Values.AwsSecurityFindingSourceProvides a consistent format for Security Hub CSPM findings. AwsSecurityFinding format allows you to share findings between Amazon Web Services security services and third-party solutions. A finding is a potential security issue generated either by Amazon Web Services services or by the integrated third-party solutions and standards checks.
type nonrec t = {schemaVersion : NonEmptyString.t;The schema version that a finding is formatted for. The value is 2018-10-08.
*)id : NonEmptyString.t;The security findings provider-specific identifier for a finding. Length Constraints: Minimum length of 1. Maximum length of 512.
*)productArn : NonEmptyString.t;The ARN generated by Security Hub CSPM that uniquely identifies a product that generates findings. This can be the ARN for a third-party product that is integrated with Security Hub CSPM, or the ARN for a custom integration. Length Constraints: Minimum length of 12. Maximum length of 2048.
*)productName : NonEmptyString.t option;The name of the product that generated the finding. Security Hub CSPM populates this attribute automatically for each finding. You cannot update this attribute with BatchImportFindings or BatchUpdateFindings. The exception to this is a custom integration. When you use the Security Hub CSPM console or API to filter findings by product name, you use this attribute. Length Constraints: Minimum length of 1. Maximum length of 128.
*)companyName : NonEmptyString.t option;The name of the company for the product that generated the finding. Security Hub CSPM populates this attribute automatically for each finding. You cannot update this attribute with BatchImportFindings or BatchUpdateFindings. The exception to this is a custom integration. When you use the Security Hub CSPM console or API to filter findings by company name, you use this attribute. Length Constraints: Minimum length of 1. Maximum length of 128.
*)region : NonEmptyString.t option;The Region from which the finding was generated. Security Hub CSPM populates this attribute automatically for each finding. You cannot update it using BatchImportFindings or BatchUpdateFindings. Length Constraints: Minimum length of 1. Maximum length of 16.
*)generatorId : NonEmptyString.t;The identifier for the solution-specific component (a discrete unit of logic) that generated a finding. In various security findings providers' solutions, this generator can be called a rule, a check, a detector, a plugin, or something else. Length Constraints: Minimum length of 1. Maximum length of 512.
*)awsAccountId : NonEmptyString.t;The Amazon Web Services account ID that a finding is generated in. Length Constraints: 12.
*)types : TypeList.t option;One or more finding types in the format of namespace/category/classifier that classify a finding. Valid namespace values are: Software and Configuration Checks | TTPs | Effects | Unusual Behaviors | Sensitive Data Identifications Array Members: Maximum number of 50 items.
*)firstObservedAt : NonEmptyString.t option;Indicates when the security findings provider first observed the potential security issue that a finding captured. For more information about the validation and formatting of timestamp fields in Security Hub CSPM, see Timestamps.
*)lastObservedAt : NonEmptyString.t option;Indicates when the security findings provider most recently observed a change in the resource that is involved in the finding. For more information about the validation and formatting of timestamp fields in Security Hub CSPM, see Timestamps.
*)createdAt : NonEmptyString.t;Indicates when the security findings provider created the potential security issue that a finding captured. For more information about the validation and formatting of timestamp fields in Security Hub CSPM, see Timestamps.
*)updatedAt : NonEmptyString.t;Indicates when the security findings provider last updated the finding record. For more information about the validation and formatting of timestamp fields in Security Hub CSPM, see Timestamps.
*)severity : Severity.t option;A finding's severity.
*)confidence : Integer.t option;A finding's confidence. Confidence is defined as the likelihood that a finding accurately identifies the behavior or issue that it was intended to identify. Confidence is scored on a 0-100 basis using a ratio scale, where 0 means zero percent confidence and 100 means 100 percent confidence.
*)criticality : Integer.t option;The level of importance assigned to the resources associated with the finding. A score of 0 means that the underlying resources have no criticality, and a score of 100 is reserved for the most critical resources.
*)title : NonEmptyString.t;A finding's title. Title is a required property. Length Constraints: Minimum length of 1. Maximum length of 256.
*)description : NonEmptyString.t;A finding's description. Description is a required property. Length Constraints: Minimum length of 1. Maximum length of 1024.
*)remediation : Remediation.t option;A data type that describes the remediation options for a finding.
*)sourceUrl : NonEmptyString.t option;A URL that links to a page about the current finding in the security findings provider's solution.
*)productFields : FieldMap.t option;A data type where security findings providers can include additional solution-specific details that aren't part of the defined AwsSecurityFinding format. Can contain up to 50 key-value pairs. For each key-value pair, the key can contain up to 128 characters, and the value can contain up to 2048 characters.
*)userDefinedFields : FieldMap.t option;A list of name/value string pairs associated with the finding. These are custom, user-defined fields added to a finding. Can contain up to 50 key-value pairs. For each key-value pair, the key can contain up to 128 characters, and the value can contain up to 1024 characters.
*)malware : MalwareList.t option;A list of malware related to a finding. Array Members: Maximum number of 5 items.
*)network : Network.t option;The details of network-related information about a finding.
*)networkPath : NetworkPathList.t option;Provides information about a network path that is relevant to a finding. Each entry under NetworkPath represents a component of that path.
*)process : ProcessDetails.t option;The details of process-related information about a finding.
*)threats : ThreatList.t option;Details about the threat detected in a security finding and the file paths that were affected by the threat. Array Members: Minimum number of 1 item. Maximum number of 32 items.
*)threatIntelIndicators : ThreatIntelIndicatorList.t option;Threat intelligence details related to a finding. Array Members: Minimum number of 1 item. Maximum number of 5 items.
*)resources : ResourceList.t;A set of resource data types that describe the resources that the finding refers to. Array Members: Minimum number of 1 item. Maximum number of 32 items.
*)compliance : Compliance.t option;This data type is exclusive to findings that are generated as the result of a check run against a specific rule in a supported security standard, such as CIS Amazon Web Services Foundations. Contains security standard-related finding details.
*)verificationState : VerificationState.t option;Indicates the veracity of a finding.
*)workflowState : WorkflowState.t option;The workflow state of a finding.
*)workflow : Workflow.t option;Provides information about the status of the investigation into a finding.
*)recordState : RecordState.t option;The record state of a finding.
*)note : Note.t option;A user-defined note added to a finding.
*)vulnerabilities : VulnerabilityList.t option;Provides a list of vulnerabilities associated with the findings.
*)patchSummary : PatchSummary.t option;Provides an overview of the patch compliance status for an instance against a selected compliance standard.
*)action : Action.t option;Provides details about an action that affects or that was taken on a resource.
*)findingProviderFields : FindingProviderFields.t option;In a BatchImportFindings request, finding providers use FindingProviderFields to provide and update their own values for confidence, criticality, related findings, severity, and types.
*)sample : Boolean.t option;Indicates whether the finding is a sample finding.
*)generatorDetails : GeneratorDetails.t option;Provides metadata for the Amazon CodeGuru detector associated with a finding. This field pertains to findings that relate to Lambda functions. Amazon Inspector identifies policy violations and vulnerabilities in Lambda function code based on internal detectors developed in collaboration with Amazon CodeGuru. Security Hub CSPM receives those findings.
*)processedAt : NonEmptyString.t option;A timestamp that indicates when Security Hub CSPM received a finding and begins to process it. For more information about the validation and formatting of timestamp fields in Security Hub CSPM, see Timestamps.
*)awsAccountName : NonEmptyString.t option;The name of the Amazon Web Services account from which a finding was generated. Length Constraints: Minimum length of 1. Maximum length of 50.
*)detection : Detection.t option;Provides details about an Amazon GuardDuty Extended Threat Detection attack sequence. GuardDuty generates an attack sequence finding when multiple events align to a potentially suspicious activity. To receive GuardDuty attack sequence findings in Security Hub CSPM, you must have GuardDuty enabled. For more information, see GuardDuty Extended Threat Detection in the Amazon GuardDuty User Guide.
*)}val make :
?productName:??? ->
?companyName:??? ->
?region:??? ->
?types:??? ->
?firstObservedAt:??? ->
?lastObservedAt:??? ->
?severity:??? ->
?confidence:??? ->
?criticality:??? ->
?remediation:??? ->
?sourceUrl:??? ->
?productFields:??? ->
?userDefinedFields:??? ->
?malware:??? ->
?network:??? ->
?networkPath:??? ->
?process:??? ->
?threats:??? ->
?threatIntelIndicators:??? ->
?compliance:??? ->
?verificationState:??? ->
?workflowState:??? ->
?workflow:??? ->
?recordState:??? ->
?relatedFindings:??? ->
?note:??? ->
?vulnerabilities:??? ->
?patchSummary:??? ->
?action:??? ->
?findingProviderFields:??? ->
?sample:??? ->
?generatorDetails:??? ->
?processedAt:??? ->
?awsAccountName:??? ->
?detection:??? ->
schemaVersion:NonEmptyString.t ->
id:NonEmptyString.t ->
productArn:NonEmptyString.t ->
generatorId:NonEmptyString.t ->
awsAccountId:NonEmptyString.t ->
createdAt:NonEmptyString.t ->
updatedAt:NonEmptyString.t ->
title:NonEmptyString.t ->
description:NonEmptyString.t ->
resources:ResourceList.t ->
unit ->
tval to_value :
t ->
[> `Structure of
(string
* [> `Boolean of Boolean.t
| `Enum of string
| `Integer of Integer.t
| `List of
[> `String of NonEmptyString.t
| `Structure of
(string
* [> `Double of Double.t
| `Enum of string
| `Integer of Integer.t
| `List of
[> `String of NonEmptyString.t
| `Structure of
(string
* [> `Double of Double.t
| `List of
[> `String of NonEmptyString.t
| `Structure of
(string * [> `String of NonEmptyString.t ]) list ]
list
| `String of NonEmptyString.t
| `Structure of
(string
* [> `Integer of Integer.t
| `String of NonEmptyString.t ])
list ])
list ]
list
| `Map of
([> `String of NonEmptyString.t ]
* [> `String of NonEmptyString.t ])
list
| `String of NonEmptyString.t
| `Structure of
(string
* [> `Map of
([> `String of NonEmptyString.t ]
* [> `String of NonEmptyString.t ])
list
| `String of NonEmptyString.t
| `Structure of
(string
* [> `Boolean of Boolean.t
| `Double of Double.t
| `Enum of string
| `Integer of Integer.t
| `List of
[> `String of NonEmptyString.t
| `Structure of
(string
* [> `Boolean of Boolean.t
| `Double of Double.t
| `Integer of Integer.t
| `List of
[> `String of NonEmptyString.t
| `Structure of
(string
* [> `Boolean of Boolean.t
| `Integer of Integer.t
| `Long of Long.t
| `String of NonEmptyString.t
| `Structure of
(string
* [> `Integer of Integer.t
| `List of
[> `Structure of
(string
* [> `Long of Long.t
| `String of
NonEmptyString.t
| `Structure of
(string
* [> `Long of Long.t ])
list ])
list ]
list ])
list ])
list ]
list
| `Long of Long.t
| `Map of
([> `String of NonEmptyString.t ]
* [> `String of NonEmptyString.t ])
list
| `String of NonEmptyString.t
| `Structure of
(string
* [> `Boolean of Boolean.t
| `Integer of Integer.t
| `List of
[> `String of NonEmptyString.t
| `Structure of
(string
* [> `Integer of Integer.t
| `List of
[> `String of NonEmptyString.t ]
list
| `String of NonEmptyString.t ])
list ]
list
| `Long of Long.t
| `Map of
([> `String of NonEmptyString.t ]
* [> `String of NonEmptyString.t ])
list
| `String of NonEmptyString.t
| `Structure of
(string
* [> `List of
[> `String of NonEmptyString.t ]
list
| `String of NonEmptyString.t
| `Structure of
(string
* [> `Integer of Integer.t
| `List of
[> `Structure of
(string
* [> `String of
NonEmptyString.t ])
list ]
list
| `String of NonEmptyString.t ])
list ])
list ])
list ])
list ]
list
| `Long of Long.t
| `Map of
([> `String of NonEmptyString.t ]
* [> `String of NonEmptyString.t ])
list
| `String of NonEmptyString.t
| `Structure of
(string
* [> `Boolean of Boolean.t
| `Double of Double.t
| `Integer of Integer.t
| `List of
[> `String of NonEmptyString.t
| `Structure of
(string
* [> `Boolean of Boolean.t
| `Integer of Integer.t
| `List of
[> `Integer of Integer.t
| `String of NonEmptyString.t
| `Structure of
(string
* [> `Boolean of Boolean.t
| `Integer of Integer.t
| `String of NonEmptyString.t
| `Structure of
(string * [> `Long of Long.t ])
list ])
list ]
list
| `Long of Long.t
| `Map of
([> `String of NonEmptyString.t ]
* [> `String of NonEmptyString.t ])
list
| `String of NonEmptyString.t
| `Structure of
(string
* [> `Boolean of Boolean.t
| `Integer of Integer.t
| `List of
[> `Structure of
(string
* [> `Long of Long.t
| `String of
NonEmptyString.t
| `Structure of
(string
* [> `Long of Long.t ])
list ])
list ]
list
| `Long of Long.t
| `String of NonEmptyString.t
| `Structure of
(string
* [> `Integer of Integer.t
| `List of
[> `Integer of Integer.t
| `String of
NonEmptyString.t
| `Structure of
(string
* [> `Enum of string
| `String of
NonEmptyString.t
| `Structure of
(string
* [> `String of
NonEmptyString.t ])
list ])
list ]
list
| `String of NonEmptyString.t
| `Structure of
(string
* [> `String of
NonEmptyString.t ])
list ])
list ])
list ])
list ]
list
| `Long of Long.t
| `Map of
([> `String of NonEmptyString.t ]
* [> `String of NonEmptyString.t ])
list
| `String of NonEmptyString.t
| `Structure of
(string
* [> `Boolean of Boolean.t
| `Integer of Integer.t
| `List of
[> `String of NonEmptyString.t
| `Structure of
(string
* [> `List of
[> `Structure of
(string
* [> `List of
[> `String of
NonEmptyString.t ]
list
| `String of
NonEmptyString.t ])
list ]
list
| `String of NonEmptyString.t
| `Structure of
(string
* [> `String of NonEmptyString.t ])
list ])
list ]
list
| `Long of Long.t
| `String of NonEmptyString.t
| `Structure of
(string
* [> `Boolean of Boolean.t
| `Double of Double.t
| `Integer of Integer.t
| `List of
[> `String of NonEmptyString.t
| `Structure of
(string
* [> `Integer of Integer.t
| `String of NonEmptyString.t
| `Structure of
(string
* [> `List of
[> `String of
NonEmptyString.t ]
list
| `Structure of
(string
* [> `List of
[> `Integer of
Integer.t
| `Structure of
(string
*
[>
`Integer of
Integer.t
| `List of
[>
`String of
NonEmptyString.t ]
list
| `String of
NonEmptyString.t ])
list ]
list ])
list ])
list ])
list ]
list
| `String of NonEmptyString.t
| `Structure of
(string
* [> `Boolean of Boolean.t
| `String of NonEmptyString.t ])
list ])
list ])
list ])
list ])
list ])
list ])
list ]
list
| `Map of
([> `String of NonEmptyString.t ]
* [> `String of NonEmptyString.t ])
list
| `String of NonEmptyString.t
| `Structure of
(string
* [> `Double of Double.t
| `Enum of string
| `Integer of Integer.t
| `List of
[> `String of NonEmptyString.t
| `Structure of
(string
* [> `List of [> `String of NonEmptyString.t ] list
| `String of NonEmptyString.t ])
list ]
list
| `String of NonEmptyString.t
| `Structure of
(string
* [> `Boolean of Boolean.t
| `Enum of string
| `Integer of Integer.t
| `List of
[> `Structure of
(string
* [> `Double of Double.t
| `Integer of Integer.t
| `List of
[> `String of NonEmptyString.t
| `Structure of
(string
* [> `List of
[> `String of NonEmptyString.t ] list
| `String of NonEmptyString.t ])
list ]
list
| `Long of Long.t
| `String of NonEmptyString.t
| `Structure of
(string
* [> `Double of Double.t
| `Enum of string
| `Integer of Integer.t
| `Long of Long.t
| `String of NonEmptyString.t
| `Structure of
(string
* [> `Double of Double.t
| `Integer of Integer.t
| `String of NonEmptyString.t ])
list ])
list ])
list ]
list
| `Map of
([> `String of NonEmptyString.t ]
* [> `String of NonEmptyString.t ])
list
| `String of NonEmptyString.t
| `Structure of
(string
* [> `Integer of Integer.t
| `String of NonEmptyString.t
| `Structure of
(string
* [> `Double of Double.t
| `Integer of Integer.t
| `String of NonEmptyString.t ])
list ])
list ])
list ])
list ])
list ]