Security Hub 的 EventBridge 事件格式 - Amazon Security Hub
Amazon Web Services 文档中描述的 Amazon Web Services 服务或功能可能因区域而异。要查看适用于中国区域的差异,请参阅中国的 Amazon Web Services 服务入门

本文属于机器翻译版本。若本译文内容与英语原文存在差异,则一律以英文原文为准。

Security Hub 的 EventBridge 事件格式

这些区域有:Security Hub Findings - ImportedSecurity Findings - Custom Action, 和Security Hub Insight Results事件类型使用以下事件格式。

事件格式是 Security Hub 向 EventBridge 发送事件时使用的格式。

Security Hub Findings - Imported

Security Hub Findings - Imported事件从 Security Hub 发送到 EventBridge 使用以下格式。

{ "version":"0", "id":"CWE-event-id", "detail-type":"Security Hub Findings - Imported", "source":"aws.securityhub", "account":"111122223333", "time":"2019-04-11T21:52:17Z", "region":"us-west-2", "resources":[ "arn:aws:securityhub:us-west-2::product/aws/macie/arn:aws:macie:us-west-2:111122223333:integtest/trigger/6294d71b927c41cbab915159a8f326a3/alert/f2893b211841" ], "detail":{ "findings": [{ <finding content> }] } }

<finding content>是由事件发送的查找结果的 JSON 格式的内容。

有关查找属性的完整列表,请参阅Amazon Security Finding 格式 (ASFF)

有关如何配置由这些事件触发的 EventBridge 规则的信息,请参阅为自动发送的查找结果配置 EventBridge 梁规则

Security Hub Findings - Custom Action

Security Hub Findings - Custom Action事件从 Security Hub 发送到 EventBridge 使用以下格式。

{ "version": "0", "id": "1a1111a1-b22b-3c33-444d-5555e5ee5555", "detail-type": "Security Hub Findings - Custom Action", "source": "aws.securityhub", "account": "111122223333", "time": "2019-04-11T18:43:48Z", "region": "us-west-1", "resources": [ "arn:aws:securityhub:us-west-1:111122223333:action/custom/custom-action-name" ], "detail": { "actionName":"custom-action-name", "actionDescription": "description of the action", "findings": [ { <finding content> } ] } }

<finding content>是由事件发送的查找结果的 JSON 格式的内容。

有关查找属性的完整列表,请参阅Amazon Security Finding 格式 (ASFF)

有关如何配置由这些事件触发的 EventBridge 规则的信息,请参阅使用自定义操作将结果和见解结果发送到 EventBridge

Security Hub Insight Results

Security Hub Insight Results事件从 Security Hub 发送到 EventBridge 使用以下格式。

{ "version": "0", "id": "1a1111a1-b22b-3c33-444d-5555e5ee5555", "detail-type": "Security Hub Insight Results", "source": "aws.securityhub", "account": "111122223333", "time": "2017-12-22T18:43:48Z", "region": "us-west-1", "resources": [ "arn:aws:securityhub:us-west-1:111122223333::product/aws/macie:us-west-1:222233334444:test/trigger/1ec9cf700ef6be062b19584e0b7d84ec/alert/f2893b211841" ], "detail": { "actionName":"name of the action", "actionDescription":"description of the action", "insightArn":"ARN of the insight", "insightName":"Name of the insight", "resultType":"ResourceAwsIamAccessKeyUserName", "number of results":"number of results, max of 100", "insightResults": [ {"result 1": 5}, {"result 2": 6} ] } }

有关如何创建由这些事件触发的 EventBridge 规则的信息,请参阅使用自定义操作将结果和见解结果发送到 EventBridge