paws.security.identity (version 0.1.9)

securityhub_batch_update_findings: Used by Security Hub customers to update information about their investigation into a finding

Description

Used by Security Hub customers to update information about their investigation into a finding. Requested by master accounts or member accounts. Master accounts can update findings for their account and their member accounts. Member accounts can update findings for their account.

Usage

securityhub_batch_update_findings(FindingIdentifiers, Note, Severity,
  VerificationState, Confidence, Criticality, Types, UserDefinedFields,
  Workflow, RelatedFindings)

Arguments

FindingIdentifiers

[required] The list of findings to update. BatchUpdateFindings can be used to update up to 100 findings at a time.

For each finding, the list provides the finding identifier and the ARN of the finding provider.

Note

Severity

Used to update the finding severity.

VerificationState

Indicates the veracity of a finding.

The available values for VerificationState are as follows.

• UNKNOWN -- The default disposition of a security finding

• TRUE_POSITIVE -- The security finding is confirmed

• FALSE_POSITIVE -- The security finding was determined to be a false alarm

• BENIGN_POSITIVE -- A special case of TRUE_POSITIVE where the finding doesn\'t pose any threat, is expected, or both

Confidence

The updated value for the finding confidence. Confidence is defined as the likelihood that a finding accurately identifies the behavior or issue that it was intended to identify.

Confidence is scored on a 0-100 basis using a ratio scale, where 0 means zero percent confidence and 100 means 100 percent confidence.

Criticality

The updated value for the level of importance assigned to the resources associated with the findings.

A score of 0 means that the underlying resources have no criticality, and a score of 100 is reserved for the most critical resources.

Types

One or more finding types in the format of namespace/category/classifier that classify a finding.

Valid namespace values are as follows.

• Software and Configuration Checks

• TTPs

• Effects

• Unusual Behaviors

• Sensitive Data Identifications

UserDefinedFields

A list of name/value string pairs associated with the finding. These are custom, user-defined fields added to a finding.

Workflow

Used to update the workflow status of a finding.

The workflow status indicates the progress of the investigation into the finding.

RelatedFindings

A list of findings that are related to the updated findings.

Request syntax

svc$batch_update_findings(
  FindingIdentifiers = list(
    list(
      Id = "string",
      ProductArn = "string"
    )
  ),
  Note = list(
    Text = "string",
    UpdatedBy = "string"
  ),
  Severity = list(
    Normalized = 123,
    Product = 123.0,
    Label = "INFORMATIONAL"|"LOW"|"MEDIUM"|"HIGH"|"CRITICAL"
  ),
  VerificationState = "UNKNOWN"|"TRUE_POSITIVE"|"FALSE_POSITIVE"|"BENIGN_POSITIVE",
  Confidence = 123,
  Criticality = 123,
  Types = list(
    "string"
  ),
  UserDefinedFields = list(
    "string"
  ),
  Workflow = list(
    Status = "NEW"|"NOTIFIED"|"RESOLVED"|"SUPPRESSED"
  ),
  RelatedFindings = list(
    list(
      ProductArn = "string",
      Id = "string"
    )
  )
)

Details

Updates from BatchUpdateFindings do not affect the value of UpdatedAt for a finding.

Master accounts can use BatchUpdateFindings to update the following finding fields and objects.

• Confidence

• Criticality

• Note

• RelatedFindings

• Severity

• Types

• UserDefinedFields

• VerificationState

• Workflow

Member accounts can only use BatchUpdateFindings to update the Note object.