Create Insight
securityhub_create_insight | R Documentation |
Creates a custom insight in Security Hub¶
Description¶
Creates a custom insight in Security Hub. An insight is a consolidation of findings that relate to a security issue that requires attention or remediation.
To group the related findings in the insight, use the
GroupByAttribute
.
Usage¶
Arguments¶
Name
[required] The name of the custom insight to create.
Filters
[required] One or more attributes used to filter the findings included in the insight. The insight only includes findings that match the criteria defined in the filters.
GroupByAttribute
[required] The attribute used to group the findings for the insight. The grouping attribute identifies the type of item that the insight applies to. For example, if an insight is grouped by resource identifier, then the insight produces a list of resource identifiers.
Value¶
A list with the following syntax:
Request syntax¶
svc$create_insight(
Name = "string",
Filters = list(
ProductArn = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
AwsAccountId = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
Id = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
GeneratorId = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
Region = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
Type = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
FirstObservedAt = list(
list(
Start = "string",
End = "string",
DateRange = list(
Value = 123,
Unit = "DAYS"
)
)
),
LastObservedAt = list(
list(
Start = "string",
End = "string",
DateRange = list(
Value = 123,
Unit = "DAYS"
)
)
),
CreatedAt = list(
list(
Start = "string",
End = "string",
DateRange = list(
Value = 123,
Unit = "DAYS"
)
)
),
UpdatedAt = list(
list(
Start = "string",
End = "string",
DateRange = list(
Value = 123,
Unit = "DAYS"
)
)
),
SeverityProduct = list(
list(
Gte = 123.0,
Lte = 123.0,
Eq = 123.0,
Gt = 123.0,
Lt = 123.0
)
),
SeverityNormalized = list(
list(
Gte = 123.0,
Lte = 123.0,
Eq = 123.0,
Gt = 123.0,
Lt = 123.0
)
),
SeverityLabel = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
Confidence = list(
list(
Gte = 123.0,
Lte = 123.0,
Eq = 123.0,
Gt = 123.0,
Lt = 123.0
)
),
Criticality = list(
list(
Gte = 123.0,
Lte = 123.0,
Eq = 123.0,
Gt = 123.0,
Lt = 123.0
)
),
Title = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
Description = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
RecommendationText = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
SourceUrl = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
ProductFields = list(
list(
Key = "string",
Value = "string",
Comparison = "EQUALS"|"NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
ProductName = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
CompanyName = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
UserDefinedFields = list(
list(
Key = "string",
Value = "string",
Comparison = "EQUALS"|"NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
MalwareName = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
MalwareType = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
MalwarePath = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
MalwareState = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
NetworkDirection = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
NetworkProtocol = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
NetworkSourceIpV4 = list(
list(
Cidr = "string"
)
),
NetworkSourceIpV6 = list(
list(
Cidr = "string"
)
),
NetworkSourcePort = list(
list(
Gte = 123.0,
Lte = 123.0,
Eq = 123.0,
Gt = 123.0,
Lt = 123.0
)
),
NetworkSourceDomain = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
NetworkSourceMac = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
NetworkDestinationIpV4 = list(
list(
Cidr = "string"
)
),
NetworkDestinationIpV6 = list(
list(
Cidr = "string"
)
),
NetworkDestinationPort = list(
list(
Gte = 123.0,
Lte = 123.0,
Eq = 123.0,
Gt = 123.0,
Lt = 123.0
)
),
NetworkDestinationDomain = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
ProcessName = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
ProcessPath = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
ProcessPid = list(
list(
Gte = 123.0,
Lte = 123.0,
Eq = 123.0,
Gt = 123.0,
Lt = 123.0
)
),
ProcessParentPid = list(
list(
Gte = 123.0,
Lte = 123.0,
Eq = 123.0,
Gt = 123.0,
Lt = 123.0
)
),
ProcessLaunchedAt = list(
list(
Start = "string",
End = "string",
DateRange = list(
Value = 123,
Unit = "DAYS"
)
)
),
ProcessTerminatedAt = list(
list(
Start = "string",
End = "string",
DateRange = list(
Value = 123,
Unit = "DAYS"
)
)
),
ThreatIntelIndicatorType = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
ThreatIntelIndicatorValue = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
ThreatIntelIndicatorCategory = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
ThreatIntelIndicatorLastObservedAt = list(
list(
Start = "string",
End = "string",
DateRange = list(
Value = 123,
Unit = "DAYS"
)
)
),
ThreatIntelIndicatorSource = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
ThreatIntelIndicatorSourceUrl = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
ResourceType = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
ResourceId = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
ResourcePartition = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
ResourceRegion = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
ResourceTags = list(
list(
Key = "string",
Value = "string",
Comparison = "EQUALS"|"NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
ResourceAwsEc2InstanceType = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
ResourceAwsEc2InstanceImageId = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
ResourceAwsEc2InstanceIpV4Addresses = list(
list(
Cidr = "string"
)
),
ResourceAwsEc2InstanceIpV6Addresses = list(
list(
Cidr = "string"
)
),
ResourceAwsEc2InstanceKeyName = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
ResourceAwsEc2InstanceIamInstanceProfileArn = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
ResourceAwsEc2InstanceVpcId = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
ResourceAwsEc2InstanceSubnetId = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
ResourceAwsEc2InstanceLaunchedAt = list(
list(
Start = "string",
End = "string",
DateRange = list(
Value = 123,
Unit = "DAYS"
)
)
),
ResourceAwsS3BucketOwnerId = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
ResourceAwsS3BucketOwnerName = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
ResourceAwsIamAccessKeyUserName = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
ResourceAwsIamAccessKeyPrincipalName = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
ResourceAwsIamAccessKeyStatus = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
ResourceAwsIamAccessKeyCreatedAt = list(
list(
Start = "string",
End = "string",
DateRange = list(
Value = 123,
Unit = "DAYS"
)
)
),
ResourceAwsIamUserUserName = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
ResourceContainerName = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
ResourceContainerImageId = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
ResourceContainerImageName = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
ResourceContainerLaunchedAt = list(
list(
Start = "string",
End = "string",
DateRange = list(
Value = 123,
Unit = "DAYS"
)
)
),
ResourceDetailsOther = list(
list(
Key = "string",
Value = "string",
Comparison = "EQUALS"|"NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
ComplianceStatus = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
VerificationState = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
WorkflowState = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
WorkflowStatus = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
RecordState = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
RelatedFindingsProductArn = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
RelatedFindingsId = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
NoteText = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
NoteUpdatedAt = list(
list(
Start = "string",
End = "string",
DateRange = list(
Value = 123,
Unit = "DAYS"
)
)
),
NoteUpdatedBy = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
Keyword = list(
list(
Value = "string"
)
),
FindingProviderFieldsConfidence = list(
list(
Gte = 123.0,
Lte = 123.0,
Eq = 123.0,
Gt = 123.0,
Lt = 123.0
)
),
FindingProviderFieldsCriticality = list(
list(
Gte = 123.0,
Lte = 123.0,
Eq = 123.0,
Gt = 123.0,
Lt = 123.0
)
),
FindingProviderFieldsRelatedFindingsId = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
FindingProviderFieldsRelatedFindingsProductArn = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
FindingProviderFieldsSeverityLabel = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
FindingProviderFieldsSeverityOriginal = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
FindingProviderFieldsTypes = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
Sample = list(
list(
Value = TRUE|FALSE
)
),
ComplianceSecurityControlId = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
ComplianceAssociatedStandardsId = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
VulnerabilitiesExploitAvailable = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
VulnerabilitiesFixAvailable = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
ComplianceSecurityControlParametersName = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
ComplianceSecurityControlParametersValue = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
AwsAccountName = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
ResourceApplicationName = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
),
ResourceApplicationArn = list(
list(
Value = "string",
Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
)
)
),
GroupByAttribute = "string"
)
Examples¶
## Not run:
# The following example creates a custom insight in Security Hub. An
# insight is a collection of findings that relate to a security issue.
svc$create_insight(
Filters = list(
ResourceType = list(
list(
Comparison = "EQUALS",
Value = "AwsIamRole"
)
),
SeverityLabel = list(
list(
Comparison = "EQUALS",
Value = "CRITICAL"
)
)
),
GroupByAttribute = "ResourceId",
Name = "Critical role findings"
)
## End(Not run)