AWS securityhub documentation change
Summary
Updated documentation for workflow status management, including clarifications about status persistence, formatting changes, console navigation updates, and expanded guidance on automation rules for workflow status changes.
Security assessment
The changes primarily improve clarity and expand documentation about existing security features (workflow status management and automation rules). While automation rules are a security feature, there is no evidence of a specific security vulnerability being addressed. The updates enhance guidance for security operations but do not directly resolve a security flaw.
Diff
diff --git a/securityhub/latest/userguide/findings-workflow-status.md b/securityhub/latest/userguide/findings-workflow-status.md index 1999466d3..c30299398 100644 --- a//securityhub/latest/userguide/findings-workflow-status.md +++ b//securityhub/latest/userguide/findings-workflow-status.md @@ -9 +9 @@ Setting the workflow status of findings -Workflow status tracks the progress of your investigation into a finding. The workflow status is specific to an individual finding. It doesn't affect the generation of new findings. For example, setting the workflow status of a finding to `SUPPRESSED` or `RESOLVED` doesn't prevent AWS Security Hub from generating a new finding for the same issue. +Workflow status tracks the progress of your investigation into a finding. Workflow status is specific to an individual finding. In addition, it doesn't affect the generation of new findings. For example, if you change the workflow status of a finding to `SUPPRESSED` or `RESOLVED`, your change doesn't prevent AWS Security Hub from generating a new finding for the same issue. @@ -11 +11 @@ Workflow status tracks the progress of your investigation into a finding. The wo -Workflow status can have the following values: +The workflow status of a finding can be one of the following values. @@ -13 +13 @@ Workflow status can have the following values: -`NEW` +**NEW** @@ -31 +31 @@ These changes imply that additional investigation is required. -`NOTIFIED` +**NOTIFIED** @@ -45 +45 @@ If one of the following occurs, the workflow status is changed automatically fro -`SUPPRESSED` +**SUPPRESSED** @@ -52 +52 @@ The workflow status of a `SUPPRESSED` finding does not change if `RecordState` c -`RESOLVED` +**RESOLVED** @@ -68 +68 @@ In those cases, the workflow status is automatically reset to `NEW`. -For findings from controls, if `Compliance.Status` is `PASSED`, then Security Hub automatically sets the workflow status to `RESOLVED`. +For findings from controls, if `Compliance.Status` is `PASSED`, Security Hub automatically sets the workflow status to `RESOLVED`. @@ -72 +72 @@ For findings from controls, if `Compliance.Status` is `PASSED`, then Security Hu -Choose your preferred method, and follow the steps to set the workflow status of one or more findings. +To change the workflow status of one or more findings, you can use the Security Hub console or the Security Hub API. If you change the workflow status of a finding, note that it can take several minutes for Security Hub to process your request and update the finding. @@ -74 +74,5 @@ Choose your preferred method, and follow the steps to set the workflow status of -To automatically update the workflow status of specific findings, see [Understanding automation rules in Security Hub](./automation-rules.html). +###### Tip + +You can also change the workflow status of findings automatically by using automation rules. With automation rules, you configure Security Hub to automatically update the workflow status of findings based on criteria that you specify. For more information, see [Understanding automation rules in Security Hub](./automation-rules.html). + +To change the workflow status of one or more findings, choose your preferred method and follow the steps. @@ -79 +83 @@ Security Hub console -###### To set the workflow status of findings +###### To change the workflow status of findings @@ -83 +87 @@ Security Hub console - 2. To display a finding list, do one of the following: + 2. In the navigation pane, do one of the following to display a table of findings: @@ -85 +89 @@ Security Hub console - * In the Security Hub navigation pane, choose **Findings**. + * Choose **Findings**. @@ -87 +91 @@ Security Hub console - * In the Security Hub navigation pane, choose **Insights**. Choose an insight. Then on the results list, choose an insight result. + * Choose **Insights**. Then choose an insight. In the insight results, choose a result. @@ -89 +93 @@ Security Hub console - * In the Security Hub navigation pane, choose **Integrations**. Choose **See findings** for an integration. + * Choose **Integrations**. Then, in the section for the integration, choose **See findings**. @@ -91 +95 @@ Security Hub console - * In the Security Hub navigation pane, choose **Security standards**. Choose **View results** to display a list of controls. Then, select a control to see a list of findings for that control. + * Choose **Security standards**. Then, in the section for the standard, choose **View results**. In the table of controls, choose a control to display findings for the control. @@ -93 +97 @@ Security Hub console - 3. In the finding list, select the check box for each finding that you want to update. + 3. In the findings table, select the check box for each finding whose workflow status you want to change. @@ -95 +99 @@ Security Hub console - 4. At the top of the list, for **Workflow status** , choose the status. + 4. At the top of the page, choose **Workflow status** , and then choose the new workflow status for the selected findings. @@ -97 +101 @@ Security Hub console - 5. In the **Set workflow status** dialog box, provide an optional note that details the reason for updating the workflow status. Choose **Set status**. + 5. In the **Set workflow status** dialog box, optionally enter a note that details the reason for changing the workflow status. Then choose **Set status**. @@ -105 +109 @@ Security Hub API -Invoke the [`BatchUpdateFindings`](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_BatchUpdateFindings.html) API. Provide both the finding ID and the ARN of the product that generated the finding. You can get these details by invoking the [`GetFindings`](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetFindings.html) API. +Use the [BatchUpdateFindings](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_BatchUpdateFindings.html) operation. Provide both the finding ID and the ARN of the product that generated the finding. You can get these details by using the [GetFindings](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetFindings.html) operation. @@ -110 +114 @@ AWS CLI -Run the [`batch-update-findings`](https://docs.aws.amazon.com/cli/latest/reference/securityhub/batch-update-findings.html) command. Provide both the finding ID and the ARN of the product that generated the finding. You can get these details by running the [`get-findings`](https://docs.aws.amazon.com/cli/latest/reference/securityhub/get-findings.html) command. +Run the [batch-update-findings](https://docs.aws.amazon.com/cli/latest/reference/securityhub/batch-update-findings.html) command. Provide both the finding ID and the ARN of the product that generated the finding. You can get these details by running the [get-findings](https://docs.aws.amazon.com/cli/latest/reference/securityhub/get-findings.html) command.