Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

AwsCloudWatch resources in ASFF

The following are examples of the Amazon Security Finding Format (ASFF) syntax for AwsCloudWatch resources.

Amazon Security Hub normalizes findings from various sources into ASFF. For background information about ASFF, see Amazon Security Finding Format (ASFF).

AwsCloudWatchAlarm

The AwsCloudWatchAlarm object provides details about Amazon CloudWatch alarms that watch a metric or perform an action when an alarm changes state.

The following example shows the Amazon Security Finding Format (ASFF) for the AwsCloudWatchAlarm object. To view descriptions of AwsCloudWatchAlarm attributes, see AwsCloudWatchAlarmDetails in the Amazon Security Hub API Reference.

Example

"AwsCloudWatchAlarm": { 
	"ActionsEnabled": true,
	"AlarmActions": [
		"arn:aws-cn:automate:region:ec2:stop",
		"arn:aws-cn:automate:region:ec2:terminate"
	],
	"AlarmArn": "arn:aws-cn:cloudwatch:us-west-2:012345678910:alarm:sampleAlarm",
	"AlarmConfigurationUpdatedTimestamp": "2022-02-18T15:31:53.161Z",
	"AlarmDescription": "Alarm Example",
	"AlarmName": "Example",
	"ComparisonOperator": "GreaterThanOrEqualToThreshold",
	"DatapointsToAlarm": 1,
	"Dimensions": [{
		"Name": "InstanceId",
		"Value": "i-1234567890abcdef0"
	}],
	"EvaluateLowSampleCountPercentile": "evaluate",
	"EvaluationPeriods": 1,
	"ExtendedStatistic": "p99.9",
	"InsufficientDataActions": [
		"arn:aws-cn:automate:region:ec2:stop"
	],
	"MetricName": "Sample Metric",
	"Namespace": "YourNamespace",
	"OkActions": [
		"arn:aws-cn:swf:region:account-id:action/actions/AWS_EC2.InstanceId.Stop/1.0"
	],
	"Period": 1,
	"Statistic": "SampleCount",
	"Threshold": 12.3,
	"ThresholdMetricId": "t1",
	"TreatMissingData": "notBreaching",
	"Unit": "Kilobytes/Second"
}