AWS - Security Hub v2

Use the AWS Security Hub V2 integration to import, manage, and retrieve unified security and compliance findings across your cloud environments.

IT Services · AWS - Security Hub

Details

ID	`AWS - Security Hub v2`
Provider	Amazon
Category	IT Services
From Version	6.10.0
Docker Image	`demisto/boto3py3:1.0.0.11314142`
Supported Modules	Agentix XSIAM

README

Unified security and compliance findings management using the AWS Security Hub V2 API.
This integration was integrated and tested with the AWS Security Hub V2 API.

Prerequisites

AWS Security Hub V2 must be enabled in the target AWS account and region. You can enable it from the AWS console or with the aws-securityhub-v2-security-hub-enable command.
AWS credentials (an access key/secret key pair or an assumable IAM role) with the required Security Hub V2 permissions:
- securityhub:EnableSecurityHubV2
- securityhub:DisableSecurityHubV2
- securityhub:GetFindingsV2
- securityhub:BatchUpdateFindingsV2

Configure AWS - Security Hub v2 in Cortex

Parameter	Description	Required
AWS Default Region		True
Access Key	The AWS Access Key ID (username) and Secret Access Key (password) paired together. If a ‘Role Arn’ is also provided, these credentials will be used to call AWS STS AssumeRole to obtain temporary credentials.	False
Role Arn	The full ARN of the role to assume via AWS STS, for example ‘arn:aws:iam::123456789012:role/MyRole’.	False
Role Session Name	The role session name to use for authentication.	False
Role Session Duration	The maximum role session duration, in seconds.	False
Timeout	The time in seconds till a timeout exception is reached. You can specify just the read timeout (for example 60) or also the connect timeout followed after a comma (for example 60,10). If a connect timeout is not specified, a default of 10 seconds will be used.	False
Retries	The maximum number of retry attempts when connection or throttling errors are encountered. Set to 0 to disable retries. Note: Increasing the number of retries will increase the execution time.	False
PrivateLink service URL.		False
STS PrivateLink URL.		False
Trust any certificate (not secure)		False
Use system proxy settings		False
Fetch incidents		False
Incident type		False
First fetch time	The time range to consider for the initial data fetch, in the format <number> <unit> (for example, 3 days, 12 hours, 7 minutes).	False
Maximum number of incidents per fetch	The maximum number of findings to fetch per cycle. The maximum is 100.	False
Minimum severity to fetch	The minimum severity of findings to fetch, based on the OCSF severity_id. Findings with this severity or higher are fetched. Leave empty to fetch all severities.	False
Additional fetch filters	The extra string filters used to narrow the fetch, in the same format as the string_filters command argument: “field_name=<OCSF field>,value=<value>,comparison=<comparison>”, multiple entries separated by “;”. All entries are combined with the time and severity filters using AND. Defaults to excluding closed findings (status Resolved or Suppressed): “field_name=status,value=Resolved,comparison=NOT_EQUALS;field_name=status,value=Suppressed,comparison=NOT_EQUALS”; clear or edit this value to fetch closed findings.	False
Incident Mirroring Direction	The direction to mirror the finding: Incoming (from AWS - Security Hub to Cortex), Outgoing (from Cortex to AWS - Security Hub), or Incoming And Outgoing (from/to Cortex and AWS - Security Hub).	False
Resolve finding of closed incident from Cortex XSOAR in AWS Security Hub	Whether closing an incident in Cortex sets the corresponding finding’s status to Resolved in AWS Security Hub (applies to outgoing mirroring).	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

aws-securityhub-v2-security-hub-enable

Enables AWS Security Hub V2 for the configured account and region. Required IAM Permission: securityhub:EnableSecurityHubV2.

Base Command

aws-securityhub-v2-security-hub-enable

Input

Argument Name	Description	Required
tags	The tags to assign to the Security Hub V2 resource, in the format: key=key1,value=value1;key=key2,value=value2.	Optional

Context Output

Path	Type	Description
AWS.SecurityHubV2.EnableHubV2.HubV2Arn	String	The ARN of the enabled Security Hub V2 resource.

Command example

!aws-securityhub-v2-security-hub-enable tags=key=env,value=prod

Context Example

{
    "AWS": {
        "SecurityHubV2": {
            "EnableHubV2": {
                "HubV2Arn": "arn:aws:securityhub:us-east-1:123456789012:hub/v2/default"
            }
        }
    }
}

Human Readable Output

AWS Security Hub V2 successfully enabled.

aws-securityhub-v2-security-hub-disable

Disables AWS Security Hub V2 for the configured account and region. Required IAM Permission: securityhub:DisableSecurityHubV2.

Base Command

aws-securityhub-v2-security-hub-disable

Input

There are no input arguments for this command.

Command example


#### Human Readable Output

>AWS Security Hub V2 successfully disabled.

### aws-securityhub-v2-findings-get

***
Retrieves a list of OCSF-formatted findings from AWS Security Hub V2. Required IAM Permission: securityhub:GetFindingsV2.

#### Base Command

`aws-securityhub-v2-findings-get`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| string_filters | The string field filters. Each entry: "field_name=&lt;OCSF field&gt;,value=&lt;value&gt;,comparison=&lt;EQUALS\|PREFIX\|NOT_EQUALS\|PREFIX_NOT_EQUALS\|CONTAINS_WORD&gt;", multiple entries separated by ";". Comparison defaults to EQUALS. For substring matching use CONTAINS_WORD (CONTAINS/NOT_CONTAINS are not supported by this API). Example: field_name=severity,value=High,comparison=EQUALS;field_name=finding_info.title,value=root,comparison=CONTAINS_WORD. | Optional |
| date_filters | The date field filters. Each entry must use EITHER an absolute range ("field_name=&lt;OCSF field&gt;,start=&lt;ISO8601&gt;,end=&lt;ISO8601&gt;" - both start and end are required) OR a relative DateRange ("field_name=&lt;OCSF field&gt;,value=&lt;number&gt;,unit=&lt;unit&gt;,comparison=&lt;comparison&gt;" - value is required, unit defaults to DAYS, comparison is optional). "days=&lt;number&gt;" is accepted as a shorthand for "value=&lt;number&gt;,unit=DAYS". Multiple entries separated by ";". Examples: field_name=finding_info.created_time_dt,start=2024-01-01T00:00:00Z,end=2024-02-01T00:00:00Z OR field_name=finding_info.modified_time_dt,value=7,unit=DAYS OR field_name=finding_info.modified_time_dt,days=7. | Optional |
| boolean_filters | The boolean field filters. Each entry: "field_name=&lt;OCSF field&gt;,value=&lt;true\|false&gt;", multiple entries separated by ";". | Optional |
| number_filters | The number field filters. Each entry: "field_name=&lt;OCSF field&gt;,&lt;operator&gt;=&lt;number&gt;" where operator is one of eq/gt/gte/lt/lte. Multiple operators may be combined in a single entry, and multiple entries are separated by ";". Examples: field_name=severity_id,gte=4 OR field_name=severity_id,gte=4,lte=6. | Optional |
| map_filters | The map field filters. Each entry: "field_name=&lt;OCSF field&gt;,key=&lt;key&gt;,value=&lt;value&gt;,comparison=&lt;EQUALS\|NOT_EQUALS&gt;", multiple entries separated by ";". Comparison defaults to EQUALS. | Optional |
| ip_filters | The IP field filters. Each entry: "field_name=&lt;field&gt;,cidr=&lt;IP address&gt;", multiple entries separated by ";". Allowed field_name values: evidences.src_endpoint.ip, evidences.dst_endpoint.ip. The cidr value must be a plain IPv4 or IPv6 address (CIDR ranges like 10.0.0.0/8 are not accepted). Example: field_name=evidences.src_endpoint.ip,cidr=10.0.0.1. | Optional |
| filter_operator | The logical operator used to combine the filter conditions within the composite filter. Possible values are: AND, OR. Default is AND. | Optional |
| sort_field | The finding field to sort the results by. | Optional |
| sort_order | The order to sort the results by. Possible values are: asc, desc. | Optional |
| limit | The maximum number of findings to return. Default is 50. | Optional |
| next_token | The pagination token returned from a previous request, used to retrieve the next set of results. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| AWS.SecurityHubV2.Findings | Unknown | The list of OCSF-formatted findings returned by Security Hub V2. Each finding is a free-form OCSF object containing fields such as metadata, finding_info, severity, status, cloud, resources, and time. |
| AWS.SecurityHubV2.FindingsNextToken | String | The pagination token to use when requesting the next set of findings. |

#### Command example

```!aws-securityhub-v2-findings-get string_filters="field_name=severity,value=High,comparison=EQUALS" limit=1```

#### Context Example

```json
{
    "AWS": {
        "SecurityHubV2": {
            "Findings": [
                {
                    "metadata": {
                        "uid": "uid"
                    },
                    "class_name": "Compliance Finding",
                    "severity": "High",
                    "status": "New",
                    "resources": [
                        {
                            "uid": "arn:aws:s3:::my-example-bucket"
                        }
                    ]
                }
            ],
            "FindingsNextToken": "eyJuZXh0IjoxfQ=="
        }
    }
}

Human Readable Output

AWS Security Hub V2 Findings

uid severity status class_name resource_uid

uid High New Compliance Finding arn:aws:s3:::my-example-bucket

uid	severity	status	class_name	resource_uid
uid	High	New	Compliance Finding	arn:aws:s3:::my-example-bucket

aws-securityhub-v2-findings-batch-update

Updates one or more AWS Security Hub V2 findings in a single batch request. Findings are targeted by metadata_uids and/or finding_identifiers. Required IAM Permission: securityhub:BatchUpdateFindingsV2.

Base Command

aws-securityhub-v2-findings-batch-update

Input

Argument Name	Description	Required
metadata_uids	A comma-separated list of OCSF finding metadata UIDs to update. Each UID must be a 64-character lowercase hexadecimal string (pattern ^[0-9a-z]{64}$), exactly as returned in the metadata.uid field by aws-securityhub-v2-findings-get.	Optional
finding_identifiers	The composite finding identifiers to update. Each entry: “cloud_account_uid=<id>,finding_info_uid=<id>,metadata_product_uid=<id>”, multiple entries separated by “;”.	Optional
comment	The reason for updating the findings.	Optional
severity_id	The new OCSF severity ID to assign to the findings (1=Informational, 2=Low, 3=Medium, 4=High, 5=Critical, 6=Fatal). Possible values are: 1, 2, 3, 4, 5, 6.	Optional
status_id	The new OCSF status ID to assign to the findings (1=New, 2=In Progress, 3=Suppressed, 4=Resolved). Possible values are: 1, 2, 3, 4.	Optional

Context Output

Path	Type	Description
AWS.SecurityHubV2.BatchUpdateFindings.ProcessedFindings	Unknown	The list of findings that were successfully updated.
AWS.SecurityHubV2.BatchUpdateFindings.UnprocessedFindings	Unknown	The list of findings that could not be updated, including the error for each.

get-remote-data

Returns the updated data of a single mirrored AWS Security Hub V2 finding. This command is used for mirroring and is not intended to be run manually.

Base Command

get-remote-data

Input

Argument Name	Description	Required
id	The finding metadata UID to retrieve.	Required
lastUpdate	The date string in local time representing the last time the incident was updated.	Optional

get-mapping-fields

Returns the list of fields available for outgoing mirroring. This command is used for mirroring and is not intended to be run manually.

Base Command

get-mapping-fields

Input

There are no input arguments for this command.

update-remote-system

Pushes local (Cortex XSOAR) incident changes to the corresponding AWS Security Hub V2 finding. This command is used for mirroring and is not intended to be run manually.

Base Command

update-remote-system

Input

Argument Name	Description	Required
remoteId	The remote finding metadata UID to update.	Optional

Incident Mirroring

You can enable incident mirroring between Cortex incidents and AWS - Security Hub v2 corresponding findings.
To set up the mirroring:

Enable Fetching incidents in your instance configuration.

In the Incident Mirroring Direction integration parameter, select in which direction the incidents should be mirrored:

Option	Description
None	Turns off incident mirroring.
Incoming	Any changes in AWS - Security Hub v2 findings (mirroring incoming fields) will be reflected in Cortex incidents.
Outgoing	Any changes in Cortex incidents will be reflected in AWS - Security Hub v2 findings (outgoing mirrored fields).
Incoming And Outgoing	Changes in Cortex incidents and AWS - Security Hub v2 findings will be reflected in both directions.

Newly fetched incidents will be mirrored in the chosen direction. However, this selection does not affect existing incidents.
Important Note: To ensure the mirroring works as expected, mappers are required, both for incoming and outgoing, to map the expected fields in Cortex and AWS - Security Hub v2.

Close synchronization

The integration syncs incident/finding closing in both directions:

Action	Result	Requires
Close an incident in Cortex XSOAR	The finding is set to Resolved (status_id 4) in AWS Security Hub.	Outgoing mirroring and the Resolve finding of closed incident from Cortex XSOAR in AWS Security Hub parameter enabled.
Resolve or Suppress a finding in AWS Security Hub	The corresponding Cortex XSOAR incident is closed.	Incoming mirroring.

Note: Reopening is not supported in either direction. Reopening a closed incident in Cortex XSOAR does not reopen the finding in AWS Security Hub, and reopening a resolved finding in AWS Security Hub does not reopen the corresponding Cortex XSOAR incident.

Configuration parameters

region — AWS Default Region (required)
credentials — Access Key
role_arn — Role Arn
role_session_name — Role Session Name
session_duration — Role Session Duration
timeout — Timeout
retries — Retries
endpoint_url — PrivateLink service URL.
sts_endpoint_url — STS PrivateLink URL.
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
isFetch — Fetch incidents
incidentFetchInterval — Incidents Fetch Interval
incidentType — Incident type
first_fetch — First fetch time
max_fetch — Maximum number of incidents per fetch
min_severity — Minimum severity to fetch
fetch_filters — Additional fetch filters
mirror_direction — Incident Mirroring Direction
resolve_finding — Resolve finding of closed incident from Cortex XSOAR in AWS Security Hub

Commands (7)

aws-securityhub-v2-findings-batch-update
Updates one or more AWS Security Hub V2 findings in a single batch request. Findings are targeted by metadata_uids and/or finding_identifiers. Required IAM Permission: securityhub:BatchUpdateFindingsV2.
aws-securityhub-v2-findings-get
Retrieves a list of OCSF-formatted findings from AWS Security Hub V2. Required IAM Permission: securityhub:GetFindingsV2.
aws-securityhub-v2-security-hub-disable
Disables AWS Security Hub V2 for the configured account and region. Required IAM Permission: securityhub:DisableSecurityHubV2.
aws-securityhub-v2-security-hub-enable
Enables AWS Security Hub V2 for the configured account and region. Required IAM Permission: securityhub:EnableSecurityHubV2.
get-mapping-fields
Returns the list of fields available for outgoing mirroring. This command is used for mirroring and is not intended to be run manually.
get-remote-data
Returns the updated data of a single mirrored AWS Security Hub V2 finding. This command is used for mirroring and is not intended to be run manually.
update-remote-system
Pushes local (Cortex XSOAR) incident changes to the corresponding AWS Security Hub V2 finding. This command is used for mirroring and is not intended to be run manually.

Source

AWS_SecurityHub_V2.py AWS_SecurityHub_V2_test.py AWS_SecurityHub_V2.yml AWS_SecurityHub_V2_description.md

Download History Raw

name: AWS - Security Hub v2
display: AWS - Security Hub v2
category: IT Services
provider: Amazon
sectionorder:
- Connect
- Collect
commonfields:
  id: AWS - Security Hub v2
  version: -1
description: Use the AWS Security Hub V2 integration to import, manage, and retrieve unified security and compliance findings across your cloud environments.
configuration:
- display: AWS Default Region
  name: region
  options:
  - us-east-1
  - us-east-2
  - us-west-1
  - us-west-2
  - af-south-1
  - ap-east-1
  - ap-south-2
  - ap-southeast-3
  - ap-southeast-5
  - ap-southeast-4
  - ap-south-1
  - ap-northeast-3
  - ap-northeast-2
  - ap-southeast-1
  - ap-southeast-2
  - ap-southeast-7
  - ap-northeast-1
  - ca-central-1
  - ca-west-1
  - eu-central-1
  - eu-west-1
  - eu-west-2
  - eu-south-1
  - eu-west-3
  - eu-south-2
  - eu-north-1
  - eu-central-2
  - il-central-1
  - mx-central-1
  - me-south-1
  - me-central-1
  - sa-east-1
  - us-gov-east-1
  - us-gov-west-1
  type: 15
  section: Connect
  required: true
- display: Access Key
  name: credentials
  type: 9
  displaypassword: Secret Key
  additionalinfo: "The AWS Access Key ID (username) and Secret Access Key (password) paired together. If a 'Role Arn' is also provided, these credentials will be used to call AWS STS AssumeRole to obtain temporary credentials."
  section: Connect
  required: false
- display: Role Arn
  name: role_arn
  type: 0
  additionalinfo: "The full ARN of the role to assume via AWS STS, for example 'arn:aws:iam::123456789012:role/MyRole'."
  section: Connect
  advanced: true
  required: false
- display: Role Session Name
  name: role_session_name
  type: 0
  additionalinfo: The role session name to use for authentication.
  section: Connect
  advanced: true
  required: false
- display: Role Session Duration
  name: session_duration
  type: 0
  additionalinfo: The maximum role session duration, in seconds.
  section: Connect
  advanced: true
  required: false
- display: Timeout
  name: timeout
  additionalinfo: The timeout interval in seconds. Can be a single integer representing the read timeout (for example 60), or two comma-separated values representing the read and connect timeouts (for example 60,10).
  defaultvalue: 60,10
  type: 0
  section: Connect
  advanced: true
  required: false
- display: Retries
  name: retries
  defaultvalue: 5
  additionalinfo: "The number of times to retry the connection if it fails with connection or throttling errors. Set to 0 to disable retries. Note: Increasing the number of retries will increase the execution time."
  type: 0
  section: Connect
  advanced: true
  required: false
- display: PrivateLink service URL.
  name: endpoint_url
  type: 0
  section: Connect
  advanced: true
  required: false
- display: STS PrivateLink URL.
  name: sts_endpoint_url
  type: 0
  section: Connect
  advanced: true
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  section: Collect
  advanced: true
  required: false
- display: Incident type
  name: incidentType
  type: 13
  section: Collect
  required: false
- display: First fetch time
  name: first_fetch
  defaultvalue: 3 days
  additionalinfo: 'The time range for the initial data fetch (for example, 3 days, 12 hours, 7 minutes).'
  type: 0
  section: Collect
  required: false
- display: Maximum number of incidents per fetch
  name: max_fetch
  defaultvalue: 50
  additionalinfo: The maximum number of findings to fetch per cycle. The maximum is 100.
  type: 0
  section: Collect
  required: false
- display: Minimum severity to fetch
  name: min_severity
  additionalinfo: The minimum severity of findings to fetch, based on the OCSF severity_id. Findings with this severity or higher are fetched. Leave empty to fetch all severities.
  options:
  - Informational
  - Low
  - Medium
  - High
  - Critical
  - Fatal
  type: 15
  section: Collect
  required: false
- display: Additional fetch filters
  name: fetch_filters
  defaultvalue: field_name=status,value=Resolved,comparison=NOT_EQUALS;field_name=status,value=Suppressed,comparison=NOT_EQUALS
  additionalinfo: 'The additional string filters used to narrow the fetch. Follows the same format as the string_filters command argument: "field_name=<OCSF field>,value=<value>,comparison=<comparison>" (multiple entries must be separated by semicolons). These filters are combined with the time and severity filters using an AND operator. Defaults to excluding closed findings (status Resolved or Suppressed); clear or edit this value to fetch closed findings.'
  type: 0
  section: Collect
  advanced: true
  required: false
- display: Incident Mirroring Direction
  name: mirror_direction
  additionalinfo: 'The direction to mirror the finding. Possible values are None, Incoming (from AWS - Security Hub to Cortex), Outgoing (from Cortex to AWS - Security Hub), or Incoming And Outgoing (from/to Cortex and AWS - Security Hub).'
  type: 15
  section: Collect
  options:
  - None
  - Incoming
  - Outgoing
  - Incoming And Outgoing
  defaultvalue: None
  hidden:
  - marketplacev2
  - platform
  required: false
- display: Resolve finding of closed incident from Cortex XSOAR in AWS Security Hub
  name: resolve_finding
  additionalinfo: 'Whether closing an incident in Cortex XSOAR sets the corresponding finding''s status to Resolved in AWS Security Hub (applies to outgoing mirroring).'
  type: 8
  section: Collect
  defaultvalue: 'false'
  hidden:
  - marketplacev2
  - platform
  required: false
script:
  commands:
  - name: aws-securityhub-v2-security-hub-enable
    description: "Enables AWS Security Hub V2 for the configured account and region. Required IAM Permission: securityhub:EnableSecurityHubV2."
    arguments:
    - name: tags
      description: "The tags to assign to the Security Hub V2 resource, in the format: key=key1,value=value1;key=key2,value=value2."
      required: false
    outputs:
    - contextPath: AWS.SecurityHubV2.EnableHubV2.HubV2Arn
      description: The ARN of the enabled Security Hub V2 resource.
      type: String
  - name: aws-securityhub-v2-security-hub-disable
    description: "Disables AWS Security Hub V2 for the configured account and region. Required IAM Permission: securityhub:DisableSecurityHubV2."
    arguments: []
  - name: aws-securityhub-v2-findings-get
    description: "Retrieves a list of OCSF-formatted findings from AWS Security Hub V2. Required IAM Permission: securityhub:GetFindingsV2."
    arguments:
    - name: string_filters
      description: 'The string field filters. Each entry must follow the format: field_name=<OCSF field>,value=<value>,comparison=<comparison_type> (separate multiple entries by semicolons). Supported comparison types are EQUALS (default), PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS, and CONTAINS_WORD. For substring matching, use CONTAINS_WORD (CONTAINS and NOT_CONTAINS are not supported by this API). Example: field_name=severity,value=High,comparison=EQUALS;field_name=finding_info.title,value=root,comparison=CONTAINS_WORD.'
      required: false
    - name: date_filters
      description: 'The date field filters. Each entry must use either an absolute range format: field_name=<OCSF field>,start=<ISO8601>,end=<ISO8601> (both start and end are required), or a relative date range format: field_name=<OCSF field>,value=<number>,unit=<unit>,comparison=<comparison> (value is required, unit defaults to DAYS, and comparison is optional). Note that days=<number> is accepted as a shorthand for value=<number>,unit=DAYS. Multiple entries must be separated by semicolons. Examples: field_name=finding_info.created_time_dt,start=2024-01-01T00:00:00Z,end=2024-02-01T00:00:00Z OR field_name=finding_info.modified_time_dt,value=7,unit=DAYS OR field_name=finding_info.modified_time_dt,days=7.'
      required: false
    - name: boolean_filters
      description: 'The boolean field filters. Each entry must follow the format: field_name=<OCSF field>,value=<true|false> (multiple entries must be separated by semicolons).'
      required: false
    - name: number_filters
      description: 'The number field filters. Each entry must follow the format: field_name=<OCSF field>,<operator>=<number> where the operator is one of eq, gt, gte, lt, or lte. Multiple operators can be combined in a single entry, and multiple entries must be separated by semicolons. For example,  "field_name=severity_id,gte=4" OR "field_name=severity_id,gte=4,lte=6".'
      required: false
    - name: map_filters
      description: 'The map field filters. Each entry must follow the format: field_name=<OCSF field>,key=<key>,value=<value>,comparison=<comparison_type> (multiple entries must be separated by semicolons).  Supported comparison types are EQUALS (default) and NOT_EQUALS.'
      required: false
    - name: ip_filters
      description: 'The IP field filters. Each entry must follow the format: field_name=<field>,cidr=<IP address> (multiple entries must be separated by semicolons). Possible field_name values are:  evidences.src_endpoint.ip and evidences.dst_endpoint.ip. The CIDR value must be a plain IPv4 or IPv6 address (CIDR ranges such as 10.0.0.0/8 are not accepted). For example, field_name=evidences.src_endpoint.ip,cidr=10.0.0.1.'
      required: false
    - name: filter_operator
      description: The logical operator used to combine the filter conditions within the composite filter. Possible values are AND and OR.
      required: false
      auto: PREDEFINED
      predefined:
      - AND
      - OR
      defaultValue: AND
    - name: sort_field
      description: The finding field to sort the results by.
      required: false
    - name: sort_order
      description: The order to sort the results by.
      required: false
      auto: PREDEFINED
      predefined:
      - asc
      - desc
    - name: limit
      description: The maximum number of findings to return.
      required: false
      defaultValue: '50'
    - name: next_token
      description: The pagination token returned from a previous request, used to retrieve the next set of results.
      required: false
    outputs:
    - contextPath: AWS.SecurityHubV2.Findings
      description: The list of OCSF-formatted findings returned by Security Hub V2. Each finding is a free-form OCSF object containing fields such as metadata, finding_info, severity, status, cloud, resources, and time.
      type: Unknown
    - contextPath: AWS.SecurityHubV2.FindingsNextToken
      description: The pagination token to use when requesting the next set of findings.
      type: String
  - name: aws-securityhub-v2-findings-batch-update
    description: "Updates one or more AWS Security Hub V2 findings in a single batch request. Findings are targeted by metadata_uids and/or finding_identifiers. Required IAM Permission: securityhub:BatchUpdateFindingsV2."
    arguments:
    - name: metadata_uids
      description: A comma-separated list of OCSF finding metadata UIDs to update. Each UID must be a 64-character lowercase hexadecimal string (pattern ^[0-9a-z]{64}$), exactly as returned in the metadata.uid field by aws-securityhub-v2-findings-get.
      required: false
      isArray: true
    - name: finding_identifiers
      description: 'The composite finding identifiers to update. Each entry must follow the format: cloud_account_uid=<id>,finding_info_uid=<id>,metadata_product_uid=<id> (multiple entries must be separated by semicolons).'
      required: false
    - name: comment
      description: The reason for updating the findings.
      required: false
    - name: severity_id
      description: The new OCSF severity ID to assign to the findings (1=Informational, 2=Low, 3=Medium, 4=High, 5=Critical, 6=Fatal).
      required: false
      auto: PREDEFINED
      predefined:
      - '1'
      - '2'
      - '3'
      - '4'
      - '5'
      - '6'
    - name: status_id
      description: The new OCSF status ID to assign to the findings (1=New, 2=In Progress, 3=Suppressed, 4=Resolved).
      required: false
      auto: PREDEFINED
      predefined:
      - '1'
      - '2'
      - '3'
      - '4'
    outputs:
    - contextPath: AWS.SecurityHubV2.BatchUpdateFindings.ProcessedFindings
      description: The list of findings that were successfully updated.
      type: Unknown
    - contextPath: AWS.SecurityHubV2.BatchUpdateFindings.UnprocessedFindings
      description: The list of findings that could not be updated, including the error for each.
      type: Unknown
  - name: get-remote-data
    description: 'Returns the updated data of a single mirrored AWS Security Hub V2 finding. This command is used for mirroring and is not intended to be run manually.'
    arguments:
    - name: id
      description: The finding metadata UID to retrieve.
      required: true
    - name: lastUpdate
      description: The date string in local time representing the last time the incident was updated.
      required: false
  - name: get-mapping-fields
    description: 'Returns the list of fields available for outgoing mirroring. This command is used for mirroring and is not intended to be run manually.'
    arguments: []
  - name: update-remote-system
    description: 'Pushes local (Cortex XSOAR) incident changes to the corresponding AWS Security Hub V2 finding. This command is used for mirroring and is not intended to be run manually.'
    arguments:
    - name: remoteId
      description: The remote finding metadata UID to update.
      required: false
  dockerimage: demisto/boto3py3:1.0.0.11314142
  isfetch: true
  ismappable: true
  isremotesyncin: true
  isremotesyncout: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
defaultmapperin: AWS Security Hub v2 - Incoming Mapper
defaultmapperout: AWS Security Hub v2 - Outgoing Mapper
fromversion: 6.10.0
tests:
- No tests (auto formatted)