本文属于机器翻译版本。若本译文内容与英语原文存在差异,则一律以英文原文为准。
Security Hub 中的自动化规则示例
本节包括常见用例的一些自动化规则示例。这些示例对应于 Amazon Security Hub 控制台中的规则模板。
当特定资源(例如 S3 存储桶)面临风险时,将严重性提升为“严重”
在本示例中,当 ResourceId
在调查发现中的对象是特定的 Amazon Simple Storage Service(Amazon S3)存储桶时,匹配规则条件。规则操作是将匹配调查发现的严重性更改为 CRITICAL
。您可以修改此模板以应用于其他资源。
API请求示例:
{ "IsTerminal":
true
, "RuleName": "Elevate severity of findings that relate to important resources
", "RuleOrder":1
, "RuleStatus": "ENABLED
", "Description": "Elevate finding severity to
", "Criteria": { "ProductName": [{ "Value": "CRITICAL
when specific resource such as an S3 bucket is at riskSecurity Hub
", "Comparison": "EQUALS
" }], "ComplianceStatus": [{ "Value": "FAILED
", "Comparison": "EQUALS
" }], "RecordState": [{ "Value": "ACTIVE
", "Comparison": "EQUALS
" }], "WorkflowStatus": [{ "Value": "NEW
", "Comparison": "EQUALS
" }], "ResourceId": [{ "Value": "arn:aws:s3:::amzn-s3-demo-bucket/developers/design_info.doc
", "Comparison": "EQUALS
" }] }, "Actions": [{ "Type": "FINDING_FIELDS_UPDATE", "FindingFieldsUpdate": { "Severity": { "Label": "CRITICAL
" }, "Note": { "Text": "This is a critical resource. Please review ASAP.
", "UpdatedBy": "sechub-automation
" } } }] }
CLI命令示例:
$
aws securityhub create-automation-rule \ --is-terminal \ --rule-name "
\ --criteria '{ "ProductName": [{ "Value": "Elevate severity of findings that relate to important resources
" \ --rule-order1
\ --rule-status "ENABLED
" \ --description "Elevate finding severity to
"CRITICAL
when specific resource such as an S3 bucket is at riskSecurity Hub
", "Comparison":"
EQUALS
" }], "ComplianceStatus": [{ "Value": "FAILED
", "Comparison": "EQUALS
" }], "RecordState": [{ "Value": "ACTIVE
", "Comparison": "EQUALS
" }], "WorkflowStatus": [{ "Value": "NEW
", "Comparison": "EQUALS
" }], "ResourceId": [{ "Value": "arn:aws:s3:::amzn-s3-demo-bucket/developers/design_info.doc"
, "Comparison": "EQUALS
" }] }' \ --actions '[{ "Type": "FINDING_FIELDS_UPDATE", "FindingFieldsUpdate": { "Severity": { "Label": "CRITICAL
" }, "Note": { "Text": "This is a critical resource. Please review ASAP.
", "UpdatedBy": "sechub-automation
" } } }]' \ --regionus-east-1
提高与生产账户中资源相关调查发现的严重性
在此示例中,当在特定的生产账户中生成 HIGH
严重级别的调查发现时,匹配规则条件。规则操作是将匹配调查发现的严重性更改为 CRITICAL
。
API请求示例:
{ "IsTerminal":
false
, "RuleName": "Elevate severity for production accounts
", "RuleOrder":1
, "RuleStatus": "ENABLED
", "Description": "Elevate finding severity from
", "Criteria": { "ProductName": [{ "Value": "HIGH
toCRITICAL
for findings that relate to resources in specific production accountsSecurity Hub
", "Comparison": "EQUALS
" }], "ComplianceStatus": [{ "Value": "FAILED
", "Comparison": "EQUALS
" }], "RecordState": [{ "Value": "ACTIVE
", "Comparison": "EQUALS
" }], "WorkflowStatus": [{ "Value": "NEW
", "Comparison": "EQUALS
" }], "SeverityLabel": [{ "Value": "HIGH
", "Comparison": "EQUALS
" }], "AwsAccountId": [ { "Value": "111122223333
", "Comparison": "EQUALS
" }, { "Value": "123456789012
", "Comparison": "EQUALS
" }] }, "Actions": [{ "Type": "FINDING_FIELDS_UPDATE", "FindingFieldsUpdate": { "Severity": { "Label": "CRITICAL
" }, "Note": { "Text": "A resource in production accounts is at risk. Please review ASAP.
", "UpdatedBy": "sechub-automation
" } } }] }
CLI命令示例:
aws securityhub create-automation-rule \ --no-is-terminal \ --rule-name
"
\ --rule-orderElevate severity of findings that relate to resources in production accounts
"\ --rule-status
1
"
\ --descriptionENABLED
""
\ --criteria '{ "ProductName": [{ "Value":Elevate finding severity from
"HIGH
toCRITICAL
for findings that relate to resources in specific production accounts"
, "Comparison":Security Hub
""
}], "ComplianceStatus": [{ "Value":EQUALS
""
, "Comparison":FAILED
""
}], "RecordState": [{ "Value":EQUALS
""
, "Comparison":ACTIVE
""
}], "SeverityLabel": [{ "Value":EQUALS
""
, "Comparison":HIGH
""
}], "AwsAccountId": [ { "Value":EQUALS
""
, "Comparison":111122223333
""
}, { "Value":EQUALS
""
, "Comparison":123456789012
""
}] }' \ --actions '[{ "Type":EQUALS
""FINDING_FIELDS_UPDATE"
, "FindingFieldsUpdate": { "Severity": { "Label":"
}, "Note": { "Text":CRITICAL
""
, "UpdatedBy":A resource in production accounts is at risk. Please review ASAP.
""
} } }]' \ --regionsechub-automation
"
us-east-1
隐藏信息性结果
在此示例中,与从亚马逊发送到 Security Hub 的INFORMATIONAL
严重性调查结果的规则标准相匹配 GuardDuty。规则操作是将匹配调查发现的工作流程状态更改为 SUPPRESSED
。
API请求示例:
{ "IsTerminal":
false
, "RuleName": "Suppress informational findings
", "RuleOrder":1
, "RuleStatus": "ENABLED
", "Description": "Suppress GuardDuty findings with
", "Criteria": { "ProductName": [{ "Value": "INFORMATIONAL
severityGuardDuty
", "Comparison": "EQUALS
" }], "RecordState": [{ "Value": "ACTIVE
", "Comparison": "EQUALS
" }], "WorkflowStatus": [{ "Value": "NEW
", "Comparison": "EQUALS
" }], "SeverityLabel": [{ "Value": "INFORMATIONAL
", "Comparison": "EQUALS
" }] }, "Actions": [{ "Type": "FINDING_FIELDS_UPDATE", "FindingFieldsUpdate": { "Workflow": { "Status": "SUPPRESSED
" }, "Note": { "Text": "Automatically suppress GuardDuty findings with
", "UpdatedBy": "INFORMATIONAL
severitysechub-automation
" } } }] }
CLI命令示例:
aws securityhub create-automation-rule \ --no-is-terminal \ --rule-name
"
\ --rule-orderSuppress informational findings
"\ --rule-status
1
"
\ --descriptionENABLED
""
\ --criteria '{ "ProductName": [{ "Value":Suppress GuardDuty findings with
"INFORMATIONAL
severity"
, "Comparison":GuardDuty
""
}], "ComplianceStatus": [{ "Value":EQUALS
""
, "Comparison":FAILED
""
}], "RecordState": [{ "Value":EQUALS
""
, "Comparison":ACTIVE
""
}], "WorkflowStatus": [{ "Value":EQUALS
""
, "Comparison":NEW
""
}], "SeverityLabel": [{ "Value":EQUALS
""
, "Comparison":INFORMATIONAL
""
}] }' \ --actions '[{ "Type":EQUALS
""FINDING_FIELDS_UPDATE"
, "FindingFieldsUpdate": { "Workflow": { "Status":"
}, "Note": { "Text":SUPPRESSED
""
, "UpdatedBy":Automatically suppress GuardDuty findings with
"INFORMATIONAL
severity"
} } }]' \ --regionsechub-automation
"
us-east-1