本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

# 自动化规则示例
<a name="examples-automation-rules"></a>

本部分提供了常见 Security Hub CSPM 使用案例的自动化规则示例。这些示例对应于 Security Hub CSPM 控制台上提供的规则模板。

## 当特定资源（例如 S3 存储桶）面临风险时，将严重性提升为“严重”
<a name="example-automation-rule-severity-resource"></a>

在本示例中，当 `ResourceId` 在调查发现中的对象是特定的 Amazon Simple Storage Service（Amazon S3）存储桶时，匹配规则条件。规则操作是将匹配调查发现的严重性更改为 `CRITICAL`。您可以修改此模板以应用于其他资源。

**API 请求示例**：

```
{
    "IsTerminal": {{true}},
    "RuleName": "{{Elevate severity of findings that relate to important resources}}",
    "RuleOrder": {{1}},
    "RuleStatus": "{{ENABLED}}",
    "Description": "{{Elevate finding severity to CRITICAL when specific resource such as an S3 bucket is at risk}}",
    "Criteria": {
        "ProductName": [{
            "Value": "{{Security Hub CSPM}}",
            "Comparison": "{{EQUALS}}"
        }],
        "ComplianceStatus": [{
            "Value": "{{FAILED}}",
            "Comparison": "{{EQUALS}}"
        }],
        "RecordState": [{
            "Value": "{{ACTIVE}}",
            "Comparison": "{{EQUALS}}"
        }],
        "WorkflowStatus": [{
            "Value": "{{NEW}}",
            "Comparison": "{{EQUALS}}"
        }],
        "ResourceId": [{
            "Value": "arn:aws:{{s3:::amzn-s3-demo-bucket/developers/design_info.doc}}",
            "Comparison": "{{EQUALS}}"
        }]
    },
    "Actions": [{
        "Type": "FINDING_FIELDS_UPDATE",
        "FindingFieldsUpdate": {
            "Severity": {
                "Label": "{{CRITICAL}}"
            },
            "Note": {
                "Text": "{{This is a critical resource. Please review ASAP.}}",
                "UpdatedBy": "{{sechub-automation}}"
            }
        }
    }]
}
```

**示例 CLI 命令：**

```
$ 
aws securityhub create-automation-rule \
--is-terminal \
--rule-name "{{Elevate severity of findings that relate to important resources}}" \
--rule-order {{1}} \
--rule-status "{{ENABLED}}" \

--description "{{Elevate finding severity to CRITICAL when specific resource such as an S3 bucket is at risk}}" \
--criteria '{
"ProductName": [{
"Value": "{{Security Hub CSPM}}",
"Comparison": "{{EQUALS}}"
}],
"ComplianceStatus": [{
"Value": "{{FAILED}}",
"Comparison": "{{EQUALS}}"
}],
"RecordState": [{
"Value": "{{ACTIVE}}",
"Comparison": "{{EQUALS}}"
}],
"WorkflowStatus": [{
"Value": "{{NEW}}",
"Comparison": "{{EQUALS}}"
}],
"ResourceId": [{
"Value": "{{arn:aws:s3:::amzn-s3-demo-bucket/developers/design_info.doc"}},
"Comparison": "{{EQUALS}}"
}]
}' \
--actions '[{
"Type": "FINDING_FIELDS_UPDATE",
"FindingFieldsUpdate": {
"Severity": {
"Label": "{{CRITICAL}}"
},
"Note": {
"Text": "{{This is a critical resource. Please review ASAP.}}",
"UpdatedBy": "{{sechub-automation}}"
}
}
}]' \
--region {{us-east-1}}
```

## 提高与生产账户中资源相关调查发现的严重性
<a name="example-automation-rule-severity-change"></a>

在此示例中，当在特定的生产账户中生成 `HIGH` 严重级别的调查发现时，匹配规则条件。规则操作是将匹配调查发现的严重性更改为 `CRITICAL`。

**API 请求示例**：

```
{
    "IsTerminal": {{false}},
    "RuleName": "{{Elevate severity for production accounts}}",
    "RuleOrder": {{1}},
    "RuleStatus": "{{ENABLED}}",
    "Description": "{{Elevate finding severity from HIGH to CRITICAL for findings that relate to resources in specific production accounts}}",
    "Criteria": {
        "ProductName": [{
            "Value": "{{Security Hub CSPM}}",
            "Comparison": "{{EQUALS}}"
        }],
        "ComplianceStatus": [{
            "Value": "{{FAILED}}",
            "Comparison": "{{EQUALS}}"
        }],
        "RecordState": [{
            "Value": "{{ACTIVE}}",
            "Comparison": "{{EQUALS}}"
        }],
        "WorkflowStatus": [{
            "Value": "{{NEW}}",
            "Comparison": "{{EQUALS}}"
        }],
        "SeverityLabel": [{
            "Value": "{{HIGH}}",
            "Comparison": "{{EQUALS}}"
        }],
        "AwsAccountId": [
        {
            "Value": "{{111122223333}}",
            "Comparison": "{{EQUALS}}"
        },
        {
            "Value": "{{123456789012}}",
            "Comparison": "{{EQUALS}}"
        }]
    },
    "Actions": [{
        "Type": "FINDING_FIELDS_UPDATE",
        "FindingFieldsUpdate": {
            "Severity": {
                "Label": "{{CRITICAL}}"
            },
            "Note": {
                "Text": "{{A resource in production accounts is at risk. Please review ASAP.}}",
                "UpdatedBy": "{{sechub-automation}}"
            }
        }
    }]
}
```

**示例 CLI 命令**：

```
aws securityhub create-automation-rule \
--no-is-terminal \
--rule-name "{{Elevate severity of findings that relate to resources in production accounts}}" \
--rule-order {{1}} \
--rule-status "{{ENABLED}}" \
--description "{{Elevate finding severity from HIGH to CRITICAL for findings that relate to resources in specific production accounts}}" \
--criteria '{
"ProductName": [{
"Value": "{{Security Hub CSPM}}",
"Comparison": "{{EQUALS}}"
}],
"ComplianceStatus": [{
"Value": "{{FAILED}}",
"Comparison": "{{EQUALS}}"
}],
"RecordState": [{
"Value": "{{ACTIVE}}",
"Comparison": "{{EQUALS}}"
}],
"SeverityLabel": [{
"Value": "{{HIGH}}",
"Comparison": "{{EQUALS}}"
}],
"AwsAccountId": [
{
"Value": "{{111122223333}}",
"Comparison": "{{EQUALS}}"
},
{
"Value": "{{123456789012}}",
"Comparison": "{{EQUALS}}"
}]
}' \
--actions '[{
"Type": "FINDING_FIELDS_UPDATE",
"FindingFieldsUpdate": {
"Severity": {
"Label": "{{CRITICAL}}"
},
"Note": {
"Text": "{{A resource in production accounts is at risk. Please review ASAP.}}",
"UpdatedBy": "{{sechub-automation}}"
}
}
}]' \
--region {{us-east-1}}
```

## 隐藏信息性调查发现
<a name="example-automation-rule-change-workflow"></a>

在此示例中，与从亚马逊发送到 Security Hub CSPM 的`INFORMATIONAL`严重性调查结果的规则标准相匹配。 GuardDuty规则操作是将匹配调查发现的工作流状态更改为 `SUPPRESSED`。

**API 请求示例**：

```
{
    "IsTerminal": {{false}},
    "RuleName": "{{Suppress informational findings}}",
    "RuleOrder": {{1}},
    "RuleStatus": "{{ENABLED}}",
    "Description": "{{Suppress GuardDuty findings with INFORMATIONAL severity}}",
    "Criteria": {
        "ProductName": [{
            "Value": "{{GuardDuty}}",
            "Comparison": "{{EQUALS}}"
        }],
        "RecordState": [{
            "Value": "{{ACTIVE}}",
            "Comparison": "{{EQUALS}}"
        }],
        "WorkflowStatus": [{
            "Value": "{{NEW}}",
            "Comparison": "{{EQUALS}}"
        }],
        "SeverityLabel": [{
            "Value": "{{INFORMATIONAL}}",
            "Comparison": "{{EQUALS}}"
        }]
    },
    "Actions": [{
        "Type": "FINDING_FIELDS_UPDATE",
        "FindingFieldsUpdate": {
            "Workflow": {
                "Status": "{{SUPPRESSED}}"
            },
            "Note": {
                "Text": "{{Automatically suppress GuardDuty findings with INFORMATIONAL severity}}",
                "UpdatedBy": "{{sechub-automation}}"
            }
        }
    }]
}
```

**示例 CLI 命令**：

```
aws securityhub create-automation-rule \
--no-is-terminal \
--rule-name "{{Suppress informational findings}}" \
--rule-order {{1}} \
--rule-status "{{ENABLED}}" \
--description "{{Suppress GuardDuty findings with INFORMATIONAL severity}}" \
--criteria '{
"ProductName": [{
"Value": "{{GuardDuty}}",
"Comparison": "{{EQUALS}}"
}],
"ComplianceStatus": [{
"Value": "{{FAILED}}",
"Comparison": "{{EQUALS}}"
}],
"RecordState": [{
"Value": "{{ACTIVE}}",
"Comparison": "{{EQUALS}}"
}],
"WorkflowStatus": [{
"Value": "{{NEW}}",
"Comparison": "{{EQUALS}}"
}],
"SeverityLabel": [{
"Value": "{{INFORMATIONAL}}",
"Comparison": "{{EQUALS}}"
}]
}' \
--actions '[{
"Type": "FINDING_FIELDS_UPDATE",
"FindingFieldsUpdate": {
"Workflow": {
"Status": "{{SUPPRESSED}}"
},
"Note": {
"Text": "{{Automatically suppress GuardDuty findings with INFORMATIONAL severity}}",
"UpdatedBy": "{{sechub-automation}}"
}
}
}]' \
--region {{us-east-1}}
```