AWS AWSCloudFormation medium security documentation change
Summary
Updated allowed values for OCSF string filters, adding 'vendor_attributes.severity' and removing 'metadata.uid'
Security assessment
Adjusts filtering capabilities for security findings, potentially improving detection accuracy. The removal of 'metadata.uid' could impact existing rules, but the addition of severity attributes enhances filtering.
Diff
diff --git a/AWSCloudFormation/latest/TemplateReference/aws-properties-securityhub-automationrulev2-ocsfstringfilter.md b/AWSCloudFormation/latest/TemplateReference/aws-properties-securityhub-automationrulev2-ocsfstringfilter.md index 3b8c154d9..8282ffd51 100644 --- a//AWSCloudFormation/latest/TemplateReference/aws-properties-securityhub-automationrulev2-ocsfstringfilter.md +++ b//AWSCloudFormation/latest/TemplateReference/aws-properties-securityhub-automationrulev2-ocsfstringfilter.md @@ -43 +43 @@ _Required_ : Yes - _Allowed values_ : `metadata.uid | activity_name | cloud.account.name | cloud.account.uid | cloud.provider | cloud.region | compliance.assessments.category | compliance.assessments.name | compliance.control | compliance.status | compliance.standards | finding_info.desc | finding_info.src_url | finding_info.title | finding_info.types | finding_info.uid | finding_info.related_events.uid | finding_info.related_events.product.uid | finding_info.related_events.title | metadata.product.feature.uid | metadata.product.name | metadata.product.uid | metadata.product.vendor_name | remediation.desc | remediation.references | resources.cloud_partition | resources.name | resources.region | resources.type | resources.uid | severity | status | comment | vulnerabilities.fix_coverage | class_name` + _Allowed values_ : `activity_name | cloud.account.name | cloud.account.uid | cloud.provider | cloud.region | compliance.assessments.category | compliance.assessments.name | compliance.control | compliance.status | compliance.standards | finding_info.desc | finding_info.src_url | finding_info.title | finding_info.types | finding_info.uid | finding_info.related_events.uid | finding_info.related_events.product.uid | finding_info.related_events.title | metadata.product.feature.uid | metadata.product.name | metadata.product.uid | metadata.product.vendor_name | remediation.desc | remediation.references | resources.cloud_partition | resources.name | resources.region | resources.type | resources.uid | vulnerabilities.fix_coverage | class_name | vendor_attributes.severity`