Identifies the finding fields that the automation rule action updates when a finding matches the defined criteria.
Syntax
To declare this entity in your AWS CloudFormation template, use the following syntax:
JSON
{
"Confidence" : Integer,
"Criticality" : Integer,
"Note" : NoteUpdate,
"RelatedFindings" : [ RelatedFinding, ... ],
"Severity" : SeverityUpdate,
"Types" : [ String, ... ],
"UserDefinedFields" : {Key: Value, ...},
"VerificationState" : String,
"Workflow" : WorkflowUpdate
}
YAML
Confidence: Integer
Criticality: Integer
Note:
NoteUpdate
RelatedFindings:
- RelatedFinding
Severity:
SeverityUpdate
Types:
- String
UserDefinedFields:
Key: Value
VerificationState: String
Workflow:
WorkflowUpdate
Properties
Confidence-
The rule action updates the
Confidencefield of a finding.Required: No
Type: Integer
Minimum:
0Maximum:
100Update requires: No interruption
Criticality-
The rule action updates the
Criticalityfield of a finding.Required: No
Type: Integer
Minimum:
0Maximum:
100Update requires: No interruption
Note-
The rule action will update the
Notefield of a finding.Required: No
Type: NoteUpdate
Update requires: No interruption
-
The rule action will update the
RelatedFindingsfield of a finding.Required: No
Type: Array of RelatedFinding
Minimum:
1Maximum:
10Update requires: No interruption
Severity-
The rule action will update the
Severityfield of a finding.Required: No
Type: SeverityUpdate
Update requires: No interruption
Types-
The rule action updates the
Typesfield of a finding.Required: No
Type: Array of String
Maximum:
50Update requires: No interruption
UserDefinedFields-
The rule action updates the
UserDefinedFieldsfield of a finding.Required: No
Type: Object of String
Pattern:
^[-_+=.:/@\w\s]{1,128}$Minimum:
0Maximum:
1024Update requires: No interruption
VerificationState-
The rule action updates the
VerificationStatefield of a finding.Required: No
Type: String
Allowed values:
UNKNOWN | TRUE_POSITIVE | FALSE_POSITIVE | BENIGN_POSITIVEUpdate requires: No interruption
Workflow-
The rule action will update the
Workflowfield of a finding.Required: No
Type: WorkflowUpdate
Update requires: No interruption
