Triage and Update Findings
A 2-step recipe with Amazon Security Hub. We can help you get access.
Recipe · 2 steps
Triage and Update Findings
with Amazon Security Hub
Get findings by severity, then update them via re-import.
- Query Security Hub for findings matching the requested severity label and compliance status so they can be reviewed before updating.
- Re-import the supplied finding objects with their revised workflow status and severity so Security Hub applies the updated attributes.
What you'll need to have ready
- severityLabel: The severity label value used to filter the returned findings.
- complianceStatus: The compliance status value used to further filter the returned findings.
- maxResults: The maximum number of findings to return.
- updatedFindings: The list of ASFF finding objects, with revised fields, to re-import.
For your developer
Arazzo workflow amazon-security-hub:triage-and-update-findings, 2 operations: GetFindings → BatchImportFindings. Specs on APIs.io.