AWS securityhub: Add procedure for automation rule that updates resource criticality
Summary
Adds a new section describing how to create a Security Hub automation rule that updates the criticality of matching resources, including a note that self-hosted AI resources are excluded from automation-rule criticality. The intro sentence and table of contents were updated to mention updating resource criticality.
Security assessment
The diff documents a new console workflow for setting resource criticality via automation rules; it is feature how-to content rather than guidance on a security control, vulnerability, or hardening practice. No credentials, permissions, encryption, or exposure behavior is described, so security impact is tangential (criticality only affects finding prioritization).
Evidence
+ 6. Under **Update resource details** , for **Criticality** , choose the criticality to apply to resources that match your criteria. You can choose **Very High** , **High** , **Medium** , **Low** , or **Unknown** .
Diff
diff --git a/securityhub/latest/userguide/securityhub-v2-automation-rules-create.md b/securityhub/latest/userguide/securityhub-v2-automation-rules-create.md index 61af7f9..c0a0fa2 100644 --- a//securityhub/latest/userguide/securityhub-v2-automation-rules-create.md +++ b//securityhub/latest/userguide/securityhub-v2-automation-rules-create.md @@ -7 +7 @@ -Creating a rule that updates finding detailsCreating a rule for a third-party integration +Creating a rule that updates finding detailsCreating a rule that updates resource criticalityCreating a rule for a third-party integration @@ -11 +11 @@ Creating a rule that updates finding detailsCreating a rule for a third-party in -This topic describes how to create automation rules. You can use automation rules to update details for a finding or create a ticket for a third-party integration. You must create automation rules individually and in the AWS Region where you want them applied. However, if you create an automation rule in an aggregation Region, it is applied in all Regions. Otherwise, if you create an automation rule in a non-linked Region, it is applied only in that Region. +This topic describes how to create automation rules. You can use automation rules to update details for a finding, update the criticality of your resources, or create a ticket for a third-party integration. You must create automation rules individually and in the AWS Region where you want them applied. However, if you create an automation rule in an aggregation Region, it is applied in all Regions. Otherwise, if you create an automation rule in a non-linked Region, it is applied only in that Region. @@ -39,0 +40,31 @@ The following procedure describes how to create a rule that updates finding deta +## Creating a rule that updates resource criticality + +The following procedure describes how to create a rule that updates the criticality of resources that match your criteria. + + 1. Sign in to your AWS account. Open the Security Hub console at [https://console.aws.amazon.com/securityhub/v2/home](https://console.aws.amazon.com/securityhub/v2/home). + + 2. From the navigation pane, under **Management** , choose **Automations**. + + 3. Choose **Create rule**. + + 4. Under **Details** , enter a name for your automation rule. + + 1. (Optional) Enter a description for your automation rule. + + 5. Under **Actions** , choose **Update resource details**. You can search for criteria and add criteria in the search bar. To check if any resources match your criteria, choose **Preview matching resources**. + + 6. Under **Update resource details** , for **Criticality** , choose the criticality to apply to resources that match your criteria. You can choose **Very High** , **High** , **Medium** , **Low** , or **Unknown**. + +###### Note + +This rule does not apply to self-hosted AI resources. These resource types are excluded from automation-rule criticality. + + 7. Under **Rule settings** , select **Enabled** or **Disabled**. If you select **Enabled** , the automation rule is enabled and processes resources that match your criteria. If you select **Disabled** , the automation rule is disabled and does not process any resources. + + 8. (Optional) Under **Tags** , choose **Add new tag** to enter a key-value pair to be applied to your automation rule. + + 9. Choose **Create rule**. + + + +