@Generated(value="software.amazon.awssdk:codegen") public final class AwsSecurityFinding extends Object implements SdkPojo, Serializable, ToCopyableBuilder<AwsSecurityFinding.Builder,AwsSecurityFinding>
Provides a consistent format for Security Hub findings. AwsSecurityFinding format allows you to share
findings between Amazon Web Services security services and third-party solutions.
A finding is a potential security issue generated either by Amazon Web Services services or by the integrated third-party solutions and standards checks.
| Modifier and Type | Class and Description |
|---|---|
static interface |
AwsSecurityFinding.Builder |
| Modifier and Type | Method and Description |
|---|---|
Action |
action()
Provides details about an action that affects or that was taken on a resource.
|
String |
awsAccountId()
The Amazon Web Services account ID that a finding is generated in.
|
static AwsSecurityFinding.Builder |
builder() |
String |
companyName()
The name of the company for the product that generated the finding.
|
Compliance |
compliance()
This data type is exclusive to findings that are generated as the result of a check run against a specific rule
in a supported security standard, such as CIS Amazon Web Services Foundations.
|
Integer |
confidence()
A finding's confidence.
|
String |
createdAt()
Indicates when the security findings provider created the potential security issue that a finding captured.
|
Integer |
criticality()
The level of importance assigned to the resources associated with the finding.
|
String |
description()
A finding's description.
|
boolean |
equals(Object obj) |
boolean |
equalsBySdkFields(Object obj) |
FindingProviderFields |
findingProviderFields()
In a
BatchImportFindings request, finding providers use FindingProviderFields to
provide and update their own values for confidence, criticality, related findings, severity, and types. |
String |
firstObservedAt()
Indicates when the security findings provider first observed the potential security issue that a finding
captured.
|
String |
generatorId()
The identifier for the solution-specific component (a discrete unit of logic) that generated a finding.
|
<T> Optional<T> |
getValueForField(String fieldName,
Class<T> clazz) |
int |
hashCode() |
boolean |
hasMalware()
For responses, this returns true if the service returned a value for the Malware property.
|
boolean |
hasNetworkPath()
For responses, this returns true if the service returned a value for the NetworkPath property.
|
boolean |
hasProductFields()
For responses, this returns true if the service returned a value for the ProductFields property.
|
boolean |
hasRelatedFindings()
For responses, this returns true if the service returned a value for the RelatedFindings property.
|
boolean |
hasResources()
For responses, this returns true if the service returned a value for the Resources property.
|
boolean |
hasThreatIntelIndicators()
For responses, this returns true if the service returned a value for the ThreatIntelIndicators property.
|
boolean |
hasThreats()
For responses, this returns true if the service returned a value for the Threats property.
|
boolean |
hasTypes()
For responses, this returns true if the service returned a value for the Types property.
|
boolean |
hasUserDefinedFields()
For responses, this returns true if the service returned a value for the UserDefinedFields property.
|
boolean |
hasVulnerabilities()
For responses, this returns true if the service returned a value for the Vulnerabilities property.
|
String |
id()
The security findings provider-specific identifier for a finding.
|
String |
lastObservedAt()
Indicates when the security findings provider most recently observed the potential security issue that a finding
captured.
|
List<Malware> |
malware()
A list of malware related to a finding.
|
Network |
network()
The details of network-related information about a finding.
|
List<NetworkPathComponent> |
networkPath()
Provides information about a network path that is relevant to a finding.
|
Note |
note()
A user-defined note added to a finding.
|
PatchSummary |
patchSummary()
Provides an overview of the patch compliance status for an instance against a selected compliance standard.
|
ProcessDetails |
process()
The details of process-related information about a finding.
|
String |
productArn()
The ARN generated by Security Hub that uniquely identifies a product that generates findings.
|
Map<String,String> |
productFields()
A data type where security findings providers can include additional solution-specific details that aren't part
of the defined
AwsSecurityFinding format. |
String |
productName()
The name of the product that generated the finding.
|
RecordState |
recordState()
The record state of a finding.
|
String |
recordStateAsString()
The record state of a finding.
|
String |
region()
The Region from which the finding was generated.
|
List<RelatedFinding> |
relatedFindings()
A list of related findings.
|
Remediation |
remediation()
A data type that describes the remediation options for a finding.
|
List<Resource> |
resources()
A set of resource data types that describe the resources that the finding refers to.
|
Boolean |
sample()
Indicates whether the finding is a sample finding.
|
String |
schemaVersion()
The schema version that a finding is formatted for.
|
List<SdkField<?>> |
sdkFields() |
static Class<? extends AwsSecurityFinding.Builder> |
serializableBuilderClass() |
Severity |
severity()
A finding's severity.
|
String |
sourceUrl()
A URL that links to a page about the current finding in the security findings provider's solution.
|
List<ThreatIntelIndicator> |
threatIntelIndicators()
Threat intelligence details related to a finding.
|
List<Threat> |
threats()
Details about the threat detected in a security finding and the file paths that were affected by the threat.
|
String |
title()
A finding's title.
|
AwsSecurityFinding.Builder |
toBuilder() |
String |
toString()
Returns a string representation of this object.
|
List<String> |
types()
One or more finding types in the format of
namespace/category/classifier that classify a finding. |
String |
updatedAt()
Indicates when the security findings provider last updated the finding record.
|
Map<String,String> |
userDefinedFields()
A list of name/value string pairs associated with the finding.
|
VerificationState |
verificationState()
Indicates the veracity of a finding.
|
String |
verificationStateAsString()
Indicates the veracity of a finding.
|
List<Vulnerability> |
vulnerabilities()
Provides a list of vulnerabilities associated with the findings.
|
Workflow |
workflow()
Provides information about the status of the investigation into a finding.
|
WorkflowState |
workflowState()
The workflow state of a finding.
|
String |
workflowStateAsString()
The workflow state of a finding.
|
clone, finalize, getClass, notify, notifyAll, wait, wait, waitcopypublic final String schemaVersion()
The schema version that a finding is formatted for.
public final String id()
The security findings provider-specific identifier for a finding.
public final String productArn()
The ARN generated by Security Hub that uniquely identifies a product that generates findings. This can be the ARN for a third-party product that is integrated with Security Hub, or the ARN for a custom integration.
public final String productName()
The name of the product that generated the finding.
Security Hub populates this attribute automatically for each finding. You cannot update this attribute with
BatchImportFindings or BatchUpdateFindings. The exception to this is a custom
integration.
When you use the Security Hub console or API to filter findings by product name, you use this attribute.
Security Hub populates this attribute automatically for each finding. You cannot update this attribute
with BatchImportFindings or BatchUpdateFindings. The exception to this is a
custom integration.
When you use the Security Hub console or API to filter findings by product name, you use this attribute.
public final String companyName()
The name of the company for the product that generated the finding.
Security Hub populates this attribute automatically for each finding. You cannot update this attribute with
BatchImportFindings or BatchUpdateFindings. The exception to this is a custom
integration.
When you use the Security Hub console or API to filter findings by company name, you use this attribute.
Security Hub populates this attribute automatically for each finding. You cannot update this attribute
with BatchImportFindings or BatchUpdateFindings. The exception to this is a
custom integration.
When you use the Security Hub console or API to filter findings by company name, you use this attribute.
public final String region()
The Region from which the finding was generated.
Security Hub populates this attribute automatically for each finding. You cannot update it using
BatchImportFindings or BatchUpdateFindings.
Security Hub populates this attribute automatically for each finding. You cannot update it using
BatchImportFindings or BatchUpdateFindings.
public final String generatorId()
The identifier for the solution-specific component (a discrete unit of logic) that generated a finding. In various security findings providers' solutions, this generator can be called a rule, a check, a detector, a plugin, etc.
public final String awsAccountId()
The Amazon Web Services account ID that a finding is generated in.
public final boolean hasTypes()
isEmpty() method on the property). This is useful
because the SDK will never return a null collection or map, but you may need to differentiate between the service
returning nothing (or null) and the service returning an empty collection or map. For requests, this returns true
if a value for the property was specified in the request builder, and false if a value was not specified.public final List<String> types()
One or more finding types in the format of namespace/category/classifier that classify a finding.
Valid namespace values are: Software and Configuration Checks | TTPs | Effects | Unusual Behaviors | Sensitive Data Identifications
Attempts to modify the collection returned by this method will result in an UnsupportedOperationException.
This method will never return null. If you would like to know whether the service returned this field (so that
you can differentiate between null and empty), you can use the hasTypes() method.
namespace/category/classifier that classify a
finding.
Valid namespace values are: Software and Configuration Checks | TTPs | Effects | Unusual Behaviors | Sensitive Data Identifications
public final String firstObservedAt()
Indicates when the security findings provider first observed the potential security issue that a finding captured.
Uses the date-time format specified in RFC
3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces, and date and time should be
separated by T. For example, 2020-03-22T13:22:13.933Z.
Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time
Format. The value cannot contain spaces, and date and time should be separated by T. For
example, 2020-03-22T13:22:13.933Z.
public final String lastObservedAt()
Indicates when the security findings provider most recently observed the potential security issue that a finding captured.
Uses the date-time format specified in RFC
3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces, and date and time should be
separated by T. For example, 2020-03-22T13:22:13.933Z.
Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time
Format. The value cannot contain spaces, and date and time should be separated by T. For
example, 2020-03-22T13:22:13.933Z.
public final String createdAt()
Indicates when the security findings provider created the potential security issue that a finding captured.
Uses the date-time format specified in RFC
3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces, and date and time should be
separated by T. For example, 2020-03-22T13:22:13.933Z.
Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time
Format. The value cannot contain spaces, and date and time should be separated by T. For
example, 2020-03-22T13:22:13.933Z.
public final String updatedAt()
Indicates when the security findings provider last updated the finding record.
Uses the date-time format specified in RFC
3339 section 5.6, Internet Date/Time Format. The value cannot contain spaces, and date and time should be
separated by T. For example, 2020-03-22T13:22:13.933Z.
Uses the date-time format specified in RFC 3339 section 5.6, Internet Date/Time
Format. The value cannot contain spaces, and date and time should be separated by T. For
example, 2020-03-22T13:22:13.933Z.
public final Severity severity()
A finding's severity.
public final Integer confidence()
A finding's confidence. Confidence is defined as the likelihood that a finding accurately identifies the behavior or issue that it was intended to identify.
Confidence is scored on a 0-100 basis using a ratio scale, where 0 means zero percent confidence and 100 means 100 percent confidence.
Confidence is scored on a 0-100 basis using a ratio scale, where 0 means zero percent confidence and 100 means 100 percent confidence.
public final Integer criticality()
The level of importance assigned to the resources associated with the finding.
A score of 0 means that the underlying resources have no criticality, and a score of 100 is reserved for the most critical resources.
A score of 0 means that the underlying resources have no criticality, and a score of 100 is reserved for the most critical resources.
public final String title()
A finding's title.
In this release, Title is a required property.
In this release, Title is a required property.
public final String description()
A finding's description.
In this release, Description is a required property.
In this release, Description is a required property.
public final Remediation remediation()
A data type that describes the remediation options for a finding.
public final String sourceUrl()
A URL that links to a page about the current finding in the security findings provider's solution.
public final boolean hasProductFields()
isEmpty() method on the property).
This is useful because the SDK will never return a null collection or map, but you may need to differentiate
between the service returning nothing (or null) and the service returning an empty collection or map. For
requests, this returns true if a value for the property was specified in the request builder, and false if a
value was not specified.public final Map<String,String> productFields()
A data type where security findings providers can include additional solution-specific details that aren't part
of the defined AwsSecurityFinding format.
Can contain up to 50 key-value pairs. For each key-value pair, the key can contain up to 128 characters, and the value can contain up to 2048 characters.
Attempts to modify the collection returned by this method will result in an UnsupportedOperationException.
This method will never return null. If you would like to know whether the service returned this field (so that
you can differentiate between null and empty), you can use the hasProductFields() method.
AwsSecurityFinding format.
Can contain up to 50 key-value pairs. For each key-value pair, the key can contain up to 128 characters, and the value can contain up to 2048 characters.
public final boolean hasUserDefinedFields()
isEmpty() method on the property).
This is useful because the SDK will never return a null collection or map, but you may need to differentiate
between the service returning nothing (or null) and the service returning an empty collection or map. For
requests, this returns true if a value for the property was specified in the request builder, and false if a
value was not specified.public final Map<String,String> userDefinedFields()
A list of name/value string pairs associated with the finding. These are custom, user-defined fields added to a finding.
Attempts to modify the collection returned by this method will result in an UnsupportedOperationException.
This method will never return null. If you would like to know whether the service returned this field (so that
you can differentiate between null and empty), you can use the hasUserDefinedFields() method.
public final boolean hasMalware()
isEmpty() method on the property). This is
useful because the SDK will never return a null collection or map, but you may need to differentiate between the
service returning nothing (or null) and the service returning an empty collection or map. For requests, this
returns true if a value for the property was specified in the request builder, and false if a value was not
specified.public final List<Malware> malware()
A list of malware related to a finding.
Attempts to modify the collection returned by this method will result in an UnsupportedOperationException.
This method will never return null. If you would like to know whether the service returned this field (so that
you can differentiate between null and empty), you can use the hasMalware() method.
public final Network network()
The details of network-related information about a finding.
public final boolean hasNetworkPath()
isEmpty() method on the property).
This is useful because the SDK will never return a null collection or map, but you may need to differentiate
between the service returning nothing (or null) and the service returning an empty collection or map. For
requests, this returns true if a value for the property was specified in the request builder, and false if a
value was not specified.public final List<NetworkPathComponent> networkPath()
Provides information about a network path that is relevant to a finding. Each entry under
NetworkPath represents a component of that path.
Attempts to modify the collection returned by this method will result in an UnsupportedOperationException.
This method will never return null. If you would like to know whether the service returned this field (so that
you can differentiate between null and empty), you can use the hasNetworkPath() method.
NetworkPath represents a component of that path.public final ProcessDetails process()
The details of process-related information about a finding.
public final boolean hasThreats()
isEmpty() method on the property). This is
useful because the SDK will never return a null collection or map, but you may need to differentiate between the
service returning nothing (or null) and the service returning an empty collection or map. For requests, this
returns true if a value for the property was specified in the request builder, and false if a value was not
specified.public final List<Threat> threats()
Details about the threat detected in a security finding and the file paths that were affected by the threat.
Attempts to modify the collection returned by this method will result in an UnsupportedOperationException.
This method will never return null. If you would like to know whether the service returned this field (so that
you can differentiate between null and empty), you can use the hasThreats() method.
public final boolean hasThreatIntelIndicators()
isEmpty() method on the
property). This is useful because the SDK will never return a null collection or map, but you may need to
differentiate between the service returning nothing (or null) and the service returning an empty collection or
map. For requests, this returns true if a value for the property was specified in the request builder, and false
if a value was not specified.public final List<ThreatIntelIndicator> threatIntelIndicators()
Threat intelligence details related to a finding.
Attempts to modify the collection returned by this method will result in an UnsupportedOperationException.
This method will never return null. If you would like to know whether the service returned this field (so that
you can differentiate between null and empty), you can use the hasThreatIntelIndicators() method.
public final boolean hasResources()
isEmpty() method on the property). This is
useful because the SDK will never return a null collection or map, but you may need to differentiate between the
service returning nothing (or null) and the service returning an empty collection or map. For requests, this
returns true if a value for the property was specified in the request builder, and false if a value was not
specified.public final List<Resource> resources()
A set of resource data types that describe the resources that the finding refers to.
Attempts to modify the collection returned by this method will result in an UnsupportedOperationException.
This method will never return null. If you would like to know whether the service returned this field (so that
you can differentiate between null and empty), you can use the hasResources() method.
public final Compliance compliance()
This data type is exclusive to findings that are generated as the result of a check run against a specific rule in a supported security standard, such as CIS Amazon Web Services Foundations. Contains security standard-related finding details.
public final VerificationState verificationState()
Indicates the veracity of a finding.
If the service returns an enum value that is not available in the current SDK version, verificationState
will return VerificationState.UNKNOWN_TO_SDK_VERSION. The raw value returned by the service is available
from verificationStateAsString().
VerificationStatepublic final String verificationStateAsString()
Indicates the veracity of a finding.
If the service returns an enum value that is not available in the current SDK version, verificationState
will return VerificationState.UNKNOWN_TO_SDK_VERSION. The raw value returned by the service is available
from verificationStateAsString().
VerificationStatepublic final WorkflowState workflowState()
The workflow state of a finding.
If the service returns an enum value that is not available in the current SDK version, workflowState
will return WorkflowState.UNKNOWN_TO_SDK_VERSION. The raw value returned by the service is available from
workflowStateAsString().
WorkflowStatepublic final String workflowStateAsString()
The workflow state of a finding.
If the service returns an enum value that is not available in the current SDK version, workflowState
will return WorkflowState.UNKNOWN_TO_SDK_VERSION. The raw value returned by the service is available from
workflowStateAsString().
WorkflowStatepublic final Workflow workflow()
Provides information about the status of the investigation into a finding.
public final RecordState recordState()
The record state of a finding.
If the service returns an enum value that is not available in the current SDK version, recordState will
return RecordState.UNKNOWN_TO_SDK_VERSION. The raw value returned by the service is available from
recordStateAsString().
RecordStatepublic final String recordStateAsString()
The record state of a finding.
If the service returns an enum value that is not available in the current SDK version, recordState will
return RecordState.UNKNOWN_TO_SDK_VERSION. The raw value returned by the service is available from
recordStateAsString().
RecordStatepublic final boolean hasRelatedFindings()
isEmpty() method on the property).
This is useful because the SDK will never return a null collection or map, but you may need to differentiate
between the service returning nothing (or null) and the service returning an empty collection or map. For
requests, this returns true if a value for the property was specified in the request builder, and false if a
value was not specified.public final List<RelatedFinding> relatedFindings()
A list of related findings.
Attempts to modify the collection returned by this method will result in an UnsupportedOperationException.
This method will never return null. If you would like to know whether the service returned this field (so that
you can differentiate between null and empty), you can use the hasRelatedFindings() method.
public final Note note()
A user-defined note added to a finding.
public final boolean hasVulnerabilities()
isEmpty() method on the property).
This is useful because the SDK will never return a null collection or map, but you may need to differentiate
between the service returning nothing (or null) and the service returning an empty collection or map. For
requests, this returns true if a value for the property was specified in the request builder, and false if a
value was not specified.public final List<Vulnerability> vulnerabilities()
Provides a list of vulnerabilities associated with the findings.
Attempts to modify the collection returned by this method will result in an UnsupportedOperationException.
This method will never return null. If you would like to know whether the service returned this field (so that
you can differentiate between null and empty), you can use the hasVulnerabilities() method.
public final PatchSummary patchSummary()
Provides an overview of the patch compliance status for an instance against a selected compliance standard.
public final Action action()
Provides details about an action that affects or that was taken on a resource.
public final FindingProviderFields findingProviderFields()
In a BatchImportFindings request, finding providers use FindingProviderFields to
provide and update their own values for confidence, criticality, related findings, severity, and types.
BatchImportFindings request, finding providers use FindingProviderFields
to provide and update their own values for confidence, criticality, related findings, severity, and
types.public final Boolean sample()
Indicates whether the finding is a sample finding.
public AwsSecurityFinding.Builder toBuilder()
toBuilder in interface ToCopyableBuilder<AwsSecurityFinding.Builder,AwsSecurityFinding>public static AwsSecurityFinding.Builder builder()
public static Class<? extends AwsSecurityFinding.Builder> serializableBuilderClass()
public final boolean equalsBySdkFields(Object obj)
equalsBySdkFields in interface SdkPojopublic final String toString()
Copyright © 2023. All rights reserved.