AWS securityhub: Add resource rules and finding rules to Security Hub automation rules
Summary
Restructures the automation rules page to describe two rule types (finding rules and resource rules), adds a table of supported resource criteria fields and operators, documents settable resource criticality values, notes the shared 100-rule quota, and explains that rule order determines final resource criticality.
Security assessment
This is a feature/UX documentation update describing new automation-rule capabilities (resource criteria, criticality actions, ordering semantics). It changes how findings/resources are triaged but documents no vulnerability, credential, encryption, or access-control change, so it is not security-issue related.
Evidence
+Automation rules in Security Hub support two rule types: finding rules and resource rules. A finding rule matches findings and updates finding details or creates a ticket for a third-party integration. A resource rule matches resources and sets the criticality of those resources.
Diff
diff --git a/securityhub/latest/userguide/securityhub-v2-automation-rules.md b/securityhub/latest/userguide/securityhub-v2-automation-rules.md index 676510e..6be188c 100644 --- a//securityhub/latest/userguide/securityhub-v2-automation-rules.md +++ b//securityhub/latest/userguide/securityhub-v2-automation-rules.md @@ -7 +7 @@ -Automation rules and AWS RegionsRule actions and criteriaHow automation rules evaluate findingsHow automation rules are orderedThird-party integrationsScenarios where automation rules do not work +Automation rules and AWS RegionsTypes of automation rulesFinding rule actions and criteriaResource rule actions and criteriaHow automation rules evaluate findingsHow automation rules are orderedThird-party integrationsScenarios where automation rules do not work @@ -11 +11 @@ Automation rules and AWS RegionsRule actions and criteriaHow automation rules ev -With Security Hub, you can automate tasks like updating finding details and creating tickets for third-party integrations. +With Security Hub, you can automate tasks like updating finding details, updating the criticality of your resources, and creating tickets for third-party integrations. @@ -17 +17,7 @@ Automation rules can be created in one AWS Region and then applied in all config -## Rule actions and criteria +## Types of automation rules + +Automation rules in Security Hub support two rule types: finding rules and resource rules. A finding rule matches findings and updates finding details or creates a ticket for a third-party integration. A resource rule matches resources and sets the criticality of those resources. A single rule uses either finding criteria or resource criteria, but not both. A resource rule pairs resource criteria with the resource action to set criticality, and it cannot update finding details or create a ticket. + +Finding rules and resource rules share the same quota. You can create a maximum of 100 automation rules per account in each AWS Region, across both finding rules and resource rules. + +## Finding rule actions and criteria @@ -99,0 +106,47 @@ The following are the OCSF fields that can be updated using automation rules. +## Resource rule actions and criteria + +Resource criteria reference resource attributes. The filters supported for resource criteria are a subset of the filters supported for the [GetResourcesV2](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetResourcesV2.html) operation. You can combine filters with `AND` and `OR` operators, and nest them up to three levels deep, with a maximum of 100 filters per rule. + +Security Hub supports the following resource fields for resource criteria. + +Resource field | Console filter value | Filter operators | Field type +---|---|---|--- +`ResourceId` | `Resource ID` | `EQUALS, PREFIX, CONTAINS, NOT_CONTAINS, NOT_EQUALS, PREFIX_NOT_EQUALS` | `String` +`ResourceName` | `Resource name` | `EQUALS, PREFIX, CONTAINS, NOT_CONTAINS, NOT_EQUALS, PREFIX_NOT_EQUALS` | `String` +`ResourceType` | `Resource type` | `EQUALS, PREFIX, CONTAINS, NOT_CONTAINS, NOT_EQUALS, PREFIX_NOT_EQUALS` | `String` +`ResourceCategory` | `Resource category` | `EQUALS, PREFIX, CONTAINS, NOT_CONTAINS, NOT_EQUALS, PREFIX_NOT_EQUALS` | `String` +`ResourceSubCategory` | `Resource sub-category` | `EQUALS, PREFIX, CONTAINS, NOT_CONTAINS, NOT_EQUALS, PREFIX_NOT_EQUALS` | `String` +`ResourceProvider` | `Cloud provider` | `EQUALS, PREFIX, CONTAINS, NOT_CONTAINS, NOT_EQUALS, PREFIX_NOT_EQUALS` | `String` +`ResourceCloudPartition` | `Resource partition` | `EQUALS, PREFIX, CONTAINS, NOT_CONTAINS, NOT_EQUALS, PREFIX_NOT_EQUALS` | `String` +`ResourceRegion` | `Region` | `EQUALS, PREFIX, CONTAINS, NOT_CONTAINS, NOT_EQUALS, PREFIX_NOT_EQUALS` | `String` +`ResourceGuid` | `Resource GUID` | `EQUALS, PREFIX, CONTAINS, NOT_CONTAINS, NOT_EQUALS, PREFIX_NOT_EQUALS` | `String` +`AccountId` | `Finding account` | `EQUALS, PREFIX, CONTAINS, NOT_CONTAINS, NOT_EQUALS, PREFIX_NOT_EQUALS` | `String` +`AccountName` | `Account name` | `EQUALS, PREFIX, CONTAINS, NOT_CONTAINS, NOT_EQUALS, PREFIX_NOT_EQUALS` | `String` +`Region` | `Finding region` | `EQUALS, PREFIX, CONTAINS, NOT_CONTAINS, NOT_EQUALS, PREFIX_NOT_EQUALS` | `String` +`ResourceOwnerAccountId` | `Account` | `EQUALS, PREFIX, CONTAINS, NOT_CONTAINS, NOT_EQUALS, PREFIX_NOT_EQUALS` | `String` +`ResourceOwnerOrgId` | `Organization` | `EQUALS, PREFIX, CONTAINS, NOT_CONTAINS, NOT_EQUALS, PREFIX_NOT_EQUALS` | `String` +`ResourceCreationTime` | `Created at` | `Start, End, DateRange` | `Date` +`ResourceDetailCaptureTime` | `Resource detail capture time` | `Start, End, DateRange` | `Date` +`ResourceTags` | `Resource tags` | `EQUALS, NOT_EQUALS, CONTAINS, NOT_CONTAINS` | `Map` + +Security Hub does not support number filters. It does not support the `CONTAINS_WORD` operator for resource criteria. For the complete list of resource filter fields and their allowed values, see [ResourcesFilters](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_ResourcesFilters.html) and [GetResourcesV2](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetResourcesV2.html) in the _Security Hub API Reference_. + +###### Resource fields that can be updated + +A resource rule updates the criticality of resources that match your criteria. You can set the criticality to one of the following values, listed from highest to lowest. + + * `Very High` + + * `High` + + * `Medium` + + * `Low` + + * `Unknown` + + + + +Resource rules do not apply to self-hosted AI resources. These resource types are excluded from automation-rule criticality, and they continue to receive inferred criticality. + @@ -115,0 +169,2 @@ When multiple rule actions relate to the same finding or finding field, the rule +Rule order also determines the final criticality of a resource. When multiple resource rules match the same resource, the rule that applies last determines the criticality of the resource. +