A filter rule is a set of filter criteria that you create and save to use again when you review findings on the Amazon Macie console. Filter rules can help you perform repeated, consistent analysis of findings that have specific characteristics. For example, you might create a filter rule for analyzing all high-severity sensitive data findings that report occurrences of sensitive data in particular Amazon Simple Storage Service (Amazon S3) buckets. You can then apply that filter rule each time you want to identify and analyze findings that have the specified characteristics.
When you create a filter rule, you specify filter criteria, a name, and, optionally, a description of the rule. For the filter criteria, you use specific attributes of findings to specify whether to include or exclude findings from a view. A finding attribute is a field that stores specific data for a finding, such as severity, type, or the name of the resource that a finding applies to. Filter criteria consist of one or more conditions. Each condition, also referred to as a criterion, consists of three parts:
-
An attribute-based field, such as Severity or Finding type.
-
An operator, such as equals or not equals.
-
One or more values. The type and number of values depends on the field and operator that you choose.
After you create and save a filter rule, you apply its filter criteria by choosing the rule. Macie then uses the criteria to determine which findings to display. Macie also displays the criteria to help you determine which criteria you applied.
Note that filter rules are different from suppression rules. A suppression rule is a set of filter criteria that you create and save to automatically archive findings that match the criteria of the rule. Although both types of rules store and apply filter criteria, a filter rule doesn't perform any action on findings that match the rule's criteria. Instead, a filter rule only determines which findings appear on the console after you apply the rule. For information about suppression rules, see Suppressing findings.
To create a filter rule for findings
You can create a filter rule by using the Amazon Macie console or the Amazon Macie API.
Follow these steps to create a filter rule by using the Amazon Macie console.
To create a filter rule
Open the Amazon Macie console at https://console.aws.amazon.com/macie/
. -
In the navigation pane, choose Findings.
Tip
To use an existing filter rule as a starting point, choose the rule from the Saved rules list.
You can also streamline creation of a rule by first pivoting and drilling down on findings by a predefined logical group. If you do this, Macie automatically creates and applies the appropriate filter conditions, which can be a helpful starting point for creating a rule. To do this, choose By bucket, By type, or By job in the navigation pane (under Findings). Then choose an item in the table. In the details panel, choose the link for the field to pivot on.
-
In the Filter criteria box, add conditions that define the filter criteria for the rule.
To learn how to add filter conditions, see Creating and applying filters to Macie findings.
-
When you finish defining filter criteria for the rule, choose Save rule in the Filter criteria box.
-
Under Filter rule, enter a name and, optionally, a description of the rule.
-
Choose Save.
