about an Elasticsearch domain.
- AwsElasticsearch
Domain Domain Endpoint Options Additional options for the domain endpoint, such as whether to require HTTPS for all traffic.
- AwsElasticsearch
Domain Encryption AtRest Options Details about the configuration for encryption at rest.
- AwsElasticsearch
Domain LogPublishing Options configures the CloudWatch Logs to publish for the Elasticsearch domain.
- AwsElasticsearch
Domain LogPublishing Options LogConfig The log configuration.
- AwsElasticsearch
Domain Node ToNode Encryption Options Details about the configuration for node-to-node encryption.
- AwsElasticsearch
Domain Service Software Options Information about the state of the domain relative to the latest service software.
- AwsElasticsearch
DomainVPC Options Information that Amazon ES derives based on
VPCOptionsfor the domain.- AwsElb
AppCookie Stickiness Policy Contains information about a stickiness policy that was created using
CreateAppCookieStickinessPolicy.- AwsElb
LbCookie Stickiness Policy Contains information about a stickiness policy that was created using
CreateLBCookieStickinessPolicy.- AwsElb
Load Balancer Access Log Contains information about the access log configuration for the load balancer.
- AwsElb
Load Balancer Attributes Contains attributes for the load balancer.
- AwsElb
Load Balancer Backend Server Description Provides information about the configuration of an EC2 instance for the load balancer.
- AwsElb
Load Balancer Connection Draining Contains information about the connection draining configuration for the load balancer.
- AwsElb
Load Balancer Connection Settings Contains connection settings for the load balancer.
- AwsElb
Load Balancer Cross Zone Load Balancing Contains cross-zone load balancing settings for the load balancer.
- AwsElb
Load Balancer Details Contains details about a Classic Load Balancer.
- AwsElb
Load Balancer Health Check Contains information about the health checks that are conducted on the load balancer.
- AwsElb
Load Balancer Instance Provides information about an EC2 instance for a load balancer.
- AwsElb
Load Balancer Listener Information about a load balancer listener.
- AwsElb
Load Balancer Listener Description Lists the policies that are enabled for a load balancer listener.
- AwsElb
Load Balancer Policies Contains information about the policies for a load balancer.
- AwsElb
Load Balancer Source Security Group Contains information about the security group for the load balancer.
- AwsElbv2
Load Balancer Details Information about a load balancer.
- AwsIam
Access KeyDetails IAM access key details related to a finding.
- AwsIam
Access KeySession Context Provides information about the session that the key was used for.
- AwsIam
Access KeySession Context Attributes Attributes of the session that the key was used for.
- AwsIam
Access KeySession Context Session Issuer Information about the entity that created the session.
- AwsIam
Attached Managed Policy A managed policy that is attached to an IAM principal.
- AwsIam
Group Details Contains details about an IAM group.
- AwsIam
Group Policy A managed policy that is attached to the IAM group.
- AwsIam
Instance Profile Information about an instance profile.
- AwsIam
Instance Profile Role Information about a role associated with an instance profile.
- AwsIam
Permissions Boundary Information about the policy used to set the permissions boundary for an IAM principal.
- AwsIam
Policy Details Represents an IAM permissions policy.
- AwsIam
Policy Version A version of an IAM policy.
- AwsIam
Role Details Contains information about an IAM role, including all of the role's policies.
- AwsIam
Role Policy An inline policy that is embedded in the role.
- AwsIam
User Details Information about an IAM user.
- AwsIam
User Policy Information about an inline policy that is embedded in the user.
- AwsKms
KeyDetails Contains metadata about a customer master key (CMK).
- AwsLambda
Function Code The code for the Lambda function. You can specify either an object in Amazon S3, or upload a deployment package directly.
- AwsLambda
Function Dead Letter Config The dead-letter queue for failed asynchronous invocations.
- AwsLambda
Function Details Details about a function's configuration.
- AwsLambda
Function Environment A function's environment variable settings.
- AwsLambda
Function Environment Error Error messages for environment variables that could not be applied.
- AwsLambda
Function Layer An AWS Lambda layer.
- AwsLambda
Function Tracing Config The function's AWS X-Ray tracing configuration.
- AwsLambda
Function VpcConfig The VPC security groups and subnets that are attached to a Lambda function.
- AwsLambda
Layer Version Details Details about a Lambda layer version.
- AwsRds
DbCluster Associated Role An IAM role that is associated with the Amazon RDS DB cluster.
- AwsRds
DbCluster Details Information about an Amazon RDS DB cluster.
- AwsRds
DbCluster Member Information about an instance in the DB cluster.
- AwsRds
DbCluster Option Group Membership Information about an option group membership for a DB cluster.
- AwsRds
DbCluster Snapshot Details Information about an Amazon RDS DB cluster snapshot.
- AwsRds
DbDomain Membership Information about an Active Directory domain membership record associated with the DB instance.
- AwsRds
DbInstance Associated Role An AWS Identity and Access Management (IAM) role associated with the DB instance.
- AwsRds
DbInstance Details Contains the details of an Amazon RDS DB instance.
- AwsRds
DbInstance Endpoint Specifies the connection endpoint.
- AwsRds
DbInstance VpcSecurity Group A VPC security groups that the DB instance belongs to.
- AwsRds
DbOption Group Membership An option group membership.
- AwsRds
DbParameter Group Provides information about a parameter group for a DB instance.
- AwsRds
DbPending Modified Values Changes to a DB instance that are currently pending.
- AwsRds
DbProcessor Feature A processor feature.
- AwsRds
DbSnapshot Details Provides details about an Amazon RDS DB cluster snapshot.
- AwsRds
DbStatus Info Information about the status of a read replica.
- AwsRds
DbSubnet Group Information about the subnet group for the database instance.
- AwsRds
DbSubnet Group Subnet Information about a subnet in a subnet group.
- AwsRds
DbSubnet Group Subnet Availability Zone An Availability Zone for a subnet in a subnet group.
- AwsRds
Pending Cloud Watch Logs Exports Identifies the log types to enable and disable.
- AwsRedshift
Cluster Cluster Node A node in an Amazon Redshift cluster.
- AwsRedshift
Cluster Cluster Parameter Group A cluster parameter group that is associated with an Amazon Redshift cluster.
- AwsRedshift
Cluster Cluster Parameter Status The status of a parameter in a cluster parameter group for an Amazon Redshift cluster.
- AwsRedshift
Cluster Cluster Security Group A security group that is associated with the cluster.
- AwsRedshift
Cluster Cluster Snapshot Copy Status Information about a cross-Region snapshot copy.
- AwsRedshift
Cluster Deferred Maintenance Window A time windows during which maintenance was deferred for an Amazon Redshift cluster.
- AwsRedshift
Cluster Details Details about an Amazon Redshift cluster.
- AwsRedshift
Cluster Elastic IpStatus The status of the elastic IP (EIP) address for an Amazon Redshift cluster.
- AwsRedshift
Cluster Endpoint The connection endpoint for an Amazon Redshift cluster.
- AwsRedshift
Cluster HsmStatus Information about whether an Amazon Redshift cluster finished applying any hardware changes to security module (HSM) settings that were specified in a modify cluster command.
- AwsRedshift
Cluster IamRole An IAM role that the cluster can use to access other AWS services.
- AwsRedshift
Cluster Pending Modified Values Changes to the Amazon Redshift cluster that are currently pending.
- AwsRedshift
Cluster Resize Info Information about the resize operation for the cluster.
- AwsRedshift
Cluster Restore Status Information about the status of a cluster restore action. It only applies if the cluster was created by restoring a snapshot.
- AwsRedshift
Cluster VpcSecurity Group A VPC security group that the cluster belongs to, if the cluster is in a VPC.
- AwsS3
Account Public Access Block Details provides information about the Amazon S3 Public Access Block configuration for accounts.
- AwsS3
Bucket Bucket Lifecycle Configuration Details The lifecycle configuration for the objects in the S3 bucket.
- AwsS3
Bucket Bucket Lifecycle Configuration Rules Abort Incomplete Multipart Upload Details Information about what Amazon S3 does when a multipart upload is incomplete.
- AwsS3
Bucket Bucket Lifecycle Configuration Rules Details Configuration for a lifecycle rule.
- AwsS3
Bucket Bucket Lifecycle Configuration Rules Filter Details Identifies the objects that a rule applies to.
- AwsS3
Bucket Bucket Lifecycle Configuration Rules Filter Predicate Details The configuration for the filter.
- AwsS3
Bucket Bucket Lifecycle Configuration Rules Filter Predicate Operands Details A value to use for the filter.
- AwsS3
Bucket Bucket Lifecycle Configuration Rules Filter Predicate Operands TagDetails A tag that is assigned to matching objects.
- AwsS3
Bucket Bucket Lifecycle Configuration Rules Filter Predicate TagDetails A tag filter.
- AwsS3
Bucket Bucket Lifecycle Configuration Rules Noncurrent Version Transitions Details A transition rule that describes when noncurrent objects transition to a specified storage class.
- AwsS3
Bucket Bucket Lifecycle Configuration Rules Transitions Details A rule for when objects transition to specific storage classes.
- AwsS3
Bucket Details The details of an Amazon S3 bucket.
- AwsS3
Bucket Server Side Encryption ByDefault Specifies the default server-side encryption to apply to new objects in the bucket.
- AwsS3
Bucket Server Side Encryption Configuration The encryption configuration for the S3 bucket.
- AwsS3
Bucket Server Side Encryption Rule An encryption rule to apply to the S3 bucket.
- AwsS3
Object Details Details about an Amazon S3 object.
- AwsSecrets
Manager Secret Details Details about an AWS Secrets Manager secret.
- AwsSecrets
Manager Secret Rotation Rules Defines the rotation schedule for the secret.
- AwsSecurity
Finding Provides consistent format for the contents of the Security Hub-aggregated findings.
AwsSecurityFindingformat enables you to share findings between AWS security services and third-party solutions, and security standards checks.A finding is a potential security issue generated either by AWS services (Amazon GuardDuty, Amazon Inspector, and Amazon Macie) or by the integrated third-party solutions and standards checks.
- AwsSecurity
Finding Filters A collection of attributes that are applied to all active Security Hub-aggregated findings and that result in a subset of findings that are included in this insight.
You can filter by up to 10 finding attributes. For each attribute, you can provide up to 20 filter values.
- AwsSecurity
Finding Identifier Identifies a finding to update using
BatchUpdateFindings.- AwsSns
Topic Details A wrapper type for the topic's ARN.
- AwsSns
Topic Subscription A wrapper type for the attributes of an Amazon SNS subscription.
- AwsSqs
Queue Details Data about a queue.
- AwsSsm
Compliance Summary Provides the details about the compliance status for a patch.
- AwsSsm
Patch Provides details about the compliance for a patch.
- AwsSsm
Patch Compliance Details Provides information about the state of a patch on an instance based on the patch baseline that was used to patch the instance.
- AwsWaf
WebAcl Details Details about a WAF WebACL.
- AwsWaf
WebAcl Rule Details for a rule in a WAF WebACL.
- Batch
Disable Standards Request - Batch
Disable Standards Response - Batch
Enable Standards Request - Batch
Enable Standards Response - Batch
Import Findings Request - Batch
Import Findings Response - Batch
Update Findings Request - Batch
Update Findings Response - Batch
Update Findings Unprocessed Finding A finding from a
BatchUpdateFindingsrequest that Security Hub was unable to update.- Cell
An occurrence of sensitive data detected in a Microsoft Excel workbook, comma-separated value (CSV) file, or tab-separated value (TSV) file.
- Cidr
Block Association An IPv4 CIDR block association.
- City
Information about a city.
- Classification
Result Details about the sensitive data that was detected on the resource.
- Classification
Status Provides details about the current status of the sensitive data detection.
- Compliance
Contains finding details that are specific to control-based findings. Only returned for findings generated from controls.
- Container
Details Container details related to a finding.
- Country
Information about a country.
- Create
Action Target Request - Create
Action Target Response - Create
Insight Request - Create
Insight Response - Create
Members Request - Create
Members Response - Custom
Data Identifiers Detections The list of detected instances of sensitive data.
- Custom
Data Identifiers Result Contains an instance of sensitive data that was detected by a customer-defined identifier.
- Cvss
CVSS scores from the advisory related to the vulnerability.
- Data
Classification Details Provides details about sensitive data that was detected on a resource.
- Date
Filter A date filter for querying findings.
- Date
Range A date range for the date filter.
- Decline
Invitations Request - Decline
Invitations Response - Delete
Action Target Request - Delete
Action Target Response - Delete
Insight Request - Delete
Insight Response - Delete
Invitations Request - Delete
Invitations Response - Delete
Members Request - Delete
Members Response - Describe
Action Targets Request - Describe
Action Targets Response - Describe
HubRequest - Describe
HubResponse - Describe
Organization Configuration Request - Describe
Organization Configuration Response - Describe
Products Request - Describe
Products Response - Describe
Standards Controls Request - Describe
Standards Controls Response - Describe
Standards Request - Describe
Standards Response - Disable
Import Findings ForProduct Request - Disable
Import Findings ForProduct Response - Disable
Organization Admin Account Request - Disable
Organization Admin Account Response - Disable
Security HubRequest - Disable
Security HubResponse - Disassociate
From Administrator Account Request - Disassociate
From Administrator Account Response - Disassociate
From Master Account Request - Disassociate
From Master Account Response - Disassociate
Members Request - Disassociate
Members Response - DnsRequest
Action Provided if
ActionTypeisDNS_REQUEST. It provides details about the DNS request that was detected.- Enable
Import Findings ForProduct Request - Enable
Import Findings ForProduct Response - Enable
Organization Admin Account Request - Enable
Organization Admin Account Response - Enable
Security HubRequest - Enable
Security HubResponse - Finding
Provider Fields In a
BatchImportFindingsrequest, finding providers useFindingProviderFieldsto provide and update values for confidence, criticality, related findings, severity, and types.- Finding
Provider Severity The severity assigned to the finding by the finding provider.
- GeoLocation
Provides the latitude and longitude coordinates of a location.
- GetAdministrator
Account Request - GetAdministrator
Account Response - GetEnabled
Standards Request - GetEnabled
Standards Response - GetFindings
Request - GetFindings
Response - GetInsight
Results Request - GetInsight
Results Response - GetInsights
Request - GetInsights
Response - GetInvitations
Count Request - GetInvitations
Count Response - GetMaster
Account Request - GetMaster
Account Response - GetMembers
Request - GetMembers
Response - Icmp
Type Code An Internet Control Message Protocol (ICMP) type and code.
- Import
Findings Error The list of the findings that cannot be imported. For each finding, the list provides the error.
- Insight
Contains information about a Security Hub insight.
- Insight
Result Value The insight result values returned by the
GetInsightResultsoperation.- Insight
Results The insight results returned by the
GetInsightResultsoperation.- Invitation
Details about an invitation.
- Invite
Members Request - Invite
Members Response - IpFilter
The IP filter for querying findings.
- IpOrganization
Details Provides information about an internet provider.
- Ipv6
Cidr Block Association An IPV6 CIDR block association.
- Keyword
Filter A keyword filter for querying findings.
- List
Enabled Products ForImport Request - List
Enabled Products ForImport Response - List
Invitations Request - List
Invitations Response - List
Members Request - List
Members Response - List
Organization Admin Accounts Request - List
Organization Admin Accounts Response - List
Tags ForResource Request - List
Tags ForResource Response - Load
Balancer State Information about the state of the load balancer.
- Malware
A list of malware related to a finding.
- MapFilter
A map filter for querying findings. Each map filter provides the field to check, the value to look for, and the comparison operator.
- Member
The details about a member account.
- Network
The details of network-related information about a finding.
- Network
Connection Action Provided if
ActionTypeisNETWORK_CONNECTION. It provides details about the attempted network connection that was detected.- Network
Header Details about a network path component that occurs before or after the current component.
- Network
Path Component Information about a network path component.
- Network
Path Component Details Information about the destination of the next component in the network path.
- Note
A user-defined note added to a finding.
- Note
Update The updated note.
- Number
Filter A number filter for querying findings.
- Occurrences
The detected occurrences of sensitive data.
- Page
An occurrence of sensitive data in an Adobe Portable Document Format (PDF) file.
- Patch
Summary Provides an overview of the patch compliance status for an instance against a selected compliance standard.
- Port
Probe Action Provided if
ActionTypeisPORT_PROBE. It provides details about the attempted port probe that was detected.- Port
Probe Detail A port scan that was part of the port probe. For each scan, PortProbeDetails provides information about the local IP address and port that were scanned, and the remote IP address that the scan originated from.
- Port
Range A range of ports.
- Port
Range From To A range of ports.
- Process
Details The details of process-related information about a finding.
- Product
Contains details about a product.
- Range
Identifies where the sensitive data begins and ends.
- Recommendation
A recommendation on how to remediate the issue identified in a finding.
- Record
An occurrence of sensitive data in an Apache Avro object container or an Apache Parquet file.
- Related
Finding Details about a related finding.
- Remediation
Details about the remediation steps for a finding.
- Resource
A resource related to a finding.
- Resource
Details Additional details about a resource related to a finding.
To provide the details, use the object that corresponds to the resource type. For example, if the resource type is
AwsEc2Instance, then you use theAwsEc2Instanceobject to provide the details.If the type-specific object does not contain all of the fields you want to populate, then you use the
Otherobject to populate those additional fields.You also use the
Otherobject to populate the details when the selected type does not have a corresponding object.- Security
HubClient - A client for the AWS SecurityHub API.
- Security
HubResult Details about the account that was not processed.
- Sensitive
Data Detections The list of detected instances of sensitive data.
- Sensitive
Data Result Contains a detected instance of sensitive data that are based on built-in identifiers.
- Severity
The severity of the finding.
The finding provider can provide the initial severity. The finding provider can only update the severity if it has not been updated using
BatchUpdateFindings.The finding must have either
LabelorNormalizedpopulated. If only one of these attributes is populated, then Security Hub automatically populates the other one. If neither attribute is populated, then the finding is invalid.Labelis the preferred attribute.- Severity
Update Updates to the severity information for a finding.
- Software
Package Information about a software package.
- Sort
Criterion A collection of finding attributes used to sort findings.
- Standard
Provides information about a specific standard.
- Standards
Control Details for an individual security standard control.
- Standards
Subscription A resource that represents your subscription to a supported standard.
- Standards
Subscription Request The standard that you want to enable.
- Status
Reason Provides additional context for the value of
Compliance.Status.- String
Filter A string filter for querying findings.
- TagResource
Request - TagResource
Response - Threat
Intel Indicator Details about the threat intelligence related to a finding.
- Untag
Resource Request - Untag
Resource Response - Update
Action Target Request - Update
Action Target Response - Update
Findings Request - Update
Findings Response - Update
Insight Request - Update
Insight Response - Update
Organization Configuration Request - Update
Organization Configuration Response - Update
Security HubConfiguration Request - Update
Security HubConfiguration Response - Update
Standards Control Request - Update
Standards Control Response - Vulnerability
A vulnerability associated with a finding.
- Vulnerability
Vendor A vendor that generates a vulnerability report.
- WafAction
Details about the action that CloudFront or AWS WAF takes when a web request matches the conditions in the rule.
- WafExcluded
Rule Details about a rule to exclude from a rule group.
- WafOverride
Action Details about an override action for a rule.
- Workflow
Provides information about the status of the investigation into a finding.
- Workflow
Update Used to update information about the investigation into the finding.
Enums§
- Accept
Administrator Invitation Error - Errors returned by AcceptAdministratorInvitation
- Accept
Invitation Error - Errors returned by AcceptInvitation
- Batch
Disable Standards Error - Errors returned by BatchDisableStandards
- Batch
Enable Standards Error - Errors returned by BatchEnableStandards
- Batch
Import Findings Error - Errors returned by BatchImportFindings
- Batch
Update Findings Error - Errors returned by BatchUpdateFindings
- Create
Action Target Error - Errors returned by CreateActionTarget
- Create
Insight Error - Errors returned by CreateInsight
- Create
Members Error - Errors returned by CreateMembers
- Decline
Invitations Error - Errors returned by DeclineInvitations
- Delete
Action Target Error - Errors returned by DeleteActionTarget
- Delete
Insight Error - Errors returned by DeleteInsight
- Delete
Invitations Error - Errors returned by DeleteInvitations
- Delete
Members Error - Errors returned by DeleteMembers
- Describe
Action Targets Error - Errors returned by DescribeActionTargets
- Describe
HubError - Errors returned by DescribeHub
- Describe
Organization Configuration Error - Errors returned by DescribeOrganizationConfiguration
- Describe
Products Error - Errors returned by DescribeProducts
- Describe
Standards Controls Error - Errors returned by DescribeStandardsControls
- Describe
Standards Error - Errors returned by DescribeStandards
- Disable
Import Findings ForProduct Error - Errors returned by DisableImportFindingsForProduct
- Disable
Organization Admin Account Error - Errors returned by DisableOrganizationAdminAccount
- Disable
Security HubError - Errors returned by DisableSecurityHub
- Disassociate
From Administrator Account Error - Errors returned by DisassociateFromAdministratorAccount
- Disassociate
From Master Account Error - Errors returned by DisassociateFromMasterAccount
- Disassociate
Members Error - Errors returned by DisassociateMembers
- Enable
Import Findings ForProduct Error - Errors returned by EnableImportFindingsForProduct
- Enable
Organization Admin Account Error - Errors returned by EnableOrganizationAdminAccount
- Enable
Security HubError - Errors returned by EnableSecurityHub
- GetAdministrator
Account Error - Errors returned by GetAdministratorAccount
- GetEnabled
Standards Error - Errors returned by GetEnabledStandards
- GetFindings
Error - Errors returned by GetFindings
- GetInsight
Results Error - Errors returned by GetInsightResults
- GetInsights
Error - Errors returned by GetInsights
- GetInvitations
Count Error - Errors returned by GetInvitationsCount
- GetMaster
Account Error - Errors returned by GetMasterAccount
- GetMembers
Error - Errors returned by GetMembers
- Invite
Members Error - Errors returned by InviteMembers
- List
Enabled Products ForImport Error - Errors returned by ListEnabledProductsForImport
- List
Invitations Error - Errors returned by ListInvitations
- List
Members Error - Errors returned by ListMembers
- List
Organization Admin Accounts Error - Errors returned by ListOrganizationAdminAccounts
- List
Tags ForResource Error - Errors returned by ListTagsForResource
- TagResource
Error - Errors returned by TagResource
- Untag
Resource Error - Errors returned by UntagResource
- Update
Action Target Error - Errors returned by UpdateActionTarget
- Update
Findings Error - Errors returned by UpdateFindings
- Update
Insight Error - Errors returned by UpdateInsight
- Update
Organization Configuration Error - Errors returned by UpdateOrganizationConfiguration
- Update
Security HubConfiguration Error - Errors returned by UpdateSecurityHubConfiguration
- Update
Standards Control Error - Errors returned by UpdateStandardsControl
Traits§
- Security
Hub - Trait representing the capabilities of the AWS SecurityHub API. AWS SecurityHub clients implement this trait.