category: IT Services
provider: Amazon
sectionorder:
- Connect
- Collect
commonfields:
  id: AWS - Security Hub
  version: -1
configuration:
- display: Role Arn
  name: roleArn
  type: 0
  section: Connect
  advanced: true
  required: false
- display: Role Session Name
  name: roleSessionName
  type: 0
  section: Connect
  advanced: true
  required: false
- display: AWS Default Region
  name: defaultRegion
  options:
  - us-east-1
  - us-east-2
  - us-west-1
  - us-west-2
  - ca-central-1
  - eu-west-1
  - eu-central-1
  - eu-west-2
  - ap-northeast-1
  - ap-northeast-2
  - ap-southeast-1
  - ap-southeast-2
  - ap-south-1
  - sa-east-1
  - eu-north-1
  - eu-west-3
  - il-central-1
  - us-gov-east-1
  - us-gov-west-1
  type: 15
  section: Connect
  advanced: true
  required: true
- display: Role Session Duration
  name: sessionDuration
  type: 0
  section: Connect
  advanced: true
  required: false
- display: Access Key
  name: credentials
  type: 9
  displaypassword: Secret Key
  section: Connect
  required: false
- display: Access Key
  name: access_key
  type: 0
  section: Connect
  hidden: true
  required: false
- display: Secret Key
  name: secret_key
  type: 4
  section: Connect
  hidden: true
  required: false
- display: Timeout
  name: timeout
  additionalinfo: The time in seconds till a timeout exception is reached. You can specify just the read timeout (for example 60) or also the connect timeout followed after a comma (for example 60,10). If a connect timeout is not specified, a default of 10 second will be used.
  defaultvalue: 60,10
  type: 0
  section: Connect
  advanced: true
  required: false
- display: Retries
  name: retries
  defaultvalue: 5
  additionalinfo: "The maximum number of retry attempts when connection or throttling errors are encountered. Set to 0 to disable retries. The default value is 5 and the limit is 10. Note: Increasing the number of retries will increase the execution time."
  type: 0
  section: Connect
  advanced: true
  required: false
- display: PrivateLink service URL.
  name: endpoint_url
  type: 0
  section: Connect
  advanced: true
  required: false
- display: STS PrivateLink URL.
  name: sts_endpoint_url
  type: 0
  section: Connect
  advanced: true
  required: false
- display: AWS STS Regional Endpoints
  additionalinfo: Sets the AWS_STS_REGIONAL_ENDPOINTS environment variable to specify the AWS STS endpoint resolution logic. By default, this option is set to “legacy” in AWS. Leave empty if the environment variable is already set using server configuration.
  name: sts_regional_endpoint
  options:
  - legacy
  - regional
  type: 15
  section: Connect
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
- display: First fetch time (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
  name: first_fetch_timestamp
  type: 0
  section: Collect
  defaultvalue: 15 days
  required: false
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- display: Security Hub Incidents Severity Level
  name: sh_severity
  type: 15
  section: Collect
  advanced: true
  additionalinfo: "Severity level of fetched incidents. Could be Informational, Low, Medium, High and Critical. For example, if you set the severity level to Medium, only findings with severity level Medium, High or Critical will be fetched."
  options:
  - Informational
  - Low
  - Medium
  - High
  - Critical
  required: false
- display: Additional Incidents Filters
  name: additionalFilters
  type: 0
  section: Collect
  advanced: true
  additionalinfo: "A comma-separated list of additional incident filters in the format 'name=name1,value=value1,comparison=comparison1."
  required: false
- display: Change findings workflow to 'NOTIFIED'
  name: archiveFindings
  type: 8
  section: Collect
  advanced: true
  additionalinfo: "Notify the resource owner about the security issue. You can use this status when you are not the resource owner, and you need intervention from the resource owner in order to resolve a security issue."
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Incident Mirroring Direction
  additionalinfo: 'Choose the direction to mirror the incident: Incoming (from AWS - Security Hub to Cortex XSOAR), Outgoing (from Cortex XSOAR to AWS - Security Hub), or Incoming and Outgoing (from/to Cortex XSOAR and AWS - Security Hub).'
  name: mirror_direction
  type: 15
  section: Collect
  options:
  - None
  - Incoming
  - Outgoing
  - Incoming And Outgoing
  defaultvalue: None
  hidden:
  - marketplacev2
  - platform
  required: false
- display: Resolve findings of closed incidents from XSOAR in AWS Security Hub
  additionalinfo: 'After closing an incident in XSOAR, update its finding workflow status in AWS Security Hub to resolved'
  name: resolve_finding
  type: 8
  section: Collect
  defaultvalue: 'true'
  hidden:
  - marketplacev2
  - platform
  required: false
- display: Finding Type
  name: finding_type
  additionalinfo: 'You can set the type of the findings to be fetched: "Software and Configuration Checks", "TTPs", "Effects", "Unusual Behaviors", "Sensitive Data Identifications". For example, if you set the finding type to "TTPs", the integration will only fetch findings with the finding type that match TTPs.'
  type: 16
  section: Collect
  advanced: true
  options:
  - Software and Configuration Checks
  - TTPs
  - Effects
  - Unusual Behaviors
  - Sensitive Data Identifications
  required: false
- display: Workflow Status
  additionalinfo: 'You can set the workflow status of the findings to be fetched: "New", "Notified", "Resolved", "Suppressed". For example, if you set the workflow status to "Suppressed", the integration will only fetch findings with the workflow status of Suppressed.'
  name: workflow_status
  type: 16
  section: Collect
  advanced: true
  options:
  - New
  - Notified
  - Resolved
  - Suppressed
  required: false
- display: Product Name
  name: product_name
  additionalinfo: 'You can enter a comma-separated list of product names. In order to get the product name, click Integrations in the AWS - Security Hub menu. Use only the product name (the value after the colon (:)) for this parameter.'
  type: 0
  section: Connect
  advanced: true
  required: false
description: Amazon Web Services Security Hub Service.
display: AWS - Security Hub
name: AWS - Security Hub
script:
  commands:
  - arguments:
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: 'The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.'
      name: roleSessionDuration
    - description: Override arguments and send a formatted JSON file.
      name: raw_json
    description: Disables Security Hub in your account only in the current Region. To disable Security Hub in all Regions, you must submit one request per Region where you have enabled Security Hub. When you disable Security Hub for a master account, it doesn't disable Security Hub for any associated member accounts. When you disable Security Hub, your existing findings and insights and any Security Hub configuration settings are deleted after 90 days and can't be recovered. Any standards that were enabled are disabled, and your master and member account associations are removed. If you want to save your existing findings, you must export them before you disable Security Hub.
    name: aws-securityhub-disable-security-hub
  - arguments:
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: 'The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.'
      name: roleSessionDuration
    - description: Override arguments and send a formatted JSON file.
      name: raw_json
    - description: The identifier of the finding that was specified by the finding. Can be retrieved using the 'aws-securityhub-get-findings' command provider.
      name: finding_identifiers_id
      required: true
    - description: The ARN generated by Security Hub that uniquely identifies a product that generates findings. This can be the ARN for a third-party product that is integrated with Security Hub, or the ARN for a custom integration. Can be retrieved using the 'aws-securityhub-get-findings' command.
      name: finding_identifiers_product_arn
      required: true
    - description: The updated note text.
      name: note_text
    - description: The principal that updated the note.
      name: note_updated_by
    - auto: PREDEFINED
      description: "The severity value of the finding. The allowed values are the following. *   INFORMATIONAL - No issue was found. *   LOW - The issue does not require action on its own. *   MEDIUM - The issue must be addressed but not urgently. *   HIGH - The issue must be addressed as a priority. *   CRITICAL - The issue must be remediated immediately to avoid it escalating."
      name: severity_label
      predefined:
      - INFORMATIONAL
      - LOW
      - MEDIUM
      - HIGH
      - CRITICAL
    - auto: PREDEFINED
      description: "Indicates the veracity of a finding. The available values for VerificationState are as follows. *   UNKNOWN - The default disposition of a security finding. *   TRUE_POSITIVE - The security finding is confirmed. *   FALSE_POSITIVE - The security finding was determined to be a false alarm. *   BENIGN_POSITIVE - A special case of TRUE_POSITIVE where the finding doesn't pose any threat, is expected, or both."
      name: verification_state
      predefined:
      - UNKNOWN
      - TRUE_POSITIVE
      - FALSE_POSITIVE
      - BENIGN_POSITIVE
    - description: "One or more finding types in the format of namespace/category/classifier that classify a finding. Valid namespace values are as follows. *  Software and Configuration Checks *  TTPs *  Effects *  Unusual Behaviors *  Sensitive Data Identifications."
      name: types
    - description: A list of name/value string pairs associated with the finding. These are custom, user-defined fields added to a finding.
      name: user_defined_fields
    - auto: PREDEFINED
      description: "The status of the investigation into the finding. The allowed values are the following. *   NEW - The initial state of a finding, before it is reviewed. *   NOTIFIED - Indicates that you notified the resource owner about the security issue. Used when the initial reviewer is not the resource owner, and needs intervention from the resource owner. *   RESOLVED - The finding was reviewed and remediated and is now considered resolved. *   SUPPRESSED - The finding will not be reviewed again and will not be acted upon."
      name: workflow_status
      predefined:
      - NEW
      - NOTIFIED
      - RESOLVED
      - SUPPRESSED
    - description: The ARN of the product that generated a related finding.
      name: related_findings_product_arn
    - description: The product-generated identifier for a related finding.
      name: related_findings_id
    description: "Used by Security Hub customers to update information about their investigation into a finding. Requested by master accounts or member accounts. Master accounts can update findings for their account and their member accounts. Member accounts can update findings for their account. Updates from BatchUpdateFindings do not affect the value of UpdatedAt for a finding. Master accounts can use BatchUpdateFindings to update the following finding fields and objects. *   Confidence *   Criticality *   Note *   RelatedFindings *   Severity *   Types *   UserDefinedFields *   VerificationState *   Workflow Member accounts can only use BatchUpdateFindings to update the Note object."
    name: aws-securityhub-batch-update-findings
    outputs:
    - contextPath: AWS-SecurityHub.ProcessedFindings.Id
      description: The identifier of the finding that was specified by the finding provider.
    - contextPath: AWS-SecurityHub.ProcessedFindings.ProductArn
      description: The ARN generated by Security Hub that uniquely identifies a product that generates findings. This can be the ARN for a third-party product that is integrated with Security Hub, or the ARN for a custom integration.
    - contextPath: AWS-SecurityHub.ProcessedFindings
      description: The list of findings that were updated successfully.
    - contextPath: AWS-SecurityHub.UnprocessedFindings.FindingIdentifier.Id
      description: The identifier of the finding that was specified by the finding provider.
    - contextPath: AWS-SecurityHub.UnprocessedFindings.FindingIdentifier.ProductArn
      description: The ARN generated by Security Hub that uniquely identifies a product that generates findings. This can be the ARN for a third-party product that is integrated with Security Hub, or the ARN for a custom integration.
    - contextPath: AWS-SecurityHub.UnprocessedFindings.FindingIdentifier
      description: The identifier of the finding that was not updated.
    - contextPath: AWS-SecurityHub.UnprocessedFindings.ErrorCode
      description: The code associated with the error.
    - contextPath: AWS-SecurityHub.UnprocessedFindings.ErrorMessage
      description: The message associated with the error.
    - contextPath: AWS-SecurityHub.UnprocessedFindings
      description: The list of findings that were not updated.
  - arguments:
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: 'The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.'
      name: roleSessionDuration
    - description: Override arguments and send a formatted JSON file.
      name: raw_json
    - description: 'List of Tags separated by Key Value. For example: "key=key1,value=value1;key=key2,value=value2".'
      name: tags
    description: Enables Security Hub for your account in the current Region or the Region you specify in the request. Enabling Security Hub also enables the CIS AWS Foundations standard. When you enable Security Hub, you grant to Security Hub the permissions necessary to gather findings from AWS Config, Amazon GuardDuty, Amazon Inspector, and Amazon Macie. To learn more, see Setting Up AWS Security Hub.
    name: aws-securityhub-enable-security-hub
  - arguments:
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: 'The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.'
      name: roleSessionDuration
    - description: Override arguments and send a formatted JSON file.
      name: raw_json
    - description: The string filter value.
      name: product_arn_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: product_arn_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: aws_account_id_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: aws_account_id_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: id_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: id_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: generator_id_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: generator_id_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: type_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: type_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: A start date for the date filter.
      name: first_observed_at_start
    - description: An end date for the date filter.
      name: first_observed_at_end
    - description: A start date for the date filter.
      name: last_observed_at_start
    - description: An end date for the date filter.
      name: last_observed_at_end
    - description: A start date for the date filter.
      name: created_at_start
    - description: An end date for the date filter.
      name: created_at_end
    - description: A start date for the date filter.
      name: updated_at_start
    - description: An end date for the date filter.
      name: updated_at_end
    - auto: PREDEFINED
      description: A date range unit for the date filter.
      name: date_range_unit
      predefined:
      - DAYS
    - description: The string filter value.
      name: severity_label_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: severity_label_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: title_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: title_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: description_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: description_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: recommendation_text_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: recommendation_text_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: source_url_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: source_url_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The key of the map filter.
      name: product_fields_key
    - description: The value for the key in the map filter.
      name: product_fields_value
    - auto: PREDEFINED
      description: The condition to apply to a key value when querying for findings with a map filter.
      name: product_fields_comparison
      predefined:
      - EQUALS
    - description: The string filter value.
      name: product_name_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: product_name_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: company_name_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: company_name_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The key of the map filter.
      name: user_defined_fields_key
    - description: The value for the key in the map filter.
      name: user_defined_fields_value
    - auto: PREDEFINED
      description: The condition to apply to a key value when querying for findings with a map filter.
      name: user_defined_fields_comparison
      predefined:
      - EQUALS
    - description: The string filter value.
      name: malware_name_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: malware_name_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: malware_type_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: malware_type_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: malware_path_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: malware_path_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: malware_state_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: malware_state_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: network_direction_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: network_direction_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: network_protocol_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: network_protocol_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: A finding's CIDR value.
      name: network_source_ip_v4_cidr
    - description: A finding's CIDR value.
      name: network_source_ip_v6_cidr
    - description: The string filter value.
      name: network_source_domain_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: network_source_domain_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: network_source_mac_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: network_source_mac_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: A finding's CIDR value.
      name: network_destination_ip_v4_cidr
    - description: A finding's CIDR value.
      name: network_destination_ip_v6_cidr
    - description: The string filter value.
      name: network_destination_domain_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: network_destination_domain_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: process_name_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: process_name_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: process_path_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: process_path_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: A start date for the date filter.
      name: process_launched_at_start
    - description: An end date for the date filter.
      name: process_launched_at_end
    - description: A start date for the date filter.
      name: process_terminated_at_start
    - description: An end date for the date filter.
      name: process_terminated_at_end
    - description: The string filter value.
      name: threat_intel_indicator_type_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: threat_intel_indicator_type_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: threat_intel_indicator_value_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: threat_intel_indicator_value_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: threat_intel_indicator_category_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: threat_intel_indicator_category_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: A start date for the date filter.
      name: threat_intel_indicator_last_observed_at_start
    - description: An end date for the date filter.
      name: threat_intel_indicator_last_observed_at_end
    - description: The string filter value.
      name: threat_intel_indicator_source_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: threat_intel_indicator_source_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: threat_intel_indicator_source_url_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: threat_intel_indicator_source_url_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: resource_type_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: resource_type_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: resource_id_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: resource_id_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: resource_partition_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: resource_partition_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: resource_region_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: resource_region_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The key of the map filter.
      name: resource_tags_key
    - description: The value for the key in the map filter.
      name: resource_tags_value
    - auto: PREDEFINED
      description: The condition to apply to a key value when querying for findings with a map filter.
      name: resource_tags_comparison
      predefined:
      - EQUALS
    - description: The string filter value.
      name: resource_aws_ec2_instance_type_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: resource_aws_ec2_instance_type_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: resource_aws_ec2_instance_image_id_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: resource_aws_ec2_instance_image_id_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: A finding's CIDR value.
      name: resource_aws_ec2_instance_ip_v4_addresses_cidr
    - description: A finding's CIDR value.
      name: resource_aws_ec2_instance_ip_v6_addresses_cidr
    - description: The string filter value.
      name: resource_aws_ec2_instance_key_name_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: resource_aws_ec2_instance_key_name_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: resource_aws_ec2_instance_iam_instance_profile_arn_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: resource_aws_ec2_instance_iam_instance_profile_arn_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: resource_aws_ec2_instance_vpc_id_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: resource_aws_ec2_instance_vpc_id_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: resource_aws_ec2_instance_subnet_id_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: resource_aws_ec2_instance_subnet_id_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: A start date for the date filter.
      name: resource_aws_ec2_instance_launched_at_start
    - description: An end date for the date filter.
      name: resource_aws_ec2_instance_launched_at_end
    - description: The string filter value.
      name: resource_aws_s3_bucket_owner_id_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: resource_aws_s3_bucket_owner_id_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: resource_aws_s3_bucket_owner_name_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: resource_aws_s3_bucket_owner_name_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: resource_aws_iam_access_key_user_name_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: resource_aws_iam_access_key_user_name_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: resource_aws_iam_access_key_status_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: resource_aws_iam_access_key_status_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: A start date for the date filter.
      name: resource_aws_iam_access_key_created_at_start
    - description: An end date for the date filter.
      name: resource_aws_iam_access_key_created_at_end
    - description: The string filter value.
      name: resource_container_name_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: resource_container_name_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: resource_container_image_id_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: resource_container_image_id_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: resource_container_image_name_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: resource_container_image_name_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: A start date for the date filter.
      name: resource_container_launched_at_start
    - description: An end date for the date filter.
      name: resource_container_launched_at_end
    - description: The key of the map filter.
      name: resource_details_other_key
    - description: The value for the key in the map filter.
      name: resource_details_other_value
    - auto: PREDEFINED
      description: The condition to apply to a key value when querying for findings with a map filter.
      name: resource_details_other_comparison
      predefined:
      - EQUALS
    - description: The string filter value.
      name: compliance_status_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: compliance_status_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: verification_state_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: verification_state_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: workflow_state_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: workflow_state_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: record_state_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: record_state_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: related_findings_product_arn_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: related_findings_product_arn_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: related_findings_id_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: related_findings_id_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: note_text_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: note_text_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: A start date for the date filter.
      name: note_updated_at_start
    - description: An end date for the date filter.
      name: note_updated_at_end
    - description: The string filter value.
      name: note_updated_by_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: note_updated_by_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: A value for the keyword.
      name: keyword_value
    - description: The finding attribute used to sort findings.
      name: sort_criteria_field
    - auto: PREDEFINED
      description: The order used to sort findings.
      name: sort_criteria_sort_order
      predefined:
      - asc
      - desc
    - description: Paginates results. On your first call to the GetFindings operation, set the value of this parameter to NULL. For subsequent calls to the operation, fill nextToken in the request with the value of nextToken from the previous response to continue listing data.
      name: next_token
    description: Returns a list of findings that match the specified criteria.
    name: aws-securityhub-get-findings
    outputs:
    - contextPath: AWS-SecurityHub.Findings.SchemaVersion
      description: The schema version that a finding is formatted for.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Id
      description: The security findings provider-specific identifier for a finding.
      type: string
    - contextPath: AWS-SecurityHub.Findings.ProductArn
      description: 'The ARN generated by Security Hub that uniquely identifies a third-party company (security-findings provider) after this provider''s product (solution that generates findings) is registered with Security Hub. '
      type: string
    - contextPath: AWS-SecurityHub.Findings.GeneratorId
      description: 'The identifier for the solution-specific component (a discrete unit of logic) that generated a finding. In various security-findings providers'' solutions, this generator can be called a rule, a check, a detector, a plug-in, etc. '
      type: string
    - contextPath: AWS-SecurityHub.Findings.AwsAccountId
      description: The AWS account ID that a finding is generated in.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Types
      description: 'One or more finding types in the format of namespace/category/classifier that classify a finding. Valid namespace values are as follows.  Software and Configuration Checks, TTPs, Effects, Unusual Behaviors, Sensitive Data Identifications.'
      type: Unknown
    - contextPath: AWS-SecurityHub.Findings.FirstObservedAt
      description: An ISO8601-formatted timestamp that indicates when the security-findings provider first observed the potential security issue that a finding captured.
      type: date
    - contextPath: AWS-SecurityHub.Findings.LastObservedAt
      description: An ISO8601-formatted timestamp that indicates when the security-findings provider most recently observed the potential security issue that a finding captured.
      type: date
    - contextPath: AWS-SecurityHub.Findings.CreatedAt
      description: An ISO8601-formatted timestamp that indicates when the security-findings provider created the potential security issue that a finding captured.
      type: date
    - contextPath: AWS-SecurityHub.Findings.UpdatedAt
      description: 'An ISO8601-formatted timestamp that indicates when the security-findings provider last updated the finding record. '
      type: date
    - contextPath: AWS-SecurityHub.Findings.Severity.Product
      description: The native severity as defined by the AWS service or integrated partner product that generated the finding.
      type: number
    - contextPath: AWS-SecurityHub.Findings.Severity.Normalized
      description: The normalized severity of a finding.
      type: number
    - contextPath: AWS-SecurityHub.Findings.Severity
      description: A finding's severity.
      type: Unknown
    - contextPath: AWS-SecurityHub.Findings.Confidence
      description: A finding's confidence. Confidence is defined as the likelihood that a finding accurately identifies the behavior or issue that it was intended to identify. Confidence is scored on a 0-100 basis using a ratio scale, where 0 means zero percent confidence and 100 means 100 percent confidence.
      type: number
    - contextPath: AWS-SecurityHub.Findings.Criticality
      description: The level of importance assigned to the resources associated with the finding. A score of 0 means that the underlying resources have no criticality, and a score of 100 is reserved for the most critical resources.
      type: number
    - contextPath: AWS-SecurityHub.Findings.Title
      description: 'A finding''s title.  In this release, Title is a required property. '
      type: string
    - contextPath: AWS-SecurityHub.Findings.Description
      description: 'A finding''s description.  In this release, Description is a required property. '
      type: string
    - contextPath: AWS-SecurityHub.Findings.Remediation.Recommendation.Text
      description: Describes the recommended steps to take to remediate an issue identified in a finding.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Remediation.Recommendation.Url
      description: A URL to a page or site that contains information about how to remediate a finding.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Remediation.Recommendation
      description: A recommendation on the steps to take to remediate the issue identified by a finding.
      type: Unknown
    - contextPath: AWS-SecurityHub.Findings.Remediation
      description: A data type that describes the remediation options for a finding.
      type: Unknown
    - contextPath: AWS-SecurityHub.Findings.SourceUrl
      description: A URL that links to a page about the current finding in the security-findings provider's solution.
      type: string
    - contextPath: AWS-SecurityHub.Findings.ProductFields
      description: A data type where security-findings providers can include additional solution-specific details that aren't part of the defined AwsSecurityFinding format.
      type: Unknown
    - contextPath: AWS-SecurityHub.Findings.UserDefinedFields
      description: 'A list of name/value string pairs associated with the finding. These are custom, user-defined fields added to a finding. '
      type: Unknown
    - contextPath: AWS-SecurityHub.Findings.Name
      description: The name of the malware that was observed.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Type
      description: The type of the malware that was observed.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Path
      description: The file system path of the malware that was observed.
      type: string
    - contextPath: AWS-SecurityHub.Findings.State
      description: The state of the malware that was observed.
      type: string
    - contextPath: AWS-SecurityHub.Findings
      description: The findings that matched the filters specified in the request.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Network.Direction
      description: The direction of network traffic associated with a finding.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Network.Protocol
      description: The protocol of network-related information about a finding.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Network.SourceIpV4
      description: The source IPv4 address of network-related information about a finding.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Network.SourceIpV6
      description: The source IPv6 address of network-related information about a finding.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Network.SourcePort
      description: The source port of network-related information about a finding.
      type: number
    - contextPath: AWS-SecurityHub.Findings.Network.SourceDomain
      description: The source domain of network-related information about a finding.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Network.SourceMac
      description: The source media access control (MAC) address of network-related information about a finding.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Network.DestinationIpV4
      description: The destination IPv4 address of network-related information about a finding.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Network.DestinationIpV6
      description: The destination IPv6 address of network-related information about a finding.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Network.DestinationPort
      description: The destination port of network-related information about a finding.
      type: number
    - contextPath: AWS-SecurityHub.Findings.Network.DestinationDomain
      description: The destination domain of network-related information about a finding.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Network
      description: The details of network-related information about a finding.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Process.Name
      description: The name of the process.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Process.Path
      description: The path to the process executable.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Process.Pid
      description: The process ID.
      type: number
    - contextPath: AWS-SecurityHub.Findings.Process.ParentPid
      description: The parent process ID.
      type: number
    - contextPath: AWS-SecurityHub.Findings.Process.LaunchedAt
      description: The date/time that the process was launched.
      type: date
    - contextPath: AWS-SecurityHub.Findings.Process.TerminatedAt
      description: The date and time when the process was terminated.
      type: date
    - contextPath: AWS-SecurityHub.Findings.Process
      description: The details of process-related information about a finding.
      type: Unknown
    - contextPath: AWS-SecurityHub.Findings.ThreatIntelIndicators.Type
      description: The type of a threat intel indicator.
      type: string
    - contextPath: AWS-SecurityHub.Findings.ThreatIntelIndicators.Value
      description: The value of a threat intel indicator.
      type: string
    - contextPath: AWS-SecurityHub.Findings.ThreatIntelIndicators.Category
      description: The category of a threat intel indicator.
      type: string
    - contextPath: AWS-SecurityHub.Findings.ThreatIntelIndicators.LastObservedAt
      description: The date and time when the most recent instance of a threat intel indicator was observed.
      type: string
    - contextPath: AWS-SecurityHub.Findings.ThreatIntelIndicators.Source
      description: The source of the threat intel indicator.
      type: string
    - contextPath: AWS-SecurityHub.Findings.ThreatIntelIndicators.SourceUrl
      description: The URL to the page or site where you can get more information about the threat intel indicator.
      type: string
    - contextPath: AWS-SecurityHub.Findings.ThreatIntelIndicators
      description: Threat intel details related to a finding.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Type
      description: The type of the resource that details are provided for.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Id
      description: The canonical identifier for the given resource type.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Partition
      description: The canonical AWS partition name that the Region is assigned to.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Region
      description: The canonical AWS external Region name where this resource is located.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Tags
      description: A list of AWS tags associated with a resource at the time the finding was processed.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsCloudFrontDistribution.DomainName
      description: The domain name corresponding to the distribution.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsCloudFrontDistribution.ETag
      description: The entity tag is a hash of the object.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsCloudFrontDistribution.LastModifiedTime
      description: The date and time that the distribution was last modified.
      type: date
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsCloudFrontDistribution.Logging.Bucket
      description: The Amazon S3 bucket to store the access logs in.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsCloudFrontDistribution.Logging.Enabled
      description: With this field, you can enable or disable the selected distribution.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsCloudFrontDistribution.Logging.IncludeCookies
      description: Specifies whether you want CloudFront to include cookies in access logs.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsCloudFrontDistribution.Logging.Prefix
      description: An optional string that you want CloudFront to prefix to the access log filenames for this distribution.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsCloudFrontDistribution.Logging
      description: A complex type that controls whether access logs are written for the distribution.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsCloudFrontDistribution.Origins.Items.DomainName
      description: 'Amazon S3 origins: The DNS name of the Amazon S3 bucket from which you want CloudFront to get objects for this origin.'
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsCloudFrontDistribution.Origins.Items.Id
      description: A unique identifier for the origin or origin group.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsCloudFrontDistribution.Origins.Items.OriginPath
      description: An optional element that causes CloudFront to request your content from a directory in your Amazon S3 bucket or your custom origin.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsCloudFrontDistribution.Origins.Items
      description: A complex type that contains origins or origin groups for this distribution.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsCloudFrontDistribution.Origins
      description: A complex type that contains information about origins for this distribution.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsCloudFrontDistribution.Status
      description: Indicates the current status of the distribution.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsCloudFrontDistribution.WebAclId
      description: A unique identifier that specifies the AWS WAF web ACL, if any, to associate with this distribution.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsCloudFrontDistribution
      description: Details about a CloudFront distribution.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsEc2Instance.Type
      description: 'The instance type of the instance. '
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsEc2Instance.ImageId
      description: The Amazon Machine Image (AMI) ID of the instance.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsEc2Instance.IpV4Addresses
      description: The IPv4 addresses associated with the instance.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsEc2Instance.IpV6Addresses
      description: The IPv6 addresses associated with the instance.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsEc2Instance.KeyName
      description: The key name associated with the instance.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsEc2Instance.IamInstanceProfileArn
      description: The IAM profile ARN of the instance.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsEc2Instance.VpcId
      description: The identifier of the VPC that the instance was launched in.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsEc2Instance.SubnetId
      description: The identifier of the subnet that the instance was launched in.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsEc2Instance.LaunchedAt
      description: The date/time the instance was launched.
      type: date
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsEc2Instance
      description: Details about an Amazon EC2 instance related to a finding.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsElbv2LoadBalancer.AvailabilityZones.ZoneName
      description: The name of the Availability Zone.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsElbv2LoadBalancer.AvailabilityZones.SubnetId
      description: The ID of the subnet. You can specify one subnet per Availability Zone.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsElbv2LoadBalancer.AvailabilityZones
      description: The Availability Zones for the load balancer.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsElbv2LoadBalancer.CanonicalHostedZoneId
      description: The ID of the Amazon Route 53 hosted zone associated with the load balancer.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsElbv2LoadBalancer.CreatedTime
      description: The date and time the load balancer was created.
      type: date
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsElbv2LoadBalancer.DNSName
      description: The public DNS name of the load balancer.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsElbv2LoadBalancer.IpAddressType
      description: The type of IP addresses used by the subnets for your load balancer. The possible values are ipv4 (for IPv4 addresses) and dualstack (for IPv4 and IPv6 addresses).
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsElbv2LoadBalancer.Scheme
      description: The nodes of an Internet-facing load balancer have public IP addresses.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsElbv2LoadBalancer.SecurityGroups
      description: The IDs of the security groups for the load balancer.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsElbv2LoadBalancer.State.Code
      description: 'The state code. The initial state of the load balancer is provisioning. After the load balancer is fully set up and ready to route traffic, its state is active. If the load balancer could not be set up, its state is failed. '
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsElbv2LoadBalancer.State.Reason
      description: A description of the state.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsElbv2LoadBalancer.State
      description: The state of the load balancer.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsElbv2LoadBalancer.Type
      description: The type of load balancer.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsElbv2LoadBalancer.VpcId
      description: The ID of the VPC for the load balancer.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsElbv2LoadBalancer
      description: Details about a load balancer.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsS3Bucket.OwnerId
      description: The canonical user ID of the owner of the S3 bucket.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsS3Bucket.OwnerName
      description: The display name of the owner of the S3 bucket.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsS3Bucket
      description: Details about an Amazon S3 Bucket related to a finding.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsIamAccessKey.UserName
      description: The user associated with the IAM access key related to a finding. The UserName parameter has been replaced with the PrincipalName parameter because access keys can also be assigned to principals that are not IAM users.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsIamAccessKey.Status
      description: The status of the IAM access key related to a finding.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsIamAccessKey.CreatedAt
      description: The creation date/time of the IAM access key related to a finding.
      type: date
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsIamAccessKey.PrincipalId
      description: The ID of the principal associated with an access key.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsIamAccessKey.PrincipalType
      description: The type of principal associated with an access key.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsIamAccessKey.PrincipalName
      description: The name of the principal.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsIamAccessKey
      description: Details about an IAM access key related to a finding.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsIamRole.AssumeRolePolicyDocument
      description: The trust policy that grants permission to assume the role.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsIamRole.CreateDate
      description: The date and time, in ISO 8601 date-time format, when the role was created.
      type: date
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsIamRole.RoleId
      description: The stable and unique string identifying the role.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsIamRole.RoleName
      description: The friendly name that identifies the role.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsIamRole.MaxSessionDuration
      description: The maximum session duration (in seconds) that you want to set for the specified role.
      type: number
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsIamRole.Path
      description: The path to the role.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsIamRole
      description: Details about an IAM role.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsKmsKey.AWSAccountId
      description: The twelve-digit account ID of the AWS account that owns the CMK.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsKmsKey.CreationDate
      description: The date and time when the CMK was created.
      type: date
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsKmsKey.KeyId
      description: The globally unique identifier for the CMK.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsKmsKey.KeyManager
      description: The manager of the CMK. CMKs in your AWS account are either customer managed or AWS managed.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsKmsKey.KeyState
      description: The state of the CMK.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsKmsKey.Origin
      description: The source of the CMK's key material. When this value is AWS\_KMS, AWS KMS created the key material. When this value is EXTERNAL, the key material was imported from your existing key management infrastructure or the CMK lacks key material. When this value is AWS\_CLOUDHSM, the key material was created in the AWS CloudHSM cluster associated with a custom key store.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsKmsKey
      description: Details about a KMS key.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsLambdaFunction.Code.S3Bucket
      description: An Amazon S3 bucket in the same AWS Region as your function. The bucket can be in a different AWS account.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsLambdaFunction.Code.S3Key
      description: The Amazon S3 key of the deployment package.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsLambdaFunction.Code.S3ObjectVersion
      description: For versioned objects, the version of the deployment package object to use.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsLambdaFunction.Code.ZipFile
      description: The base64-encoded contents of the deployment package. AWS SDK and AWS CLI clients handle the encoding for you.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsLambdaFunction.Code
      description: An AwsLambdaFunctionCode object.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsLambdaFunction.CodeSha256
      description: The SHA256 hash of the function's deployment package.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsLambdaFunction.DeadLetterConfig.TargetArn
      description: The Amazon Resource Name (ARN) of an Amazon SQS queue or Amazon SNS topic.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsLambdaFunction.DeadLetterConfig
      description: The function's dead letter queue.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsLambdaFunction.Environment.Variables
      description: Environment variable key-value pairs.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsLambdaFunction.Environment.Error.ErrorCode
      description: The error code.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsLambdaFunction.Environment.Error.Message
      description: The error message.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsLambdaFunction.Environment.Error
      description: An AwsLambdaFunctionEnvironmentError object.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsLambdaFunction.Environment
      description: The function's environment variables.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsLambdaFunction.FunctionName
      description: The name of the function.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsLambdaFunction.Handler
      description: The function that Lambda calls to begin executing your function.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsLambdaFunction.KmsKeyArn
      description: The KMS key that's used to encrypt the function's environment variables. This key is only returned if you've configured a customer managed CMK.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsLambdaFunction.LastModified
      description: The date and time that the function was last updated, in ISO-8601 format (YYYY-MM-DDThh:mm:ss.sTZD).
      type: date
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsLambdaFunction.Layers.Arn
      description: The Amazon Resource Name (ARN) of the function layer.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsLambdaFunction.Layers.CodeSize
      description: The size of the layer archive in bytes.
      type: number
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsLambdaFunction.Layers
      description: The function's layers.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsLambdaFunction.MasterArn
      description: For Lambda@Edge functions, the ARN of the master function.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsLambdaFunction.MemorySize
      description: The memory that's allocated to the function.
      type: number
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsLambdaFunction.RevisionId
      description: The latest updated revision of the function or alias.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsLambdaFunction.Role
      description: The function's execution role.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsLambdaFunction.Runtime
      description: The runtime environment for the Lambda function.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsLambdaFunction.Timeout
      description: The amount of time that Lambda allows a function to run before stopping it.
      type: number
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsLambdaFunction.TracingConfig.Mode
      description: The tracing mode.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsLambdaFunction.TracingConfig
      description: The function's AWS X-Ray tracing configuration.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsLambdaFunction.VpcConfig.SecurityGroupIds
      description: A list of VPC security groups IDs.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsLambdaFunction.VpcConfig.SubnetIds
      description: A list of VPC subnet IDs.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsLambdaFunction.VpcConfig.VpcId
      description: The ID of the VPC.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsLambdaFunction.VpcConfig
      description: The function's networking configuration.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsLambdaFunction.Version
      description: The version of the Lambda function.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsLambdaFunction
      description: Details about a Lambda function.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsSnsTopic.KmsMasterKeyId
      description: The ID of an AWS-managed customer master key (CMK) for Amazon SNS or a custom CMK.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsSnsTopic.Subscription.Endpoint
      description: The subscription's endpoint (format depends on the protocol).
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsSnsTopic.Subscription.Protocol
      description: The subscription's protocol.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsSnsTopic.Subscription
      description: Subscription is an embedded property that describes the subscription endpoints of an Amazon SNS topic.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsSnsTopic.TopicName
      description: The name of the topic.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsSnsTopic.Owner
      description: The subscription's owner.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsSnsTopic
      description: Details about an SNS topic.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsSqsQueue.KmsDataKeyReusePeriodSeconds
      description: The length of time, in seconds, for which Amazon SQS can reuse a data key to encrypt or decrypt messages before calling AWS KMS again.
      type: number
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsSqsQueue.KmsMasterKeyId
      description: The ID of an AWS-managed customer master key (CMK) for Amazon SQS or a custom CMK.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsSqsQueue.QueueName
      description: The name of the new queue.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsSqsQueue.DeadLetterTargetArn
      description: 'The Amazon Resource Name (ARN) of the dead-letter queue to which Amazon SQS moves messages after the value of maxReceiveCount is exceeded.'
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.AwsSqsQueue
      description: Details about an SQS queue.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.Container.Name
      description: The name of the container related to a finding.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.Container.ImageId
      description: The identifier of the image related to a finding.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.Container.ImageName
      description: The name of the image related to a finding.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.Container.LaunchedAt
      description: The date and time when the container started.
      type: date
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.Container
      description: Details about a container resource related to a finding.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details.Other
      description: Details about a resource that doesn't have a specific type defined.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources.Details
      description: Additional details about the resource related to a finding.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Resources
      description: A set of resource data types that describe the resources that the finding refers to.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Compliance.Status
      description: The result of a compliance check.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Compliance
      description: This data type is exclusive to findings that are generated as the result of a check run against a specific rule in a supported standard (for example, CIS AWS Foundations). Contains compliance-related finding details.
      type: string
    - contextPath: AWS-SecurityHub.Findings.VerificationState
      description: Indicates the veracity of a finding.
      type: string
    - contextPath: AWS-SecurityHub.Findings.WorkflowState
      description: The workflow state of a finding.
      type: string
    - contextPath: AWS-SecurityHub.Findings.RecordState
      description: The record state of a finding.
      type: string
    - contextPath: AWS-SecurityHub.Findings.RelatedFindings.ProductArn
      description: The ARN of the product that generated a related finding.
      type: string
    - contextPath: AWS-SecurityHub.Findings.RelatedFindings.Id
      description: The product-generated identifier for a related finding.
      type: string
    - contextPath: AWS-SecurityHub.Findings.RelatedFindings
      description: A list of related findings.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Note.Text
      description: The text of a note.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Note.UpdatedBy
      description: The principal that created a note.
      type: string
    - contextPath: AWS-SecurityHub.Findings.Note.UpdatedAt
      description: The timestamp of when the note was updated.
      type: date
    - contextPath: AWS-SecurityHub.Findings.Note
      description: A user-defined note added to a finding.
      type: string
    - contextPath: AWS-SecurityHub.NextToken
      description: The token that is required for pagination.
      type: string
  - arguments:
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: 'The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.'
      name: roleSessionDuration
    - description: Override arguments and send a formatted JSON file.
      name: raw_json
    description: Provides the details for the Security Hub master account to the current member account.
    name: aws-securityhub-get-master-account
    outputs:
    - contextPath: AWS-SecurityHub.Master.AccountId
      description: The account ID of the Security Hub master account that the invitation was sent from.
      type: string
    - contextPath: AWS-SecurityHub.Master.InvitationId
      description: The ID of the invitation sent to the member account.
      type: string
    - contextPath: AWS-SecurityHub.Master.InvitedAt
      description: The timestamp of when the invitation was sent.
      type: date
    - contextPath: AWS-SecurityHub.Master.MemberStatus
      description: The current status of the association between member and master accounts.
      type: string
    - contextPath: AWS-SecurityHub.Master
      description: 'A list of details about the Security Hub master account for the current member account. '
      type: Unknown
  - arguments:
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: 'The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.'
      name: roleSessionDuration
    - description: Override arguments and send a formatted JSON file.
      name: raw_json
    - auto: PREDEFINED
      description: <p>Specifies which member accounts the response includes based on their relationship status with the master account. The default value is <code>TRUE</code>. If <code>onlyAssociated</code> is set to <code>TRUE</code>, the response includes member accounts whose relationship status with the master is set to <code>ENABLED</code> or <code>DISABLED</code>. If <code>onlyAssociated</code> is set to <code>FALSE</code>, the response includes all existing member accounts. </p>.
      name: only_associated
      predefined:
      - 'True'
      - 'False'
    - description: 'Paginates results. Set the value of this parameter to NULL on your first call to the ListMembers operation. For subsequent calls to the operation, fill nextToken in the request with the value of nextToken from the previous response to continue listing data.'
      name: next_token
    description: Lists details about all member accounts for the current Security Hub master account.
    name: aws-securityhub-list-members
    outputs:
    - contextPath: AWS-SecurityHub.Members.AccountId
      description: The AWS account ID of the member account.
      type: string
    - contextPath: AWS-SecurityHub.Members.Email
      description: The email address of the member account.
      type: string
    - contextPath: AWS-SecurityHub.Members.MasterId
      description: The AWS account ID of the Security Hub master account associated with this member account.
      type: string
    - contextPath: AWS-SecurityHub.Members.MemberStatus
      description: The status of the relationship between the member account and its master account.
      type: string
    - contextPath: AWS-SecurityHub.Members.InvitedAt
      description: A timestamp for the date and time when the invitation was sent to the member account.
      type: date
    - contextPath: AWS-SecurityHub.Members.UpdatedAt
      description: The timestamp for the date and time when the member account was updated.
      type: date
    - contextPath: AWS-SecurityHub.Members
      description: Member details returned by the operation.
      type: Unknown
    - contextPath: AWS-SecurityHub.NextToken
      description: The token that is required for pagination.
      type: string
  - arguments:
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: 'The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.'
      name: roleSessionDuration
    - description: Override arguments and send a formatted JSON file.
      name: raw_json
    - description: The string filter value.
      name: product_arn_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: product_arn_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: aws_account_id_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: aws_account_id_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: id_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: id_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: generator_id_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: generator_id_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: type_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: type_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: A start date for the date filter.
      name: first_observed_at_start
    - description: An end date for the date filter.
      name: first_observed_at_end
    - auto: PREDEFINED
      description: A date range unit for the date filter.
      name: date_range_unit
      predefined:
      - DAYS
    - description: A start date for the date filter.
      name: last_observed_at_start
    - description: An end date for the date filter.
      name: last_observed_at_end
    - description: A start date for the date filter.
      name: created_at_start
    - description: An end date for the date filter.
      name: created_at_end
    - description: A start date for the date filter.
      name: updated_at_start
    - description: An end date for the date filter.
      name: updated_at_end
    - description: The string filter value.
      name: severity_label_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: severity_label_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: title_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: title_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: description_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: description_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: recommendation_text_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: recommendation_text_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: source_url_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: source_url_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The key of the map filter.
      name: product_fields_key
    - description: The value for the key in the map filter.
      name: product_fields_value
    - auto: PREDEFINED
      description: The condition to apply to a key value when querying for findings with a map filter.
      name: product_fields_comparison
      predefined:
      - EQUALS
    - description: The string filter value.
      name: product_name_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: product_name_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: company_name_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: company_name_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The key of the map filter.
      name: user_defined_fields_key
    - description: The value for the key in the map filter.
      name: user_defined_fields_value
    - auto: PREDEFINED
      description: The condition to apply to a key value when querying for findings with a map filter.
      name: user_defined_fields_comparison
      predefined:
      - EQUALS
    - description: The string filter value.
      name: malware_name_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: malware_name_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: malware_type_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: malware_type_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: malware_path_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: malware_path_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: malware_state_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: malware_state_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: network_direction_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: network_direction_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: network_protocol_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: network_protocol_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: A finding's CIDR value.
      name: network_source_ip_v4_cidr
    - description: A finding's CIDR value.
      name: network_source_ip_v6_cidr
    - description: The string filter value.
      name: network_source_domain_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: network_source_domain_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: network_source_mac_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: network_source_mac_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: A finding's CIDR value.
      name: network_destination_ip_v4_cidr
    - description: A finding's CIDR value.
      name: network_destination_ip_v6_cidr
    - description: The string filter value.
      name: network_destination_domain_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: network_destination_domain_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: process_name_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: process_name_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: process_path_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: process_path_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: A start date for the date filter.
      name: process_launched_at_start
    - description: An end date for the date filter.
      name: process_launched_at_end
    - description: A start date for the date filter.
      name: process_terminated_at_start
    - description: An end date for the date filter.
      name: process_terminated_at_end
    - description: The string filter value.
      name: threat_intel_indicator_type_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: threat_intel_indicator_type_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: threat_intel_indicator_value_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: threat_intel_indicator_value_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: threat_intel_indicator_category_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: threat_intel_indicator_category_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: A start date for the date filter.
      name: threat_intel_indicator_last_observed_at_start
    - description: An end date for the date filter.
      name: threat_intel_indicator_last_observed_at_end
    - description: The string filter value.
      name: threat_intel_indicator_source_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: threat_intel_indicator_source_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: threat_intel_indicator_source_url_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: threat_intel_indicator_source_url_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: resource_type_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: resource_type_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: resource_id_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: resource_id_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: resource_partition_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: resource_partition_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: resource_region_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: resource_region_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The key of the map filter.
      name: resource_tags_key
    - description: The value for the key in the map filter.
      name: resource_tags_value
    - auto: PREDEFINED
      description: The condition to apply to a key value when querying for findings with a map filter.
      name: resource_tags_comparison
      predefined:
      - EQUALS
    - description: The string filter value.
      name: resource_aws_ec2_instance_type_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: resource_aws_ec2_instance_type_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: resource_aws_ec2_instance_image_id_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: resource_aws_ec2_instance_image_id_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: A finding's CIDR value.
      name: resource_aws_ec2_instance_ip_v4_addresses_cidr
    - description: A finding's CIDR value.
      name: resource_aws_ec2_instance_ip_v6_addresses_cidr
    - description: The string filter value.
      name: resource_aws_ec2_instance_key_name_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: resource_aws_ec2_instance_key_name_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: resource_aws_ec2_instance_iam_instance_profile_arn_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: resource_aws_ec2_instance_iam_instance_profile_arn_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: resource_aws_ec2_instance_vpc_id_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: resource_aws_ec2_instance_vpc_id_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: resource_aws_ec2_instance_subnet_id_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: resource_aws_ec2_instance_subnet_id_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: A start date for the date filter.
      name: resource_aws_ec2_instance_launched_at_start
    - description: An end date for the date filter.
      name: resource_aws_ec2_instance_launched_at_end
    - description: The string filter value.
      name: resource_aws_s3_bucket_owner_id_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: resource_aws_s3_bucket_owner_id_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: resource_aws_s3_bucket_owner_name_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: resource_aws_s3_bucket_owner_name_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: resource_aws_iam_access_key_user_name_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: resource_aws_iam_access_key_user_name_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: resource_aws_iam_access_key_status_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: resource_aws_iam_access_key_status_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: A start date for the date filter.
      name: resource_aws_iam_access_key_created_at_start
    - description: An end date for the date filter.
      name: resource_aws_iam_access_key_created_at_end
    - description: The string filter value.
      name: resource_container_name_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: resource_container_name_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: resource_container_image_id_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: resource_container_image_id_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: resource_container_image_name_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: resource_container_image_name_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: A start date for the date filter.
      name: resource_container_launched_at_start
    - description: An end date for the date filter.
      name: resource_container_launched_at_end
    - description: The key of the map filter.
      name: resource_details_other_key
    - description: The value for the key in the map filter.
      name: resource_details_other_value
    - auto: PREDEFINED
      description: The condition to apply to a key value when querying for findings with a map filter.
      name: resource_details_other_comparison
      predefined:
      - EQUALS
    - description: The string filter value.
      name: compliance_status_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: compliance_status_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: verification_state_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: verification_state_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: workflow_state_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: workflow_state_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: record_state_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: record_state_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: related_findings_product_arn_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: related_findings_product_arn_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: related_findings_id_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: related_findings_id_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: The string filter value.
      name: note_text_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: note_text_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: A start date for the date filter.
      name: note_updated_at_start
    - description: An end date for the date filter.
      name: note_updated_at_end
    - description: The string filter value.
      name: note_updated_by_value
    - auto: PREDEFINED
      description: The condition to be applied to a string value when querying for findings.
      name: note_updated_by_comparison
      predefined:
      - EQUALS
      - PREFIX
    - description: A value for the keyword.
      name: keyword_value
    - description: The updated note text.
      name: note_text
    - description: The principal that updated the note.
      name: note_updated_by
    - auto: PREDEFINED
      description: The updated record state for the finding.
      name: record_state
      predefined:
      - ACTIVE
      - ARCHIVED
    deprecated: true
    description: Deprecated, use aws-securityhub-batch-update-findings instead.
    name: aws-securityhub-update-findings
  - name: get-remote-data
    description: Get remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes only.
    arguments:
    - name: id
      description: The remote incident ID.
      required: true
    - name: lastUpdate
      defaultValue: '0'
      description: The UTC timestamp in seconds since the last update. The incident is only updated if it was modified after the last update time.
  - name: get-mapping-fields
    description: Returns the list of fields to map in outgoing mirroring. This command is only used for debugging purposes.
  dockerimage: demisto/boto3py3:1.0.0.10221838
  isfetch: true
  ismappable: true
  isremotesyncin: true
  isremotesyncout: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
defaultmapperin: AWS Security Hub - Incoming Mapper
defaultmapperout: AWS Security Hub - Outgoing Mapper
fromversion: 5.0.0
tests:
- AWS-securityhub Test